mirror of
https://github.com/rizinorg/rizin
synced 2026-08-22 20:26:16 -04:00
6150ac78bc
While processing xrefs for marking them as data: 1. classify target using `xref_ref_kind` for data section too, previously it was only classified if target was in exec segment. Which caused false positive when the target was in non-exec section. Happens when the immediate value is small and it points in data section. 2. restrict data block from bleeding into other sections. Currently it correctly caps data block at next "detected" function (or next data) but when the function is not detected yet (like in stripped bins) and the area onward from data ref is empty, the data block bleeds into other sections specifically executable section. This should never happen.
4586 lines
132 KiB
Text
4586 lines
132 KiB
Text
NAME=analyze preludes & tail-call split
|
||
FILE=bins/elf/fedora_32_bin_ls
|
||
CMDS=<<EOF
|
||
aap
|
||
aflc
|
||
afl~mpsort
|
||
s sym.mpsort
|
||
pd 2 @ sym.mpsort
|
||
pdf~jmp
|
||
EOF
|
||
EXPECT=<<EOF
|
||
459
|
||
0x000125e0 35 696 -> 679 sym.mpsort_with_tmp.part.0
|
||
0x000128a0 6 83 -> 75 sym.mpsort
|
||
; CALL XREF from fcn.00008cac @ 0x8d43
|
||
/ sym.mpsort(int64_t arg_8h);
|
||
| ; arg int64_t arg_8h @ stack + 0x8
|
||
| 0x000128a0 endbr64
|
||
| 0x000128a4 push r12
|
||
\ 0x000128ee jmp sym.mpsort_with_tmp.part.0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=.gnu_debugdata parsed
|
||
FILE=bins/elf/fedora_32_bin_ls
|
||
CMDS=<<EOF
|
||
aap
|
||
afl~x2realloc
|
||
afl~quotearg_alloc_mem
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00016dc0 8 96 -> 83 sym.x2realloc
|
||
0x00015d10 3 233 sym.quotearg_alloc_mem
|
||
EOF
|
||
RUN
|
||
|
||
NAME=got switch cases
|
||
FILE=bins/elf/game_of_thrones
|
||
CMDS=<<EOF
|
||
s main
|
||
aa > /dev/null
|
||
pdsf~case
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00401125 switch table (7 cases) at 0x4013e4
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis.ijmp missing branch bug
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx 564155415453504989ff8b1f8b7f0889de83e61fe851010000418b7f1089dec1ee1083e61fe84001000085db0f8915010000458b77184585f60f84080100004983c71c31db4c8d250a0100004c8d2d07dacd29418b470889c1c1e91880f9040f87d700000049630c8c4c01e1ffe1418b3fc1e8100fb6f0e8ee0000004983c70ce9b700000084c00f84ab000000418b570c4885d2756de99d00000041837f0c000f84920000004d8b2f418b7d00c1e8100fb6f0e8b2000000418b470c83f802722141bc01000000410fb6770a438b7ca500e894000000418b470c49ffc44139c472e585c04c8d256b0000004c8d2d68d9cd297444410fb64f0885c9743b89c248c1e202498b37418b7d00e86d0e0000eb27a8027514418b7d00418b770c498b17e8fefc0000418b4708418b7f0cc1e8100fb6f0e8320000004983c710ffc34439f30f850cffffff4883c4085b415c415d415e415f5dc3
|
||
af
|
||
afb
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000000 0x00000032 00:0000 50 j 0x00000147 f 0x00000032
|
||
0x00000032 0x0000003f 00:0000 13 j 0x00000147 f 0x0000003f
|
||
0x0000003f 0x00000053 00:0000 20 j 0x00000053
|
||
0x00000053 0x00000065 00:0000 18 j 0x0000013c f 0x00000065
|
||
0x00000065 0x0000006e 00:0000 9
|
||
0x0000013c 0x00000147 00:0000 11 j 0x00000053 f 0x00000147
|
||
0x00000147 0x00000156 00:0000 15
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 getenv this maybe & jmp noret fix
|
||
FILE=bins/elf/ls.odd
|
||
CMDS=<<EOF
|
||
aaa
|
||
s 0x4901
|
||
afb~4901
|
||
echo
|
||
e asm.bytes=false
|
||
s main+98
|
||
pd 3
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x000048f4 0x00004901 00:0000 13 j 0x000045b1 f 0x00004901
|
||
0x00004901 0x0000491a 00:0000 25 j 0x000045ba f 0x0000491a
|
||
|
||
| 0x000039c2 mov dword [data.0021f558], 0x02 ; [0x21f558:4]=1
|
||
| 0x000039cc call fcn.00015960
|
||
| 0x000039d1 mov byte [data.00220618], 0x01 ; [0x220618:1]=0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 socket syscall
|
||
FILE=bins/elf/socket-syscall
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
aa
|
||
aae
|
||
s main
|
||
pd 1 @ 0x00001140
|
||
aei
|
||
aeim
|
||
aecu 0x00001140
|
||
as
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| ;-- syscall.socket:
|
||
| 0x00001140 0f05 syscall
|
||
41 = socket (0x00000001, 0x00000002, 0x00000003)
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 jmptbl -O0
|
||
FILE=bins/mach0/FMS.uu
|
||
CMDS=<<EOF
|
||
s sym._checkinput
|
||
af
|
||
afi
|
||
EOF
|
||
EXPECT=<<EOF
|
||
offset: 0x100000da0
|
||
name: sym._checkinput
|
||
size: 288
|
||
is-pure: false
|
||
realsz: 288
|
||
stackframe: 8
|
||
call-convention: amd64
|
||
cyclomatic-cost: 91
|
||
cyclomatic-complexity: 17
|
||
loops: 1
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 24
|
||
edges: 29
|
||
end-bbs: 2
|
||
call-refs: 0x100000de4 J 0x100000e00 J 0x100000e2a J 0x100000e54 J 0x100000e90 J 0x100000e99 J 0x100000e25 J 0x100000eba J 0x100000e99 J 0x100000e4f J 0x100000eba J 0x100000e99 J 0x100000e8b J 0x100000eba J 0x100000e99 J 0x100000eba J 0x100000e9e J
|
||
data-refs: 0x100000ec0
|
||
code-xrefs: 0x100000de2 J 0x100000de2 J 0x100000de2 J 0x100000de2 J 0x100000de2 J 0x100000dfb J 0x100000e17 J 0x100000e20 J 0x100000e25 J 0x100000e41 J 0x100000e4a J 0x100000e4f J 0x100000e7d J 0x100000e86 J 0x100000e8b J 0x100000e94 J 0x100000e99 J
|
||
noreturn: false
|
||
in-degree: 17
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 6
|
||
args: 1
|
||
arg int64_t arg1 @ rdi
|
||
var int64_t var_30h @ stack - 0x30
|
||
var int64_t var_28h @ stack - 0x28
|
||
var int64_t var_20h @ stack - 0x20
|
||
var int64_t var_1ch @ stack - 0x1c
|
||
var int64_t var_18h @ stack - 0x18
|
||
var int64_t var_9h @ stack - 0x9
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 main() jmptbl in bins/elf/ls.odd
|
||
FILE=bins/elf/ls.odd
|
||
CMDS=<<EOF
|
||
e analysis.jmp.tbl=true
|
||
s main
|
||
aF
|
||
afb
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00003960 0x00003a1f 00:0000 191 j 0x000047a7 f 0x00003a1f
|
||
0x00003a1f 0x00003a24 00:0000 5 j 0x00003a32 f 0x00003a24
|
||
0x00003a24 0x00003a2d 00:0000 9 j 0x0000431a f 0x00003a2d
|
||
0x00003a2d 0x00003a32 00:0000 5
|
||
0x00003a32 0x00003a48 00:0000 22 j 0x00003a48
|
||
0x00003a48 0x00003ad5 00:0000 141 j 0x00003b0b f 0x00003ad5
|
||
0x00003ad5 0x00003af8 00:0000 35 j 0x000047c2 f 0x00003af8
|
||
0x00003af8 0x00003b0b 00:0000 19 j 0x00003b0b
|
||
0x00003b0b 0x00003b2a 00:0000 31 j 0x00003b33 f 0x00003b2a
|
||
0x00003b2a 0x00003b33 00:0000 9 j 0x000047fd f 0x00003b33
|
||
0x00003b33 0x00003b51 00:0000 30 j 0x00003b62 f 0x00003b51
|
||
0x00003b51 0x00003b5b 00:0000 10 j 0x00003b62 f 0x00003b5b
|
||
0x00003b5b 0x00003b62 00:0000 7 j 0x00003b62
|
||
0x00003b62 0x00003b81 00:0000 31 j 0x00003ba7 f 0x00003b81
|
||
0x00003b81 0x00003b9b 00:0000 26 j 0x00004caf f 0x00003b9b
|
||
0x00003b9b 0x00003ba7 00:0000 12 j 0x00003ba7
|
||
0x00003ba7 0x00003bc8 00:0000 33 j 0x00003bc8
|
||
0x00003bc8 0x00003bf4 00:0000 44 j 0x0000437b f 0x00003bf4
|
||
0x00003bf4 0x00003c04 00:0000 16 j 0x00005159 f 0x00003c04
|
||
0x00003c04 0x00003c0e 00:0000 10 s 0x00003eae s 0x000050bf s 0x00005159 s 0x00003e92 s 0x00003e83 s 0x00003e32 s 0x00003e23 s 0x00003e17 s 0x00003e08 s 0x00003dfc s 0x00003ded s 0x00003db8 s 0x00003da9 s 0x00003d9b s 0x00003d8a s 0x00003d7e s 0x00003d6a s 0x00003d25 s 0x00003d11 s 0x00003cfd s 0x00003cf1 s 0x00003ce2 s 0x00003cd1 s 0x00003cc2 s 0x00003cb6 s 0x00003c76 s 0x00003c60 s 0x00003c31 s 0x00003c28 s 0x00003c21 s 0x00003c15 s 0x0000427c s 0x00003c0e s 0x00004266 s 0x00004257 s 0x0000424b s 0x0000423f s 0x00004233 s 0x0000421f s 0x000042ff s 0x000042eb s 0x0000429a s 0x0000428b s 0x0000430e s 0x000041de s 0x0000417f s 0x00004170 s 0x00004161 s 0x0000411e s 0x00004108 s 0x000040fc s 0x000040d1 s 0x00004065 s 0x00004022 s 0x00003fde s 0x00003fd2 s 0x00003fa3 s 0x00003f5b s 0x00003f18 s 0x00003f0c
|
||
0x00003c0e 0x00003c15 00:0000 7 j 0x00003c15
|
||
0x00003c15 0x00003c21 00:0000 12 j 0x00003bc8
|
||
0x00003c21 0x00003c28 00:0000 7 j 0x00003bc8
|
||
0x00003c28 0x00003c31 00:0000 9 j 0x00003bc8
|
||
0x00003c31 0x00003c60 00:0000 47 j 0x00003bc8
|
||
0x00003c60 0x00003c76 00:0000 22 j 0x00003bc8
|
||
0x00003c76 0x00003c97 00:0000 33 j 0x00004d9d f 0x00003c97
|
||
0x00003c97 0x00003cb6 00:0000 31 j 0x00003bc8
|
||
0x00003cb6 0x00003cc2 00:0000 12 j 0x00003bc8
|
||
0x00003cc2 0x00003cd1 00:0000 15 j 0x00003bc8
|
||
0x00003cd1 0x00003ce2 00:0000 17 j 0x00003bc8
|
||
0x00003ce2 0x00003cf1 00:0000 15 j 0x00003bc8
|
||
0x00003cf1 0x00003cfd 00:0000 12 j 0x00003bc8
|
||
0x00003cfd 0x00003d11 00:0000 20 j 0x00003bc8
|
||
0x00003d11 0x00003d25 00:0000 20 j 0x00003bc8
|
||
0x00003d25 0x00003d6a 00:0000 69 j 0x00003bc8
|
||
0x00003d6a 0x00003d7e 00:0000 20 j 0x00003bc8
|
||
0x00003d7e 0x00003d8a 00:0000 12 j 0x00003bc8
|
||
0x00003d8a 0x00003d9b 00:0000 17 j 0x00003bc8
|
||
0x00003d9b 0x00003da9 00:0000 14 j 0x00003bc8
|
||
0x00003da9 0x00003db8 00:0000 15 j 0x00003bc8
|
||
0x00003db8 0x00003ded 00:0000 53 j 0x00003bc8
|
||
0x00003ded 0x00003dfc 00:0000 15 j 0x00003bc8
|
||
0x00003dfc 0x00003e08 00:0000 12 j 0x00003bc8
|
||
0x00003e08 0x00003e17 00:0000 15 j 0x00003bc8
|
||
0x00003e17 0x00003e23 00:0000 12 j 0x00003bc8
|
||
0x00003e23 0x00003e32 00:0000 15 j 0x00003bc8
|
||
0x00003e32 0x00003e83 00:0000 81 j 0x00003bc8
|
||
0x00003e83 0x00003e92 00:0000 15 j 0x00003bc8
|
||
0x00003e92 0x00003e9f 00:0000 13 j 0x00003bc8 f 0x00003e9f
|
||
0x00003e9f 0x00003eae 00:0000 15 j 0x00003bc8
|
||
0x00003eae 0x00003ec7 00:0000 25 j 0x00003edc f 0x00003ec7
|
||
0x00003ec7 0x00003edc 00:0000 21 j 0x00003edc
|
||
0x00003edc 0x00003f0c 00:0000 48
|
||
0x00003f0c 0x00003f18 00:0000 12 j 0x00003bc8
|
||
0x00003f18 0x00003f5b 00:0000 67 j 0x00003bc8
|
||
0x00003f5b 0x00003fa3 00:0000 72 j 0x00003bc8
|
||
0x00003fa3 0x00003fd2 00:0000 47 j 0x00003bc8
|
||
0x00003fd2 0x00003fde 00:0000 12 j 0x00003bc8
|
||
0x00003fde 0x00004022 00:0000 68 j 0x00003bc8
|
||
0x00004022 0x00004065 00:0000 67 j 0x00003bc8
|
||
0x00004065 0x00004075 00:0000 16 j 0x00004364 f 0x00004075
|
||
0x00004075 0x000040af 00:0000 58 j 0x00004364 f 0x000040af
|
||
0x000040af 0x000040ba 00:0000 11 j 0x00004369 f 0x000040ba
|
||
0x000040ba 0x000040d1 00:0000 23 j 0x00004369
|
||
0x000040d1 0x000040fc 00:0000 43 j 0x00003bc8
|
||
0x000040fc 0x00004108 00:0000 12 j 0x00003bc8
|
||
0x00004108 0x0000411e 00:0000 22 j 0x00003bc8
|
||
0x0000411e 0x00004161 00:0000 67 j 0x00003bc8
|
||
0x00004161 0x00004170 00:0000 15 j 0x00003bc8
|
||
0x00004170 0x0000417f 00:0000 15 j 0x00003bc8
|
||
0x0000417f 0x0000418f 00:0000 16 j 0x0000434d f 0x0000418f
|
||
0x0000418f 0x000041c9 00:0000 58 j 0x0000434d f 0x000041c9
|
||
0x000041c9 0x000041d2 00:0000 9 j 0x0000433b f 0x000041d2
|
||
0x000041d2 0x000041de 00:0000 12 j 0x00003bc8
|
||
0x000041de 0x00004200 00:0000 34 j 0x00005289 f 0x00004200
|
||
0x00004200 0x0000421f 00:0000 31 j 0x00003bc8
|
||
0x0000421f 0x00004233 00:0000 20 j 0x00003bc8
|
||
0x00004233 0x0000423f 00:0000 12 j 0x00003bc8
|
||
0x0000423f 0x0000424b 00:0000 12 j 0x00003bc8
|
||
0x0000424b 0x00004257 00:0000 12 j 0x00003bc8
|
||
0x00004257 0x00004266 00:0000 15 j 0x00003bc8
|
||
0x00004266 0x0000427c 00:0000 22 j 0x00003bc8
|
||
0x0000427c 0x0000428b 00:0000 15 j 0x00003bc8
|
||
0x0000428b 0x0000429a 00:0000 15 j 0x00003bc8
|
||
0x0000429a 0x000042ae 00:0000 20 j 0x00003bc8 f 0x000042ae
|
||
0x000042ae 0x000042eb 00:0000 61 j 0x000042eb
|
||
0x000042eb 0x000042ff 00:0000 20 j 0x00003bc8
|
||
0x000042ff 0x0000430e 00:0000 15 j 0x00003bc8
|
||
0x0000430e 0x0000431a 00:0000 12 j 0x00003bc8
|
||
0x0000431a 0x0000432c 00:0000 18 j 0x00004dd1 f 0x0000432c
|
||
0x0000432c 0x0000433b 00:0000 15 j 0x00003a48
|
||
0x0000433b 0x0000434d 00:0000 18 j 0x000041d2 f 0x0000434d
|
||
0x0000434d 0x00004364 00:0000 23 j 0x00003bc8
|
||
0x00004364 0x00004369 00:0000 5 j 0x00004369
|
||
0x00004369 0x0000437b 00:0000 18 j 0x00003bc8
|
||
0x0000437b 0x00004389 00:0000 14 j 0x0000499b f 0x00004389
|
||
0x00004389 0x000043c6 00:0000 61 j 0x000047f6 f 0x000043c6
|
||
0x000043c6 0x000043cf 00:0000 9 j 0x000047f6 f 0x000043cf
|
||
0x000043cf 0x000043d9 00:0000 10 j 0x000043df f 0x000043d9
|
||
0x000043d9 0x000043df 00:0000 6 j 0x000043f7 f 0x000043df
|
||
0x000043df 0x000043f7 00:0000 24 j 0x000043f7
|
||
0x000043f7 0x0000441c 00:0000 37 j 0x00004dba f 0x0000441c
|
||
0x0000441c 0x00004427 00:0000 11 j 0x0000445f f 0x00004427
|
||
0x00004427 0x0000443e 00:0000 23 j 0x0000445f f 0x0000443e
|
||
0x0000443e 0x00004440 00:0000 2 j 0x00004440
|
||
0x00004440 0x0000445f 00:0000 31 j 0x00004440 f 0x0000445f
|
||
0x0000445f 0x00004488 00:0000 41 j 0x0000449c f 0x00004488
|
||
0x00004488 0x00004495 00:0000 13 j 0x00004940 f 0x00004495
|
||
0x00004495 0x0000449c 00:0000 7 j 0x0000449c
|
||
0x0000449c 0x000044b0 00:0000 20 j 0x000044bb f 0x000044b0
|
||
0x000044b0 0x000044bb 00:0000 11 j 0x00004df3 f 0x000044bb
|
||
0x000044bb 0x000044bf 00:0000 4 j 0x00004502 f 0x000044bf
|
||
0x000044bf 0x000044c8 00:0000 9 j 0x00004e27 f 0x000044c8
|
||
0x000044c8 0x000044d1 00:0000 9 j 0x000044dc
|
||
0x000044d8 0x000044dc 00:0000 4 j 0x000044dc
|
||
0x000044dc 0x000044f4 00:0000 24 j 0x00004d03 f 0x000044f4
|
||
0x000044f4 0x00004502 00:0000 14 j 0x000044d8 f 0x00004502
|
||
0x00004502 0x00004516 00:0000 20 j 0x00004b81 f 0x00004516
|
||
0x00004516 0x00004523 00:0000 13 j 0x0000496a f 0x00004523
|
||
0x00004523 0x0000452c 00:0000 9 j 0x0000457b f 0x0000452c
|
||
0x0000452c 0x0000455d 00:0000 49 j 0x00005306 f 0x0000455d
|
||
0x0000455d 0x0000457b 00:0000 30 j 0x0000457b
|
||
0x0000457b 0x000045a4 00:0000 41 j 0x000045b1 f 0x000045a4
|
||
0x000045a4 0x000045b1 00:0000 13 j 0x000048e7 f 0x000045b1
|
||
0x000045b1 0x000045ba 00:0000 9 j 0x000045ba
|
||
0x000045ba 0x000045d4 00:0000 26 j 0x00004a84 f 0x000045d4
|
||
0x000045d4 0x000045e1 00:0000 13 j 0x00004a08 f 0x000045e1
|
||
0x000045e1 0x00004623 00:0000 66 j 0x00004841 f 0x00004623
|
||
0x00004623 0x00004628 00:0000 5 j 0x00004628
|
||
0x00004628 0x00004644 00:0000 28 j 0x00004628 f 0x00004644
|
||
0x00004644 0x00004652 00:0000 14 j 0x00004ac3 f 0x00004652
|
||
0x00004652 0x0000465f 00:0000 13 j 0x0000469c f 0x0000465f
|
||
0x0000465f 0x00004664 00:0000 5 j 0x00004ce3
|
||
0x00004668 0x00004695 00:0000 45 j 0x00004695
|
||
0x00004695 0x0000469c 00:0000 7 j 0x0000469c
|
||
0x0000469c 0x000046a5 00:0000 9 j 0x00004736 f 0x000046a5
|
||
0x000046a5 0x000046bf 00:0000 26 j 0x00004668 f 0x000046bf
|
||
0x000046bf 0x000046c4 00:0000 5 j 0x00004668 f 0x000046c4
|
||
0x000046c4 0x000046df 00:0000 27 j 0x000052a4 f 0x000046df
|
||
0x000046df 0x00004710 00:0000 49 j 0x000052c3 f 0x00004710
|
||
0x00004710 0x00004736 00:0000 38 j 0x00004695
|
||
0x00004736 0x0000473f 00:0000 9 j 0x0000474c f 0x0000473f
|
||
0x0000473f 0x0000474c 00:0000 13 j 0x0000486c f 0x0000474c
|
||
0x0000474c 0x00004759 00:0000 13 j 0x00004b2a f 0x00004759
|
||
0x00004759 0x00004765 00:0000 12 j 0x0000477e f 0x00004765
|
||
0x00004765 0x00004776 00:0000 17 j 0x000052e2 f 0x00004776
|
||
0x00004776 0x0000477e 00:0000 8 j 0x0000477e
|
||
0x0000477e 0x00004798 00:0000 26 j 0x00005301 f 0x00004798
|
||
0x00004798 0x000047a7 00:0000 15
|
||
0x000047a7 0x000047c2 00:0000 27 j 0x00003a48
|
||
0x000047c2 0x000047f6 00:0000 52 j 0x00003b0b
|
||
0x000047f6 0x000047fd 00:0000 7 j 0x000043f7
|
||
0x000047fd 0x0000480d 00:0000 16 j 0x00003b33 f 0x0000480d
|
||
0x0000480d 0x00004841 00:0000 52 j 0x00003b33
|
||
0x00004841 0x0000484e 00:0000 13 j 0x00004952 f 0x0000484e
|
||
0x0000484e 0x0000486c 00:0000 30 j 0x00004644
|
||
