Igor’s Tip of the Week #137: Processor modes and segment registers – Hex Rays

Written by Igor Skochinsky | Apr 20, 2023

Some of the processors supported by IDA support different ISA variants, in particular:

ARM processor module supports the classic 32-bit ARM instructions (A32), 16-bit Thumb or mixed 16/32-bit Thumb32 (T32) , as well as 64-bit A64 instructions (A64)
PPC processor module supports the standard 32-bit PowerPC instructions and mixed 16/32-bit Variable Length Environment (VLE)
MIPS module supports the classic 32-bit instructions as well as the compressed variants MIPS16 and microMIPS

Because sometimes these instructions sets may be present in the same binary, IDA needs a way to determine which subset to use. For this, it repurposes segment registers, originally used on 16-bit x86 processors to extend the 16-bit addressing. For example, if you load an ARM firmware binary, you will see the following informational box:

In many cases, IDA is able to determine the correct processor mode by analyzing the code and determining mode switch sequences (e.g. BX/BLX instructions), but you can also force its decision by using the described shortcut Alt–G (if you prefer menus, you can find it in Edit > Segments > Change segment register value…).

In the dialog, select the T register and specify 0 for ARM mode or 1 for Thumb (includes Thumb32 aka Thumb-2).

You can observe mode switches in the disassembly listing by the CODE32/CODE16 directives (usually text view only):

If you need a global overview, use the View> Open subviews > Segment registers…. (Shift–F8) view or its modal version Jump > Jump to segment (Ctrl–G):

The Tag column gives a hint on how the specific changepoint was created: a denotes a changepoint added by IDA during autoanalysis while u is used for those specified by the user (or, sometimes a plugin).

If necessary, wrong changepoints can be deleted from the list (even many at a time, using the selection). When a change point is deleted, IDA uses the value of a preceding one (or the default for the current segment).

For MIPS, the mips16 pseudoregister is used to switch between standard MIPS and MIPS16 or microMIPS, and for PPC, vle is used to enable decoding of VLE instructions.