one_gadget 1.9.0 → 2.0.0

data/lib/one_gadget/emulators/arm.rb

@@ -0,0 +1,306 @@
+# frozen_string_literal: true
+
+require 'one_gadget/abi'
+require 'one_gadget/emulators/arm_family'
+require 'one_gadget/emulators/instruction'
+require 'one_gadget/emulators/lambda'
+require 'one_gadget/emulators/processor'
+require 'one_gadget/helper'
+
+module OneGadget
+  module Emulators
+    # Emulator of 32-bit ARM (both A32 and Thumb-2 encodings).
+    class Arm < ArmFamily
+      # Instantiate an {Arm} object.
+      # @param [String, nil] file
+      #   Path to the target libc. Used to read words from the literal pool when
+      #   resolving PC-relative +ldr+ loads. May be +nil+ in unit tests that don't
+      #   exercise literal loads.
+      def initialize(file = nil)
+        super(OneGadget::ABI.arm, 'sp')
+        @pc = 'pc'
+        # find() builds a fresh emulator per candidate; cache the file's bytes so
+        # the literal pool isn't re-read from disk thousands of times.
+        @data = file && self.class.file_data(file)
+        @prev_addr = nil
+        # A32 until proven Thumb by a +.w+/+.n+ suffix or a 2-byte instruction stride.
+        @thumb = false
+      end
+
+      # Memoized bytes of +file+ (the target libc), shared across emulator instances.
+      def self.file_data(file)
+        (@file_data ||= {})[file] ||= File.binread(file)
+      end
+
+      # @see OneGadget::Emulators::AArch64#process!
+      def process!(cmd)
+        resolve_pending_branch(cmd)
+        line = cmd.strip
+        track_mode(line)
+        body, @literal = decompose(line)
+        mnem, rest = body.split(/\s+/, 2)
+        return handle_compare(COMPARES[mnem], rest) if COMPARES.key?(mnem)
+        return handle_branch(mnem, rest) != :fail if branch_mnem?(mnem)
+        # push/pop take a {reg-list} whose commas would confuse the generic parser.
+        return __send__(:"inst_#{mnem}", rest) != :fail if %w[push pop].include?(mnem)
+
+        inst, args = parse(body)
+        __send__(:"inst_#{inst.inst}", *args) != :fail
+      end
+
+      # The flag-setting spelling of an instruction we model, which differs from
+      # the base mnemonic only by a trailing +s+ (+movs+, +ands+, ...). The flags
+      # it sets are not modelled, so a branch reading them aborts the path anyway;
+      # what matters here is the value it also writes. Conditional variants
+      # (+moveq+, +addne+, ...) are deliberately absent and stay unsupported.
+      FLAG_SETTING = /\A(mov|add|sub|and|orr|eor|bic|mvn|lsl|lsr)s\z/
+
+      # Supported instruction set. Any instruction not listed here aborts the
+      # current gadget candidate (mirrors the conservative aarch64 emulator).
+      # @return [Array<Instruction>] The supported instructions.
+      def instructions
+        [
+          Instruction.new('push', 1),
+          Instruction.new('pop', 1),
+          Instruction.new('add', 2..3),
+          Instruction.new('sub', 2..3),
+          Instruction.new('mov', 2),
+          Instruction.new('ldr', 2..3),
+          Instruction.new('ldrb', 2..3),
+          Instruction.new('str', 2..3),
+          Instruction.new('bl', 1),
+          Instruction.new('blx', 1),
+          Instruction.new('nop', 0..1),
+          Instruction.new('dmb', 0..1),
+          Instruction.new('dsb', 0..1),
+          Instruction.new('isb', 0..1),
+          Instruction.new('and', 2..3),
+          Instruction.new('orr', 2..3),
+          Instruction.new('eor', 2..3),
+          Instruction.new('bic', 2..3),
+          Instruction.new('mvn', 2),
+          Instruction.new('lsl', 2..3),
+          Instruction.new('lsr', 2..3),
+          Instruction.new('cmp', 2..3),
+          Instruction.new('cmn', 2..3),
+          Instruction.new('tst', 2..3),
+          Instruction.new('svc', 1)
+        ]
+      end
+
+      # Return the argument value of calling a function.