0x0000486c 0x00004876 00:0000 10 j 0x00004888 f 0x00004876
|
||
0x00004876 0x00004888 00:0000 18 j 0x00005015 f 0x00004888
|
||
0x00004888 0x000048a0 00:0000 24 j 0x000048a0
|
||
0x000048a0 0x000048bd 00:0000 29 j 0x000048cf f 0x000048bd
|
||
0x000048bd 0x000048c0 00:0000 3 j 0x000048c0
|
||
0x000048c0 0x000048cf 00:0000 15 j 0x000048c0 f 0x000048cf
|
||
0x000048cf 0x000048dd 00:0000 14 j 0x0000474c f 0x000048dd
|
||
0x000048dd 0x000048e7 00:0000 10 j 0x0000474c
|
||
0x000048e7 0x000048f4 00:0000 13 j 0x000045b1 f 0x000048f4
|
||
0x000048f4 0x00004901 00:0000 13 j 0x000045b1 f 0x00004901
|
||
0x00004901 0x0000491a 00:0000 25 j 0x000045ba f 0x0000491a
|
||
0x0000491a 0x00004927 00:0000 13 j 0x000045ba f 0x00004927
|
||
0x00004927 0x00004934 00:0000 13 j 0x000045ba f 0x00004934
|
||
0x00004934 0x00004940 00:0000 12 j 0x000045ba
|
||
0x00004940 0x0000494d 00:0000 13 j 0x000044bf f 0x0000494d
|
||
0x0000494d 0x00004952 00:0000 5 j 0x00004495
|
||
0x00004952 0x0000496a 00:0000 24 j 0x00004644
|
||
0x0000496a 0x00004978 00:0000 14 j 0x00004990 f 0x00004978
|
||
0x00004978 0x00004981 00:0000 9 j 0x00004990 f 0x00004981
|
||
0x00004981 0x00004990 00:0000 15 j 0x00004990
|
||
0x00004990 0x0000499b 00:0000 11 j 0x00004523
|
||
0x0000499b 0x000049c9 00:0000 46 j 0x000051d7 f 0x000049c9
|
||
0x000049c9 0x000049e3 00:0000 26 j 0x000049e3
|
||
0x000049e3 0x000049ee 00:0000 11 j 0x00004389 f 0x000049ee
|
||
0x000049ee 0x00004a08 00:0000 26 j 0x00004389
|
||
0x00004a08 0x00004a13 00:0000 11 j 0x00004a48
|
||
0x00004a18 0x00004a1d 00:0000 5 j 0x00004a55 f 0x00004a1d
|
||
0x00004a1d 0x00004a25 00:0000 8 j 0x00004a55 f 0x00004a25
|
||
0x00004a25 0x00004a2d 00:0000 8 j 0x00004a55 f 0x00004a2d
|
||
0x00004a2d 0x00004a32 00:0000 5 j 0x00004a55 f 0x00004a32
|
||
0x00004a32 0x00004a48 00:0000 22 j 0x00004a6a f 0x00004a48
|
||
0x00004a48 0x00004a4d 00:0000 5 j 0x00004a18 f 0x00004a4d
|
||
0x00004a4d 0x00004a55 00:0000 8 j 0x00004a25 f 0x00004a55
|
||
0x00004a55 0x00004a6a 00:0000 21 j 0x00004a48 f 0x00004a6a
|
||
0x00004a6a 0x00004a78 00:0000 14 j 0x00004e1b f 0x00004a78
|
||
0x00004a78 0x00004a84 00:0000 12 j 0x000045e1
|
||
0x00004a84 0x00004ac3 00:0000 63 j 0x000045d4
|
||
0x00004ac3 0x00004ad5 00:0000 18 j 0x00004e0a f 0x00004ad5
|
||
0x00004ad5 0x00004ae3 00:0000 14 j 0x00004652 f 0x00004ae3
|
||
0x00004ae3 0x00004af6 00:0000 19 j 0x00004736 f 0x00004af6
|
||
0x00004af6 0x00004b0b 00:0000 21 j 0x0000522c f 0x00004b0b
|
||
0x00004b0b 0x00004b16 00:0000 11 j 0x00004b16
|
||
0x00004b16 0x00004b2a 00:0000 20 j 0x0000469c
|
||
0x00004b2a 0x00004b81 00:0000 87 j 0x00004759
|
||
0x00004b81 0x00004b97 00:0000 22 j 0x00004ba0 f 0x00004b97
|
||
0x00004b97 0x00004ba0 00:0000 9 j 0x00004e9a f 0x00004ba0
|
||
0x00004ba0 0x00004bb1 00:0000 17 j 0x00004bba f 0x00004bb1
|
||
0x00004bb1 0x00004bba 00:0000 9 j 0x00004c52 f 0x00004bba
|
||
0x00004bba 0x00004bd0 00:0000 22 j 0x00004c4b f 0x00004bd0
|
||
0x00004bd0 0x00004bda 00:0000 10 j 0x00004c4b f 0x00004bda
|
||
0x00004bda 0x00004bef 00:0000 21 j 0x00004c03
|
||
0x00004bef 0x00004c03 00:0000 20 j 0x00004c03
|
||
0x00004c03 0x00004c11 00:0000 14 j 0x00004c45 f 0x00004c11
|
||
0x00004c11 0x00004c29 00:0000 24 j 0x00004bef f 0x00004c29
|
||
0x00004c29 0x00004c3d 00:0000 20 j 0x00004bef f 0x00004c3d
|
||
0x00004c3d 0x00004c45 00:0000 8 j 0x00004c52
|
||
0x00004c45 0x00004c4b 00:0000 6 j 0x00004c4b
|
||
0x00004c4b 0x00004c52 00:0000 7 j 0x00004c52
|
||
0x00004c52 0x00004c5f 00:0000 13 j 0x00004516 f 0x00004c5f
|
||
0x00004c5f 0x00004c6d 00:0000 14 j 0x00004ca3 f 0x00004c6d
|
||
0x00004c6d 0x00004c7b 00:0000 14 j 0x00004c84 f 0x00004c7b
|
||
0x00004c7b 0x00004c84 00:0000 9 j 0x00004ca3 f 0x00004c84
|
||
0x00004c84 0x00004c96 00:0000 18 j 0x00004516 f 0x00004c96
|
||
0x00004c96 0x00004ca3 00:0000 13 j 0x00004516 f 0x00004ca3
|
||
0x00004ca3 0x00004caf 00:0000 12 j 0x00004516
|
||
0x00004caf 0x00004ce3 00:0000 52 j 0x00003ba7
|
||
0x00004ce3 0x00004cec 00:0000 9 j 0x00004736 f 0x00004cec
|
||
0x00004cec 0x00004cf7 00:0000 11 j 0x0000469c f 0x00004cf7
|
||
0x00004cf7 0x00004d03 00:0000 12 j 0x0000469c
|
||
0x00004d03 0x00004d0d 00:0000 10 j 0x00004e4b f 0x00004d0d
|
||
0x00004d0d 0x00004d31 00:0000 36 j 0x000050c6 f 0x00004d31
|
||
0x00004d31 0x00004d3b 00:0000 10 j 0x000051f1 f 0x00004d3b
|
||
0x00004d3b 0x00004d41 00:0000 6 j 0x00005038 f 0x00004d41
|
||
0x00004d41 0x00004d4b 00:0000 10 j 0x0000520b f 0x00004d4b
|
||
0x00004d4b 0x00004d51 00:0000 6 j 0x00004d93 f 0x00004d51
|
||
0x00004d51 0x00004d5f 00:0000 14 j 0x00004d93 f 0x00004d5f
|
||
0x00004d5f 0x00004d93 00:0000 52 j 0x00004d93
|
||
0x00004d93 0x00004d9d 00:0000 10 j 0x00004502
|
||
0x00004d9d 0x00004dba 00:0000 29 j 0x00003c97
|
||
0x00004dba 0x00004dd1 00:0000 23 j 0x0000441c
|
||
0x00004dd1 0x00004df3 00:0000 34 j 0x00003a48
|
||
0x00004df3 0x00004dfb 00:0000 8 j 0x000044bf f 0x00004dfb
|
||
0x00004dfb 0x00004e0a 00:0000 15 j 0x00004502
|
||
0x00004e0a 0x00004e1b 00:0000 17 j 0x00004ad5
|
||
0x00004e1b 0x00004e27 00:0000 12 j 0x00004a78
|
||
0x00004e27 0x00004e3f 00:0000 24 j 0x000044c8 f 0x00004e3f
|
||
0x00004e3f 0x00004e4b 00:0000 12 j 0x00004d0d
|
||
0x00004e4b 0x00004e68 00:0000 29 j 0x0000505b f 0x00004e68
|
||
0x00004e68 0x00004e82 00:0000 26 j 0x00005257 f 0x00004e82
|
||
0x00004e82 0x00004e87 00:0000 5 j 0x00004e87
|
||
0x00004e87 0x00004e9a 00:0000 19 j 0x00004d93
|
||
0x00004e9a 0x00004eca 00:0000 48 j 0x00004eca
|
||
0x00004eca 0x00004edb 00:0000 17 j 0x00005063 f 0x00004edb
|
||
0x00004edb 0x00004ee4 00:0000 9 j 0x0000523b f 0x00004ee4
|
||
0x00004ee4 0x00004eec 00:0000 8 j 0x00005249 f 0x00004eec
|
||
0x00004eec 0x00004f06 00:0000 26 j 0x000050b1 f 0x00004f06
|
||
0x00004f06 0x00004f2a 00:0000 36 j 0x000050b1 f 0x00004f2a
|
||
0x00004f2a 0x00004f38 00:0000 14 j 0x00004f38
|
||
0x00004f38 0x00004f48 00:0000 16 j 0x000051a1 f 0x00004f48
|
||
0x00004f48 0x00004f55 00:0000 13 j 0x00004f38 f 0x00004f55
|
||
0x00004f55 0x00004f8d 00:0000 56 j 0x00004f8d
|
||
0x00004f8d 0x00004fc3 00:0000 54 j 0x00004fcf
|
||
0x00004fc3 0x00004fcf 00:0000 12 j 0x00004fcf
|
||
0x00004fcf 0x00004fd4 00:0000 5 j 0x00004fc3 f 0x00004fd4
|
||
0x00004fd4 0x00004fdb 00:0000 7 j 0x00004fdb
|
||
0x00004fdb 0x00004fe9 00:0000 14 j 0x00004c52 f 0x00004fe9
|
||
0x00004fe9 0x00005009 00:0000 32 j 0x00004c52 f 0x00005009
|
||
0x00005009 0x00005015 00:0000 12 j 0x00004c52
|
||
0x00005015 0x00005023 00:0000 14 j 0x00004888 f 0x00005023
|
||
0x00005023 0x00005033 00:0000 16 j 0x00004888 f 0x00005033
|
||
0x00005033 0x00005038 00:0000 5 j 0x000048a0
|
||
0x00005038 0x00005041 00:0000 9 j 0x00004d93 f 0x00005041
|
||
0x00005041 0x0000505b 00:0000 26 j 0x00004d93
|
||
0x0000505b 0x00005063 00:0000 8 j 0x00004e87
|
||
0x00005063 0x000050b1 00:0000 78 j 0x00005163 f 0x000050b1
|
||
0x000050b1 0x000050bf 00:0000 14 j 0x00004f8d
|
||
0x000050bf 0x000050c6 00:0000 7 j 0x000050c6
|
||
0x000050c6 0x00005112 00:0000 76 j 0x00005112
|
||
0x00005112 0x00005134 00:0000 34 j 0x00005112 f 0x00005134
|
||
0x00005134 0x00005159 00:0000 37 j 0x00005159
|
||
0x00005159 0x00005163 00:0000 10 j 0x00005163
|
||
0x00005163 0x0000517a 00:0000 23 j 0x000050b1 f 0x0000517a
|
||
0x0000517a 0x0000519c 00:0000 34 j 0x00004eca f 0x0000519c
|
||
0x0000519c 0x000051a1 00:0000 5 j 0x000050b1
|
||
0x000051a1 0x000051d2 00:0000 49 j 0x00004eca f 0x000051d2
|
||
0x000051d2 0x000051d7 00:0000 5 j 0x00004f55
|
||
0x000051d7 0x000051ec 00:0000 21 j 0x000049c9 f 0x000051ec
|
||
0x000051ec 0x000051f1 00:0000 5 j 0x000049e3
|
||
0x000051f1 0x0000520b 00:0000 26 j 0x00004d93
|
||
0x0000520b 0x0000522c 00:0000 33 j 0x00004d93
|
||
0x0000522c 0x0000523b 00:0000 15 j 0x00004b16
|
||
0x0000523b 0x00005249 00:0000 14 j 0x00004eca
|
||
0x00005249 0x00005257 00:0000 14 j 0x00004fdb
|
||
0x00005257 0x00005289 00:0000 50 j 0x00005289
|
||
0x00005289 0x000052a4 00:0000 27 j 0x000052a4
|
||
0x000052a4 0x000052c3 00:0000 31
|
||
0x000052c3 0x000052e2 00:0000 31
|
||
0x000052e2 0x00005301 00:0000 31
|
||
0x00005301 0x00005306 00:0000 5
|
||
0x00005306 0x0000533a 00:0000 52
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 main() jmptbl in bins/elf/analysis/ls-alxchk
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e asm.bytes=false
|
||
e analysis.jmp.tbl=true
|
||
s main
|
||
aF
|
||
pd 3 @ 0x3ec1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x00003ec1 add rax, rbx
|
||
| ;-- switch
|
||
| 0x00003ec4 jmp rax ; switch table (275 cases) at 0x172d8
|
||
| ; CODE XREF from main @ 0x3ec4
|
||
| ;-- case 110: ; from 0x3ec4
|
||
| 0x00003ec6 mov byte [0x00021260], 0x01 ; [0x21260:1]=0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aac pe trampoline fcn name 64bit
|
||
FILE=bins/pe/testx64.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e analysis.autoname=false
|
||
aac
|
||
pd 1 @ 0x140001970
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x140001970 e8d1040000 call sub.KERNEL32.dll_IsProcessorFeaturePresent ; BOOL IsProcessorFeaturePresent(DWORD ProcessorFeature)
|
||
EOF
|
||
RUN
|
||
|
||
NAME=block takeover
|
||
FILE=bins/elf/static-glibc-2.27
|
||
CMDS=<<EOF
|
||
e asm.comments=false
|
||
e asm.bytes=true
|
||
e asm.var=false
|
||
aac
|
||
pdr @ 0x00487350
|
||
s 0x0040f710
|
||
afvx
|
||
aei
|
||
aeim
|
||
ar rsi=0x1111111111111111
|
||
11ds
|
||
afvd
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00487350();
|
||
| 0x00487350 8b8710030000 mov eax, dword [rdi+0x310]
|
||
| 0x00487356 48b900000000. mov rcx, 0x200000000
|
||
| 0x00487360 8d50ff lea edx, qword [rax-0x01]
|
||
| 0x00487363 48b8ffffffff. mov rax, 0x3ffffffff
|
||
| 0x0048736d 899710030000 mov dword [rdi+0x310], edx
|
||
| 0x00487373 482387100300. and rax, qword [rdi+0x310]
|
||
| 0x0048737a 4839c8 cmp rax, rcx
|
||
| 0x0048737d 7411 jz 0x487390
|
||
| ----------- true: 0x00487390 false: 0x0048737f
|
||
| 0x0048737f f605d2542300. test byte [0x006bc858], 0x40
|
||
| 0x00487386 7525 jnz 0x4873ad
|
||
| ----------- true: 0x004873ad false: 0x00487388
|
||
| 0x00487388 f3c3 ret
|
||
|
||
| 0x00487390 8b05ea4d2300 mov eax, dword [0x006bc180]
|
||
| 0x00487396 85c0 test eax, eax
|
||
| 0x00487398 7426 jz 0x4873c0
|
||
| ----------- true: 0x004873c0 false: 0x0048739a
|
||
| 0x0048739a f605b7542300. test byte [0x006bc858], 0x40
|
||
| 0x004873a1 c705d54d2300. mov dword [0x006bc180], 0x02
|
||
| 0x004873ab 74db jz 0x487388
|
||
| ----------- true: 0x00487388 false: 0x004873ad
|
||
| 0x004873ad 488b7708 mov rsi, qword [rdi+0x08]
|
||
| 0x004873b1 488d3dd03502. lea rdi, qword str.closing_file__s__direct_opencount__u
|
||
| 0x004873b8 31c0 xor eax, eax
|
||
| 0x004873ba e9b16cffff jmp fcn.0047e070
|
||
| ----------- true: 0x0047e070
|
||
| 0x004873c0 400fb6f6 movzx esi, sil
|
||
\ 0x004873c4 e937f1ffff jmp fcn.00486500
|
||
| ----------- true: 0x00486500
|
||
afvR
|
||
var_118h 0x40f790,0x40f839
|
||
var_108h 0x40f7c1
|
||
var_110h 0x40f78c,0x40f835
|
||
var_11ch 0x40f86e
|
||
var_100h 0x40f7d4
|
||
var_111h 0x40f7a6
|
||
afvW
|
||
var_118h 0x40f728
|
||
var_108h 0x40f735
|
||
var_110h 0x40f79b,0x40f843
|
||
var_11ch 0x40f866
|
||
var_100h
|
||
var_111h
|
||
var var_118h = 0x00177fc0 = 0x1111111111111111 [LE]
|
||
var var_108h = 0x00177fd0 = 0x0000000000000000 [LE]
|
||
var var_110h = 0x00177fc8 = 0x0000000000000000 [LE]
|
||
var var_11ch = 0x00177fbc = 0x1111111100000000 [LE]
|
||
var var_100h = 0x00177fd8 = 0x0000000000000000 [LE]
|
||
var var_111h = 0x00177fc7 = 0x0000000000000011 [LE]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aaa with avra
|
||
FILE=bins/elf/class_test
|
||
CMDS=<<EOF
|
||
aaa
|
||
avra
|
||
EOF
|
||
EXPECT=<<EOF
|
||
Type Info at 0x08048f4c:
|
||
Type Info type: __vmi_class_type_info
|
||
Belongs to class vtable: 0x08048edc
|
||
Reference to RTTI's type class: 0x0804b140
|
||
Reference to type's name: 0x08048f6c
|
||
Type Name: Bat
|
||
Name unique: true
|
||
Flags: 0x0
|
||
Count of base classes: 0x2
|
||
Base class type descriptor address: 0x08048f74
|
||
Base class flags: 0x2
|
||
Base class type descriptor address: 0x08048fac
|
||
Base class flags: 0x402
|
||
|
||
Type Info at 0x08048f4c:
|
||
Type Info type: __vmi_class_type_info
|
||
Belongs to class vtable: 0x08048ef0
|
||
Reference to RTTI's type class: 0x0804b140
|
||
Reference to type's name: 0x08048f6c
|
||
Type Name: Bat
|
||
Name unique: true
|
||
Flags: 0x0
|
||
Count of base classes: 0x2
|
||
Base class type descriptor address: 0x08048f74
|
||
Base class flags: 0x2
|
||
Base class type descriptor address: 0x08048fac
|
||
Base class flags: 0x402
|
||
|
||
Type Info at 0x08048f74:
|
||
Type Info type: __class_type_info
|
||
Belongs to class vtable: 0x08048f04
|
||
Reference to RTTI's type class: 0x0804b048
|
||
Reference to type's name: 0x08048f7c
|
||
Type Name: Bird
|
||
Name unique: true
|
||
|
||
Type Info at 0x08048f84:
|
||
Type Info type: __si_class_type_info
|
||
Belongs to class vtable: 0x08048f18
|
||
Reference to RTTI's type class: 0x0804b114
|
||
Reference to type's name: 0x08048f90
|
||
Type Name: Dog
|
||
Name unique: true
|
||
Reference to parent's type info: 0x08048fac
|
||
|
||
Type Info at 0x08048f98:
|
||
Type Info type: __si_class_type_info
|
||
Belongs to class vtable: 0x08048f2c
|
||
Reference to RTTI's type class: 0x0804b114
|
||
Reference to type's name: 0x08048fa4
|
||
Type Name: Cat
|
||
Name unique: true
|
||
Reference to parent's type info: 0x08048fac
|
||
|
||
Type Info at 0x08048fac:
|
||
Type Info type: __class_type_info
|
||
Belongs to class vtable: 0x08048f40
|
||
Reference to RTTI's type class: 0x0804b048
|
||
Reference to type's name: 0x08048fb4
|
||
Type Name: Mammal
|
||
Name unique: true
|
||
|
||
EOF
|
||
RUN
|
||
|
||
NAME=sym is not fcn
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
aa > /dev/null
|
||
afl~sym.__mh_execute_header[0]
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
|
||
NAME=call-convention
|
||
FILE=bins/elf/analysis/x86-simple
|
||
CMDS=<<EOF
|
||
aa
|
||
s entry0
|
||
afc stdcall
|
||
afi~call-convention
|
||
EOF
|
||
EXPECT=<<EOF
|
||
call-convention: stdcall
|
||
EOF
|
||
RUN
|
||
|
||
NAME=function address
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=0
|
||
aa
|
||
afo @ sym._foo
|
||
afo @ sym._bar
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00001f50
|
||
0x00001f00
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afr
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=0
|
||
afr
|
||
afl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00001f00 4 73 sym._bar
|
||
0x00001f50 1 47 sym._foo
|
||
0x00001f80 1 41 main
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aF
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=0
|
||
aF
|
||
afl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00001f80 1 41 main
|
||
EOF
|
||
RUN
|
||
|
||
NAME=function prelude offsets
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
s 0x1000
|
||
aap
|
||
afl~[0]
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00001f00
|
||
0x00001f50
|
||
0x00001f80
|
||
EOF
|
||
RUN
|
||
|
||
NAME=function preludes symbol names
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
s 0x1000
|
||
aap
|
||
afl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00001f00 4 73 sym._bar
|
||
0x00001f50 1 47 sym._foo
|
||
0x00001f80 1 41 main
|
||
EOF
|
||
RUN
|
||
|
||
|
||
NAME=af-*
|
||
FILE=bins/elf/analysis/main
|
||
CMDS=<<EOF
|
||
aa
|
||
af-*
|
||
afl
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=iS. and iSj. implementation
|
||
FILE=bins/elf/lab1B
|
||
CMDS=<<EOF
|
||
s 0x188
|
||
iS.
