From 7b64f16d6a8a27023ff6991a734609e94ccbcd6f Mon Sep 17 00:00:00 2001 From: Paul Sokolovsky Date: Thu, 11 Jan 2018 23:43:47 +0200 Subject: [PATCH] plugins/loader/elf: Detect ARM's Thumb vs ARM mode based on entry point. If lowest bit of entry point address is 1, it's Thumb mode. --- plugins/loader/elf.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/plugins/loader/elf.py b/plugins/loader/elf.py index c8190b0..7b76879 100644 --- a/plugins/loader/elf.py +++ b/plugins/loader/elf.py @@ -48,8 +48,19 @@ def detect(fname): #print(elffile.header) #print(elffile["e_ident"]["EI_CLASS"]) - bitness = 32 if elffile["e_ident"]["EI_CLASS"] == "ELFCLASS32" else 64 - return "%s_%s" % (MACH_MAP[elffile["e_machine"]], bitness) + if elffile["e_ident"]["EI_CLASS"] == "ELFCLASS32": + variant = 32 + elif elffile["e_ident"]["EI_CLASS"] == "ELFCLASS64": + variant = 64 + else: + assert 0, "Unknown ELF bitness: %s" % elffile["e_ident"]["EI_CLASS"] + + if elffile["e_machine"] == "EM_ARM" and variant == 32: + if elffile["e_entry"] & 1: + variant = "32_thumb" + else: + variant = "32_arm" + return "%s_%s" % (MACH_MAP[elffile["e_machine"]], variant) # PLT is Procedure Linkage Table, part of (read-only) code -- 2.11.4.GIT