Problems assembling ARM branch when file mapped at offset >= 0x80000000.

[ghost]

I'm working on a 32 bit ARM binary, mapped at 0xc0000000.

When trying to assemble branch instructions, rz-asm fails with "invalid branch address (out of range)".

This seems to happen for any address >= 0x80000000:

$ dd if=/dev/zero of=test.bin bs=2M count=1
...
$ rizin -a arm -b 32 -e little -m 0x80000000 -w test.bin
...
[0x80000000]> px 4
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x80000000  0000 0000                                ....
[0x80000000]> 
[0x80000000]> wa 'b 0x80000000'
ERROR: assembler: arm: b: invalid branch address (out of range).
ERROR: assembler: arm: b: invalid branch address (out of range).
ERROR: assembler: arm: b: invalid branch address (out of range).
ERROR: Cannot assemble 'b 0x80000000' at line 3
[0x80000000]> 
[0x80000000]> px 4
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x80000000  0000 0000                                ....
[0x80000000]> 
[0x80000000]> wx feffffea
[0x80000000]> 
[0x80000000]> px 4
- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF
0x80000000  feff ffea                                ....
[0x80000000]> pi 1
b 0x80000000
[0x80000000]>

I get the same result using rz-asm to assemble a file:

$ cat test.rzasm  
.arch arm  
.org 0x80000000  
test:     
    b test

$ rz-asm -f test.rzasm  
ERROR: assembler: arm: b: invalid branch address (out of range). 
ERROR: assembler: arm: b: invalid branch address (out of range). 
ERROR: assembler: arm: b: invalid branch address (out of range). 
ERROR: assembler: arm: b: invalid branch address (out of range). 
ERROR: assembler: arm: b: invalid branch address (out of range). 
ERROR: Cannot assemble 'b test' at line 20

At addresses less than 0x80000000 everything works as expected.

$ rizin -a arm -b 32 -e little -m 0x7ffffffc -w test.bin
...
[0x7ffffffc]> wa 'b 0x7ffffffc' 
[0x7ffffffc]> pi 1 
b 0x7ffffffc 
[0x7ffffffc]> 

$ cat test.rzasm  
.arch arm  
.org 0x7ffffffc  
test:     
    b test

$ rz-asm -f test.rzasm  
feffffea

It's likely user error and I just don't understand how it works, where am I going wrong?

[Rot127]

The operand of b is a ~24bit offset to the current PC. But it seems like our assembler there doesn't treat it like an offset but an address.
In which case it would be broken. Please open an issue about it.

I am also not sure in what state the ARM assembler is. I think you might be better off to use llvm-mc for assembling and then write the bytes with wx.

You could write a small script assembling some input instructions with llvm-mc, extract the bytes and write them in hex into a file. Then write the hex string with wxf <filename>.

Then you can do a one liner like this:

!assembly_script.sh "institutors..." ; wxf <insntr_bytes_file>

[notxvilka]

Yes, it's quite incomplete, and we should improve this one instead: https://github.com/rizinorg/rz-asm-llvm

[ghost]

Thank you for your help. I ended up with a macro using pa at a temporary offset to branch to an address. Just have to adjust the address in the instruction.

[0xc0000000]> (wa instr; wx `pa ${instr} @ (`s`-0xc0000000)`) 
[0xc0000000]>  
[0xc0000000]> .(wa 'b 0x00987654') @ 0xc0004000 
[0xc0000000]> 
[0xc0000000]> pi 1 @ 0xc0004000 
b 0xc0987654 
[0xc0000000]>