+      # @param [Integer] idx The 0-based index of the argument.
+      # @return [Lambda, Integer]
+      #   AAPCS passes the first four arguments in +r0+-+r3+; any further
+      #   arguments are on the stack at +[sp]+, +[sp+4]+, ... (needed for
+      #   6-argument calls such as +posix_spawn+).
+      def argument(idx)
+        return registers["r#{idx}"] if idx < 4
+
+        sp_based_stack[(idx - 4) * size_t]
+      end
+
+      # Settle Thumb vs A32 from a whole candidate, before any of it is emulated.
+      # {#track_mode} can only learn from lines already seen, so the FIRST
+      # instruction is judged on no evidence at all -- and when that instruction
+      # reads +pc+, the bias it picks decides an address the constraints go on to
+      # name. Applying the same evidence up front removes that dependence on
+      # whatever happened to be processed first.
+      #
+      # A32 is left alone: it shows neither a width suffix nor a 2-byte stride, so
+      # a genuinely A32 candidate keeps the whole-word bias. A single-instruction
+      # Thumb candidate offers no evidence either and is no better served than
+      # before.
+      # @param [Array<String>] lines The candidate's objdump lines.
+      def note_instruction_set(lines)
+        return if @thumb
+
+        addrs = lines.filter_map { |l| l[/\A\s*([0-9a-f]+):/, 1]&.to_i(16) }
+        @thumb = lines.any? { |l| l.match?(/\.[wn]\b/) } ||
+                 addrs.each_cons(2).any? { |a, b| b - a == 2 }
+      end
+
+      private
+
+      # Update {@thumb}/{@cur_addr} from the leading +ADDR:+ of an objdump line.
+      # A 2-byte stride proves Thumb; A32 keeps the whole-word stride.
+      def track_mode(line)
+        @thumb = true if line.match?(/\.[wn]\b/) # Thumb-2 wide/narrow suffix
+        @cur_addr = line[/\A([0-9a-f]+):/, 1]&.to_i(16)
+        return if @cur_addr.nil?
+
+        @thumb = true if @prev_addr && (@cur_addr - @prev_addr) == 2
+        @prev_addr = @cur_addr
+      end
+
+      # Split an objdump line into its instruction body and the literal-pool address
+      # embedded in the trailing +@+ comment (used by PC-relative +ldr+).
+      # @return [(String, Integer?)] The instruction body, and the literal address (or +nil+).
+      # @example
+      #   split_line('2c626: ldr r2, [pc, #128] @ (2c6a8 <x>)')
+      #   #=> ['ldr r2, [pc, #128]', 0x2c6a8]
+      # The instruction body a line carries, in the plain form the generic parser
+      # expects, and the literal-pool address it points at. Both are decided by the
+      # text alone (see {Processor.line_memo}).
+      # @param [String] line
+      # @return [(String, Integer, nil)]
+      def decompose(line)
+        self.class.line_memo(:decompose)[line] ||= begin
+          body, literal = split_line(line)
+          [normalize(body), literal]
+        end
+      end
+
+      def split_line(line)
+        body = line.sub(/\A[0-9a-f]+:\s*/, '')
+        literal = body[/@\s*\(?([0-9a-f]+)\s/, 1]&.to_i(16)
+        # Strip a trailing comment. The marker is whitespace-prefixed, which avoids
+        # eating the +@@+ inside symbol names such as +<execve@@GLIBC_2.4>+.
+        [body.sub(/\s+[@;].*\z/, '').strip, literal]
+      end
+
+      # Rewrite one instruction into the plain form the generic parser expects:
+      # drop the +.w+/+.n+ width suffix, map the flag-setting aliases we support
+      # (+movs+/+adds+/+subs+) back to their base mnemonic, and strip the +#+ that
+      # prefixes ARM immediates. Other conditional/flag variants (+moveq+, +addne+, ...) are
+      # left intact so they fall through to "unsupported".
