From ff56cb099f4978eef7b75a61f63aacb6cff71bd0 Mon Sep 17 00:00:00 2001 From: "Dr. Christian Giessen" Date: Wed, 22 Apr 2026 20:08:33 +0000 Subject: [PATCH] Tighten Type 9 BO validation and fix Type 32a discriminator Type 9 Constant-YOP: Only accept BO=01 and BO=11 as valid constant encodings. BO=00 or BO=10 now fall through to unk instead of producing plausible-looking but invalid disassembly. Type 32a: - DAG_REG field is 4 bits (was 3), using bits7-4 not bits6-4. - Add strict bit checks: bit15=0, bits12-11=11, bit10=0. (was: only checking bit11=1, matching too broadly) - Prevents overlap with Type 32 (bit11=0) encodings. --- r2plugin/asm_adsp219x.c | 46 +++++++++++++++++++++++++-------------- r2plugin/asm_adsp219x.so | Bin 28512 -> 28512 bytes 2 files changed, 30 insertions(+), 16 deletions(-) diff --git a/r2plugin/asm_adsp219x.c b/r2plugin/asm_adsp219x.c index 16ea33d..e076daf 100644 --- a/r2plugin/asm_adsp219x.c +++ b/r2plugin/asm_adsp219x.c @@ -219,24 +219,31 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask) } /* Constant YOP form: YY=bits12-11, CC=bits7-6, BO=bits5-4. + Only BO=01 and BO=11 are valid encodings. Index = (YY<<2)|CC. BO=01: val = 1<> 11) & 0x3; - ut32 cc = (ins >> 6) & 0x3; ut32 bo = (ins >> 4) & 0x3; - ut32 idx = (yy << 2) | cc; - int32_t val; - if (idx == 15) - val = (bo & 0x2) ? 32767 : -32768; - else if (bo & 0x2) - val = -((int32_t)(1 << idx)) - 1; - else - val = (int32_t)(1 << idx); - op->mnemonic = r_str_newf ("%s%s%s%s = %s(%s, %d)", - cp, cs, sp, dst, f, x, val); - return true; + if (bo == 1 || bo == 3) + { + ut32 yy = (ins >> 11) & 0x3; + ut32 cc_bits = (ins >> 6) & 0x3; + ut32 idx = (yy << 2) | cc_bits; + int32_t val; + if (idx == 15) + val = (bo == 3) ? 32767 : -32768; + else if (bo == 3) + val = -((int32_t)(1 << idx)) - 1; + else + val = (int32_t)(1 << idx); + op->mnemonic = r_str_newf ( + "%s%s%s%s = %s(%s, %d)", + cp, cs, sp, dst, f, x, val); + return true; + } + /* BO=00 or BO=10 with non-zero lower bits: + not a valid Type 9 encoding, fall through. */ } } @@ -710,13 +717,20 @@ decode (RArchSession *as, RAnalOp *op, RAnalOpMask mask) return