Thumb-2: 32-bit flag-setting instructions inside an IT block lose their NZCV writes (Lifter_Arml.do_it_block) #1572

"""a32_build.py <cases.txt> <workdir>: for each case build a static ARM/Thumb program (r0-r3 and NZCV preset, then the
snippet), run it under qemu-arm, print r0-r3 and NZCV after the snippet; also write <workdir>/<name>.bin (snippet bytes).
Case line: name arm|thumb r0 r1 r2 r3 nzcv(4 bits) | insn ; insn ; ..."""
import subprocess, sys, struct, os
path, wd = sys.argv[1], sys.argv[2]
for line in open(path):
    if not line.strip() or line.startswith("#"): continue
    head, body = line.split("|", 1)
    name, mode, r0, r1, r2, r3, f = head.split()
    insns = "\n".join("  " + i.strip() for i in body.split(";") if i.strip())
    src = """.syntax unified
.arch armv7-a
.arch_extension idiv
.%s
.global _start
.text
%s
_start:
  ldr r4, =%#x
  msr APSR_nzcvq, r4
  ldr r0, =%s
  ldr r1, =%s
  ldr r2, =%s
  ldr r3, =%s
snip_s:
%s
snip_e:
  mrs r4, apsr
  ldr r5, =buf
  str r0, [r5]
  str r1, [r5, #4]
  str r2, [r5, #8]
  str r3, [r5, #12]
  str r4, [r5, #16]
  movs r0, #1
  mov r1, r5
  movs r2, #20
  movs r7, #4
  svc 0
  movs r0, #0
  movs r7, #1
  svc 0
.ltorg
.data
.balign 4
buf: .skip 32
""" % (mode, ".thumb_func" if mode == "thumb" else "", int(f, 2) << 28, r0, r1, r2, r3, insns)
    b = os.path.join(wd, name)
    open(b + ".s", "w").write(src)
    if subprocess.run(["arm-none-eabi-as", "-o", b + ".o", b + ".s"]).returncode:
        print("%s | asm-error" % name); open(b + ".bin", "wb").write(b""); continue
    subprocess.run(["arm-none-eabi-ld", "-Ttext=0x400000", "-o", b, b + ".o"], check=True)
    syms = {}
    for l in subprocess.run(["arm-none-eabi-nm", b], capture_output=True, text=True).stdout.split("\n"):
        p = l.split()
        if len(p) == 3: syms[p[2]] = int(p[0], 16)
    subprocess.run(["arm-none-eabi-objcopy", "-O", "binary", "-j", ".text", b, b + ".text"], check=True)
    t = open(b + ".text", "rb").read()
    s, e = syms["snip_s"] - 0x400000, syms["snip_e"] - 0x400000
    open(b + ".bin", "wb").write(t[s:e]); open(b + ".addr", "w").write("%#x" % syms["snip_s"])
    out = subprocess.run(["timeout", "10", "qemu-arm", b], capture_output=True).stdout
    if len(out) != 20:
        print("%s | qemu-error %r" % (name, out)); continue
    v = struct.unpack("<5I", out); n = v[4]
    print("%s | r0=%#x r1=%#x r2=%#x r3=%#x nzcv=%d%d%d%d" % ((name,) + v[:4] + ((n >> 31) & 1, (n >> 30) & 1, (n >> 29) & 1, (n >> 28) & 1)))

"""a32_miasm.py <symb|python|gcc> <cases.txt> <workdir>: run each snippet (<workdir>/<name>.bin) in Miasm
(arml / armtl) from the case's r0-r3 and NZCV; print the disassembly, r0-r3 and NZCV at the snippet end."""
import sys
from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.core.bin_stream import bin_stream_str
from miasm.expression.expression import ExprInt
mode, path, wd = sys.argv[1], sys.argv[2], sys.argv[3]
def symb(mach, code, regs, f, CODE):
    from miasm.ir.symbexec import SymbolicExecutionEngine
    import miasm.arch.arm.regs as R
    ldb = LocationDB()
    mdis = mach.dis_engine(bin_stream_str(code, base_address=CODE), loc_db=ldb)
    end = CODE + len(code); mdis.dont_dis = [end]
    asmcfg = mdis.dis_multiblock(CODE)
    asm = " ; ".join(str(l) for b in sorted([b for b in asmcfg.blocks if b.lines], key=lambda b: b.lines[0].offset) for l in b.lines)
    lifter = mach.lifter_model_call(ldb); ircfg = lifter.new_ircfg_from_asmcfg(asmcfg)
    st = {R.regs32_expr[i]: ExprInt(0, 32) for i in range(13)}
    for i, v in enumerate(regs): st[R.regs32_expr[i]] = ExprInt(v, 32)
    st[R.SP] = ExprInt(0x30001000, 32); st[R.LR] = ExprInt(0, 32)
    for b, e in zip(f, (R.nf, R.zf, R.cf, R.of)): st[e] = ExprInt(int(b), 1)
    for e in R.ge_regs: st[e] = ExprInt(0, 1)
    se = SymbolicExecutionEngine(lifter, st)
    addr = se.run_at(ircfg, CODE, lbl_stop=ldb.get_offset_location(end))
    if not (addr.is_int() and int(addr) == end) and not (addr.is_loc() and ldb.get_location_offset(addr.loc_key) == end):
        raise RuntimeError("stopped at %s" % addr)
    def g(e):
        v = se.eval_expr(e)
        return ("%#x" % int(v)) if v.is_int() else "?(%s)" % v
    fl = "".join(g(e)[-1] if g(e) in ("0x0", "0x1") else "?(%s)" % g(e) for e in (R.nf, R.zf, R.cf, R.of))
    return asm, [g(R.regs32_expr[i]) for i in range(4)], fl
def jit(mach, code, regs, f, CODE):
    from miasm.jitter.csts import PAGE_READ, PAGE_WRITE, PAGE_EXEC
    j = mach.jitter(LocationDB(), mode)
    j.vm.add_memory_page(CODE & ~0xfff, PAGE_READ | PAGE_WRITE | PAGE_EXEC, b"\x00" * (CODE & 0xfff) + code + b"\x00" * 16)
    j.vm.add_memory_page(0x30000000, PAGE_READ | PAGE_WRITE, b"\x00" * 0x2000)
    j.cpu.SP = 0x30001000
    for i, v in enumerate(regs): setattr(j.cpu, "R%d" % i, v)
    j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of = (int(b) for b in f)
    j.add_breakpoint(CODE + len(code), lambda jit: False)
    if mach.name == "armtl": j.cpu.PC = CODE  # thumb state
    j.run(CODE)
    return "-", ["%#x" % getattr(j.cpu, "R%d" % i) for i in range(4)], "%d%d%d%d" % (j.cpu.nf, j.cpu.zf, j.cpu.cf, j.cpu.of)
for line in open(path):
    if not line.strip() or line.startswith("#"): continue
    head = line.split("|", 1)[0].split()
    name, m = head[0], head[1]
    regs = [int(x, 0) for x in head[2:6]]
    mach = Machine("armtl" if m == "thumb" else "arml")
    code = open("%s/%s.bin" % (wd, name), "rb").read(); addr = int(open("%s/%s.addr" % (wd, name)).read(), 0)
    try: asm, r, fl = (symb if mode == "symb" else jit)(mach, code, regs, head[6], addr)
    except Exception as e: asm, r, fl = "-", ["EXC %s: %s" % (type(e).__name__, str(e)[:150])] + ["-"] * 3, "-"
    print("%s | r0=%s r1=%s r2=%s r3=%s nzcv=%s   [%s]" % (name, r[0], r[1], r[2], r[3], fl, asm))