+      # @example
+      #   normalize('movs r0, #0')
+      #   #=> 'mov r0, 0'
+      #   normalize('add.w r0, r4, #8')
+      #   #=> 'add r0, r4, 8'
+      def normalize(body)
+        mnem, rest = body.split(/\s+/, 2)
+        mnem = mnem.sub(/\.(w|n)\z/, '')
+        mnem = mnem.sub(FLAG_SETTING, '\\1')
+        [mnem, rest].compact.join(' ').gsub(/#(-?(?:0x)?[0-9a-f]+)/i, '\1')
+      end
+
+      # The value of +pc+ when used as an operand: +$base + (addr + bias)+,
+      # bias +4+ in Thumb and +8+ in A32.
+      def pc_value
+        libc_base + @cur_addr + (@thumb ? 4 : 8)
+      end
+
+      def inst_mov(dst, src)
+        check_register!(dst)
+
+        registers[dst] = value_of(src)
+      end
+
+      def inst_ldr(dst, src, index = 0)
+        check_register!(dst)
+        raise_unsupported('ldr', dst, src, index) unless OneGadget::Helper.integer?(index)
+
+        val = src.include?(pc) ? literal_value : read_value(arg_to_lambda(resolve_int_regs(src)))
+        registers[dst] = val
+
+        index = Integer(index)
+        return unless src.end_with?('!') || index.nonzero?
+
+        # pre-index ([reg, imm]!) or post-index ([reg], imm) write-back.
+        writeback(src, index)
+      end
+
+      def inst_str(src, dst, index = 0)
+        check_register!(src)
+        raise_unsupported('str', src, dst, index) unless OneGadget::Helper.integer?(index)
+
+        dst_l = arg_to_lambda(resolve_int_regs(dst)).ref!
+        track_write(dst_l, registers[src])
+
+        index = Integer(index)
+        return unless dst.end_with?('!') || index.nonzero?
+
+        writeback(dst, index)
+      end
+
+      # Pre-/post-index write-back of a +[reg, imm]+ memory operand to +reg+.
+      def writeback(mem, index)
+        lmda = OneGadget::Emulators::Lambda.parse(resolve_int_regs(mem.delete('!')))
+        registers[lmda.obj] += lmda.immi + index if register?(lmda.obj)
+      end
+
+      # push {r4, r5, lr}: registers are stored with the lowest-numbered at the
+      # lowest address; sp ends decremented by 4 * count.
+      def inst_push(list)
+        regs = reglist(list)
+        registers[sp] -= size_t * regs.size
+        base = registers[sp].evaluate(eval_dict)
+        regs.each_with_index { |r, i| sp_based_stack[base + size_t * i] = registers[r] }
+      end
+
+      # pop {r4, r5, pc}: inverse of push. A pop into pc/lr does not affect the
+      # constraint search, so only sp and the popped GPRs are updated.
+      def inst_pop(list)
+        regs = reglist(list)
+        base = registers[sp].evaluate(eval_dict)
+        regs.each_with_index { |r, i| registers[r] = sp_based_stack[base + size_t * i] if register?(r) }
+        registers[sp] += size_t * regs.size
+      end
+
+      # +blx+ (interworking call) is modelled exactly like +bl+ (see {ArmFamily#inst_bl}).
+      alias inst_blx inst_bl
+
+      # Flag-only / no-effect instructions: keep emulating without changing state.
+      # A raw syscall: not modelled, but it does not touch anything the emulator
+      # tracks either, so the candidate continues (see {ArmFamily#inst_nop}).
+      alias inst_svc inst_nop
+
+      def branch_mnem?(mnem)
+        return true if mnem == 'b' || %w[cbz cbnz].include?(mnem)
+
+        # +vs+/+vc+ aren't in COND but are still branches (they just abort the path).
+        mnem.start_with?('b') && (COND.key?(mnem[1..]) || %w[vs vc].include?(mnem[1..]))
+      end
+
+      def operands(rest)
+        rest.to_s.split(',').map { |o| o.strip.sub(/\s*<.*>\z/, '') }
+      end
+
+      def handle_branch(mnem, rest)
+        ops = operands(rest)
+        case mnem
+        when 'b' then true # unconditional: control handled by the stitched path
+        when 'cbz' then handle_cbz(ops, negate: false)
+        when 'cbnz' then handle_cbz(ops, negate: true)
+        else branch_on_compare(COND[mnem[1..]], ops[0].to_i(16))
+        end
+      end
+
+      # Read the little-endian word the current PC-relative +ldr+ points at.
