Base addresses (Program Counters) of symbols (methods and functions) do not match. Off by 1

Question

I have some code in my app that sends me the stack trace of uncaught exceptions.

"0   CoreFoundation   0x3ad073ff <redacted> + 186",
"1   libobjc.A.dylib  0x39412963 objc_exception_throw + 30",
"2   CoreFoundation   0x3ad0729d <redacted> + 0",
"3   Foundation       0x39f3b7b3 <redacted> + 90",
"4   UIKit            0x34a3ae29 <redacted> + 4184",
"5   MyApp            0x0001feab -[MAMyClassA firstMethod:withParameter1:andParameter2:] + 374",
"6   MyApp            0x000f76b5 -[MAMyClassB secondMethod:withParameter1:andParameter2:] + 164",
"7   UIKit            0x34bd0fe1 <redacted> + 84",
"8   UIKit            0x34af2047 <redacted> + 70",
"9   UIKit            0x34af1ffb <redacted> + 30",
"10  UIKit            0x34af1fd5 <redacted> + 44",
...

As you can see, most of Apple's methods are replaced with <redacted>. I have been able to extract the symbols and their corresponding base addresses from Apple's libraries using nm, but the addresses do not match. They are off by 1.

I have calculated the address as explained here: iOS crash reports: atos not working as expected.

Symbol address = (base address of framework) - (base address of symbol from crash report) + (virtual memory slide [vmaddr]).

For example, I'm getting 0xC2345, but the actual symbol address returned by nm is 0xC2344. I know that this is the right symbol. I have tried this with different addresses in different frameworks (UIKit, Foundation, CoreFoundation, etc.) in different crash reports and the result is the same: the value is always off by 1. I have to subtract 1 from what I get in the crash report to get the "right" address as provided by nm.

As I am typing this question, I found this: Wrong method implementation address from otool for armv7?.

Does that mean that every time I have an address to look up I have to perform the following logic?

if ((symbol address) mod 2 == 1) {
  // This is a thumb instruction so it may be 2 or four bytes
  Subtract 1 from the symbol address and then use it to lookup the symbol.
}
else {
  // This is a standard 4-byte ARM instruction.
  Perform symbol lookup with the address as is.
}

Thanks in advance for any help or direction.

Answer 1

The LSB in the PC shows the current execution-mode. If the bit is 0 then it's ARM, if it's set to 1 then the execution is done in Thumb-Mode. So yes, you'll get the real address like this:

real_address = address & ~1;

And the current execution mode like this:

is_thumb_mode = address & 1;

Most code these days will be compiled to Thumb-2 as it has only a few areas where it lacks behind "real" ARM-code and usually saves about 30% in code size.