Andrew Case
2013-Jul-17 01:02 UTC
[LLVMdev] Setting endian/byte order through disassemble command?
Hello, I am working on auto-analysis with lldb using ARM (thumb) disassembly, but am having problems with the 'disassemble' command. It seems that llvm is defaulting to big-endian processing, and I cannot figure out how to switch the mode to little endian. Here is the output: (lldb) disassemble -A thumb -b -s 0x687f4 -e 0x68808 testfile[0x687f4]: 0x4bbe .short 0x4bbe ; unknown opcode testfile[0x687f6]: 0x4abf .short 0x4abf ; unknown opcode testfile[0x687f8]: 0x447b .short 0x447b ; unknown opcode testfile[0x687fa]: 0x49bf .short 0x49bf ; unknown opcode testfile[0x687fc]: 0x4ff0e92d .long 0x4ff0e92d ; unknown opcode testfile[0x68800]: 0xb0a7 .short 0xb0a7 ; unknown opcode testfile[0x68802]: 0x589e .short 0x589e ; unknown opcode testfile[0x68804]: 0x6830 .short 0x6830 ; unknown opcode testfile[0x68806]: 0x9025 .short 0x9025 ; unknown opcode ----------- as you can see, none of the opcodes are known as each 2 byte pair is backwards. When I process the file with IDA Pro it treats the code as thumb little endian and the disassembly looks as expected and the byte pairs are switched. Also, this is kind of a different question, but my analysis currently works through Python scripting and eventually calling out to the 'disassemble' command. Is there a more structured API in python for disassembly (e.g. getting parsed informed for each instruction?). Thanks for any help!