+      def literal_value
+        raise_unsupported('ldr', 'pc') if @literal.nil? || @data.nil?
+
+        @data[@literal, size_t].unpack1('V')
+      end
+
+      # Resolve an operand to its current value, modelling +pc+ symbolically.
+      # +pc+ reads as its own address plus the pipeline bias; everything else is
+      # an ordinary operand (see {ArmFamily#value_of}).
+      # @param [String] arg The operand, as written.
+      # @return [OneGadget::Emulators::Lambda, Integer] Its current value.
+      def value_of(arg)
+        return pc_value if arg == pc
+
+        super
+      end
+
+      # Parse an ARM register-list operand (as written by +push+/+pop+/+ldm+/+stm+)
+      # into the individual register names.
+      # @example
+      #   reglist('{r4, r5, lr}')
+      #   #=> ['r4', 'r5', 'lr']
+      def reglist(list)
+        list.tr('{}', '').split(',').map(&:strip)
+      end
+
+      class << self
+        # ARM (32-bit) is 32-bit.
+        def bits
+          32
+        end
+      end
+    end
+  end
+end

data/lib/one_gadget/emulators/arm_family.rb

@@ -0,0 +1,300 @@
+# frozen_string_literal: true
+
+require 'one_gadget/emulators/lambda'
+require 'one_gadget/emulators/processor'
+
+module OneGadget
+  module Emulators
+    # Behaviour shared by the two ARM-architecture emulators, {Arm} (AArch32) and
+    # {AArch64}: the condition-code table plus the parts of the calling convention
+    # and memory model that are identical in 32- and 64-bit mode. The common base
+    # each inherits (the ARM counterpart of {X86}); everything that genuinely
+    # differs (instruction set, register width, +pc+ handling) stays in the
+    # individual classes.
+    class ArmFamily < Processor
+      # ARM condition-code suffix (the +<cc>+ in +b<cc>+ / +b.<cc>+) mapped to a
+      # shared {Conditional::RELATION} predicate. Decodes the opaque mnemonics once:
+      # +hs+/+cs+ and +lo+/+cc+ are aliases; +mi+/+pl+ (sign bit) act as signed
+      # +</+>=+. +vs+/+vc+ (overflow) have no constraint form and are absent, so a
+      # branch on them maps to +nil+ and aborts the path. (x86 uses {X86::JCC}.)
+      COND = {
+        'eq' => :eq, 'ne' => :ne,
+        'hs' => :uge, 'cs' => :uge, 'lo' => :ult, 'cc' => :ult,
+        'hi' => :ugt, 'ls' => :ule,
+        'ge' => :sge, 'lt' => :slt, 'gt' => :sgt, 'le' => :sle,
+        'mi' => :slt, 'pl' => :sge
+      }.freeze
+
+      # This arch family's flag-setting compare mnemonics, mapped to the ALU op
+      # whose result their flags reflect (see {Conditional::COMPARE_OPS}). x86 has
+      # its own {X86::COMPARES}.
+      COMPARES = { 'cmp' => :sub, 'cmn' => :add, 'tst' => :and }.freeze
+
+      # The data-processing instructions both ARM families spell the same way,
+      # mapped to the Ruby operator that folds them and renders them alike.
+      # +bic+ and +mvn+ are absent: they complement their operand first, which
+      # {#complement} turns back into one of these (see {#inst_bic}).
+      DATA_OPS = { 'and' => :&, 'orr' => :|, 'eor' => :^, 'lsl' => :<<, 'lsr' => :>> }.freeze
+      private_constant :DATA_OPS
+
+      private
+
+      # A compare whose second operand may carry a shift modifier, e.g.
+      # +cmn x0, 0x1, lsl 12+ (the immediate is 0x1000, not 0x1). Fold a constant
+      # shift into the operand; abort on any modifier not modelled, since dropping
+      # it would silently understate the constraint.