|
||
s 0x08058000
|
||
iS.
|
||
s 0x760
|
||
iS.j
|
||
EOF
|
||
EXPECT=<<EOF
|
||
paddr size vaddr vsize align perm name type flags
|
||
--------------------------------------------------------------------------
|
||
0x00000188 0x24 0x08048188 0x24 0x0 -r-- .note.gnu.build-id NOTE alloc
|
||
paddr size vaddr vsize align perm name type flags
|
||
--------------------------------------------------
|
||
[{"name":".plt","size":240,"vsize":240,"perm":"-r-x","type":"PLT","flags":["alloc","execute"],"paddr":1888,"vaddr":134514528}]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=iE and iE. implementation
|
||
FILE=bins/elf/lab1B
|
||
CMDS=<<EOF
|
||
s 0x080489b9
|
||
iE.
|
||
s 0x080489a6
|
||
sd +5
|
||
is.j
|
||
EOF
|
||
EXPECT=<<EOF
|
||
nth paddr vaddr bind type size lib name
|
||
-------------------------------------------------------
|
||
22 0x000009b7 0x080489b7 GLOBAL FUNC 189 decrypt
|
||
[{"name":"prog_timeout","flagname":"sym.prog_timeout","realname":"prog_timeout","ordinal":35,"bind":"GLOBAL","size":17,"type":"FUNC","vaddr":134515110,"paddr":2470,"is_imported":false,"lib":""}]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=address information
|
||
FILE=bins/mach0/mach0-i386
|
||
CMDS=<<EOF
|
||
s entry0
|
||
ai
|
||
s sym.__mh_execute_header
|
||
ai
|
||
EOF
|
||
EXPECT=<<EOF
|
||
exec
|
||
read
|
||
flag
|
||
exec
|
||
read
|
||
flag
|
||
EOF
|
||
RUN
|
||
|
||
NAME=af x86-64
|
||
FILE=malloc://16
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx 662e0f1f840000000000
|
||
ao 1~size[1]
|
||
EOF
|
||
EXPECT=<<EOF
|
||
10
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis/fcn_name
|
||
FILE=bins/elf/analysis/main-g
|
||
CMDS=<<EOF
|
||
s 0x0040042c
|
||
af
|
||
pd 1~sym.call_gmon_start:0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ sym.call_gmon_start();
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis/fcn_subname
|
||
FILE=bins/elf/analysis/main-g
|
||
CMDS=<<EOF
|
||
s 0x0040042c
|
||
af
|
||
afi~name
|
||
pd 1~sym.call_gmon_start:0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
name: sym.call_gmon_start
|
||
/ sym.call_gmon_start();
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis/name
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
af
|
||
afi~name
|
||
EOF
|
||
EXPECT=<<EOF
|
||
name: main
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis hasnext on main
|
||
FILE=bins/elf/true32
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=true
|
||
af @ main
|
||
afi @ main~size
|
||
EOF
|
||
EXPECT=<<EOF
|
||
size: 261
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis without hasnext on main
|
||
FILE=bins/elf/true32
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=false
|
||
af @ main
|
||
afi @ main~size
|
||
EOF
|
||
EXPECT=<<EOF
|
||
size: 261
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ahe
|
||
FILE=malloc://512
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
ao~esil
|
||
ahe test
|
||
ao~esil
|
||
EOF
|
||
EXPECT=<<EOF
|
||
esil: al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=
|
||
esil: test
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ahe2
|
||
FILE=malloc://512
|
||
CMDS=<<EOF
|
||
ahe test
|
||
ao~^esil
|
||
EOF
|
||
EXPECT=<<EOF
|
||
esil: test
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ahe 33,rax,=
|
||
FILE=malloc://512
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx 000000
|
||
ahe 33,rax,=
|
||
aes
|
||
ar rax
|
||
EOF
|
||
EXPECT=<<EOF
|
||
rax = 0x0000000000000021
|
||
EOF
|
||
RUN
|
||
|
||
NAME=delete memory format with Cf-
|
||
FILE=bins/dmg/src/Hello
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
pd 1
|
||
Cf 1 x4
|
||
pd 1
|
||
Cf-
|
||
pd 1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000000 57 push rdi
|
||
0x00000000 pf x4 # size=1
|
||
0x00000000 = 0x6c726f57 [LE]
|
||
0x00000000 57 push rdi
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reflines offset 2 (ascii)
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e analysis.jmp.cref=true
|
||
e asm.sub.rel=false
|
||
e asm.bytes=false
|
||
e asm.hint.lea=false
|
||
e scr.utf8=false
|
||
e scr.color=false
|
||
s $S
|
||
aaa >/dev/null
|
||
s 0x000113bd
|
||
pd 28
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| ,=< 0x000113bd jz 0x1144e
|
||
| | 0x000113c3 mov esi, 0x2f ; '/' ; int c
|
||
| | 0x000113c8 call sym.imp.strrchr ; char *strrchr(const char *s, int c)
|
||
| | 0x000113cd test rax, rax
|
||
| ,==< 0x000113d0 jz 0x11424
|
||
| || 0x000113d2 lea rdx, qword [rax+0x01]
|
||
| || 0x000113d6 mov rcx, rdx
|
||
| || 0x000113d9 sub rcx, rbx
|
||
| || 0x000113dc cmp rcx, 0x06
|
||
| ,===< 0x000113e0 jle 0x11424
|
||
| ||| 0x000113e2 lea rsi, qword [rax-0x06]
|
||
| ||| 0x000113e6 mov ecx, 0x07
|
||
| ||| 0x000113eb lea rdi, qword [rip+0x7ebb] ; str..libs
|
||
| ||| ; 0x192ad ; "/.libs/"
|
||
| ||| 0x000113f2 repe cmpsb
|
||
| ,====< 0x000113f4 jnz 0x11424
|
||
| |||| 0x000113f6 mov ecx, 0x03
|
||
| |||| 0x000113fb mov rsi, rdx
|
||
| |||| 0x000113fe mov rbx, rdx
|
||
| |||| 0x00011401 lea rdi, qword [rip+0x7ead] ; data.000192b5
|
||
| |||| ; 0x192b5 ; "lt-"
|
||
| |||| 0x00011408 repe cmpsb
|
||
| |||| 0x0001140a setnbe sil
|
||
| |||| 0x0001140e setb cl
|
||
| |||| 0x00011411 cmp sil, cl
|
||
| ,=====< 0x00011414 jnz 0x11424
|
||
| ||||| 0x00011416 lea rbx, qword [rax+0x04]
|
||
| ||||| 0x0001141a mov rax, qword [rip+0xdeaf] ; reloc.program_invocation_short_name
|
||
| ||||| ; [0x1f2d0:8]=0x21ba0 reloc.target.program_invocation_short_name
|
||
| ||||| 0x00011421 mov qword [rax], rbx
|
||
| ||||| ; CODE XREFS from fcn.00011390 @ 0x113d0, 0x113e0, 0x113f4, 0x11414
|
||
| ````--> 0x00011424 mov rax, qword [rip+0xde3d] ; data.0001f268
|
||
| | ; [0x1f268:8]=0x21680
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reflines offset 3 (ascii)
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e analysis.jmp.cref=true
|
||
e asm.sub.rel=false
|
||
e asm.bytes=false
|
||
e asm.hint.lea=false
|
||
e scr.utf8=false
|
||
e scr.color=false
|
||
s $S
|
||
aaa >/dev/null
|
||
s 0x00003ca6
|
||
pd 19
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x00003ca6 cmp eax, 0x02
|
||
| ,=< 0x00003ca9 jz 0x45ec
|
||
| | 0x00003caf cmp eax, 0x03
|
||
| ,==< 0x00003cb2 jz 0x3ce3
|
||
| || 0x00003cb4 sub eax, 0x01
|
||
| ,===< 0x00003cb7 jz 0x3cbe
|
||
| ||| ; CODE XREFS from main @ 0x58bc, 0x58d2
|
||
| ||| ;-- default: ; from 0x58d2
|
||
| ||| 0x00003cb9 call sym.imp.abort ; void abort(void)
|
||
| ||| ; CODE XREF from main @ 0x3cb7
|
||
| `---> 0x00003cbe mov edi, 0x01 ; int fd
|
||
| || 0x00003cc3 call sym.imp.isatty ; int isatty(int fd)
|
||
| || 0x00003cc8 test eax, eax
|
||
| ,===< 0x00003cca jz 0x4c2e
|
||
| ||| 0x00003cd0 mov dword [rip+0x1d626], 0x02 ; data.00021300
|
||
| ||| ; [0x21300:4]=0
|
||
| ||| 0x00003cda mov byte [rip+0x1d33f], 0x01 ; data.00021020
|
||
| ||| ; [0x21020:1]=0
|
||
| ,====< 0x00003ce1 jmp 0x3cf9
|
||
| |||| ; CODE XREF from main @ 0x3cb2
|
||
| ||`--> 0x00003ce3 mov esi, 0x05 ; int64_t arg2
|
||
| || | 0x00003ce8 xor edi, edi ; int64_t arg1
|
||
| || | 0x00003cea mov dword [rip+0x1d60c], 0x00 ; data.00021300
|
||
| || | ; [0x21300:4]=0
|
||
| || | 0x00003cf4 call fcn.00012740
|
||
| || | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38
|
||
| `----> 0x00003cf9 lea rdi, qword [rip+0x14fb4] ; str.QUOTING_STYLE
|
||
| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reflines offset 3 (ascii + wide)
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e analysis.jmp.cref=true
|
||
e asm.sub.rel=false
|
||
e asm.bytes=false
|
||
e asm.hint.lea=false
|
||
e scr.utf8=false
|
||
e scr.color=false
|
||
e asm.lines.wide=true
|
||
s $S
|
||
aaa >/dev/null
|
||
s 0x00003ca6
|
||
pd 19
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x00003ca6 cmp eax, 0x02
|
||
| ,==< 0x00003ca9 jz 0x45ec
|
||
| | 0x00003caf cmp eax, 0x03
|
||
| ,====< 0x00003cb2 jz 0x3ce3
|
||
| | | 0x00003cb4 sub eax, 0x01
|
||
| ,======< 0x00003cb7 jz 0x3cbe
|
||
| | | | ; CODE XREFS from main @ 0x58bc, 0x58d2
|
||
| | | | ;-- default: ; from 0x58d2
|
||
| | | | 0x00003cb9 call sym.imp.abort ; void abort(void)
|
||
| | | | ; CODE XREF from main @ 0x3cb7
|
||
| `------> 0x00003cbe mov edi, 0x01 ; int fd
|
||
| | | 0x00003cc3 call sym.imp.isatty ; int isatty(int fd)
|
||
| | | 0x00003cc8 test eax, eax
|
||
| ,======< 0x00003cca jz 0x4c2e
|
||
| | | | 0x00003cd0 mov dword [rip+0x1d626], 0x02 ; data.00021300
|
||
| | | | ; [0x21300:4]=0
|
||
| | | | 0x00003cda mov byte [rip+0x1d33f], 0x01 ; data.00021020
|
||
| | | | ; [0x21020:1]=0
|
||
| ========< 0x00003ce1 jmp 0x3cf9
|
||
| | | | ; CODE XREF from main @ 0x3cb2
|
||
| | `----> 0x00003ce3 mov esi, 0x05 ; int64_t arg2
|
||
| | | 0x00003ce8 xor edi, edi ; int64_t arg1
|
||
| | | 0x00003cea mov dword [rip+0x1d60c], 0x00 ; data.00021300
|
||
| | | ; [0x21300:4]=0
|
||
| | | 0x00003cf4 call fcn.00012740
|
||
| | | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38
|
||
| --------> 0x00003cf9 lea rdi, qword [rip+0x14fb4] ; str.QUOTING_STYLE
|
||
| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reflines offset 4 (ascii + wide)
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e analysis.jmp.cref=true
|
||
e asm.sub.rel=false
|
||
e asm.bytes=false
|
||
e asm.hint.lea=false
|
||
e scr.utf8=false
|
||
e scr.color=false
|
||
e asm.lines.wide=true
|
||
aaa >/dev/null
|
||
s 0x00003ca6
|
||
pd 19
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x00003ca6 cmp eax, 0x02
|
||
| ,==< 0x00003ca9 jz 0x45ec
|
||
| | 0x00003caf cmp eax, 0x03
|
||
| ,====< 0x00003cb2 jz 0x3ce3
|
||
| | | 0x00003cb4 sub eax, 0x01
|
||
| ,======< 0x00003cb7 jz 0x3cbe
|
||
| | | | ; CODE XREFS from main @ 0x58bc, 0x58d2
|
||
| | | | ;-- default: ; from 0x58d2
|
||
| | | | 0x00003cb9 call sym.imp.abort ; void abort(void)
|
||
| | | | ; CODE XREF from main @ 0x3cb7
|
||
| `------> 0x00003cbe mov edi, 0x01 ; int fd
|
||
| | | 0x00003cc3 call sym.imp.isatty ; int isatty(int fd)
|
||
| | | 0x00003cc8 test eax, eax
|
||
| ,======< 0x00003cca jz 0x4c2e
|
||
| | | | 0x00003cd0 mov dword [rip+0x1d626], 0x02 ; data.00021300
|
||
| | | | ; [0x21300:4]=0
|
||
| | | | 0x00003cda mov byte [rip+0x1d33f], 0x01 ; data.00021020
|
||
| | | | ; [0x21020:1]=0
|
||
| ========< 0x00003ce1 jmp 0x3cf9
|
||
| | | | ; CODE XREF from main @ 0x3cb2
|
||
| | `----> 0x00003ce3 mov esi, 0x05 ; int64_t arg2
|
||
| | | 0x00003ce8 xor edi, edi ; int64_t arg1
|
||
| | | 0x00003cea mov dword [rip+0x1d60c], 0x00 ; data.00021300
|
||
| | | ; [0x21300:4]=0
|
||
| | | 0x00003cf4 call fcn.00012740
|
||
| | | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38
|
||
| --------> 0x00003cf9 lea rdi, qword [rip+0x14fb4] ; str.QUOTING_STYLE
|
||
| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reflines in noreturn
|
||
FILE=bins/elf/analysis/ls-alxchk
|
||
CMDS=<<EOF
|
||
e asm.sub.rel=false
|
||
e asm.bytes=false
|
||
e asm.hint.lea=false
|
||
e scr.utf8=false
|
||
e scr.color=false
|
||
e asm.lines.wide=true
|
||
e asm.comments=0
|
||
aaa >/dev/null
|
||
s 0x00012740
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00012740(int64_t arg1, int64_t arg2);
|
||
| ; arg int64_t arg1 @ rdi
|
||
| ; arg int64_t arg2 @ rsi
|
||
| ; var int64_t var_10h @ stack - 0x10
|
||
| 0x00012740 push rbp
|
||
| 0x00012741 mov rbp, rsp
|
||
| 0x00012744 sub rsp, 0x1030
|
||
| 0x0001274b or qword [rsp], 0x00
|
||
| 0x00012750 add rsp, 0x1020
|
||
| 0x00012757 mov rax, qword fs:[0x28]
|
||
| 0x00012760 mov qword [var_10h], rax
|
||
| 0x00012764 xor eax, eax
|
||
| 0x00012766 lea rax, qword [rip+0xf033]
|
||
| 0x0001276d test rdi, rdi
|
||
| 0x00012770 cmovnz rax, rdi
|
||
| 0x00012774 mov dword [rax], esi
|
||
| 0x00012776 mov rax, qword [var_10h]
|
||
| 0x0001277a xor rax, qword fs:[0x28]
|
||
| ,==< 0x00012783 jnz 0x12787
|
||
| | 0x00012785 leave
|
||
| | 0x00012786 ret
|
||
\ `--> 0x00012787 call sym.imp.__stack_chk_fail
|
||
EOF
|
||
RUN
|
||
|
||
NAME=⁝ and XREF cmt
|
||
FILE=bins/elf/strenc-ctrlchars
|
||
CMDS=<<EOF
|
||
e scr.utf8=true
|
||
e asm.bytes=false
|
||
s main
|
||
af
|
||
s sym.imp.puts
|
||
echo
|
||
pd 3
|
||
EOF
|
||
EXPECT=<<EOF
|
||
|
||
╎ ; CALL XREF from main @ 0x400406
|
||
┌ int sym.imp.puts(const char *s);
|
||
└ ╎ 0x004003f0 jmp qword [reloc.puts] ; [0x601018:8]=0x4003f6
|
||
╎ 0x004003f6 push 0x00
|
||
└─< 0x004003fb jmp sym..plt
|
||
EOF
|
||
RUN
|
||
|
||
NAME=stackptr
|
||
FILE=bins/mach0/mac-ls
|
||
CMDS=<<EOF
|
||
s 0x1000039b6
|
||
af
|
||
e asm.lines.bb=false
|
||
e asm.lines.fcn=false
|
||
e asm.stackptr=true
|
||
e asm.comments=false
|
||
pdr~0x100003b27
|
||
pdf~0x100003b27
|
||
pdr~0x100003b3d
|
||
pdr~0x100003b3e
|
||
pdr~0x100003b40
|
||
pdr~0x100003b42
|
||
pdr~0x100003b44
|
||
pdr~0x100003b46
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x100003b27 -104 add rsi, 0x0c
|
||
0x100003b27 -104 add rsi, 0x0c
|
||
0x100003b3d -48 += 8 pop rbx
|
||
0x100003b3e -40 += 8 pop r12
|
||
0x100003b40 -32 += 8 pop r13
|
||
0x100003b42 -24 += 8 pop r14
|
||
0x100003b44 -16 += 8 pop r15
|
||
0x100003b46 -8 += 8 pop rbp
|
||
EOF
|
||
RUN
|
||
|
||
NAME=auto string memory reference (iopa)
|
||
FILE=malloc://8096
|
||
CMDS=<<EOF
|
||
e asm.sub.rel=false
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e scr.color=false
|
||
e io.va=0
|
||
e asm.lines.bb=0
|
||
e asm.bytes=0
|
||
e asm.cmt.right=10
|
||
wx 488b3541100000
|
||
wv8 0x500 @ 0x1048
|
||
w Hello @ 0x500
|
||
pd 1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; [0x1048:8]=0x500 "Hello"
|
||
0x00000000 mov rsi, qword [rip+0x1041]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=auto string memory reference (io.va)
|
||
FILE=malloc://8096
|
||
CMDS=<<EOF
|
||
e asm.sub.rel=false
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e scr.color=false
|
||
e io.va=1
|
||
e asm.lines.bb=0
|
||
e asm.bytes=0
|
||
e asm.cmt.right=10
|
||
wx 488b3541100000
|
||
wv8 0x500 @ 0x1048
|
||
w Hello @ 0x500
|
||
pd 1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; [0x1048:8]=0x500 "Hello"
|
||
0x00000000 mov rsi, qword [rip+0x1041]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Basic type Matching
|
||
FILE=bins/elf/analysis/x86-helloworld-gcc
|
||
CMDS=<<EOF
|
||
s sym.main
|
||
aa
|
||
aei
|
||
aeim
|
||
td int puts(char *s);
|
||
aft
|
||
s 0x08048409
|
||
pd 1~char *s?