true; } - /* Type 32a: DAG reg store + transfer (bits 23-17=0001010, bit11=1) */ - if ((ins >> 17) == 0x0A && ((ins >> 11) & 1)) + /* Type 32a: DAG reg store + register transfer. + bits23-17=0001010, bit15=0, bits12-11=11, bit10=0. + U=bit14, G=bit13, RGP=bits9-8, DAG_REG=bits7-4, + I=bits3-2, M=bits1-0. + Syntax: DM(Ireg1 op Mreg1) = DAGreg, DAGreg = Ireg1 */ + if ((ins >> 17) == 0x0A + && !((ins >> 15) & 1) + && ((ins >> 11) & 0x3) == 0x3 + && !((ins >> 10) & 1)) { ut32 u_bit = (ins >> 14) & 1; ut32 g = (ins >> 13) & 1; ut32 rgp = (ins >> 8) & 0x3; - ut32 dag_reg = (ins >> 4) & 0x7; + ut32 dag_reg = (ins >> 4) & 0xF; ut32 ireg = (ins >> 2) & 0x3; ut32 mreg = ins & 0x3; int base = g ? 4 : 0; diff --git a/r2plugin/asm_adsp219x.so b/r2plugin/asm_adsp219x.so index 8e1ced56cd1968cbed9d42c28c2351d5ebed2208..f53f4fe7127f4661933d254d744e7ff1794f8180 100755 GIT binary patch delta 5494 zcmZ8l3v?9K8J>M5yLnB(M8eBN9z_L#AOV7`%|HSZvPcva0Wm-{XaOIP)D}H%;_Rx| zbVOY2vDW$kAGOC?C5ot(W+DVc#Sj&1k4T6i%q-*q@<<|K`~CM$B$#vd%$@)KkMDop zJ8AmC(e#7ksb>>>gCzdv8?ufey=FjM8w+{n-oLxL-@sr5MJP%CjU zQ!&hRMeB0Op*5~P!X+TM<INC^J<(XWDQ{ zGNQ6!x>Y@S3|_Qmht?!l9g*@RNtFvuXkD@#dJ2-*AAo&T_djr%B!wGQJ^jQm&a)TG z8Pl<>cGs!wq{`~EYt6*ov9XxST)StbdJs{yYUks4Y)2%dB}k;O35c>=4R`_7ZLN~f=txx9IYn!6Y27G+Wg-v*5Qu<2{B208)oI9l@^&m0)}~Y)=>)KXaEly% z2+>irUNpj_+u>e8xD7RjO+{-?mBU}6!jUZX8cCX4?QSZD@2$|0U8@uqvd#ee!PI+r zFsVkY%HCM)sb8f$d>e&dPxs_Rx<^k9evY(LV!V{1-EwFYb_j>5`{j?30-m~ z&>p8=0cPX4o41V7HX!fJE?{ecs9tq&SZ6}~-^1v{l_8&${NSTlN(q5~F_C;ej|ni9uX+>Y&|huF&=S6g!!V!Kpb2X(f0Hd=MDlPdd1N;CHA>RoVhz^F zOXD&YY(dEZST+ad-$JhTA12*rg$JETWI!MN!~_&ocB~-#%shSdsJvtIG3P3B3&QZ) z^LI>h7XAna!01NBp8BS1395s+^f8>1#1_(r9m4;3b#8 zB-Q0r_WlFIA4dnOwGA`flX*>K!&PRTD1D3#Th3#R%{g{@>!lBaw!2uM8 z7W2p(hQTki3l1b;t%5~3S&j#)MJ_;m{Wo(I=4-a#-ym4l7q(UD)aYNSY`^t70w?Gq zEq~?#nM`T-z=FcH{#!;uy7Dt0IyH-1zq#bejI(QT})t>#Y7Q?J`LZkdq7frTtfY>jH zAD`m>;{deYfhszLjU!3&`)7=35{|7e(Q#B-+EE%WT{x^z?f$)&kR;L` zV0+CqHikQZftS=>C@FrTW(WfTn_(6hB2QhN9y~ozlAeWhzCJ1s2F~DhUTI6fRqDkd z;8o@PJ=zg>fHljZXGGV12zxMV>pOn3Ux*i^2G|xJ;IC04IZ`E@IZGp)j`VFDr}+^C z=)m3z4is9XX#Aw$%g{`BD9^R94qM2sf)#|GCS!5|{Pa|aA~q4Fxk3kye+X9g*}MiC z!;LH|hYwQ9^_=g8j{AAlndyWS{E}5;pDLaaD1XG)Co*A8IUkuZVW@NKz{sKr!