ARM CFG After-Party: ARM, Thumb, and ARM's special ELves

Disclaimer: The angr suite is maintained by a small team of volunteers. While we cannot guarantee any timeliness for fixes and enhancements, we will do our best. For more real-time help with angr, from us and the community, join our Slack.

---

Is your feature request related to a problem? Please describe.

ARM binaries today (specifically A-profile ARM binaries for Linux) have weird behavior regarding building CFGs, locating functions, and looking up symbols. The root of the problem is our inability to distinguish ARM code, Thumb code, and data properly.

There are, apparently, two (or more?) different ways to actually do this, given an ELF created by a "proper compiler". First is the LSB of the symbols -- this is not always done, and ARM seems to only standardize on this in binaries targeting M-class parts. On platforms where ARM/Thumb transitions are legal, we need some extra metadata. Jumping to an odd address is a good signal here, but not all the addresses are odd, as occasionally the compiler will generate a binary with even addresses and a $t marker, and assume something else switched the CPU to thumb mode ahead of time.

These $a/$t/$d local symbols are meant to indicate ARM/Thumb/Data respectively. This is great, but it has a few caveats. GCC has been observed to dump $d pseudo-randomly all over the place, and therefore it cannot be trusted entirely. $a/$t on the other hand should probably be fine, assuming the user compiled the binary correctly.

Describe the solution you'd likewhat you want to happen.

• Implement support for reading the $a/$t/$d symbols, and using this info to set thumb-ness and not try to decode pure data as instructions.
• Don't rely entirely on $d, allowing its data-ness to be overridden by a strong signal within CFG (e.g., a jump or call from some actual code). Thanks, GCC
• Improve decoding of the .ARMAttributes section. If we have no Thumb (or no ARM), just don't even try, ever. This should reduce decode errors thrown by CFG trying the wrong thing, and the accuracy of function location.

Please include a sample of what should work if this feature is implemented. See:

• #1168
• #1123
• #589
• Supersedes #1114
• https://github.com/angr/cle/issues/180 (R_ARM_GLOB_DATA is another type of weird ARM stuff we should pay attention to, equivalent to $d)

[todo: attach Tobi's horrible binary with all the broken $d symbols here]

Describe alternatives you've considered See above description

Additional context

#NeverSkipARMDay #ARMCFGParty