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Mixed reg/stack callee arguments type matching
|
||
FILE=bins/pe/testapp-msvc64.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
s 0x14000b54c
|
||
aei
|
||
aeim
|
||
af
|
||
aft
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
;-- rip:
|
||
/ fcn.14000b54c();
|
||
| ; var DWORD dwCreationDisposition @ stack - 0x28
|
||
| ; var DWORD dwFlagsAndAttributes @ stack - 0x20
|
||
| ; var HANDLE hTemplateFile @ stack - 0x18
|
||
| 0x14000b54c 4883ec48 sub rsp, 0x48
|
||
| 0x14000b550 488364243000 and qword [hTemplateFile], 0x00 ; HANDLE hTemplateFile
|
||
| 0x14000b556 488d0da37300. lea rcx, qword str.CONOUT ; 0x140012900 ; u"CONOUT$" ; LPCWSTR lpFileName
|
||
| 0x14000b55d 8364242800 and dword [dwFlagsAndAttributes], 0x00 ; DWORD dwFlagsAndAttributes
|
||
| 0x14000b562 41b803000000 mov r8d, 0x03 ; DWORD dwShareMode
|
||
| 0x14000b568 4533c9 xor r9d, r9d ; LPSECURITY_ATTRIBUTES lpSecurityAttributes
|
||
| 0x14000b56b 4489442420 mov dword [dwCreationDisposition], r8d ; DWORD dwCreationDisposition
|
||
| 0x14000b570 ba00000040 mov edx, 0x40000000 ; DWORD dwDesiredAccess
|
||
| 0x14000b575 ff158d1c0000 call qword [sym.imp.KERNEL32.dll_CreateFileW] ; [0x14000d208:8]=0x1579e ; HANDLE CreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
|
||
| 0x14000b57b 4889057eb400. mov qword [0x140016a00], rax ; [0x140016a00:8]=-2
|
||
| 0x14000b582 4883c448 add rsp, 0x48
|
||
\ 0x14000b586 c3 ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=call not function
|
||
FILE=bins/pe/crackme0x00.exe
|
||
CMDS=<<EOF
|
||
aa
|
||
s sym._main
|
||
aei
|
||
aeim
|
||
td "int strcmp(char *s1, char *s2);"
|
||
tfc strcmp stdcall
|
||
aft
|
||
s 0x00401370
|
||
pd 1~char *s1?
|
||
s 0x00401368
|
||
pd 1~char *s2?
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Settings global calling convention
|
||
FILE=bins/pe/msvcfindmain.exe
|
||
CMDS=<<EOF
|
||
e analysis.cc=pascal
|
||
aaa
|
||
afi @@F~?pascal
|
||
EOF
|
||
EXPECT=<<EOF
|
||
65
|
||
EOF
|
||
RUN
|
||
|
||
NAME=1: Wrong calling convention
|
||
FILE=bins/pe/crackme0x00.exe
|
||
CMDS=<<EOF
|
||
s entry0
|
||
af
|
||
td "int CRTStartup(int who_cares);"
|
||
tfc CRTStartup THE_CC_THAT_NEVER_EXISTED
|
||
aei
|
||
aeim
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=2: Wrong calling convention
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
s entry0
|
||
aaa
|
||
Ct. @ 0x100001413
|
||
Ct. @ 0x10000145b
|
||
Ct. @ 0x100001460
|
||
EOF
|
||
EXPECT=<<EOF
|
||
int category
|
||
int fd
|
||
unsigned long request
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Function definition (autorename)
|
||
FILE=bins/pe/hello-mingw32
|
||
CMDS=<<EOF
|
||
aaa
|
||
s 0x00401255
|
||
pd 1~?ExitProcess\(UINT
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Function definition indirect calls
|
||
FILE=bins/pe/msvcfindmain.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
pd 1 @ 0x004012c0 ~?dword
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Function definition
|
||
FILE=bins/elf/ioli/crackme0x00
|
||
CMDS=<<EOF
|
||
aaa
|
||
s 0x08048469
|
||
pd 1~?strcmp\(const
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvt
|
||
FILE=bins/mach0/arg
|
||
CMDS=<<EOF
|
||
s sym._call
|
||
af
|
||
afvl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_1ch @ stack - 0x1c
|
||
var int64_t var_18h @ stack - 0x18
|
||
var int64_t var_10h @ stack - 0x10
|
||
arg int64_t arg1 @ rdi
|
||
arg int64_t arg2 @ rsi
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvt
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvt var_30h char
|
||
afvl~var_30h
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var char var_30h @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvn
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvn mylocal var_30h
|
||
afvl~mylocal
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var int64_t mylocal @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvn + afvn
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvn mylocal var_30h
|
||
afvn var_30h mylocal
|
||
afvl~var_30h
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var int64_t var_30h @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvt + afvn
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvn mylocal var_30h
|
||
afvt mylocal char
|
||
afvl~mylocal
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var char mylocal @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvn + afvt
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvt var_30h char
|
||
afvn mylocal var_30h
|
||
afvl~mylocal
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var char mylocal @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvt + afvt
|
||
FILE=bins/mach0/macho
|
||
CMDS=<<EOF
|
||
s 0x100000b60
|
||
af
|
||
afvl~var_30h
|
||
afvt var_30h char
|
||
afvt var_30h int
|
||
afvl~var_30h
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t var_30h @ stack - 0x30
|
||
var int var_30h @ stack - 0x30
|
||
EOF
|
||
RUN
|
||
|
||
|
||
NAME=afva for fastcall with no esp vars
|
||
FILE=bins/elf/analysis/fast
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
aa
|
||
s sym.fastcaslled
|
||
afc fastcall
|
||
afc
|
||
afva
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
fastcall
|
||
; CALL XREF from main @ 0x80484c7
|
||
/ sym.fastcaslled(int32_t arg1, int32_t arg2, int32_t arg_4h, int32_t arg_8h);
|
||
| ; arg int32_t arg1 @ ecx
|
||
| ; arg int32_t arg2 @ edx
|
||
| ; var int32_t var_24h @ stack - 0x24
|
||
| ; var int32_t var_20h @ stack - 0x20
|
||
| ; var int32_t var_14h @ stack - 0x14
|
||
| ; var int32_t var_10h @ stack - 0x10
|
||
| ; arg int32_t arg_4h @ stack + 0x4
|
||
| ; arg int32_t arg_8h @ stack + 0x8
|
||
| 0x0804841b 55 push ebp
|
||
| 0x0804841c 89e5 mov ebp, esp
|
||
| 0x0804841e 83ec28 sub esp, 0x28
|
||
| 0x08048421 894de4 mov dword [var_20h], ecx ; arg1
|
||
| 0x08048424 8955e0 mov dword [var_24h], edx ; arg2
|
||
| 0x08048427 8b55e4 mov edx, dword [var_20h]
|
||
| 0x0804842a 8b45e0 mov eax, dword [var_24h]
|
||
| 0x0804842d 01d0 add eax, edx
|
||
| 0x0804842f 8945f4 mov dword [var_10h], eax
|
||
| 0x08048432 8b45e0 mov eax, dword [var_24h]
|
||
| 0x08048435 2b450c sub eax, dword [arg_8h]
|
||
| 0x08048438 8945f0 mov dword [var_14h], eax
|
||
| 0x0804843b ff7508 push dword [arg_4h]
|
||
| 0x0804843e ff75f0 push dword [var_14h]
|
||
| 0x08048441 ff75f4 push dword [var_10h]
|
||
| 0x08048444 6874850408 push str.i__i__i ; 0x8048574 ; "%i %i %i\n"
|
||
| 0x08048449 e8a2feffff call sym.imp.printf ; int printf(const char *format)
|
||
| 0x0804844e 83c410 add esp, 0x10
|
||
| 0x08048451 90 nop
|
||
| 0x08048452 c9 leave
|
||
\ 0x08048453 c20800 ret 0x08
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afva for cdecl/stdcall with no esp vars
|
||
FILE=bins/elf/analysis/fast
|
||
CMDS=<<EOF
|
||
e asm.calls=false
|
||
e asm.bytes=true
|
||
aa
|
||
s sym.nonfastcaslled
|
||
afc
|
||
afva
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
cdecl
|
||
; CALL XREF from main @ 0x80484db
|
||
/ sym.nonfastcaslled(int32_t arg_4h, int32_t arg_8h, int32_t arg_ch, int32_t arg_10h);
|
||
| ; var int32_t var_14h @ stack - 0x14
|
||
| ; var int32_t var_10h @ stack - 0x10
|
||
| ; arg int32_t arg_4h @ stack + 0x4
|
||
| ; arg int32_t arg_8h @ stack + 0x8
|
||
| ; arg int32_t arg_ch @ stack + 0xc
|
||
| ; arg int32_t arg_10h @ stack + 0x10
|
||
| 0x08048456 55 push ebp
|
||
| 0x08048457 89e5 mov ebp, esp
|
||
| 0x08048459 83ec18 sub esp, 0x18
|
||
| 0x0804845c 8b5508 mov edx, dword [arg_4h]
|
||
| 0x0804845f 8b450c mov eax, dword [arg_8h]
|
||
| 0x08048462 01d0 add eax, edx
|
||
| 0x08048464 8945f4 mov dword [var_10h], eax
|
||
| 0x08048467 8b450c mov eax, dword [arg_8h]
|
||
| 0x0804846a 2b4514 sub eax, dword [arg_10h]
|
||
| 0x0804846d 8945f0 mov dword [var_14h], eax
|
||
| 0x08048470 ff7510 push dword [arg_ch]
|
||
| 0x08048473 ff75f0 push dword [var_14h]
|
||
| 0x08048476 ff75f4 push dword [var_10h]
|
||
| 0x08048479 6874850408 push str.i__i__i ; 0x8048574 ; "%i %i %i\n"
|
||
| 0x0804847e e86dfeffff call sym.imp.printf
|
||
| 0x08048483 83c410 add esp, 0x10
|
||
| 0x08048486 90 nop
|
||
| 0x08048487 c9 leave
|
||
\ 0x08048488 c3 ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis vars crash
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
af
|
||
afvr-*
|
||
afvr-*
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=analysis vars crash 2
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.arch=x86
|
||
e asm.calls=false
|
||
wx 554889e5534881ec3810000048830c24004881c42010000064488b042528000000488945e831c04885ff4889fb909090909090c3 @ 10
|
||
aa
|
||
afvn new_1 old_1
|
||
afvn my_local var_20h
|
||
pd 1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00000000(int64_t arg1);
|
||
| ; arg int64_t arg1 @ rdi
|
||
| ; var int64_t my_local @ stack - 0x20
|
||
| 0x00000000 0000 add byte [rax], al
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvs & afvn
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
af
|
||
afvn ImageHandle arg_4h
|
||
afvn SystemTable arg_8h
|
||
afvs~?ImageHandle
|
||
afvs~?SystemTable
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvs idx... & afvn
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
td "typedef void * EFI_HANDLE;"
|
||
af
|
||
afvs -0x10 ImageHandle EFI_HANDLE @ 0x10002d8d
|
||
afvs~ImageHandle
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var EFI_HANDLE ImageHandle @ stack - 0x10
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvsj
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
td "typedef void * EFI_HANDLE;"
|
||
af
|
||
afvs -0x10 ImageHandle EFI_HANDLE @ 0x10002d8d
|
||
afvsj~?ImageHandle
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvs- ArgName
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
td "typedef void * EFI_HANDLE;"
|
||
af
|
||
afvs -0x10 ImageHandle blah @ 0x10002d8d
|
||
afvs- ImageHandle
|
||
afvs~?ImageHandle
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvr & afvn
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
af
|
||
afvr esi myreg int @ 0x10002d8d
|
||
afvr~?myreg
|
||
afvn blah myreg
|
||
afvr~?blah
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvr idx & afvr*
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
af
|
||
afvr esi myreg int @ 0x10002d8d
|
||
afvr~?myreg
|
||
afvr~?int
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvr- name
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
af
|
||
afvr esi myreg int @ 0x10002d8d
|
||
afvr- myreg
|
||
afvr~?myreg
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvs-* afvr-*
|
||
FILE=bins/efi/bootia32.efi
|
||
CMDS=<<EOF
|
||
af
|
||
afvs-*
|
||
afvr-*
|
||
afvs~?
|
||
afvr~?
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0
|
||
0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis vars count
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
af
|
||
afvs~?
|
||
EOF
|
||
EXPECT=<<EOF
|
||
13
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis vars retype
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
af
|
||
afvt var_38h char
|
||
afvs~_38h
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var char var_38h @ stack - 0x38
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis vars rename
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
af
|
||
afvn newname var_38h
|
||
afvs~newname
|
||
EOF
|
||
EXPECT=<<EOF
|
||
var int64_t newname @ stack - 0x38
|
||
EOF
|
||
RUN
|
||
|
||
NAME=vars display in debugger
|
||
FILE=bins/elf/analysis/fast
|
||
CMDS=<<EOF
|
||
aa
|
||
s 0x0804843b
|
||
afvd arg_8h
|
||
afvd var_14h
|
||
EOF
|
||
EXPECT=<<EOF
|
||
arg arg_8h = 0x0000000c = -1 [LE]
|
||
var var_14h = 0xfffffffffffffff0 = -1 [LE]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=afvR and afvW test
|
||
FILE=bins/elf/crackme0x05
|
||
CMDS=<<EOF
|
||
aa
|
||
s main
|
||
echo
|
||
afvR
|
||
afvW
|
||
EOF
|
||
EXPECT=<<EOF
|
||
|
||
var_7ch 0x8048577,0x804858a
|
||
var_88h
|
||
var_7ch
|
||
var_88h 0x804857a
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt avr
|
||
FILE=bins/firmware/main.avr
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
f str.hello 12 @ 0x276
|
||
Csb 12 @ str.hello
|
||
axd 0x260 @ str.hello
|
||
pd 1 @ 0x260
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; DATA XREF from str.hello @
|
||
0x00000260 80e0 ldi r24, 0x00
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt capstone x86
|
||
FILE=bins/elf/analysis/main
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e analysis.arch=x86
|
||
e scr.color=false
|
||
e scr.wheel=false
|
||
aa
|
||
axt @ str.Hello_World
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x40050a [DATA] mov edi, str.Hello_World
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt capstone x86: IOLI0
|
||
FILE=bins/elf/ioli/crackme0x00
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e analysis.arch=x86
|
||
e scr.color=false
|
||
e scr.wheel=false
|
||
aa
|
||
axt @ str.Password:
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x804843c [DATA] mov dword [esp], str.Password:
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt capstone x86: IOLI7 aa
|
||
FILE=bins/elf/ioli/crackme0x07
|
||
CMDS=<<EOF
|
||
aaa
|
||
axt @ sym.imp.exit
|
||
EOF
|
||
EXPECT=<<EOF
|
||
fcn.08048524 0x804853d [CALL] call sym.imp.exit
|
||
fcn.08048542 0x80485ab [CALL] call sym.imp.exit
|
||
(nofunc) 0x804866f [CALL] call sym.imp.exit
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt capstone x86: IOLI7 aa 2
|
||
FILE=bins/elf/ioli/crackme0x07
|
||
CMDS=<<EOF
|
||
aaaa
|
||
axt @ sym.imp.exit
|
||
EOF
|
||
EXPECT=<<EOF
|
||
fcn.08048524 0x804853d [CALL] call sym.imp.exit
|
||
fcn.08048542 0x80485ab [CALL] call sym.imp.exit
|
||
(nofunc) 0x804866f [CALL] call sym.imp.exit
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt respect subrel
|
||
FILE=bins/pe/ibknoreloc64.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
e asm.sub.rel=false
|
||
axt @ sym.imp.msvcrt.dll_printf
|
||
e asm.sub.rel=true
|
||
axt @ sym.imp.msvcrt.dll_printf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
entry0 0xffffffffffff100a [CALL] call qword [rip+0xd8]
|
||
entry0 0xffffffffffff100a [CALL] call qword [sym.imp.msvcrt.dll_printf]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ax-
|
||
FILE==
|
||
CMDS=<<EOF
|
||
ax 10 @ 20
|
||
axlq
|
||
ax- 10 20
|
||
axlq
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000014 -> 0x0000000a UNKNOWN
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ax-
|
||
FILE==
|
||
CMDS=<<EOF
|
||
s 20
|
||
ax 10
|
||
axlq
|
||
ax- 10
|
||
axlq
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000014 -> 0x0000000a UNKNOWN
|
||
EOF
|
||
RUN
|
||
|
||
NAME=ax-*
|
||
FILE==
|
||
CMDS=<<EOF
|
||
ax 10
|
||
axl
|
||
ax-*
|
||
axl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
? 0x0 -> UNKNOWN -> 0xa
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axt unknown function
|
||
FILE=bins/pe/lab11.malware
|
||
CMDS=<<EOF
|
||
aaa
|
||
axt @ fcn.00401270
|
||
EOF
|
||
EXPECT=<<EOF
|
||
(nofunc) 0x401a1d [CALL] call fcn.00401270
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axf string ref capstone x86
|
||
FILE=bins/elf/ioli/crackme0x03
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e analysis.arch=x86
|
||
e scr.color=false
|
||
e scr.wheel=false
|
||
aa
|
||
axt @ str.Sdvvzrug_RN
|
||
s str.Sdvvzrug_RN
|
||
axt
|
||
axf @ 0x804848a
|
||
s 0x804848a
|
||
axf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
sym.test 0x804848a [DATA] mov dword [esp], str.Sdvvzrug_RN
|
||
sym.test 0x804848a [DATA] mov dword [esp], str.Sdvvzrug_RN
|
||
d 0x80485fe str.Sdvvzrug_RN
|
||
d 0x80485fe str.Sdvvzrug_RN
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86 ref issue
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx c7052a44000050000000
|
||
ao~^ptr[1]
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00004434
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aoj pushf
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx 669c
|
||
aoj~{}
|
||
EOF
|
||
EXPECT=<<EOF
|
||
[
|
||
{
|
||
"opcode": "pushf",
|
||
"disasm": "pushf",
|
||
"pseudo": "pushf ",
|
||
"description": "push flags register onto the stack",
|
||
"mnemonic": "pushf",
|
||
"mask": "ffff",
|
||
"esil": "8,rsp,-=,eflags,rsp,=[8]",
|
||
"rzil": {
|
||
"opcode": "seq",
|
||
"x": {
|
||
"opcode": "set",
|
||
"dst": "final",
|
||
"src": {
|
||
"opcode": "-",
|
||
"x": {
|
||
"opcode": "var",
|
||
"value": "rsp"
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x8",
|
||
"len": 64
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "seq",
|
||
"x": {
|
||
"opcode": "storew",
|
||
"mem": 0,
|
||
"key": {
|
||
"opcode": "var",
|
||
"value": "final"
|
||
},
|
||
"value": {
|
||
"opcode": "cast",
|
||
"value": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "|",
|
||
"x": {
|
||
"opcode": "<<",
|
||
"x": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "nt"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x2",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x3",
|
||
"len": 16
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "of"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "df"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "if"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "tf"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "zf"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "zf"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x2",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "af"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x2",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "pf"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"fill_bit": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "ite",
|
||
"condition": {
|
||
"opcode": "var",
|
||
"value": "cf"
|
||
},
|
||
"x": {
|
||
"opcode": "bitv",
|
||
"bits": "0x1",
|
||
"len": 16
|
||
},
|
||
"y": {
|
||
"opcode": "bitv",
|
||
"bits": "0x0",
|
||
"len": 16
|
||
}
|
||
}
|
||
},
|
||
"length": 16,
|
||
"fill": {
|
||
"opcode": "bool",
|
||
"value": false
|
||
}
|
||
}
|
||
},
|
||
"y": {
|
||
"opcode": "set",
|
||
"dst": "rsp",
|
||
"src": {
|
||
"opcode": "var",
|
||
"value": "final"
|
||
}
|
||
}
|
||
}
|
||
},
|
||
"sign": false,
|
||
"prefix": 0,
|
||
"id": 668,
|
||
"opex": {
|
||
"operands": [
|
||
{
|
||
"type": "reg",
|
||
"value": "eflags",
|
||
"read": true,
|
||
"nbits": 64
|
||
}
|
||
]
|
||
},
|
||
"addr": 0,
|
||
"bytes": "669c",
|
||
"size": 2,
|
||
"type": "rpush",
|
||
"scale": 0,
|
||
"refptr": 0,
|
||
"cycles": 1,
|
||
"failcycles": 0,
|
||
"delay": 0,
|
||
"stack": "inc",
|
||
"stackptr": 8,
|
||
"family": "cpu"
|
||
}
|
||
]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=strings xref issue
|
||
FILE=bins/elf/redpill
|
||
CMDS=<<EOF
|
||
e analysis.strings=true
|
||
aa
|
||
aae
|
||
axt @ 0x00001d89
|
||
axt @ 0x00001da0
|
||
axt @ 0x00001db7
|
||
axt @ 0x00001dd1
|
||
axt @ 0x00001de8
|
||
axt @ 0x00001df4
|
||
axt @ 0x00001e09
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x1457 [STRING] lea eax, dword str.Take_the_Red_Pill
|
||
main 0x148e [STRING] lea eax, dword str.use:_._exploit1_PILL
|
||
main 0x14eb [STRING] lea eax, dword str.Red_Pill__0x50444552
|
||
main 0x1502 [STRING] lea eax, dword str.Your_Pill_0x_08x
|
||
main 0x1523 [STRING] lea eax, dword str.Red_Pill
|
||
main 0x1557 [STRING] lea eax, dword str.fwhibbit
|
||
main 0x161d [STRING] lea eax, dword str.Blue_Pill
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reference to like mov [0x400000], 0x1234
|
||
FILE=bins/elf/analysis/reference.out
|
||
CMDS=<<EOF
|
||
aaa
|
||
axt@ 0x0804a01c
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x80483ee [DATA] mov dword [obj.a], 0x1337
|
||
EOF
|
||
RUN
|
||
|
||
NAME=delete references with ax-
|
||
FILE==
|
||
CMDS=<<EOF
|
||
ax 10 @ 20
|
||
axlq
|
||
ax- 10
|
||
axlq
|
||
ax 10 @ 20
|
||
ax 30 @ 40
|
||
axlq
|
||
ax-*
|
||
axlq
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000014 -> 0x0000000a UNKNOWN
|
||
0x00000014 -> 0x0000000a UNKNOWN
|
||
0x00000028 -> 0x0000001e UNKNOWN
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reference PIC binary
|
||
FILE=bins/elf/analysis/xrefpic
|
||
CMDS=<<EOF
|
||
e analysis.strings=true
|
||
aa
|
||
aae
|
||
axt @ 0x80484e0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x8048432 [STRING] lea eax, dword str.Hello_PIC
|
||
EOF
|
||
RUN
|
||
|
||
NAME=strings xref issue without subrel
|
||
FILE=bins/elf/redpill
|
||
CMDS=<<EOF
|
||
e analysis.strings=true
|
||
e asm.sub.rel=false
|
||
aa
|
||
aae
|
||
axt @ 0x00001d89
|
||
axt @ 0x00001da0
|
||
axt @ 0x00001db7
|
||
axt @ 0x00001dd1
|
||
axt @ 0x00001de8
|
||
axt @ 0x00001df4
|
||
axt @ 0x00001e09
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x1457 [STRING] lea eax, dword [esi-0x2277]
|
||
main 0x148e [STRING] lea eax, dword [esi-0x2260]
|
||
main 0x14eb [STRING] lea eax, dword [esi-0x2249]
|
||
main 0x1502 [STRING] lea eax, dword [esi-0x222f]
|
||
main 0x1523 [STRING] lea eax, dword [esi-0x2218]
|
||
main 0x1557 [STRING] lea eax, dword [esi-0x220c]
|
||
main 0x161d [STRING] lea eax, dword [esi-0x21f7]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=reference PIC binary without subrel
|
||
FILE=bins/elf/analysis/xrefpic
|
||
CMDS=<<EOF
|
||
e analysis.strings=true
|
||
e asm.sub.rel=false
|
||
aa
|
||
aae
|
||
axt @ 0x80484e0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
main 0x8048432 [STRING] lea eax, dword [ebx-0x1b20]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=refs on PIC binary disassembly
|
||
FILE=bins/elf/analysis/xrefpic
|
||
CMDS=<<EOF
|
||
e analysis.strings=true
|
||
e asm.bytes=true
|
||
aa
|
||
aae
|
||
pd 1 @ 0x08048432
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| 0x08048432 8d83e0e4ffff lea eax, dword str.Hello_PIC ; 0x80484e0 ; "Hello PIC!"
