objdump and ARM vs Thumb

Question

I'm trying to disassemble an object built for ARM with gcc. Unfortunately, objdump is trying to guess whether the code is ARM and Thumb, and is getting it wrong: it thinks my code is Thumb when it's actually ARM.

I see that objdump has an option to force it to interpret all instructions as Thumb (-Mforce-thumb), but it doesn't have one to force ARM mode!

This seems like a really weird omission to me, and it's seriously hampering my ability to get work done (I'm on an embedded device and my only means of debugging is to look at the disassembly). I've tried various approaches, including trying to tell objdump to use an ARM architecture that doesn't support Thumb, but nothing seems to work. Any ideas?

(And yes, I know that the instructions really are ARM...)

Marishamariska

are you stripping the binary (elf) files, maybe the info was there and then removed. Or maybe you have to add a switch to include the debug info into the binary. – Pedaias

It's objdump ... -Mno-force-thumb today. Can't say if this was present back in 2011. Essentially it's either ARM or Thumb, so when you say no-force-thumb the instruction set is ARM. – Egalitarian

Answer 1

arm-linux-gnueabi-objdump -marm -b binary -D does the trick for me. It doesn't preserve the symbol information though, so it's not quite what you are looking for, but it gives you the disassemble, which is a start.

Alleenallegation

Answer 2

This sounds like a bug in either compiler/linker or objdump. Normally the symbols should be marked properly if they're Thumb or ARM and disassembled accordingly.

That said, there's a few things you can try:

1. interpret file as plain binary (-b binary -D) - this will disable symbol checking and will disassemble whole file as ARM. Downside: lots of garbage in the output, no nice addresses.
2. use IDA Pro. Even if it guesses incorrectly, you can always override its decision. Also, it's a much nicer disassembly environment :)

Undersurface

I need the symbol information so I know what I'm looking at, so using raw binary doesn't cut it, I'm afraid. The file in question does have debugging information so the marking information should be there. My build process is convoluted but does involve gcc throughout; any ideas what might be stripping out the symbol marking? – Marishamariska

It's hard to say what's exactly is the issue. Print the contents of the symbol table and have a look at print_insn(_arm) in arm-dis.c. Maybe that will give you some ideas. – Undersurface