-5~2 z5J2Ci($LdOp^Vp7rwHV8*cR%hL7hD%UK?;xf&X5pxOK6$iYv*<6o@oD;KssVRFt9p z0N5k8H<5*4tvQYMseG*i7(}dtwc}2swaVI2mze}_SUWBz?QWwZ0rSMBpCXgGeRXylG$(=E4h?lNc zV5qvlTPAp6>yY59CcX!$ymbFEIAT6QgjU{IdqGPOPTv74;aLJsGQtQF!yAxvxm+yJN7XGw69?MBs>PZt3$_&83{gB6fAon_F z70|+!~w4g3xBcvkosxOkq|)Pv4Y+ ziDx-+w?+k0y&ZNb_#qmIXC7q`Osm0Ut|QF4UxoQXRx58qNi`ZxPJOa>rk><2p2v(^ zklm#M(Behbjew-PpMhUMLxzp^g^5}-Vwq%EZeIiXZ~s-cE1&Yy3s);At|^Xsm`3!< z=NGaraCP9q$)|cHh-Pn_@c0z!g7ObYU6FrH8XDYZZ|uSboya&DlV5gQ|iFhcm3rAOh9}p28L_=Zw5&Krm^kjrXB!!1#CTZ1^^YH+c2MN8E zJPGe+F89A4;X!N^N3C#0(bF8|iwoHap#2Qx5?}`qtKl}{G%9i3Z{i!2N(##_u+-B~ zQaLqHYL`^bKgllZ=H9eWO1?i1Z(hcz!d)Z?u`pB@vOU?gbZ|79JFrb{`5rRIKL*+c z;G@MShj)rWgO4H<0Zp5z4__|vlz7wvT!ya8ucT1WId~Ri;fB^Vu%b}ej?0e}ZY#f; zFTgrwH10q_gxmnM>a=e`Y5{3(^^9+o8*f4U2^s}wya1#uSz?UuEdK zio!A1V%u7S?{RPxU*MR9rCPdcM;?4bTfGfdd^xE43^y=d2N}mM>l=P1BoDbDm3*<( zJr_xNh182es>MeG_JW1!7x5mnxP@hc_XB(r_G9&2#JW|m<`Cn>*o;v~Yx#S4zZ37Hd1}|gb*q~$1h|Ez9~i;eC*Z+9>ikbe{yk-| zuLw4%IcC=UFeT2nHLo-7s*=O8*kgxcF*lw&o5Y&l`+h5JT4qyZ$eeA-$AKe+-=6Pc zv89oNbH)T8b)-z2oib5LxngEY*36WQnJK9=Q@ll=)PMfPzAx33T89?@XxyJXy8B7j z2B-6dls%3>N`s>aPX(KS)KNtAi+eiY6#w~uFjAJ15q%`^X6EI5;oNcsI$ z4{`Fn2FFb{Pbr=^fnyP#WU9tcWx3{yg+*~rX==@o+vD86rMP3!Uqj^O6@wh#MebiQ zD0mp}4(Sr9X))iDD#b&xZ2GcAf{NWclg} z{#>)XRQkic_m$A|kM@(^*WGn@S-G^XtmK~MYwlbptyyt*`MU8FIV*`0E1os3GQY>6 aN0e0)5~Qg%x~Y-%tLh!)HOlHt*Z%>{iqEnD delta 5355 zcmZu#3sh8f8ozfQz##A^6(P|;#l*K1n4X-KtDu98M_bERsVVAaYCfPXJ9`?~d&j!c z73;Pg+uE(%V`uHT<)*Hh&X9t-X~1TtZ8jq4y&&MD5YU|ceg8Xzp0k`|_y735-}nB$ z{}ehahR%vxw#GL15%^zopI5exas^_nUEtHxYsB8;+t#0*aVtFOzuV6zx*i&H?z3U< z{e9=-HgB5vjlN^R{FKKR>1_SQq1}b{!5HiA;G)PaW9T_aZLkP8(CAY@kvN zDQF}~a=V==n!W3w7Y-aud5b9Ib|+IR9K<9tWjv1L4iJA4jRjqmI|V^)3^vBgo%b*$ zIf@9=n6eoQ)eM?F<&J2k)Wvcn@cFj%AjWv6tc#~bEK_#Jb;-R8(p=0R0Jhqynre## zh*n3?ba^#r>v+)DMF(4K@OAtKO{oDbkrmR+G5P^W#IesoZdxI+&Q>f?)z$eSn4HwT2n;pGqrg#hDVyDzJT z9Abo(E-+;(A^@y*j^(I;>9CzCiFB-1K(~XbT({jfxCv(Mt#Fv7m5^TA%*!6lc>sQZ z7S(1p1aUcj-%+M~j5x|22ys5lQCk4C7e0ZJYa&3Kx`A*xvA-Y~OK}DJDLG-k`6Q=+ z;*#2^wo1r}U~5dCTC29pb!l=ay2~AIq##1DixkmvzV0jd1aDa!!jP1aEnw-W0KX~M zjgikWxig(9dmWZDdPwS*l6>AScQB@GwH$GU9HF_l^u?