|
||
EOF
|
||
RUN
|
||
|
||
NAME=refs on PIC binary disassembly (color)
|
||
FILE=bins/elf/analysis/xrefpic
|
||
CMDS=<<EOF
|
||
e asm.bytes=false
|
||
e asm.comments=false
|
||
e scr.color=1
|
||
e analysis.strings=true
|
||
aa
|
||
aae
|
||
pd 1 @ 0x08048432
|
||
EOF
|
||
EXPECT=<<EOF
|
||
[36m|[0m [32m0x08048432[0m [37mlea[0m[37m [0m[36meax[0m[37m, [0m[37mdword[0m[37m [33mstr.Hello_PIC[0m[0m[0m
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axs
|
||
FILE==
|
||
CMDS=<<EOF
|
||
axs 0x10
|
||
axlq
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000000 -> 0x00000010 STRING
|
||
EOF
|
||
RUN
|
||
|
||
NAME=refs with aar
|
||
FILE=bins/elf/crackme
|
||
CMDS=<<EOF
|
||
e analysis.jmp.cref=true
|
||
e asm.bytes=true
|
||
e asm.lines.bb=false
|
||
e asm.lines.fcn=false
|
||
aar
|
||
pd 1 @ 0x400730
|
||
pd 1 @ 0x4007f0
|
||
pd 1 @ 0x400610
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; DATA XREF from entry0 @ +0xf
|
||
;-- __libc_csu_fini:
|
||
0x00400730 f3c3 ret
|
||
; CODE XREF from sym.__do_global_ctors_aux @ +0x2d
|
||
0x004007f0 4883eb08 sub rbx, 0x08
|
||
; CALL XREF from section..fini @ +0x4
|
||
;-- __do_global_dtors_aux:
|
||
0x00400610 55 push rbp
|
||
EOF
|
||
RUN
|
||
|
||
NAME=refs with afr
|
||
FILE=bins/elf/crackme
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.lines.bb=false
|
||
e asm.lines.fcn=false
|
||
e analysis.jmp.cref=true
|
||
aa
|
||
afr
|
||
pd 1 @ 0x400730
|
||
pd 1 @ 0x4007f0
|
||
pd 1 @ 0x400610
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; DATA XREF from entry0 @ 0x4005cf
|
||
sym.__libc_csu_fini();
|
||
0x00400730 f3c3 ret
|
||
; CODE XREF from sym.__do_global_ctors_aux @ 0x4007fd
|
||
0x004007f0 4883eb08 sub rbx, 0x08
|
||
; CALL XREF from sym._fini @ 0x40080c
|
||
sym.__do_global_dtors_aux();
|
||
0x00400610 55 push rbp
|
||
EOF
|
||
RUN
|
||
|
||
NAME=cjmp data refs with aar
|
||
FILE=malloc://10000
|
||
CMDS=<<EOF
|
||
e asm.arch=8051
|
||
e asm.bytes=true
|
||
e asm.lines.bb=false
|
||
e asm.lines.fcn=false
|
||
wx 307401000022
|
||
aar
|
||
pd 1 @ _idata+0x2e
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; DATA XREF from unk @
|
||
0x1000002e 00 nop
|
||
EOF
|
||
RUN
|
||
|
||
NAME=cjmp data refs with afr
|
||
FILE=malloc://10000
|
||
CMDS=<<EOF
|
||
e asm.arch=8051
|
||
e asm.lines.bb=false
|
||
e asm.bytes=true
|
||
e asm.lines.fcn=false
|
||
wx 307401000022
|
||
aa
|
||
afr
|
||
pd 1 @ _idata+0x2e
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; DATA XREF from fcn.00000000 @
|
||
0x1000002e 00 nop
|
||
EOF
|
||
RUN
|
||
|
||
NAME=xrefs and overlapping basic blocks
|
||
FILE=bins/elf/analysis/ls-linux-x86_64-zlul
|
||
CMDS=<<EOF
|
||
aaa
|
||
axt @ main
|
||
EOF
|
||
EXPECT=<<EOF
|
||
entry0 0x40488d [DATA] mov rdi, main
|
||
EOF
|
||
RUN
|
||
|
||
NAME=unique function names
|
||
FILE=bins/elf/bash
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~strlen~390
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=no function split without overlapping blocks
|
||
FILE=bins/elf/libc.so.6
|
||
CMDS=<<EOF
|
||
aac
|
||
s 0x2254d
|
||
agf~invalid
|
||
echo end
|
||
EOF
|
||
EXPECT=<<EOF
|
||
end
|
||
EOF
|
||
RUN
|
||
|
||
NAME=noreturn of reloc-functions
|
||
FILE=bins/elf/ls
|
||
CMDS=<<EOF
|
||
aaa
|
||
afbr @ 0x80b0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x000081cb
|
||
0x00008237
|
||
EOF
|
||
RUN
|
||
|
||
NAME=r_analysis_fcn_split_bb FITFCNSZ fix (#12008)
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bytes=true
|
||
e asm.bits=64
|
||
e analysis.jmp.mid=false
|
||
wx b8210000c1ebfdbb2c0000000000
|
||
af
|
||
afi
|
||
echo
|
||
afb
|
||
echo
|
||
e asm.bb.middle=true
|
||
pdf
|
||
echo
|
||
e asm.bb.middle=false
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
offset: 0x00000000
|
||
name: fcn.00000000
|
||
size: 7
|
||
is-pure: true
|
||
realsz: 7
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 2
|
||
cyclomatic-complexity: 0
|
||
loops: 0
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 2
|
||
edges: 2
|
||
end-bbs: 0
|
||
call-refs:
|
||
data-refs:
|
||
code-xrefs:
|
||
noreturn: false
|
||
in-degree: 0
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000004 00:0000 4 j 0x00000004
|
||
0x00000004 0x00000007 00:0000 3 j 0x00000004
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| ; CODE XREF from fcn.00000000 @ 0x5
|
||
\ .-> 0x00000004 c1ebfd shr ebx, 0xfd
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
\ `=< 0x00000005 ebfd jmp 0x4
|
||
EOF
|
||
RUN
|
||
|
||
NAME=overlapping basic blocks and analysis.jmp.mid
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bytes=true
|
||
e asm.bits=64
|
||
e analysis.nopskip=false
|
||
e asm.bb.middle=true
|
||
e analysis.jmp.mid=true
|
||
(show_fcn bin; wx ${bin}; af-*; af; afi; echo; afb; echo; pdr; echo; agf; echo; e asm.bb.middle=true; pdf; echo; e asm.bb.middle=false; pdf)
|
||
.(show_fcn b8210000c1ebfdbb2c000000cc)
|
||
echo
|
||
.(show_fcn b8210000c1ebfdbb2c000000ebf6)
|
||
echo
|
||
.(show_fcn b8210000c1ebfdbb2c000000ebf7)
|
||
echo
|
||
.(show_fcn 0f1f440000b8210000c1ebfdbb2c000000ebf0)
|
||
EOF
|
||
EXPECT=<<EOF
|
||
offset: 0x00000000
|
||
name: fcn.00000000
|
||
size: 13
|
||
is-pure: false
|
||
realsz: 16
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 6
|
||
cyclomatic-complexity: 1
|
||
loops: 0
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 2
|
||
edges: 1
|
||
end-bbs: 1
|
||
call-refs: 0x00000004 J
|
||
data-refs: 0x0000002c
|
||
code-xrefs: 0x00000005 J
|
||
noreturn: false
|
||
in-degree: 1
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000007 00:0000 7 j 0x00000004
|
||
0x00000004 0x0000000d 00:0000 9
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| 0x00000005 ebfd jmp 0x4
|
||
| ----------- true: 0x00000004
|
||
| ; CODE XREF from fcn.00000000 @ 0x5
|
||
| 0x00000004 c1ebfd shr ebx, 0xfd
|
||
| 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x0000000c cc int3
|
||
|
||
|
||
.---------------------.
|
||
| 0x0 |
|
||
| fcn.00000000(); |
|
||
| ; '!' |
|
||
| mov eax, 0xc1000021 |
|
||
| jmp 0x4 |
|
||
`---------------------'
|
||
v
|
||
|
|
||
.-------'
|
||
|
|
||
.-------------------------------------.
|
||
| 0x4 |
|
||
| ; CODE XREF from fcn.00000000 @ 0x5 |
|
||
| shr ebx, 0xfd |
|
||
| ; ',' |
|
||
| mov ebx, 0x2c |
|
||
| int3 |
|
||
`-------------------------------------'
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| ; CODE XREF from fcn.00000000 @ 0x5
|
||
| .-> 0x00000004 c1ebfd shr ebx, 0xfd
|
||
| 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x0000000c cc int3
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| `=< 0x00000005 ebfd jmp 0x4
|
||
| 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x0000000c cc int3
|
||
|
||
offset: 0x00000000
|
||
name: fcn.00000000
|
||
size: 14
|
||
is-pure: false
|
||
realsz: 17
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 7
|
||
cyclomatic-complexity: 0
|
||
loops: 0
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 2
|
||
edges: 2
|
||
end-bbs: 0
|
||
call-refs: 0x00000004 J 0x00000004 J
|
||
data-refs: 0x0000002c
|
||
code-xrefs: 0x00000005 J 0x0000000c J
|
||
noreturn: false
|
||
in-degree: 2
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000007 00:0000 7 j 0x00000004
|
||
0x00000004 0x0000000e 00:0000 10 j 0x00000004
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| 0x00000005 ebfd jmp 0x4
|
||
| ----------- true: 0x00000004
|
||
| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc
|
||
| 0x00000004 c1ebfd shr ebx, 0xfd
|
||
| 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x0000000c ebf6 jmp 0x4
|
||
| ----------- true: 0x00000004
|
||
|
||
.---------------------.
|
||
| 0x0 |
|
||
| fcn.00000000(); |
|
||
| ; '!' |
|
||
| mov eax, 0xc1000021 |
|
||
| jmp 0x4 |
|
||
`---------------------'
|
||
v
|
||
|
|
||
.--------'
|
||
.--------.
|
||
| | |
|
||
|.-------------------------------------------.
|
||
|| 0x4 |
|
||
|| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc |
|
||
|| shr ebx, 0xfd |
|
||
|| ; ',' |
|
||
|| mov ebx, 0x2c |
|
||
|| jmp 0x4 |
|
||
|`-------------------------------------------'
|
||
| v
|
||
| |
|
||
`----'
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc
|
||
| ..-> 0x00000004 c1ebfd shr ebx, 0xfd
|
||
| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `=< 0x0000000c ebf6 jmp 0x4
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| `==< 0x00000005 ebfd jmp 0x4
|
||
| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `=< 0x0000000c ebf6 jmp 0x4
|
||
|
||
offset: 0x00000000
|
||
name: fcn.00000000
|
||
size: 14
|
||
is-pure: false
|
||
realsz: 17
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 7
|
||
cyclomatic-complexity: 0
|
||
loops: 1
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 3
|
||
edges: 3
|
||
end-bbs: 0
|
||
call-refs: 0x00000004 J 0x00000005 J
|
||
data-refs: 0x0000002c
|
||
code-xrefs: 0x00000005 J 0x0000000c J
|
||
noreturn: false
|
||
in-degree: 2
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000005 00:0000 5 j 0x00000005
|
||
0x00000004 0x0000000e 00:0000 10 j 0x00000005
|
||
0x00000005 0x00000007 00:0000 2 j 0x00000004
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| ----------- true: 0x00000005
|
||
| ; CODE XREF from fcn.00000000 @ 0x5
|
||
| 0x00000004 c1ebfd shr ebx, 0xfd
|
||
| 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x0000000c ebf7 jmp 0x5
|
||
| ----------- true: 0x00000005
|
||
| ; CODE XREF from fcn.00000000 @ 0xc
|
||
| 0x00000005 ebfd jmp 0x4
|
||
| ----------- true: 0x00000004
|
||
|
||
.---------------------.
|
||
| 0x0 |
|
||
| fcn.00000000(); |
|
||
| ; '!' |
|
||
| mov eax, 0xc1000021 |
|
||
`---------------------'
|
||
v
|
||
|
|
||
.-----'
|
||
.--------.
|
||
| | |
|
||
|.-------------------------------------.
|
||
|| 0x5 |
|
||
|| ; CODE XREF from fcn.00000000 @ 0xc |
|
||
|| jmp 0x4 |
|
||
|`-------------------------------------'
|
||
| v
|
||
| |
|
||
| |
|
||
|.-------------------------------------.
|
||
|| 0x4 |
|
||
|| ; CODE XREF from fcn.00000000 @ 0x5 |
|
||
|| shr ebx, 0xfd |
|
||
|| ; ',' |
|
||
|| mov ebx, 0x2c |
|
||
|| jmp 0x5 |
|
||
|`-------------------------------------'
|
||
| v
|
||
| |
|
||
`----'
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| ; CODE XREF from fcn.00000000 @ 0x5
|
||
| .-> 0x00000004 ~ c1ebfd shr ebx, 0xfd
|
||
| | ; CODE XREF from fcn.00000000 @ 0xc
|
||
| .`=< 0x00000005 ebfd jmp 0x4
|
||
| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `==< 0x0000000c ebf7 jmp 0x5
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| | ; CODE XREF from fcn.00000000 @ 0xc
|
||
| .`=< 0x00000005 ebfd jmp 0x4
|
||
| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `==< 0x0000000c ebf7 jmp 0x5
|
||
|
||
offset: 0x00000000
|
||
name: fcn.00000000
|
||
size: 19
|
||
is-pure: false
|
||
realsz: 24
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 9
|
||
cyclomatic-complexity: 0
|
||
loops: 1
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 4
|
||
edges: 4
|
||
end-bbs: 0
|
||
call-refs: 0x00000009 J 0x00000003 J
|
||
data-refs: 0x0000002c
|
||
code-xrefs: 0x0000000a J 0x00000011 J
|
||
noreturn: false
|
||
in-degree: 2
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000005 00:0000 5 j 0x00000005
|
||
0x00000003 0x00000005 00:0000 2 j 0x00000005
|
||
0x00000005 0x0000000c 00:0000 7 j 0x00000009
|
||
0x00000009 0x00000013 00:0000 10 j 0x00000003
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 0f1f440000 nop dword [rax+rax*1], eax
|
||
| ----------- true: 0x00000005
|
||
| ; CODE XREF from fcn.00000000 @ 0x11
|
||
| 0x00000003 0000 add byte [rax], al
|
||
| ----------- true: 0x00000005
|
||
| 0x00000005 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| 0x0000000a ebfd jmp 0x9
|
||
| ----------- true: 0x00000009
|
||
| ; CODE XREF from fcn.00000000 @ 0xa
|
||
| 0x00000009 c1ebfd shr ebx, 0xfd
|
||
| 0x0000000c bb2c000000 mov ebx, 0x2c ; ','
|
||
\ 0x00000011 ebf0 jmp 0x3
|
||
| ----------- true: 0x00000003
|
||
|
||
.----------------------------.
|
||
| 0x0 |
|
||
| fcn.00000000(); |
|
||
| nop dword [rax+rax*1], eax |
|
||
`----------------------------'
|
||
v
|
||
|
|
||
'-----.