+      # @return [Boolean] false aborts the candidate.
+      def handle_compare(op, cmd)
+        ops = operands(cmd)
+        return false if ops.size > 3
+
+        rhs = operand_str(ops[1])
+        if ops.size == 3
+          rhs = shifted_operand(rhs, ops[2])
+          return false if rhs.nil?
+        end
+        record_compare(op, operand_str(ops[0]), rhs)
+      end
+
+      # Apply a constant shift modifier to an already-rendered operand.
+      # @return [String, nil] nil when the shift isn't a constant amount applied to
+      #   a known integer, which the caller treats as unmodelled.
+      # @example
+      #   shifted_operand('0x1', 'lsl 12') #=> '0x1000'
+      def shifted_operand(rhs, modifier)
+        m = modifier.match(/\A(lsl|lsr|asr)\s+(\d+)\z/)
+        return nil unless m && OneGadget::Helper.integer?(rhs)
+
+        value = Integer(rhs)
+        OneGadget::Helper.hex(m[1] == 'lsl' ? value << Integer(m[2]) : value >> Integer(m[2]))
+      end
+
+      # +add+/+sub+, shared by both families. Each allows the 2-operand shorthand,
+      # and each may carry a modifier on +op2+ -- a shift, or (aarch64) a
+      # sign-extension of its low half.
+      # @param [String] dst The destination register.
+      # @param [String] src The value added to, or the only operand given.
+      # @param [String, nil] op2 The value to add, or nil in the 2-operand form.
+      # @param [String, nil] mode A modifier applied to +op2+ (see {#modified_operand}).
+      # @return [void]
+      def inst_add(dst, src, op2 = nil, mode = nil) = arith(:+, dst, src, op2, mode)
+
+      # +sub dst, src, op2+. See {#inst_add} for the operands.
+      # @return [void]
+      def inst_sub(dst, src, op2 = nil, mode = nil) = arith(:-, dst, src, op2, mode)
+
+      # Add or subtract, and store the result.
+      #
+      # A sum of two values neither of which is known folds into no base+offset,
+      # so it is named as the operation it is -- a candidate deriving a pointer
+      # that way still says what the caller has to arrange. That is the only
+      # fallback: an offset from a known base stays a base+offset, which the rest
+      # of the emulator can resolve against tracked memory.
+      # @param [Symbol] op +:++ or +:-+.
+      # @return [void]
+      # @raise [OneGadget::Error::UnsupportedInstructionArgumentError]
+      #   When the modifier, or the result, is not one this emulator can name.
+      def arith(op, dst, src, op2, mode)
+        check_register!(dst)
+        src, op2 = shorthand(dst, src, op2)
+        lhs = value_of(src)
+        rhs = modified_operand(value_of(op2), mode) { raise_unsupported(op, dst, src, op2, mode) }
+
+        result = offset_result(op, lhs, rhs)
+        # The stack pointer has to stay an offset from itself: every tracked
+        # stack slot is keyed on it, and a candidate that reads one back after
+        # allocating a variable-size frame would be answered from the wrong
+        # place. Such a frame also puts the array a gadget builds at an address
+        # only a register the caller supplies decides, which no constraint this
+        # emulator emits states.
+        result ||= operation_result(op, lhs, rhs) unless dst == sp
+        raise_unsupported(op, dst, src, op2) if result.nil?
+
+        registers[dst] = result
+      end
+
+      # +lhs op rhs+ when the result is an offset from +lhs+'s base, which
+      # {Lambda} expresses directly. +nil+ when it is not, leaving the caller to
+      # name the operation instead.
+      # @return [Lambda, Integer, nil]
+      def offset_result(op, lhs, rhs)
+        return lhs.send(op, rhs) if rhs.is_a?(Integer)
+        # Adding a known offset to an unknown value is the same value shifted;
+        # subtracting from one is not, so only addition commutes here.
+        return rhs + lhs if op == :+ && lhs.is_a?(Integer)
+
+        nil
+      end
+
+      # +value+ with an operand modifier applied. +nil+ +mode+ is the bare
+      # operand. Yields, rather than returning, for a modifier this emulator does
+      # not model, so an unmodelled one aborts instead of being silently dropped.
