ARM: Incorrect(?) operand information for pop

[captincook]

I'm using code from the next branch to decode instructions and get its details.
I wonder is ARM code for pop register correct e.g.

04 10 9D E4 -----> pop {r1}

Disasm:
0x80001000: pop {r1}
op_count: 1
operands[0].type: REG = r1
operands[0].access: READ
Write-back: True
Registers read: r1

Is this correct to you guys ?
Shouldn't this instruction have operands read sp, write r1, write sp ? since it decodes to
r1 = [sp]
sp = sp + 4

[captincook]

a good solution how to fix this would be to replace pop {reg} with ldr reg, [sp], #0x4

All other disassemblers (IDA, Binary ninja, HIEW, Retargetable Decompiler) show this instruction with LDR
04 10 9d e4 ----> ldr r1, [sp], #4

[aquynh]

fixed now with commit 6cd1ab1, please confirm.

$ cstool -d arm "04 10 9d e4"
0  04109de4  pop	{r1}
	op_count: 1
		operands[0].type: REG = r1
		operands[0].access: READ
	Write-back: True
	Registers read: sp r1
	Registers modified: sp
	Groups: arm

[captincook]

thanks but it's NOT correct:

Registers read: sp r1
Registers modified: sp

Correct would be:

Registers read: sp
Registers modified: r1 sp

since the instr will do read memory from [sp] and write to r1 register then add sp,4 so in pseudocode:

r1 = [sp]
sp = sp + 4 

The best way would to force it to: ldr r1, [sp], +#4

All other other disassemblers (IDA, Binary ninja, HIEW, Retargetable Decompiler) show this instruction with LDR.

It's supposed to be like this but of course not IMM = 0x8 only IMM = 0x4.

ubuntu@ubuntu ~ $ cstool -d arm "08 10 9d e4"
0  08109de4  ldr r1, [sp], #8
op_count: 3
operands[0].type: REG = r1
operands[0].access: WRITE
operands[1].type: MEM
operands[1].mem.base: REG = sp
operands[1].access: READ
operands[2].type: IMM = 0x8
Write-back: True
Registers read: sp
Registers modified: r1 sp
Groups: arm 

Could you change the code from pop {reg32} to LDR reg32, [sp], #4 ?
it seems to be the correct way to disassemble this ARM code.

[aquynh]

i think this is fine, as pop is just the alias here.

i just committed another fix for r1 to be modified, not read.

[captincook]

Thanks registers read/modified is good now.

It is confusing when switching between tools all disassemblers on the market (IDA, BN, Hiew) use
ldr reg, [sp], #0x4 not pop. I checked with winedbg today and +1 for ldr:

$ rasm2 -b32 -a arm.winedbg -D 04109de4
0x00000000   4                 04109de4  ldr r1, [sp], #4

Maybe there is an option to enable it in capstone ? I see some alias is implemented here:

3caf837

[aquynh]

yes that will be nice to have an option for alias (in the form of CS_OPT_XXX, using with cs_option(). if you can do it with a pull req, i will happily merge it.

[captincook]

OK in the changelog I see

- Alias LDR instruction with operands [sp], 4 to POP.

https://github.com/aquynh/capstone/blob/master/ChangeLog

so the idea would be to add an option to disable this alias (?) and undo this change since I cannot simply change name like with x86 'jz/jnz' because arm LDR and POP have different operands.