|
||
.-----------------.
|
||
| | |
|
||
| .---------------------.
|
||
| | 0x5 |
|
||
| | ; '!' |
|
||
| | mov eax, 0xc1000021 |
|
||
| | jmp 0x9 |
|
||
| `---------------------'
|
||
| v
|
||
| |
|
||
| .-------'
|
||
| |
|
||
| .-------------------------------------.
|
||
| | 0x9 |
|
||
| | ; CODE XREF from fcn.00000000 @ 0xa |
|
||
| | shr ebx, 0xfd |
|
||
| | ; ',' |
|
||
| | mov ebx, 0x2c |
|
||
| | jmp 0x3 |
|
||
| `-------------------------------------'
|
||
| v
|
||
| |
|
||
| .'
|
||
| |
|
||
|.--------------------------------------.
|
||
|| 0x3 |
|
||
|| ; CODE XREF from fcn.00000000 @ 0x11 |
|
||
|| add byte [rax], al |
|
||
|`--------------------------------------'
|
||
| v
|
||
| |
|
||
`----'
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 ~ 0f1f440000 nop dword [rax+rax*1], eax
|
||
| ; CODE XREF from fcn.00000000 @ 0x11
|
||
| .-> 0x00000003 0000 add byte [rax], al
|
||
| : 0x00000005 ~ b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| : ; CODE XREF from fcn.00000000 @ 0xa
|
||
| .--> 0x00000009 c1ebfd shr ebx, 0xfd
|
||
| : 0x0000000c bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `=< 0x00000011 ebf0 jmp 0x3
|
||
|
||
/ fcn.00000000();
|
||
| 0x00000000 0f1f440000 nop dword [rax+rax*1], eax
|
||
| : 0x00000005 b8210000c1 mov eax, 0xc1000021 ; '!'
|
||
| `==< 0x0000000a ebfd jmp 0x9
|
||
| : 0x0000000c bb2c000000 mov ebx, 0x2c ; ','
|
||
\ `=< 0x00000011 ebf0 jmp 0x3
|
||
EOF
|
||
RUN
|
||
|
||
NAME=basic block overlaps function start
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bytes=true
|
||
e asm.bits=64
|
||
wx b821c10010ebf9
|
||
s 3
|
||
af; afi; echo; afb; echo; pdr; echo; agf; echo; pdf
|
||
echo
|
||
e asm.bb.middle=false
|
||
pd 2 @ 0
|
||
echo
|
||
e asm.bb.middle=true
|
||
pd 3 @ 0
|
||
EOF
|
||
EXPECT=<<EOF
|
||
offset: 0x00000003
|
||
name: fcn.00000003
|
||
size: 7
|
||
is-pure: true
|
||
realsz: 9
|
||
stackframe: 0
|
||
call-convention: amd64
|
||
cyclomatic-cost: 4
|
||
cyclomatic-complexity: 0
|
||
loops: 1
|
||
bits: 64
|
||
type: fcn
|
||
num-bbs: 3
|
||
edges: 3
|
||
end-bbs: 0
|
||
call-refs: 0x00000000 J
|
||
data-refs:
|
||
code-xrefs: 0x00000005 J
|
||
noreturn: false
|
||
in-degree: 1
|
||
out-degree: 0
|
||
data-xrefs:
|
||
locals: 0
|
||
args: 0
|
||
|
||
0x00000000 0x00000005 00:0000 5 j 0x00000005
|
||
0x00000003 0x00000005 00:0000 2 j 0x00000005
|
||
0x00000005 0x00000007 00:0000 2 j 0x00000000
|
||
|
||
| ; CODE XREF from fcn.00000003 @ 0x5
|
||
| ;-- (0x00000003) fcn.00000003:
|
||
| 0x00000000 ~ b821c10010 mov eax, 0x1000c121
|
||
| ----------- true: 0x00000005
|
||
/ fcn.00000003();
|
||
| 0x00000003 0010 add byte [rax], dl
|
||
| ----------- true: 0x00000005
|
||
| 0x00000005 ebf9 jmp 0x0
|
||
| ----------- true: 0x00000000
|
||
|
||
.----.
|
||
| |
|
||
|.-------------------------------------. .--------------------.
|
||
|| 0x0 | | 0x3 |
|
||
|| ; CODE XREF from fcn.00000003 @ 0x5 | | fcn.00000003(); |
|
||
|| ;-- (0x00000003) fcn.00000003: | | add byte [rax], dl |
|
||
|| mov eax, 0x1000c121 | `--------------------'
|
||
|`-------------------------------------' v
|
||
| v |
|
||
| | |
|
||
| '-------------------------------. |
|
||
| | .-------'
|
||
| | |
|
||
| .-----------.
|
||
| | 0x5 |
|
||
| | jmp 0x0 |
|
||
| `-----------'
|
||
| v
|
||
| |
|
||
`----------------------------------'
|
||
|
||
/ fcn.00000003();
|
||
| 0x00000003 0010 add byte [rax], dl
|
||
| 0x00000005 ebf9 jmp 0x0
|
||
|
||
| ; CODE XREF from fcn.00000003 @ 0x5
|
||
| ;-- (0x00000003) fcn.00000003:
|
||
| 0x00000000 ~ b821c10010 mov eax, 0x1000c121
|
||
| 0x00000005 ebf9 jmp 0x0
|
||
|
||
| ; CODE XREF from fcn.00000003 @ 0x5
|
||
| 0x00000000 ~ b821c10010 mov eax, 0x1000c121
|
||
/ fcn.00000003();
|
||
| 0x00000003 0010 add byte [rax], dl
|
||
| 0x00000005 ebf9 jmp 0x0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=af-* removes function flags
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bytes=true
|
||
e asm.bits=64
|
||
wx b821c10010ebf9
|
||
s 0
|
||
af; af-*
|
||
s 3
|
||
af
|
||
pdr
|
||
echo
|
||
agf
|
||
echo
|
||
afll
|
||
EOF
|
||
EXPECT=<<EOF
|
||
| ; CODE XREF from fcn.00000003 @ 0x5
|
||
| ;-- (0x00000003) fcn.00000003:
|
||
| 0x00000000 ~ b821c10010 mov eax, 0x1000c121
|
||
| ----------- true: 0x00000005
|
||
/ fcn.00000003();
|
||
| 0x00000003 0010 add byte [rax], dl
|
||
| ----------- true: 0x00000005
|
||
| 0x00000005 ebf9 jmp 0x0
|
||
| ----------- true: 0x00000000
|
||
|
||
.----.
|
||
| |
|
||
|.-------------------------------------. .--------------------.
|
||
|| 0x0 | | 0x3 |
|
||
|| ; CODE XREF from fcn.00000003 @ 0x5 | | fcn.00000003(); |
|
||
|| ;-- (0x00000003) fcn.00000003: | | add byte [rax], dl |
|
||
|| mov eax, 0x1000c121 | `--------------------'
|
||
|`-------------------------------------' v
|
||
| v |
|
||
| | |
|
||
| '-------------------------------. |
|
||
| | .-------'
|
||
| | |
|
||
| .-----------.
|
||
| | 0x5 |
|
||
| | jmp 0x0 |
|
||
| `-----------'
|
||
| v
|
||
| |
|
||
`----------------------------------'
|
||
|
||
addr name size xrefsTo xrefsFrom calls nbbs edges cc cost noreturn min bound range max bound locals args frame loops
|
||
-------------------------------------------------------------------------------------------------------------------------------------
|
||
0x00000003 fcn.00000003 9 1 1 0 3 3 0 4 false 0x00000000 7 0x00000007 0 0 0 1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=so -N and overlapping basic blocks
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.jmp.mid=true
|
||
e analysis.nopskip=false
|
||
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
|
||
af
|
||
s 0x4
|
||
so -1
|
||
s
|
||
s 0x4
|
||
so -2
|
||
s
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x3
|
||
0x0
|
||
EOF
|
||
RUN
|
||
|
||
NAME=a8 analyze bytes
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e asm.os=linux
|
||
a8 55|
|
||
EOF
|
||
EXPECT=<<EOF
|
||
address: 0x0
|
||
opcode: push rbp
|
||
disasm: push rbp
|
||
pseudo: push rbp
|
||
mnemonic: push
|
||
description: push word, doubleword or quadword onto the stack
|
||
mask: ff
|
||
prefix: 0
|
||
id: 665
|
||
bytes: 55
|
||
refptr: 0
|
||
size: 1
|
||
sign: false
|
||
type: rpush
|
||
cycles: 1
|
||
esil: rbp,8,rsp,-,=[8],8,rsp,-=
|
||
rzil: (seq (set final (- (var rsp) (bv 64 0x8))) (storew 0 (var final) (cast 64 false (var rbp))) (set rsp (var final)))
|
||
opex:
|
||
operands:
|
||
- type: "reg"
|
||
value: "rbp"
|
||
read: true
|
||
nbits: 64
|
||
family: cpu
|
||
stackop: inc
|
||
stackptr: 8
|
||
EOF
|
||
RUN
|
||
|
||
NAME=af jmp after ret
|
||
FILE=malloc://512
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=0
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3
|
||
af
|
||
afl~?
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=af jmp after ret
|
||
FILE=malloc://512
|
||
CMDS=<<EOF
|
||
e analysis.hasnext=0
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3
|
||
af
|
||
afl~?
|
||
afl~[2]
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
60
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Windows Function EMU LoadStringA
|
||
FILE=bins/pe/standard.exe
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=32
|
||
e asm.os=windows
|
||
e asm.emu=true
|
||
e emu.write=true
|
||
e asm.bytes=0
|
||
e asm.cmt.col=20
|
||
e asm.lines.bb=false
|
||
aeim
|
||
s 0x00402aee
|
||
pd 10~?int LoadStringA
|
||
EOF
|
||
EXPECT=<<EOF
|
||
1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Linux fcnsign test
|
||
FILE=bins/elf/analysis/ls-linux64
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e asm.os=linux
|
||
e asm.emu=true
|
||
e emu.write=true
|
||
e asm.bytes=0
|
||
e asm.cmt.col=20
|
||
e asm.lines.bb=false
|
||
e asm.lines.fcn=false
|
||
aa
|
||
aeim
|
||
s 0x00003cb8-0x30
|
||
pd 20~env
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00003cb8 call sym.imp.getenv ; rsp=0x177fe8 -> 0x464c457f ; rip=0x3430 -> 0x97fa25ff
|
||
; char *getenv("COLUMNS")
|
||
EOF
|
||
RUN
|
||
|
||
NAME=sar on x86-64
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.hasnext=0
|
||
# testing mov eax, -4 sar
|
||
wx 48c7c0fcffffff 48d1f8 48d1f8 48d1f8 48d1f8 48d1f8 48d1f8
|
||
aes
|
||
ar rax
|
||
aes
|
||
ar rax
|
||
aes
|
||
ar rax
|
||
aes
|
||
ar rax
|
||
EOF
|
||
EXPECT=<<EOF
|
||
rax = 0xfffffffffffffffc
|
||
rax = 0xfffffffffffffffe
|
||
rax = 0xffffffffffffffff
|
||
rax = 0xffffffffffffffff
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aes
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.hasnext=0
|
||
wx 48c7c0fcffffff 48d1f8 48d1f8 48d1f8
|
||
aes
|
||
ar rax
|
||
aes
|
||
ar rax
|
||
aes
|
||
ar rax
|
||
EOF
|
||
EXPECT=<<EOF
|
||
rax = 0xfffffffffffffffc
|
||
rax = 0xfffffffffffffffe
|
||
rax = 0xffffffffffffffff
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86-64 after unknown jmp
|
||
FILE=bins/elf/analysis/ls-linux64
|
||
CMDS=<<EOF
|
||
s 0x5c50
|
||
af
|
||
pif
|
||
EOF
|
||
EXPECT=<<EOF
|
||
lea rdi, qword loc._edata
|
||
lea rax, qword [0x0021d28f]
|
||
push rbp
|
||
sub rax, rdi
|
||
mov rbp, rsp
|
||
cmp rax, 0x0e
|
||
jbe 0x5c80
|
||
mov rax, qword [reloc._ITM_deregisterTMCloneTable]
|
||
test rax, rax
|
||
jz 0x5c80
|
||
pop rbp
|
||
jmp rax
|
||
nop word [rax+rax*1], ax
|
||
pop rbp
|
||
ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=t.analysis/x86/aap
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
f- sym.func.*
|
||
aap
|
||
pi 2 @ fcn.1000010f8
|
||
EOF
|
||
EXPECT=<<EOF
|
||
push rbp
|
||
mov rbp, rsp
|
||
EOF
|
||
RUN
|
||
|
||
NAME=mac-ls switch count
|
||
FILE=bins/mach0/ls-osx-x86_64
|
||
CMDS=<<EOF
|
||
e analysis.jmp.tbl=true
|
||
af
|
||
fl~switch
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x100001527 1 switch.0x100001527
|
||
EOF
|
||
RUN
|
||
|
||
NAME=gcc_5.5.0_64 switch/case flags, meta, hints, etc.
|
||
FILE=bins/jmptbl/test_gcc_5.5.0_64.out
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
C~Cd 4
|
||
ahl
|
||
axf @ 0x59d
|
||
afb @ 0x59d
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x0000059d 1 switch.0x0000059d
|
||
0x0000059f 1 case.0x59d.13
|
||
0x000005b2 1 case.0x59d.1
|
||
0x000005c0 1 case.0x59d.2
|
||
0x000005c0 1 case.0x59d.3
|
||
0x000005c0 1 case.0x59d.4
|
||
0x000005ce 1 case.0x59d.5
|
||
0x000005dc 1 case.0x59d.6
|
||
0x000005ea 1 case.0x59d.7
|
||
0x000005f8 1 case.0x59d.9
|
||
0x00000606 1 case.0x59d.11
|
||
0x00000614 1 case.0x59d.12
|
||
0x00000622 1 case.0x59d.0
|
||
0x00000622 1 case.0x59d.8
|
||
0x00000622 1 case.0x59d.10
|
||
0x00000622 1 case.default.0x59d
|
||
0x00000844 data Cd 4
|
||
0x00000848 data Cd 4
|
||
0x0000084c data Cd 4
|
||
0x00000850 data Cd 4
|
||
0x00000854 data Cd 4
|
||
0x00000858 data Cd 4
|
||
0x0000085c data Cd 4
|
||
0x00000860 data Cd 4
|
||
0x00000864 data Cd 4
|
||
0x00000868 data Cd 4
|
||
0x0000086c data Cd 4
|
||
0x00000870 data Cd 4
|
||
0x00000874 data Cd 4
|
||
0x00000878 data Cd 4
|
||
0x00000844 => immbase=10
|
||
0x00000848 => immbase=10
|
||
0x0000084c => immbase=10
|
||
0x00000850 => immbase=10
|
||
0x00000854 => immbase=10
|
||
0x00000858 => immbase=10
|
||
0x0000085c => immbase=10
|
||
0x00000860 => immbase=10
|
||
0x00000864 => immbase=10
|
||
0x00000868 => immbase=10
|
||
0x0000086c => immbase=10
|
||
0x00000870 => immbase=10
|
||
0x00000874 => immbase=10
|
||
0x00000878 => immbase=10
|
||
c 0x59f case.0x59d.13
|
||
c 0x5b2 case.0x59d.1
|
||
c 0x5c0 case.0x59d.2
|
||
c 0x5ce case.0x59d.5
|
||
c 0x5dc case.0x59d.6
|
||
c 0x5ea case.0x59d.7
|
||
c 0x5f8 case.0x59d.9
|
||
c 0x606 case.0x59d.11
|
||
c 0x614 case.0x59d.12
|
||
c 0x622 case.0x59d.0
|
||
0x00000580 0x0000058d 00:0000 13 j 0x00000622 f 0x0000058d
|
||
0x0000058d 0x0000059f 00:0000 18 s 0x00000622 s 0x000005b2 s 0x000005c0 s 0x000005ce s 0x000005dc s 0x000005ea s 0x000005f8 s 0x00000606 s 0x00000614 s 0x0000059f
|
||
0x0000059f 0x000005ab 00:0000 12 j 0x000005ab
|
||
0x000005ab 0x000005b2 00:0000 7
|
||
0x000005b2 0x000005c0 00:0000 14 j 0x000005ab
|
||
0x000005c0 0x000005ce 00:0000 14 j 0x000005ab
|
||
0x000005ce 0x000005dc 00:0000 14 j 0x000005ab
|
||
0x000005dc 0x000005ea 00:0000 14 j 0x000005ab
|
||
0x000005ea 0x000005f8 00:0000 14 j 0x000005ab
|
||
0x000005f8 0x00000606 00:0000 14 j 0x000005ab
|
||
0x00000606 0x00000614 00:0000 14 j 0x000005ab
|
||
0x00000614 0x00000622 00:0000 14 j 0x000005ab
|
||
0x00000622 0x00000633 00:0000 17 j 0x000005ab
|
||
EOF
|
||
RUN
|
||
|
||
NAME=gcc_7.2.0_64 switch/case flags
|
||
FILE=bins/jmptbl/test_gcc_7.2.0_64.out
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x0000054d 1 switch.0x0000054d
|
||
0x0000054f 1 case.0x54d.13
|
||
0x00000562 1 case.0x54d.1
|
||
0x00000570 1 case.0x54d.2
|
||
0x00000570 1 case.0x54d.3
|
||
0x00000570 1 case.0x54d.4
|
||
0x0000057e 1 case.0x54d.5
|
||
0x0000058c 1 case.0x54d.6
|
||
0x0000059a 1 case.0x54d.7
|
||
0x000005a8 1 case.0x54d.9
|
||
0x000005b6 1 case.0x54d.11
|
||
0x000005c4 1 case.0x54d.12
|
||
0x000005d2 1 case.0x54d.0
|
||
0x000005d2 1 case.0x54d.8
|
||
0x000005d2 1 case.0x54d.10
|
||
0x000005d2 1 case.default.0x54d
|
||
EOF
|
||
RUN
|
||
|
||
NAME=gcc_9.2.0_64 switch/case flags
|
||
FILE=bins/elf/dectest64
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x004011fd 1 switch.0x004011fd
|
||
0x0040138d 1 switch.0x0040138d
|
||
0x0040120a 1 case.0x4011fd.0
|
||
0x0040121b 1 case.0x4011fd.1
|
||
0x0040122c 1 case.0x4011fd.2
|
||
0x0040123d 1 case.0x4011fd.3
|
||
0x0040124e 1 case.0x4011fd.4
|
||
0x00401270 1 case.default.0x4011fd
|
||
0x00401398 1 case.0x40138d.0
|
||
0x004013a9 1 case.0x40138d.1
|
||
0x004013ba 1 case.0x40138d.2
|
||
0x004013cb 1 case.0x40138d.3
|
||
0x004013dc 1 case.0x40138d.4
|
||
0x004013fe 1 case.default.0x40138d
|
||
EOF
|
||
RUN
|
||
|
||
NAME=clang_3.8_64 switch/case flags
|
||
FILE=bins/jmptbl/test_clang_3.8_64.out
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x004004d8 1 switch.0x004004d8
|
||
0x004004df 1 case.0x4004d8.2
|
||
0x004004df 1 case.0x4004d8.3
|
||
0x004004df 1 case.0x4004d8.4
|
||
0x004004e6 1 case.0x4004d8.1
|
||
0x004004ed 1 case.0x4004d8.5
|
||
0x004004f4 1 case.0x4004d8.6
|
||
0x004004fb 1 case.0x4004d8.7
|
||
0x00400502 1 case.0x4004d8.8
|
||
0x00400502 1 case.0x4004d8.10
|
||
0x00400502 1 case.default.0x4004d8
|
||
0x00400509 1 case.0x4004d8.9
|
||
0x00400510 1 case.0x4004d8.11
|
||
0x00400517 1 case.0x4004d8.12
|
||
0x0040051e 1 case.0x4004d8.13
|
||
EOF
|
||
RUN
|
||
|
||
NAME=clang_5.0_64 switch/case flags
|
||
FILE=bins/jmptbl/test_clang_5.0_64.out
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x004004c8 1 switch.0x004004c8
|
||
0x004004cf 1 case.0x4004c8.2
|
||
0x004004cf 1 case.0x4004c8.3
|
||
0x004004cf 1 case.0x4004c8.4
|
||
0x004004d6 1 case.0x4004c8.1
|
||
0x004004dd 1 case.0x4004c8.5
|
||
0x004004e4 1 case.0x4004c8.6
|
||
0x004004eb 1 case.0x4004c8.7
|
||
0x004004f2 1 case.0x4004c8.8
|
||
0x004004f2 1 case.0x4004c8.10
|
||
0x004004f2 1 case.default.0x4004c8
|
||
0x004004f9 1 case.0x4004c8.9
|
||
0x00400500 1 case.0x4004c8.11
|
||
0x00400507 1 case.0x4004c8.12
|
||
0x0040050e 1 case.0x4004c8.13
|
||
EOF
|
||
RUN
|
||
|
||
NAME=msvc_1700_64 switch/case flags
|
||
FILE=bins/jmptbl/test_msvc_1700_64.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x140001023 1 switch.0x140001023
|
||
0x140004b01 1 switch.0x140004b01
|
||
0x140001025 1 case.0x140001023.1
|
||
0x140001038 1 case.0x140001023.2
|
||
0x140001038 1 case.0x140001023.3
|
||
0x140001038 1 case.0x140001023.4
|
||
0x14000104b 1 case.0x140001023.5
|
||
0x14000105e 1 case.0x140001023.6
|
||
0x140001071 1 case.0x140001023.7
|
||
0x140001084 1 case.0x140001023.9
|
||
0x140001097 1 case.0x140001023.11
|
||
0x1400010aa 1 case.0x140001023.12
|
||
0x1400010bd 1 case.0x140001023.13
|
||
0x1400010d0 1 case.0x140001023.8
|
||
0x1400010d0 1 case.0x140001023.10
|
||
0x1400010d0 1 case.default.0x140001023
|
||
0x140004a40 1 case.default.0x140004b01
|
||
0x140004b47 1 case.0x140004b01.0
|
||
0x140004b4b 1 case.0x140004b01.1
|
||
0x140004b56 1 case.0x140004b01.2
|
||
0x140004b62 1 case.0x140004b01.3
|
||
0x140004b77 1 case.0x140004b01.4
|
||
0x140004b80 1 case.0x140004b01.5
|
||
0x140004b92 1 case.0x140004b01.6
|
||
0x140004ba5 1 case.0x140004b01.7
|
||
0x140004bc1 1 case.0x140004b01.8
|
||
0x140004bcb 1 case.0x140004b01.9
|
||
0x140004bde 1 case.0x140004b01.10
|
||
0x140004bf2 1 case.0x140004b01.11
|
||
0x140004c0f 1 case.0x140004b01.12
|
||
0x140004c20 1 case.0x140004b01.13
|
||
0x140004c3a 1 case.0x140004b01.14
|
||
0x140004c55 1 case.0x140004b01.15
|
||
0x140004c79 1 case.0x140004b01.16
|
||
EOF
|
||
RUN
|
||
|
||
NAME=test_switch_indirect.exe switch/case flags
|
||
FILE=bins/jmptbl/test_switch_indirect.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
s main
|
||
af
|
||
e asm.lines=false
|
||
pdf~case
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x140001012 0f871a010000 jnbe case.0x140001034.3
|
||
0x140001034 ffe1 jmp rcx ; switch table (99 cases) at 0x140001148
|
||
;-- case 1: ; from 0x140001034
|
||
0x140001036 488d0dd31100. lea rcx, qword str.case_1 ; 0x140002210 ; "case 1"
|
||
;-- case 2: ; from 0x140001034
|
||
0x14000104b 488d0dc61100. lea rcx, qword str.case_2 ; 0x140002218 ; "case 2"
|
||
;-- case 11: ; from 0x140001034
|
||
0x140001060 488d0db91100. lea rcx, qword str.case_11 ; 0x140002220 ; "case 11"
|
||
;-- case 13: ; from 0x140001034
|
||
0x140001075 488d0dac1100. lea rcx, qword str.case_13 ; 0x140002228 ; "case 13"
|
||
;-- case 15...16: ; from 0x140001034
|
||
0x14000108a 488d0d9f1100. lea rcx, qword str.case_15_and_16 ; 0x140002230 ; "case 15 and 16"
|
||
;-- case 19: ; from 0x140001034
|
||
0x14000109f 488d0d9a1100. lea rcx, qword str.case_19 ; 0x140002240 ; "case 19"
|
||
;-- case 50: ; from 0x140001034
|
||
0x1400010b4 488d0d8d1100. lea rcx, qword str.case_50 ; 0x140002248 ; "case 50"
|
||
;-- case 30: ; from 0x140001034
|
||
0x1400010c9 488d0d801100. lea rcx, qword str.case_30 ; 0x140002250 ; "case 30"
|
||
;-- case 20: ; from 0x140001034
|
||
0x1400010de 488d0d731100. lea rcx, qword str.case_20 ; 0x140002258 ; "case 20"
|
||
;-- case 10: ; from 0x140001034
|
||
0x1400010f3 488d0d661100. lea rcx, qword str.case_10 ; 0x140002260 ; "case 10"
|
||
;-- case 99: ; from 0x140001034
|
||
0x140001108 488d0d591100. lea rcx, qword str.case_99 ; 0x140002268 ; "case 99"
|
||
;-- case 97: ; from 0x140001034
|
||
0x14000111d 488d0d4c1100. lea rcx, qword str.case_97 ; 0x140002270 ; "case 97"
|
||
;-- case 3...9: ; from 0x140001034
|
||
;-- case 12: ; from 0x140001034
|
||
;-- case 14: ; from 0x140001034
|
||
;-- case 17...18: ; from 0x140001034
|
||
;-- case 21...29: ; from 0x140001034
|
||
;-- case 31...49: ; from 0x140001034
|
||
;-- case 51...96: ; from 0x140001034
|
||
;-- case 98: ; from 0x140001034
|
||
EOF
|
||
RUN
|
||
|
||
NAME=msvc_1900_64 switch/case flags
|
||
FILE=bins/jmptbl/test_msvc_1900_64.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
fl~switch
|
||
fl~case.