+      # @example (aarch64) +add x0, x1, w2, sxtw+ -- +mode+ is +"sxtw"+
+      # @example (arm) +add r0, r1, r2, lsl 3+ -- +mode+ is +"lsl 3"+
+      # @return [Lambda, Integer]
+      def modified_operand(value, mode)
+        return value if mode.nil? || mode == 'sxtw' # a sign-extension we take whole
+
+        shifted = shifted_operand(value_str(value), mode)
+        return yield if shifted.nil?
+
+        Integer(shifted)
+      end
+
+      # Apply a data-processing instruction and store its result. Both families
+      # allow the 2-operand shorthand, so +src+ may be the only operand given.
+      # @param [String] name The mnemonic, and the {DATA_OPS} key naming its operator.
+      # @param [String] dst The destination register.
+      # @param [String] src The left operand, or the only one given (see {#shorthand}).
+      # @param [String, nil] op2 The right operand, or nil in the 2-operand form.
+      # @return [void]
+      # @raise [OneGadget::Error::UnsupportedInstructionArgumentError]
+      #   When the result is nothing this emulator can name.
+      def data_op(name, dst, src, op2)
+        check_register!(dst)
+        src, op2 = shorthand(dst, src, op2)
+        result = operation_result(DATA_OPS.fetch(name), value_of(src), value_of(op2))
+        raise_unsupported(name, dst, src, op2) if result.nil?
+
+        # A shift can push bits past the register width, which the arbitrary-
+        # precision fold above would otherwise keep.
+        registers[dst] = result.is_a?(Integer) ? result & width_mask : result
+      end
+
+      # Each {DATA_OPS} mnemonic handled the one way, since they differ only in the
+      # operator applied (see {#data_op} for the operands).
+      %w[and orr eor lsl lsr].each do |name|
+        define_method(:"inst_#{name}") { |dst, src, op2 = nil| data_op(name, dst, src, op2) }
+      end
+
+      # +bic dst, src, op2+ clears the bits +op2+ sets, which is +and+ against its
+      # complement -- the form a constraint should read as, since that complement
+      # is the mask the caller has to arrange.
+      # @param [String] dst The destination register.
+      # @param [String] src The value to clear bits of, or the only operand given.
+      # @param [String, nil] op2 The bits to clear, or nil in the 2-operand form.
+      # @return [void]
+      def inst_bic(dst, src, op2 = nil)
+        src, op2 = shorthand(dst, src, op2)
+        data_op('and', dst, src, OneGadget::Helper.hex(complement('bic', op2, dst, src, op2)))
+      end
+
+      # +mvn dst, op2+ is that complement on its own.
+      # @param [String] dst The destination register.
+      # @param [String] op2 The value to complement.
+      # @return [void]
+      def inst_mvn(dst, op2)
+        check_register!(dst)
+
+        registers[dst] = complement('mvn', op2, dst, op2)
+      end
+
+      # +op2+ with every bit flipped. Only a concrete value has a complement this
+      # emulator can name; a symbolic one aborts rather than being recorded as a
+      # mask it isn't.
+      # @param [String] name The mnemonic to report an abort against.
+      # @param [String] op2 The operand to complement.
+      # @param [Array<String>] reported The operands to name in that abort.
+      # @return [Integer] +op2+ complemented, within the register width.
+      def complement(name, op2, *reported)
+        value = value_of(op2)
+        raise_unsupported(name, *reported) unless value.is_a?(Integer)
+
+        ~value & width_mask
+      end
+
+      # Every bit of a register, for masking a result back to its width.
+      # @return [Integer]
+      def width_mask = (1 << self.class.bits) - 1
+
+      # The value of an operand. {Arm} overrides it for +pc+, whose value depends
+      # on the address of the instruction reading it.
+      # @param [String] arg The operand, as written.
+      # @return [OneGadget::Emulators::Lambda, Integer] Its current value.
+      def value_of(arg) = arg_to_lambda(arg)
+
+      # Expand a 2-operand data-processing form into its (src, op2) operands:
+      # +add dst, op2+ is shorthand for +add dst, dst, op2+, while an explicit
+      # 3-operand form is passed through unchanged.
+      # @param [String] dst The destination register, which the 2-operand form
+      #   also reads as its left operand.
+      # @param [String] src The left operand, or the right one in the 2-operand form.
+      # @param [String, nil] op2 The right operand, or nil in the 2-operand form.
+      # @return [(String, String)] The left and right operands.
+      # @example
+      #   shorthand('r0', 'r4', nil) # 2-operand: add r0, r4
+      #   #=> ['r0', 'r4']
+      #   shorthand('r0', 'r4', '8') # 3-operand: add r0, r4, 8
+      #   #=> ['r4', '8']
+      def shorthand(dst, src, op2)
+        op2.nil? ? [dst, src] : [src, op2]
+      end
+
+      # An instruction with no effect this emulator models anything of.
+      # @return [void]
+      def inst_nop(*); end
+
+      # A memory barrier orders accesses without changing any value, so a path
+      # crossing one carries on unchanged. The operand naming its scope (+dmb ish+)
+      # says which accesses, not what they hold.
+      alias inst_dmb inst_nop
+      alias inst_dsb inst_nop
+      alias inst_isb inst_nop
+
+      # A +bl+/+blx+ call: record the terminal +exec*+ target, accept a known-safe
+      # syscall wrapper, or +:fail+ to abort the candidate.
+      def inst_bl(addr)
+        return reach_terminal_call(addr) if terminal_call?(addr)
+
+        dispatch_safe_call(addr)
+      end
+
+      # Track a store: write +values+ (one per word from +dst_l+) into the stack
+      # {#resolve_address} resolves +dst_l+ to, and require +dst_l+
+      # writable -- unless it is a pure +sp+ store. +sp+ is invariantly the
+      # writable stack; the frame pointer only conventionally is, so a store
+      # through it stays a real precondition (like amd64's +writable: rbp+imm+).
+      # Shared by +str+ (one value) and +stp+ (two).
+      # @param [OneGadget::Emulators::Lambda] dst_l The destination, zero-deref.
+      # @param [Array<OneGadget::Emulators::Lambda, Integer>] values One per word.
+      # @return [void]
+      def track_write(dst_l, *values)
+        stack, offset = resolve_address(dst_l)
+        values.each_with_index { |v, i| stack[offset + size_t * i] = v } if stack
+        add_writable(dst_l) unless stack.equal?(sp_based_stack)
+      end
+
+      # A byte load. The address is read like any other, so what the caller has to
+      # arrange about it is recorded the same way -- but one byte of a word is not
+      # a value this emulator can name, so the register holds what a call would
+      # have left: a path that goes on to depend on it is abandoned rather than
+      # described wrongly.
+      def inst_ldrb(dst, src, index = 0)
+        inst_ldr(dst, src, index)
+        registers[dst] = clobbered_value
+      end
+
+      # +cbz+/+cbnz+ (compare-and-branch-on-zero): identical decoding in ARM and
+      # AArch64. +ops+ is +[register, target-address-hex]+, as {#operands} splits it.
+      # @param [Array<String>] ops The branch's operands.
+      # @param [Boolean] negate +false+ for +cbz+, +true+ for +cbnz+.
+      def handle_cbz(ops, negate:)
+        branch_on_zero(ops[1].to_i(16), ops[0], negate:)
+      end
+
+      # Replace register tokens that currently hold a concrete integer with that
+      # integer, so a register-indexed memory operand becomes an offset one the
+      # Lambda parser handles.
+      # @example
+      #   # with the index register currently holding 0xd8
+      #   resolve_int_regs('[r8, r2]')  #=> '[r8, 0xd8]'
+      #   resolve_int_regs('[x8, x2]')  #=> '[x8, 0xd8]'
+      def resolve_int_regs(str)
+        str.gsub(/[a-z]+\d*/) do |tok|
+          v = registers[tok] if register?(tok)
+          v.is_a?(Integer) ? OneGadget::Helper.hex(v) : tok
+        end
+      end
+    end
+  end
+end