#F_c7pZ#Zpo)Nu~9dp;*5E zd*&ZO6(Qe55%{5OzQ3ON-v_%S*CjH4vuzqdI5Y1TglT1t?`CENq?rZkWsiCb!25w_ ztnTE_oIBs#_zO9WhvxPOf5lBoYRJ}44}QS+A(D#%69bhTRZMvew*_htXj84=G<8_P ziL%hNX$VYG8|1?eFd=C;mT=9BcU$f-_i@h(>Qz7laOhDh5t;1~lmN1a2NIlF5bcB1 z3iF>FTcNMEzLVP-^RFP6(QTs> zZW5*IXQa}rLP${PI3iL@0+o((FJaX5{Dxho<=Y6ZDpL%T*sB*ShMPjP?}atDO>O2J1x|@ybC>hNJXvft-kq4j}HPtw|!_AZ$6sp{gik-t3 zQB1k%vg(A%?Fr0(n)GUf@)MJ(bF$o$hV@%^48NWwn!;Gwm8D8W#++ZaPrO7De z1tgZa9SV?RHg7?PKvTY|8da0mqP+{jbB^U%wLv2mU~S1d8=mQ_XtR9s15b#~tN^Yu zAkNqkxj2Li)qt-W;@IxCpb^>ky1PmMpolw5w4lnO-E z1oSq98YXxFz8BL=(2e1VzS$(A9UeYL38J}+FiO!t(N~U9VR+SJ9%}VQkBCb55_HK`OD||t13AQB2x8j)cHVw{pG$=10tUZ|WFMc92|Hp_b zGN44jBsoa89hlyaPzlrc^dCojc*8~0#58a8p{OsR@nW`92R2aEb#_Uvx62ppQfWxY z1wx$&Ky*UpcL1E6qxJu>Hw>t>1Qkc);NLia|BvI7?+;Ms#2>)gI1IzsuG(Oo4Q*(O z<`|eK)>;#oDG$a7snqJc>RH%26LEs`w*O>#B5+-gA2M+48*sChor~O{*<08K!bG^t zV=sy^7DPy&LsF{nf6^r?3@vByNPXFm%*p#kBI}Ge%o2~<3BEri;kGQBnxPQkOzq+< z2WKuja6D+l0H73{VAz_ZR}V=^3tY1_`W`7j5sfb&0psB>BAq-^kIw8rs|*2!0)OEO zxEYt^sPLc%^X9uO0#O18uQs@C7`&7f&d+L_uC2<*ZJL26)idMs{jkp2yB8tF_vocp zXWpHDncO;*RK9f;krOKm4c%mSTYz%pDD#K#U=fgXEpJ(9HdRG((BTZqY1~=9;Pcrjg@(v5@4ih2WCAFt^k?*t`)d zxcwBF!}5>dZto~8QCm=={0bL>7X$|%y(OgJ!T1mf6(>>a}8yjmJ_xh3IPFy z9srG{{~7cFTsK(P#a5hC=$bmCSw&s06%D5~M!vw%3ye#+Q(M&5V2dNz8jE2`=RRC~ zLvl6uIzr;P{-0LM>J~&CDb18UK=h~=jbpelr%>f-&X*Y3L~X*k8cX1L)eC?*0T?J+ zPNX+zmQFm~_F@fs|bFtLo#z6mjnU6owxEIsOi(1Zx;auVjNaU|5{;0{b1n;4Y$E+@P z?x7&7lM~J9ToqtRLwWjBt)WpsXOZiSb^%<&9?|?BkZX?5!Ho9}vO(|2>M3r}M4 zW6DOTTEIuC9#268NCrTRcbhF2?WYXFFvs~@03~~4scI}^>+E8MNPTX7gj^$XjBTfg zW~sK~bzgdsez@V`a|CWP9B_9DhSIJ;@gLN0eZdPcr56O)<*M|Di)VT;w>9@5ZiJB@ zfqW2JSu@FF4qNTCv42FIkE^NE3QY*OQOc6HxL*#IMiPG7fpBAl@LdpE57H4pC{T}N1=Je+ zzBHCa2ucVE1LXwtc)=1fEpoLCS3Vpk;ioYr36`Ds-K_OSlH`PNNHM3U+!?G2 zVdNB6I6KH!zu>IYTG@)H`kSA*A8LGx#43?bzDj>Hr*Gfi5X-^FaJcCp&fe+1*6G?8hSQ8Px-P@@ zs_yGWSb7Q%AIOE4=*VA@bB9)Xv64|Zyo{L1o_yg8cn|u= zzd{J=gbW0z_;c(_>8;mp%VWy(Fv1)SW}eAc2XgX<@Zpao_xk|g3Edn2uY!75$d2Tu zH}mfxmmal$+}Sxc%JpiWexK!Djv98YAsqhld^o%n-?@=B?YsWnsJGTT>-D}=%WbwdBh20iv%Q4i@&Gp*UkT*)v0W!~x=v0RJLHk?e4XvJaH*l{u$CqzppJA)p^^pNP>Sv|)SWvd^%v+u$vhfBh1k^ZXncb6n* zoxw^JdI_O<{E&Ja|2vQW^7HxDzQp&IGJ)Q{DlUs)-x-6^d~v;PlIKdz<#