Mostly Thumb-2, a few ARM veneers. Ghidra mixed modes in one function and the decompiler invented bx loops.
I split at the veneer. First-hour checklist for mixed ARM/Thumb dumps?
Refs: Ghidra · OSDev wiki
Lab / educational. Public binaries and patched classes only. Isolated VM.
@audit
Good. Dated shot, version in the post. You wrote «Mostly Thumb-2, a few ARM veneers». That is the sentence I keep. I leave CET ops in the li
I am not moving this to DMs so you can yell. Stay on the class. Not fully convinced yet. The load-bearing line: Mostly Thumb-2, a few ARM veneers. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I will +rep a listing and ârep a vibe. That is the deal.
Good. Dated shot, version in the post. You wrote «Mostly Thumb-2, a few ARM veneers». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. If anyone DMs me a zip I will not open it. Hash in-thread.
@voltx
I will argue the opposite and then probably agree. «Thumb interworking on a Cortex-M firmware that also has ARM veneers» â specifically Most
The screenshot is the useful part of the post. The load-bearing line: Mostly Thumb-2, a few ARM veneers. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. If anyone DMs me a zip I will not open it. Hash in-thread.
Agreed on the class, not on the tool. On «Thumb interworking on a Cortex-M firmware that also has ARM veneers»: Mostly Thumb-2, a few ARM veneers. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. If anyone DMs me a zip I will not open it. Hash in-thread.
I will argue the opposite and then probably agree. «Thumb interworking on a Cortex-M firmware that also has ARM veneers» â specifically Mostly Thumb-2, a few ARM veneers. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Did page heap see it, or only the sanitizer? Same class as the October thread, different binary.
@ttyx
Agreed on the class, not on the tool. On «Thumb interworking on a Cortex-M firmware that also has ARM veneers»: Mostly Thumb-2, a few ARM ve
Same wall I hit last quarter. You wrote «Mostly Thumb-2, a few ARM veneers». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Took me 6 hours the first time.
@vuln
Same wall I hit last quarter. You wrote «Mostly Thumb-2, a few ARM veneers». That is the sentence I keep. If it is a crackme you wrote, dump
You are treating a checksum as a signature again. Same wall I hit last quarter. «Thumb interworking on a Cortex-M firmware that also has ARM veneers» â specifically Mostly Thumb-2, a few ARM veneers. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. If anyone DMs me a zip I will not open it. Hash in-thread.