Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Req: Ctrl+Alt+L on a fn ptr to rename the fn (Thumb mode) #7422

Open
PennRobotics opened this issue Jan 28, 2025 · 1 comment
Open

Req: Ctrl+Alt+L on a fn ptr to rename the fn (Thumb mode) #7422

PennRobotics opened this issue Jan 28, 2025 · 1 comment

Comments

@PennRobotics
Copy link

PennRobotics commented Jan 28, 2025

Is your feature request related to a problem? Please describe.
Renaming vector table interrupts is time-consuming. This could be faster if functions could be renamed from their pointers.

Many Arm Cortex-M microcontrollers run in Thumb mode often and have a vector table with pointers to interrupt handlers near the beginning of an executable. For some microcontrollers, this can be hundreds of interrupts—some mixture of the same infinite loop handler or a fault/reset routine when the IRQ is unused and, when used, pointing to the appropriate interrupt handler function or to another branch to that function (aka thunked).

Image
A Cortex-M33 vector table is shown. A few interrupts are unused (infinite loop), some are named, and some are unnamed but used.

If you double click each vector table entry (an address) you can define a function and then rename the function by pressing L. Then? "Go to previous location," double click the next function; repeat ad nauseam until, worst case today, IRQ 479 (plus 16 system interrupts).

Image
IRQ handlers for the vector table. Note that the label from XREF 20000080h (CPU1_IRQ16_FLEXCOMM2) is nowhere to be found.

What would work better is if Ctrl+Alt+L would rename each function via its pointer (or if the context menu included "Rename function" when an address type points to a function entry, which could then be assigned to a hotkey as usual)

It's possible this is how Ctrl+Alt+L works normally. While I haven't checked the behavior on other processors, one nuance of Thumb mode is that function pointers have their LSB set to 1, so the Thumb function for IRQ 16 might be at address 1207Ch but its vector table entry will be 1207Dh.

Ctrl+Alt+L ("Set Associated Label") will have its edit field prepopulated with "thunk_FUN_0000f384+1" (the function name at address 1207c) but if you type something like "IRQ16_Handler" or "IRQ16_Handler+1", neither the function at f384 or the one at 1207c is renamed.

Image
In the figure shown, changing the field does not rename the function or even show up at the target address listing. Only the addr name (thunk_FUN_2000f384+1) changes in the vector table itself.

Describe the solution you'd like
If Ctrl+Alt+L (at an IRQ pointer, in this example, the illustrated but unmentioned address 80h) actually modifies the function name at a Thumb function (and, as usual, the callees of a thunk function with a single caller), this would speed up the time it takes to name interrupt handlers. As the second figure shows, IRQ target addresses are normally not consecutive: there might be a data entry to the function address between each handler or even an inline handler.

Describe alternatives you've considered
Pyhidra. You could create a function for each handler address and rename each interrupt handler mostly programmatically with a Python script (and I often do). This generally works well, as you can copy and paste an interrupt table from documentation and perform the same few functions for each entry e.g. s.createLabel(f.getAddress("0x80"), "CPU1_IRQ16_FLEXCOMM2", SourceType.USER_DEFINED) (and then create a function at each address and execute createLabel at each address).

For an individual trying to reverse a small number of binaries, learning the ghidra Python modules is a hassle and would take more time than renaming each function by hand (assuming a developer is already comfortable using Python).

Additional context
This is a very low priority feature request; mostly a convenience meant to save a few minutes per binary, and to more appropriately define what Ctrl+Alt+L does.

As I changed the base address a few times during disassembly, a few times in this post I interchanged 0x0 and 0x20000000. This isn't meant to be confusing. Think of 0x20000080 as 0x80 and vice-versa (e.g. ignore bits 31:28).

@PennRobotics PennRobotics changed the title L on a function pointer could rename function on Arm Thumb-mode processors Ctrl+Alt+L on a fn ptr could rename the fn (Thumb mode) Jan 28, 2025
@PennRobotics PennRobotics changed the title Ctrl+Alt+L on a fn ptr could rename the fn (Thumb mode) Req: Ctrl+Alt+L on a fn ptr to rename the fn (Thumb mode) Jan 28, 2025
@astrelsky
Copy link
Contributor

I have found this and the unnecessary conflict dialogue when trying to rename a function through a pointer annoying as well.

I think it shouldn't need a special keyboard shortcut and should just work with the existing label/rename action.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants