Skip to content

Add ARM countdown decompiler fixture - #199

Open
zardus wants to merge 2 commits into
masterfrom
feature/arm-seq-dephi-copy
Open

Add ARM countdown decompiler fixture#199
zardus wants to merge 2 commits into
masterfrom
feature/arm-seq-dephi-copy

Conversation

@zardus

@zardus zardus commented Aug 26, 2026

Copy link
Copy Markdown
Member

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Problem

The decompiler regression for the countdown loop in tests/armel/decompiler/blink_main_countdown.elf, function 0x80001ad, needs a compiler-produced Cortex-M image. Binaries master has no such path, so the full Phoenix and SAILR paths cannot exercise the undefined loop-carrier failure.

Root cause

The failure depends on the control-flow and data-flow shape emitted by the public libopencm3 build; a fabricated byte string would not preserve that production shape or its licensing obligations.

Fix

Add the stripped DecBench libopencm3 ELF, pinned provenance and corresponding-source links, plus the verbatim GPLv3 and LGPLv3 license texts.

Testing

Exact-head readback reports a 32-bit little-endian ARM executable with .text at 0x08000000, size 0x32c, and SHA-256 29efb122e62bbbd4edaf3aa5c429093cdc2183b91fa62dbf85a48aac08c12093. The coordinated angr regression loads function 0x80001ad under Phoenix and SAILR. Validation: #199 (comment)

session: sharpen

@zardus

zardus commented Aug 26, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head b8fae56a38d47ceed441f5ce100634efcdd0255e against baseline a87538bc248531d2a1d22434143e8b9752459bac.

  • Exact PR shape: the own-merge-base/head scan verifies the added compiler-produced fixture and its load-bearing format/address shape: ARM EABI ELF; the countdown main entry is at Thumb address 0x80001ad.
  • Provenance/reproduction: ARM GNU Binutils 2.46 strip --strip-all was rerun twice in separate fresh directories; both outputs byte-compare with each other and with the committed bytes.
  • Input/native identity: committed SHA-256 29efb122e62bbbd4edaf3aa5c429093cdc2183b91fa62dbf85a48aac08c12093; rustylib mapped from the isolated consumer worktrees on both arms, SHA-256 6cc4d9f576ebff26e0d99d3d2a03dd2f351ff4f8db0a3b59904f73df34301c85.
  • Real consumer: Preserve loop-header variables during expression folding angr#6954 at baseline 829ea98f577ac04d9cd3927ddc868713a5b0a1ab and head 278171b94be1c685ad81d24d6b02f6985d0aef78 loaded the committed fixture and produced the complete output linked in this PR's output record.
  • Repeat/order control: A/B/B/A, ASLR disabled and PYTHONHASHSEED=0; same-arm output is byte-identical and the cross-arm delta is nonempty.
  • Local scope: this recapture validates fixture bytes, fixture shape, and the actual consumer path only. It does not claim a fresh full-workspace gate.
  • Hosted status: fresh hosted dependency validation for this exact binaries head has not been observed in this recapture; it remains pending and no hosted success is claimed here.

@zardus

zardus commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Exact fixture-shape and consumer-output record for #199.

  • Fixture comparison: own merge base a87538bc248531d2a1d22434143e8b9752459bac versus exact head b8fae56a38d47ceed441f5ce100634efcdd0255e. The target path/shape is absent on the merge base and present on the head. ARM EABI ELF; the countdown main entry is at Thumb address 0x80001ad.
  • Fixture identity: SHA-256 29efb122e62bbbd4edaf3aa5c429093cdc2183b91fa62dbf85a48aac08c12093; source provenance: DecBench revision e5eb576d66ee36793b800a4dd45e291e0add4472, O2/libopencm3/blink.elf. The complete readelf/objdump scan is retained with the exact script. The recorded recipe (ARM GNU Binutils 2.46 strip --strip-all) was rerun twice in fresh directories; both runs are byte-identical to the committed fixture.
  • Actual consumer: Preserve loop-header variables during expression folding angr#6954, exact baseline 829ea98f577ac04d9cd3927ddc868713a5b0a1ab versus exact head 278171b94be1c685ad81d24d6b02f6985d0aef78; target main at 0x80001ad; configuration full / SAILR.
  • Native identity: rustylib mapped from the isolated consumer worktrees on both arms, SHA-256 6cc4d9f576ebff26e0d99d3d2a03dd2f351ff4f8db0a3b59904f73df34301c85.
  • Determinism: fresh A/B/B/A order, ASLR disabled and PYTHONHASHSEED=0; each same-arm pair is byte-identical and every base/head comparison below is nonempty. Absolute checkout prefixes in tracebacks are normalized to <workspace> for publication; raw output is retained unchanged.

Beforemain at 0x80001ad

Exact consumer baseline
void sub_80001ad(void)
{
    unsigned int v2;  // r4
    unsigned int v3;  // lr
    unsigned int v4;  // r3
    unsigned int i;  // r3
    unsigned int v6;  // r3
    unsigned int v0;  // [bp-0x8]
    unsigned int v1;  // [bp-0x4]

    v0 = v2;
    v1 = v3;
    sub_8000241(0x600);
    sub_80001f5(0x40020000, 1, 0, 32);
    while (1)
    {
        sub_80001e1(0x40020000, 32);
        v4 = 1000000;
        do
        {
            v6 = v4 - 1;
            v4 = v6;
        } while (i != 1);
    }
}

Aftermain at 0x80001ad

Exact consumer head
void sub_80001ad(void)
{
    unsigned int v2;  // r4
    unsigned int v3;  // lr
    unsigned int v4;  // r3
    unsigned int i;  // r3
    unsigned int v0;  // [bp-0x8]
    unsigned int v1;  // [bp-0x4]

    v0 = v2;
    v1 = v3;
    sub_8000241(0x600);
    sub_80001f5(0x40020000, 1, 0, 32);
    while (1)
    {
        sub_80001e1(0x40020000, 32);
        v4 = 1000000;
        do
        {
            i = v4;
            v4 = i - 1;
        } while (i != 1);
    }
}

@zardus
zardus force-pushed the feature/arm-seq-dephi-copy branch from b90a545 to b8fae56 Compare August 28, 2026 16:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant