[LLVMdev] Setting endian/byte order through disassemble command?

Andrew Case atcuno at gmail.com
Tue Jul 16 18:02:13 PDT 2013


Hello,

I am working on auto-analysis with lldb using ARM (thumb) disassembly,
but am having problems with the 'disassemble' command. It seems that
llvm is defaulting to big-endian processing, and I cannot figure out
how to switch the mode to little endian. Here is the output:

(lldb) disassemble -A thumb -b -s 0x687f4 -e 0x68808
testfile[0x687f4]:  0x4bbe       .short 0x4bbe                    ;
unknown opcode
testfile[0x687f6]:  0x4abf       .short 0x4abf                    ;
unknown opcode
testfile[0x687f8]:  0x447b       .short 0x447b                    ;
unknown opcode
testfile[0x687fa]:  0x49bf       .short 0x49bf                    ;
unknown opcode
testfile[0x687fc]:  0x4ff0e92d   .long  0x4ff0e92d                ;
unknown opcode
testfile[0x68800]:  0xb0a7       .short 0xb0a7                    ;
unknown opcode
testfile[0x68802]:  0x589e       .short 0x589e                    ;
unknown opcode
testfile[0x68804]:  0x6830       .short 0x6830                    ;
unknown opcode
testfile[0x68806]:  0x9025       .short 0x9025                    ;
unknown opcode

-----------

as you can see, none of the opcodes are known as each 2 byte pair is
backwards. When I process the file with IDA Pro it treats the code as
thumb little endian and the disassembly looks as expected and the byte
pairs are switched.

Also, this is kind of a different question, but my analysis currently
works through Python scripting and eventually calling out to the
'disassemble' command. Is there a more structured API in python for
disassembly (e.g. getting parsed informed for each instruction?).

Thanks for any help!



More information about the llvm-dev mailing list