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x140001023 1 switch.0x140001023
|
||
0x140001f5b 1 switch.0x140001f5b
|
||
0x1400095b4 1 switch.0x1400095b4
|
||
0x140009670 1 switch.0x140009670
|
||
0x1400097b8 1 switch.0x1400097b8
|
||
0x14000c185 1 switch.0x14000c185
|
||
0x140001025 1 case.0x140001023.1
|
||
0x140001038 1 case.0x140001023.2
|
||
0x140001038 1 case.0x140001023.3
|
||
0x140001038 1 case.0x140001023.4
|
||
0x14000104b 1 case.0x140001023.5
|
||
0x14000105e 1 case.0x140001023.6
|
||
0x140001071 1 case.0x140001023.7
|
||
0x140001084 1 case.0x140001023.9
|
||
0x140001097 1 case.0x140001023.11
|
||
0x1400010aa 1 case.0x140001023.12
|
||
0x1400010bd 1 case.0x140001023.13
|
||
0x1400010d0 1 case.0x140001023.8
|
||
0x1400010d0 1 case.0x140001023.10
|
||
0x1400010d0 1 case.default.0x140001023
|
||
0x140001e3e 1 case.default.0x140001f5b
|
||
0x140001f60 1 case.0x140001f5b.15
|
||
0x140001f64 1 case.0x140001f5b.7
|
||
0x140001f67 1 case.0x140001f5b.3
|
||
0x140001f6b 1 case.0x140001f5b.1
|
||
0x140001f6e 1 case.0x140001f5b.0
|
||
0x140001f70 1 case.0x140001f5b.12
|
||
0x140001f74 1 case.0x140001f5b.4
|
||
0x140001f78 1 case.0x140001f5b.9
|
||
0x140001f80 1 case.0x140001f5b.13
|
||
0x140001f84 1 case.0x140001f5b.5
|
||
0x140001f90 1 case.0x140001f5b.14
|
||
0x140001f94 1 case.0x140001f5b.6
|
||
0x140001f97 1 case.0x140001f5b.2
|
||
0x140001f9c 1 case.0x140001f5b.8
|
||
0x140001fa0 1 case.0x140001f5b.11
|
||
0x140001fb0 1 case.0x140001f5b.10
|
||
0x140001fb8 1 case.0x140001f5b.16
|
||
0x1400095b6 1 case.0x1400095b4.1
|
||
0x1400095bd 1 case.0x1400095b4.2
|
||
0x1400095c4 1 case.0x1400095b4.3
|
||
0x1400095cb 1 case.0x1400095b4.4
|
||
0x1400095d2 1 case.0x1400095b4.5
|
||
0x1400095d9 1 case.0x1400095b4.6
|
||
0x1400095e0 1 case.0x1400095b4.7
|
||
0x1400095e7 1 case.0x1400095b4.8
|
||
0x1400095ee 1 case.0x1400095b4.9
|
||
0x1400095f5 1 case.0x1400095b4.10
|
||
0x1400095fc 1 case.0x1400095b4.11
|
||
0x140009603 1 case.0x1400095b4.12
|
||
0x14000960a 1 case.0x1400095b4.13
|
||
0x140009611 1 case.0x1400095b4.14
|
||
0x140009618 1 case.0x1400095b4.15
|
||
0x14000961d 1 case.default.0x1400095b4
|
||
0x140009672 1 case.0x140009670.0
|
||
0x140009681 1 case.0x140009670.1
|
||
0x140009690 1 case.0x140009670.2
|
||
0x14000969f 1 case.0x140009670.3
|
||
0x1400096ae 1 case.0x140009670.4
|
||
0x1400096ba 1 case.0x140009670.5
|
||
0x1400096c6 1 case.0x140009670.6
|
||
0x1400096d2 1 case.0x140009670.7
|
||
0x1400096de 1 case.0x140009670.8
|
||
0x1400096ea 1 case.0x140009670.9
|
||
0x1400096f6 1 case.0x140009670.10
|
||
0x140009702 1 case.0x140009670.11
|
||
0x14000970e 1 case.0x140009670.12
|
||
0x14000971a 1 case.0x140009670.13
|
||
0x140009726 1 case.0x140009670.14
|
||
0x140009732 1 case.0x140009670.15
|
||
0x140009735 1 case.default.0x140009670
|
||
0x1400097ba 1 case.0x1400097b8.0
|
||
0x1400097ba 1 case.0x140009670.16
|
||
0x1400097c1 1 case.0x1400097b8.1
|
||
0x1400097c1 1 case.0x140009670.17
|
||
0x1400097c8 1 case.0x1400097b8.2
|
||
0x1400097c8 1 case.0x140009670.18
|
||
0x1400097cf 1 case.0x1400097b8.3
|
||
0x1400097cf 1 case.0x140009670.19
|
||
0x1400097d6 1 case.0x1400097b8.4
|
||
0x1400097d6 1 case.0x140009670.20
|
||
0x1400097dd 1 case.0x1400097b8.5
|
||
0x1400097dd 1 case.0x140009670.21
|
||
0x1400097e4 1 case.0x1400097b8.6
|
||
0x1400097e4 1 case.0x140009670.22
|
||
0x1400097eb 1 case.0x1400097b8.7
|
||
0x1400097eb 1 case.0x140009670.23
|
||
0x1400097f2 1 case.0x1400097b8.8
|
||
0x1400097f2 1 case.0x140009670.24
|
||
0x1400097f9 1 case.0x1400097b8.9
|
||
0x1400097f9 1 case.0x140009670.25
|
||
0x140009800 1 case.0x1400097b8.10
|
||
0x140009800 1 case.0x140009670.26
|
||
0x140009807 1 case.0x1400097b8.11
|
||
0x140009807 1 case.0x140009670.27
|
||
0x14000980e 1 case.0x1400097b8.12
|
||
0x14000980e 1 case.0x140009670.28
|
||
0x140009815 1 case.0x1400097b8.13
|
||
0x140009815 1 case.0x140009670.29
|
||
0x14000981c 1 case.0x1400097b8.14
|
||
0x14000981c 1 case.0x140009670.30
|
||
0x140009823 1 case.0x1400097b8.15
|
||
0x140009823 1 case.0x140009670.31
|
||
0x140009826 1 case.default.0x1400097b8
|
||
0x14000c100 1 case.default.0x14000c185
|
||
0x14000c1d0 1 case.0x14000c185.0
|
||
0x14000c1d1 1 case.0x14000c185.2
|
||
0x14000c1d8 1 case.0x14000c185.8
|
||
0x14000c1df 1 case.0x14000c185.3
|
||
0x14000c1ef 1 case.0x14000c185.1
|
||
0x14000c1f5 1 case.0x14000c185.16
|
||
0x14000c200 1 case.0x14000c185.11
|
||
0x14000c21b 1 case.0x14000c185.4
|
||
0x14000c220 1 case.0x14000c185.5
|
||
0x14000c230 1 case.0x14000c185.6
|
||
0x14000c240 1 case.0x14000c185.7
|
||
0x14000c258 1 case.0x14000c185.13
|
||
0x14000c270 1 case.0x14000c185.9
|
||
0x14000c280 1 case.0x14000c185.10
|
||
0x14000c290 1 case.0x14000c185.12
|
||
0x14000c2a0 1 case.0x14000c185.14
|
||
0x14000c2c0 1 case.0x14000c185.15
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Jump table attached to wrong basic block bug
|
||
FILE=bins/elf/static-glibc-2.27
|
||
CMDS=<<EOF
|
||
aF @ 0x00459990
|
||
abil @ 0x00459aa7~outputs
|
||
EOF
|
||
EXPECT=<<EOF
|
||
outputs: 11
|
||
EOF
|
||
RUN
|
||
|
||
NAME=Microsoft x64 CC Args/Vars
|
||
FILE=bins/pe/testx64.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.comments=0
|
||
s 0x140001080
|
||
e analysis.cc=ms
|
||
af
|
||
pdf
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.140001080(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);
|
||
| ; arg int64_t arg1 @ rcx
|
||
| ; arg int64_t arg2 @ rdx
|
||
| ; arg int64_t arg3 @ r8
|
||
| ; arg int64_t arg4 @ r9
|
||
| ; var int64_t var_28h @ stack - 0x28
|
||
| ; var int64_t var_8h @ stack + 0x8
|
||
| ; var int64_t var_10h @ stack + 0x10
|
||
| ; var int64_t var_18h @ stack + 0x18
|
||
| ; var int64_t var_20h @ stack + 0x20
|
||
| 0x140001080 48894c2408 mov qword [var_8h], rcx
|
||
| 0x140001085 4889542410 mov qword [var_10h], rdx
|
||
| 0x14000108a 4c89442418 mov qword [var_18h], r8
|
||
| 0x14000108f 4c894c2420 mov qword [var_20h], r9
|
||
| 0x140001094 53 push rbx
|
||
| 0x140001095 56 push rsi
|
||
| 0x140001096 57 push rdi
|
||
| 0x140001097 4883ec30 sub rsp, 0x30
|
||
| 0x14000109b 488bf9 mov rdi, rcx
|
||
| 0x14000109e 488d742458 lea rsi, qword [var_10h]
|
||
| 0x1400010a3 33c9 xor ecx, ecx
|
||
| 0x1400010a5 ff15cd100000 call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
|
||
| 0x1400010ab 488bd8 mov rbx, rax
|
||
| 0x1400010ae e85dffffff call fcn.140001010
|
||
| 0x1400010b3 4533c9 xor r9d, r9d
|
||
| 0x1400010b6 4889742420 mov qword [var_28h], rsi
|
||
| 0x1400010bb 4c8bc7 mov r8, rdi
|
||
| 0x1400010be 488bd3 mov rdx, rbx
|
||
| 0x1400010c1 488b08 mov rcx, qword [rax]
|
||
| 0x1400010c4 ff159e100000 call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfscanf]
|
||
| 0x1400010ca 4883c430 add rsp, 0x30
|
||
| 0x1400010ce 5f pop rdi
|
||
| 0x1400010cf 5e pop rsi
|
||
| 0x1400010d0 5b pop rbx
|
||
\ 0x1400010d1 c3 ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 show registers in table
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
ar=
|
||
EOF
|
||
EXPECT=<<EOF
|
||
rax 0x0000000000000000 rbx 0x0000000000000000 rcx 0x0000000000000000 rdx 0x0000000000000000
|
||
rsi 0x0000000000000000 rdi 0x0000000000000000 r8 0x0000000000000000 r9 0x0000000000000000
|
||
r10 0x0000000000000000 r11 0x0000000000000000 r12 0x0000000000000000 r13 0x0000000000000000
|
||
r14 0x0000000000000000 r15 0x0000000000000000 rip 0x0000000000000000 rbp 0x0000000000000000
|
||
rflags 0x0000000000000000 rsp 0x0000000000000000
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 retpoline jmptbl
|
||
FILE=bins/elf/retpoline
|
||
CMDS=<<EOF
|
||
s 0x780
|
||
af
|
||
pdr~- case[2]
|
||
EOF
|
||
EXPECT=<<EOF
|
||
3:
|
||
2:
|
||
1:
|
||
0:
|
||
4:
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x86_64 retpoline disabled jmptbl
|
||
FILE=bins/elf/retpoline
|
||
CMDS=<<EOF
|
||
e analysis.jmp.retpoline=false
|
||
s 0x780
|
||
af
|
||
pdr~- case[2]
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=lea pseudo improvements (pseudo disabled)
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e asm.comments=false
|
||
e asm.pseudo=false
|
||
wx 544889e5b40266b83333b85555444448b8bebafecaefbeadde4889d8488d03488b4308488d4308488d041b488d441b0a488d430a488d44240c488d450b488d45f5488d442404488d4508488d45f8
|
||
aa
|
||
pd 19
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00000000(int64_t arg_3h, int64_t arg_4h);
|
||
| ; var int64_t var_13h @ stack - 0x13
|
||
| ; var int64_t var_10h @ stack - 0x10
|
||
| ; var int64_t var_4h @ stack - 0x4
|
||
| ; arg int64_t arg_3h @ stack + 0x3
|
||
| ; arg int64_t arg_4h @ stack + 0x4
|
||
| 0x00000000 54 push rsp
|
||
| 0x00000001 4889e5 mov rbp, rsp
|
||
| 0x00000004 b402 mov ah, 0x02
|
||
| 0x00000006 66b83333 mov ax, 0x3333
|
||
| 0x0000000a b855554444 mov eax, 0x44445555
|
||
| 0x0000000f 48b8bebafeca. mov rax, 0xdeadbeefcafebabe
|
||
| 0x00000019 4889d8 mov rax, rbx
|
||
| 0x0000001c 488d03 lea rax, qword [rbx]
|
||
| 0x0000001f 488b4308 mov rax, qword [rbx+0x08]
|
||
| 0x00000023 488d4308 lea rax, qword [rbx+0x08]
|
||
| 0x00000027 488d041b lea rax, qword [rbx+rbx*1]
|
||
| 0x0000002b 488d441b0a lea rax, qword [rbx+rbx*1+0x0a]
|
||
| 0x00000030 488d430a lea rax, qword [rbx+0x0a]
|
||
| 0x00000034 488d44240c lea rax, qword [arg_4h]
|
||
| 0x00000039 488d450b lea rax, qword [arg_3h]
|
||
| 0x0000003d 488d45f5 lea rax, qword [var_13h]
|
||
| 0x00000041 488d442404 lea rax, qword [var_4h]
|
||
| 0x00000046 488d4508 lea rax, qword [var_4h + 0x4]
|
||
| 0x0000004a 488d45f8 lea rax, qword [var_10h]
|
||
EOF
|
||
RUN
|
||
|
||
NAME=lea pseudo improvements (pseudo enabled)
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bytes=true
|
||
e asm.bits=64
|
||
e asm.comments=false
|
||
e asm.pseudo=true
|
||
wx 544889e5b40266b83333b85555444448b8bebafecaefbeadde4889d8488d03488b4308488d4308488d041b488d441b0a488d430a488d44240c488d450b488d45f5488d442404488d4508488d45f8
|
||
aa
|
||
pd 19
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00000000(int64_t arg_3h, int64_t arg_4h);
|
||
| ; var int64_t var_13h @ stack - 0x13
|
||
| ; var int64_t var_10h @ stack - 0x10
|
||
| ; var int64_t var_4h @ stack - 0x4
|
||
| ; arg int64_t arg_3h @ stack + 0x3
|
||
| ; arg int64_t arg_4h @ stack + 0x4
|
||
| 0x00000000 54 push rsp
|
||
| 0x00000001 4889e5 rbp = rsp
|
||
| 0x00000004 b402 ah = 0x02
|
||
| 0x00000006 66b83333 ax = 0x3333
|
||
| 0x0000000a b855554444 eax = 0x44445555
|
||
| 0x0000000f 48b8bebafeca. rax = 0xdeadbeefcafebabe
|
||
| 0x00000019 4889d8 rax = rbx
|
||
| 0x0000001c 488d03 rax = qword rbx
|
||
| 0x0000001f 488b4308 rax = qword [rbx+0x08]
|
||
| 0x00000023 488d4308 rax = qword rbx+0x08
|
||
| 0x00000027 488d041b rax = qword rbx+rbx*1
|
||
| 0x0000002b 488d441b0a rax = qword rbx+rbx*1+0x0a
|
||
| 0x00000030 488d430a rax = qword rbx+0x0a
|
||
| 0x00000034 488d44240c rax = qword arg_4h
|
||
| 0x00000039 488d450b rax = qword arg_3h
|
||
| 0x0000003d 488d45f5 rax = qword var_13h
|
||
| 0x00000041 488d442404 rax = qword var_4h
|
||
| 0x00000046 488d4508 rax = qword var_4h + 0x4
|
||
| 0x0000004a 488d45f8 rax = qword var_10h
|
||
EOF
|
||
RUN
|
||
|
||
NAME=xref graph
|
||
FILE=bins/pe/libzmq-v100-mt-4_0_4.dll
|
||
CMDS=<<EOF
|
||
aa
|
||
aac
|
||
axg @ 0x1004aa5e
|
||
axgj @ 0x1004aa5e~{}
|
||
EOF
|
||
EXPECT=<<EOF
|
||
- 0x1004aa5e fcn 0x1004aa5e fcn.1004aa5e
|
||
- 0x1004ab07 fcn 0x1004aaff fcn.1004aaff
|
||
- 0x1004aaff fcn 0x1004aaff fcn.1004aaff
|
||
- 0x1004ab94 ???
|
||
- 0x1004aba0 ???
|
||
- 0x1004d380 ???
|
||
- 0x1004d3cf ???
|
||
{
|
||
"268741214": {
|
||
"type": "fcn",
|
||
"fcn_addr": 268741214,
|
||
"name": "fcn.1004aa5e",
|
||
"refs": [
|
||
{
|
||
"268741383": {
|
||
"type": "fcn",
|
||
"fcn_addr": 268741375,
|
||
"name": "fcn.1004aaff",
|
||
"refs": [
|
||
{
|
||
"268741375": {
|
||
"type": "fcn",
|
||
"fcn_addr": 268741375,
|
||
"name": "fcn.1004aaff",
|
||
"refs": [
|
||
{
|
||
"268741524": {
|
||
"type": "???",
|
||
"refs": [
|
||
|
||
]
|
||
}
|
||
},
|
||
{
|
||
"268741536": {
|
||
"type": "???",
|
||
"refs": [
|
||
|
||
]
|
||
}
|
||
},
|
||
{
|
||
"268751744": {
|
||
"type": "???",
|
||
"refs": [
|
||
|
||
]
|
||
}
|
||
},
|
||
{
|
||
"268751823": {
|
||
"type": "???",
|
||
"refs": [
|
||
|
||
]
|
||
}
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
}
|
||
}
|
||
EOF
|
||
RUN
|
||
|
||
NAME=dwarf attribute kind check
|
||
FILE=bins/elf/dwarf_attr_check
|
||
CMDS=<<EOF
|
||
aaa
|
||
EOF
|
||
EXPECT=
|
||
RUN
|
||
|
||
NAME=x86_64 int64_t variable overlapping removal
|
||
FILE=bins/elf/arch-x86_64-ls
|
||
CMDS=<<EOF
|
||
s 0x10270
|
||
af
|
||
afs
|
||
afvl
|
||
aaft
|
||
afs
|
||
afvl
|
||
EOF
|
||
EXPECT=<<EOF
|
||
void fcn.00010270(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg5);
|
||
var int64_t var_c8h @ stack - 0xc8
|
||
var int64_t var_c7h @ stack - 0xc7
|
||
var int64_t var_c0h @ stack - 0xc0
|
||
var int64_t var_b8h @ stack - 0xb8
|
||
var int64_t var_b0h @ stack - 0xb0
|
||
var int64_t var_a8h @ stack - 0xa8
|
||
var int64_t var_98h @ stack - 0x98
|
||
var int64_t var_94h @ stack - 0x94
|
||
var int64_t var_90h @ stack - 0x90
|
||
var int64_t var_88h @ stack - 0x88
|
||
var int64_t var_80h @ stack - 0x80
|
||
var int64_t var_7ch @ stack - 0x7c
|
||
var int64_t var_7ah @ stack - 0x7a
|
||
var int64_t var_78h @ stack - 0x78
|
||
var int64_t var_40h @ stack - 0x40
|
||
arg int64_t arg5 @ r8
|
||
arg int64_t arg4 @ rcx
|
||
arg int64_t arg1 @ rdi
|
||
arg int64_t arg3 @ rdx
|
||
arg int64_t arg2 @ rsi
|
||
void fcn.00010270(int64_t arg1, int64_t arg2, const char **s, int64_t arg4, int64_t arg5);
|
||
var const char *s2 @ stack - 0xc8
|
||
var void *s1 @ stack - 0xc0
|
||
var unsigned long var_b8h @ stack - 0xb8
|
||
var int64_t var_b0h @ stack - 0xb0
|
||
var int64_t var_a8h @ stack - 0xa8
|
||
var unsigned long var_98h @ stack - 0x98
|
||
var int64_t var_94h @ stack - 0x94
|
||
var int64_t var_90h @ stack - 0x90
|
||
var int64_t var_88h @ stack - 0x88
|
||
var const char **var_80h @ stack - 0x80
|
||
var int64_t var_78h @ stack - 0x78
|
||
var int64_t var_40h @ stack - 0x40
|
||
arg int64_t arg5 @ r8
|
||
arg int64_t arg4 @ rcx
|
||
arg int64_t arg1 @ rdi
|
||
arg const char **s @ rdx
|
||
arg int64_t arg2 @ rsi
|
||
EOF
|
||
RUN
|
||
|
||
NAME=double jump function
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx 7421eb1a4889c3488d45d04889c7e8450000004889d84889c7e874feffffe82ffeffff4883c4485b5dc3
|
||
af
|
||
afbt
|
||
EOF
|
||
EXPECT=<<EOF
|
||
addr size jump fail
|
||
--------------------
|
||
0x0 2 0x23 0x2
|
||
0x2 2 0x1e -1
|
||
0x1e 5 0x23 -1
|
||
0x23 7 -1 -1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=analysis endsize
|
||
FILE=bins/elf/libc.so.6
|
||
CMDS=<<EOF
|
||
s 0x000a3a20
|
||
af
|
||
afbt
|
||
EOF
|
||
EXPECT=<<EOF
|
||
addr size jump fail
|
||
-----------------------------
|
||
0xa3a20 17 0xa3b4b 0xa3a31
|
||
0xa3a31 10 0xa3b9a 0xa3a3b
|
||
0xa3a3b 17 -1 -1
|
||
0xa3b4a 1 -1 -1
|
||
0xa3b4b 5 0xa3b62 0xa3b50
|
||
0xa3b50 5 0xa3b73 0xa3b55
|
||
0xa3b55 5 0xa3b80 0xa3b5a
|
||
0xa3b5a 2 0xa3b61 0xa3b5c
|
||
0xa3b5c 5 0xa3b61 -1
|
||
0xa3b61 1 -1 -1
|
||
0xa3b62 17 -1 -1
|
||
0xa3b73 13 -1 -1
|
||
0xa3b80 17 -1 -1
|
||
0xa3b9a 9 0xa3c13 0xa3ba3
|
||
0xa3ba3 6 0xa3bf0 0xa3ba9
|
||
0xa3ba9 71 -1 -1
|
||
0xa3bf0 35 -1 -1
|
||
0xa3c13 9 0xa3ca8 0xa3c1c
|
||
0xa3c1c 6 0xa3b4a 0xa3c22
|
||
0xa3c22 65 0xa3d2f 0xa3c63
|
||
0xa3c63 48 0xa3c63 0xa3c93
|
||
0xa3c93 21 -1 -1
|
||
0xa3ca8 63 0xa3d96 0xa3ce7
|
||
0xa3ce7 52 0xa3ce7 0xa3d1b
|
||
0xa3d1b 20 -1 -1
|
||
0xa3d2f 13 0xa3c63 0xa3d3c
|
||
0xa3d3c 66 0xa3d3c 0xa3d7e
|
||
0xa3d7e 24 -1 -1
|
||
0xa3d96 13 0xa3ce7 0xa3da3
|
||
0xa3da3 67 0xa3da3 0xa3de6
|
||
0xa3de6 23 -1 -1
|
||
EOF
|
||
RUN
|
||
|
||
NAME=X86_INSTR_POP wrong order
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e io.va=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
aei
|
||
aeim
|
||
ar rdi=0x178000
|
||
ar rsp=rdi-0x30
|
||
wa "push rbp ; mov rbp,rsp ; lea rsp,[rdi+8] ; push rsp; pop rsp ; push 0x1337 ; pop qword ptr [rsp] ; pop qword ptr [rsp] ; pop qword ptr [rsp] ; pop qword ptr [rsp] ; mov rsp,rbp ; pop rbp ; ret"
|
||
13aes
|
||
pxQ 0x28 @ 0+rdi
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00178000 0x0000000000001337 rax+4919
|
||
0x00178008 0x0000000000001337 rax+4919
|
||
0x00178010 0x0000000000001337 rax+4919
|
||
0x00178018 0x0000000000001337 rax+4919
|
||
0x00178020 0x0000000000001337 rax+4919
|
||
EOF
|
||
RUN
|
||
|
||
NAME=axf string false positive
|
||
FILE=bins/elf/echo
|
||
CMDS=<<EOF
|
||
# make sure none of the analysis produces incorrect redundant xref see rizinorg/rizin#1828
|
||
aaa
|
||
axf @ 0xef8
|
||
EOF
|
||
EXPECT=<<EOF
|
||
d 0x11f4 str.Missing_argument
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aoj incorrect immediate value
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e io.va=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
wx "c6442428d6"
|
||
aoj~{[0].opex.operands[1].value}
|
||
EOF
|
||
EXPECT=<<EOF
|
||
214
|
||
EOF
|
||
RUN
|
||
|
||
NAME=aac creates function at syn_start_line
|
||
FILE=bins/elf/vim
|
||
CMDS=<<EOF
|
||
aac
|
||
s 0x001b8420
|
||
afl.
|
||
pdf @ sym.syn_start_line
|
||
pd 2 @ sym.syntax_start
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x001b8420 sym.syn_start_line
|
||
; CALL XREFS from sym.syntax_start @ 0x1b9f10, 0x1b9fca, 0x1ba458
|
||
/ sym.syn_start_line();
|
||
| 0x001b8420 sub rsp, 0x08
|
||
| 0x001b8424 mov eax, dword [0x004b3d90] ; [0x4b3d90:4]=0
|
||
| 0x001b842a mov dword [0x004b3da8], 0x00 ; [0x4b3da8:4]=0
|
||
| 0x001b8434 mov dword [0x004b3db0], 0x00 ; [0x4b3db0:4]=0
|
||
| 0x001b843e test eax, eax
|
||
| ,=< 0x001b8440 jle 0x1b8451
|
||
| | 0x001b8442 mov edi, 0x01
|
||
| | 0x001b8447 call sym.syn_update_ends
|
||
| | 0x001b844c call sym.check_state_ends
|
||
| `-> 0x001b8451 mov dword [0x004b3e18], 0xffffffff ; [0x4b3e18:4]=0
|
||
| 0x001b845b add dword [0x004b3d74], 0x01 ; [0x4b3d74:4]=0
|
||
| 0x001b8462 add rsp, 0x08
|
||
\ 0x001b8466 ret
|
||
; CALL XREFS from sym.win_line @ 0x181983, 0x185a31
|
||
; CALL XREF from sym.syn_get_foldlevel @ 0x1ba870
|
||
; CALL XREF from sym.syn_get_id @ 0x1baad1
|
||
/ sym.syntax_start(int64_t arg_fh);
|
||
| ; var int64_t var_70h @ stack - 0x70
|
||
| ; var int64_t var_64h @ stack - 0x64
|
||
| ; var int64_t var_60h @ stack - 0x60
|
||
| ; var int64_t var_58h @ stack - 0x58
|
||
| ; var int64_t var_50h @ stack - 0x50
|
||
| ; var int64_t var_48h @ stack - 0x48
|
||
| ; var int64_t var_40h @ stack - 0x40
|
||
| ; arg int64_t arg_fh @ stack + 0xf
|
||
| 0x001b9b30 push r15
|
||
| 0x001b9b32 push r14
|
||
EOF
|
||
RUN
|
||
NAME=global variables populated from ELF OBJ symbols without DWARF
|
||
FILE=bins/elf/dectest64
|
||
CMDS=<<EOF
|
||
aaa
|
||
avgl~global_var
|
||
avgl~global_array
|
||
EOF
|
||
EXPECT=<<EOF
|
||
global uint8_t [4] global_var @ 0x404050
|
||
global uint8_t [8] global_array @ 0x404058
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x64 structured exception handling xframe
|
||
FILE=bins/pe/microsoft_seh_tests/x64/xframe_eh_exe.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
pdf @ main
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; CALL XREF from entry0 @ 0x1400019cb
|
||
/ int main(int argc, char **argv, char **envp);
|
||
| 0x140001770 sub rsp, 0x28
|
||
| 0x140001774 call fcn.140001590
|
||
| 0x140001779 call fcn.140001000
|
||
| 0x14000177e call fcn.140001220
|
||
| 0x140001783 lea rcx, qword str.Caught_Exceptions_Test_PASSED. ; 0x140003320 ; "Caught Exceptions Test PASSED." ; const char *s
|
||
| 0x14000178a call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x1400031a0:8]=0x3e22 ; "\">" ; int puts(const char *s)
|
||
| 0x140001790 call fcn.1400016a0
|
||
| 0x140001795 lea rcx, qword str.Resumed_Exceptions_Test_PASSED. ; 0x140003340 ; "Resumed Exceptions Test PASSED." ; const char *s
|
||
| 0x14000179c call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x1400031a0:8]=0x3e22 ; "\">" ; int puts(const char *s)
|
||
| 0x1400017a2 xor eax, eax
|
||
| 0x1400017a4 add rsp, 0x28
|
||
\ 0x1400017a8 ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=x64 structured exception handling
|
||
FILE=bins/pe/seh_x64.exe
|
||
CMDS=<<EOF
|
||
aaa
|
||
pdf @ main
|
||
EOF
|
||
EXPECT=<<EOF
|
||
; CALL XREF from entry0 @ 0x140001433
|
||
/ int main(int argc, char **argv, char **envp);
|
||
| ; arg int argc @ rcx
|
||
| ; arg char **argv @ rdx
|
||
| ; var int64_t var_18h @ stack - 0x18
|
||
| ; var int64_t var_8h @ stack + 0x8
|
||
| 0x140001010 mov qword [var_8h], rbx
|
||
| 0x140001015 push rdi
|
||
| 0x140001016 sub rsp, 0x30
|
||
| 0x14000101a mov rbx, rdx ; argv
|
||
| 0x14000101d mov edi, 0xbadbeef
|
||
| 0x140001022 cmp ecx, 0x01 ; 1 ; argc
|
||
| ,=< 0x140001025 jle 0x140001048
|
||
| | 0x140001027 lea rcx, qword str.Writing_to_invalid_pointer. ; 0x140002330 ; "Writing to invalid pointer." ; const char *s
|
||
| | 0x14000102e call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x140002180:8]=0x2cbe ; int puts(const char *s)
|
||
| | 0x140001034 mov rcx, qword [rbx+0x08] ; const char *str
|
||
| | 0x140001038 call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi] ; [0x140002098:8]=0x2ca4 ; int atoi(const char *str)
|
||
| | 0x14000103e mov ebx, eax
|
||
| | 0x140001040 mov dword [var_18h], eax
|
||
| | 0x140001044 mov dword [rdi], eax
|
||
| ,==< 0x140001046 jmp 0x14000104c
|
||
| |`-> 0x140001048 mov ebx, dword [var_18h]
|
||
| | ; CODE XREF from main @ 0x140001046
|
||
| `--> 0x14000104c lea rcx, qword str.Try_dividing_by_zero. ; 0x140002350 ; "Try dividing by zero." ; const char *s
|
||
| 0x140001053 call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x140002180:8]=0x2cbe ; int puts(const char *s)
|
||
| 0x140001059 mov eax, ebx
|
||
| 0x14000105b cdq
|
||
| 0x14000105c xor ecx, ecx
|
||
| 0x14000105e idiv ecx
|
||
| 0x140001060 mov dword [var_18h], eax
|
||
| ,=< 0x140001064 jmp 0x140001074
|
||
| | ; CODE XREF from main @ 0x14000104c
|
||
| | 0x140001066 lea rcx, qword str.Inside_nested_except_block ; 0x140002368 ; "Inside nested except block!" ; const char *s
|
||
| | 0x14000106d call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x140002180:8]=0x2cbe ; int puts(const char *s)
|
||
| | 0x140001073 nop
|
||
| | ; CODE XREF from main @ 0x140001064
|
||
| ,`-> 0x140001074 jmp 0x1400010a2
|
||
| | ; CODE XREF from main @ 0x140001022
|
||
| | 0x140001076 lea rcx, qword str.Inside_exception_handler ; 0x140002388 ; "Inside exception handler!\n" ; const char *s
|
||
| | 0x14000107d call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x140002180:8]=0x2cbe ; int puts(const char *s)
|
||
| | 0x140001083 nop
|
||
| | 0x140001084 mov edx, 0xbadbeef ; int64_t arg2
|
||
| | 0x140001089 mov ecx, dword [var_18h] ; int64_t arg1
|
||
| | 0x14000108d call fcn.140001170
|
||
| |,=< 0x140001092 jmp 0x1400010a2
|
||
| || ; CODE XREF from main @ 0x140001084
|
||
| || 0x140001094 lea rcx, qword str.Divide_by_zero_exception ; 0x1400023a8 ; "Divide by zero exception!" ; const char *s
|
||
| || 0x14000109b call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts] ; [0x140002180:8]=0x2cbe ; int puts(const char *s)
|
||
| || 0x1400010a1 nop
|
||
| || ; CODE XREFS from main @ 0x140001074, 0x140001092
|
||
| ``-> 0x1400010a2 xor eax, eax
|
||
| 0x1400010a4 mov rbx, qword [var_8h]
|
||
| 0x1400010a9 add rsp, 0x30
|
||
| 0x1400010ad pop rdi
|
||
\ 0x1400010ae ret
|
||
EOF
|
||
RUN
|
||
|
||
NAME=do not mark coincidental imm in non-exec segment as data
|
||
FILE=bins/elf/hello-freebsd-x64
|
||
CMDS=<<EOF
|
||
e io.cache=true
|
||
s 0x002015ae
|
||
wa "and dword [rbp-8], 0x0020001f"
|
||
aaa
|
||
Cdl~0x0020001f
|
||
EOF
|
||
EXPECT=<<EOF
|
||
EOF
|
||
RUN
|
||
|
||
NAME=data block should not bleed across section or map boundary
|
||
FILE=bins/elf/hello-freebsd-x64
|
||
CMDS=<<EOF
|
||
aaa
|
||
# map at 0x200000 ends at 0x0020059b = 1435 bytes
|
||
oml~0x00200000
|
||
# should not be 5536 bytes (upto next fxn at 0x002015a0), cap at next section
|
||
Cdl~0x00200000
|
||
echo "===not bleed across section==="
|
||
e io.cache=true
|
||
s 0x002015ae
|
||
wa "add dword [0x00200546], 1"
|
||
aaa
|
||
# 0x00200546 is in section gap
|
||
# should be caped at next section, 2 bytes ahead
|
||
# should not be 4186 bytes (upto next fxn at 0x002015a0)
|
||
Cdl~0x00200546
|
||
echo "===handle section gap==="
|
||
wa "add dword [0x00200544], 1"
|
||
aaa
|
||
# 0x00200544 is in .rodata
|
||
s 0x00200544
|
||
iS.
|
||
# should be caped to curr section end, 2 bytes ahead
|
||
# should not be 4188 bytes (upto next fxn at 0x002015a0)
|
||
Cdl~0x00200544
|
||
echo "===cap at map end==="
|
||
s 0x002015ae
|
||
wa "add dword [0x00200562], 1"
|
||
aaa
|
||
# 0x00200562 is last section before unmapped
|
||
# so data block should cap at curr map end 0x0020059b = 57 bytes,
|
||
# should not be 4158 bytes (upto next fxn at 0x002015a0)
|
||
Cdl~0x00200562
|
||
EOF
|
||
EXPECT=<<EOF
|
||
2 fd: 3 +0x00000000 0x00200000 - 0x0020059b r-- fmap.LOAD0
|
||
0x00200000 data Cd 680
|
||
===not bleed across section===
|
||
0x00200546 data Cd 2
|
||
===handle section gap===
|
||
paddr size vaddr vsize align perm name type flags
|
||
---------------------------------------------------------------------------------
|
||
0x00000538 0xe 0x00200538 0xe 0x0 -r-- .rodata PROGBITS alloc,merge,strings
|
||
0x00200544 data Cd 2
|
||
===cap at map end===
|
||
0x00200562 data Cd 58
|
||
EOF
|
||
RUN
|