mirror of
https://github.com/rizinorg/rizin
synced 2026-08-22 20:26:16 -04:00
0f0582d77b
* rz-sign: fix CRLF handling in FLIRT .pat parsing * test: use Fd to dump CRLF FLIRT .pat file * test: use issue-provided CRLF FLIRT .pat sample --------- Co-authored-by: Giovanni <561184+wargio@users.noreply.github.com>
579 lines
21 KiB
Text
579 lines
21 KiB
Text
NAME=aa ; Fs libc-v7.sig ; no old flag
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=aa ; Fs bins/other/sigs/libc-v7.sig ; pd 10 @ flirt.libc_start_main
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
|
|
; CALL XREF from entry0 @ 0x401384
|
|
/ flirt.libc_start_main(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg5, int64_t arg6, int64_t arg_8h);
|
|
| ; arg int64_t arg1 @ rdi
|
|
| ; arg int64_t arg2 @ rsi
|
|
| ; arg int64_t arg3 @ rdx
|
|
| ; arg int64_t arg4 @ rcx
|
|
| ; arg int64_t arg5 @ r8
|
|
| ; arg int64_t arg6 @ r9
|
|
| ; var int64_t var_ach @ stack - 0xac
|
|
| ; var int64_t var_a8h @ stack - 0xa8
|
|
| ; var int64_t var_a0h @ stack - 0xa0
|
|
| ; var int64_t var_98h @ stack - 0x98
|
|
| ; var int64_t var_50h @ stack - 0x50
|
|
| ; var int64_t var_48h @ stack - 0x48
|
|
| ; arg int64_t arg_8h @ stack + 0x8
|
|
| 0x004e2420 push r14
|
|
| 0x004e2422 push r13
|
|
| 0x004e2424 mov eax, 0x00
|
|
| 0x004e2429 push r12
|
|
| 0x004e242b push rbp
|
|
| 0x004e242c mov r12, r8 ; arg5
|
|
| 0x004e242f push rbx
|
|
| 0x004e2430 mov rbp, rcx ; arg4
|
|
| 0x004e2433 mov r13, r9 ; arg6
|
|
| 0x004e2436 sub rsp, 0x90
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Fd libc-v7.sig
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=Fd bins/other/sigs/libc-v7.sig
|
|
EXPECT=<<EOF
|
|
SIG format
|
|
Signature: , 1 modules
|
|
Version: 7
|
|
Architecture: 0 (x86)
|
|
41564155B8........4154554D89C4534889CD4D89CD4881EC900000004885C0:
|
|
0. 16 D2A2 0298 0000:__libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=af ; af ; Fs libc-v7.sig - rzshell
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=s 0x4e2420 ; af ; s 0x4e25c7 ; af ; Fs bins/other/sigs/libc-v7.sig ; afl ~4e2420
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
|
|
0x004e2420 40 664 flirt.libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=af ; af ; Fs libc-v7.sig
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=<<EOF
|
|
s 0x4e2420
|
|
af
|
|
s 0x4e25c7
|
|
af
|
|
Fs bins/other/sigs/libc-v7.sig
|
|
afl~4e2420
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
|
|
0x004e2420 40 664 flirt.libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=aa ; Fs libc-v10.sig
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=aa ; Fs bins/other/sigs/libc-v10.sig
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Fd libc-v10.sig (malformed v10)
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=Fd bins/other/sigs/libc-v10.sig
|
|
EXPECT=<<EOF
|
|
SIG format
|
|
Signature: FLIRT v10, 1 modules
|
|
Version: 10
|
|
Architecture: 0 (x86)
|
|
41564155B8........4154554D89C4534889CD4D89CD4881EC900000004885C0:
|
|
0. 16 D2A2 0298 0000:__libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=af ; af ; Fs libc-v10.sig - rzshell
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=s 0x4e2420 ; af ; s 0x4e25c7 ; af ; Fs bins/other/sigs/libc-v10.sig ; afl ~4e2420
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
|
|
0x004e2420 40 664 flirt.libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=af ; af ; Fs libc-v10.sig
|
|
FILE=bins/elf/analysis/pid_stripped
|
|
CMDS=<<EOF
|
|
s 0x4e2420
|
|
af
|
|
s 0x4e25c7
|
|
af
|
|
Fs bins/other/sigs/libc-v10.sig
|
|
afl~4e2420
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
|
|
0x004e2420 40 664 flirt.libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Fs on static glibc
|
|
FILE=bins/elf/static-glibc-2.27
|
|
CMDS=<<EOF
|
|
aac
|
|
Fs bins/other/sigs/libc6_2.27-3ubuntu1_amd64.sig~silence
|
|
fl @F:flirt
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x004004d1 86 flirt.malloc_assert.constprop.13
|
|
0x00400527 35 flirt.gconv_release_step.part.1
|
|
0x0040054a 79 flirt.length_mismatch
|
|
0x00400b70 613 flirt.get_common_indeces.constprop.1
|
|
0x00400de0 1657 flirt.libc_start_main
|
|
0x00401460 385 flirt.libc_check_standard_fds
|
|
0x004015f0 581 flirt.libc_setup_tls
|
|
0x00401930 339 flirt.assert_fail_base
|
|
0x00401a90 80 flirt.assert_fail
|
|
0x00401ae0 15 flirt.dcgettext
|
|
0x00403840 672 flirt.nl_find_domain
|
|
0x00403ae0 5366 flirt.nl_load_domain
|
|
0x004054e0 601 flirt.cxa_finalize
|
|
0x004056b0 1488 flirt.nl_make_l10nflist
|
|
0x00405c80 286 flirt.nl_normalize_codeset
|
|
0x00405da0 574 flirt.nl_explode_name
|
|
0x00405fe0 28945 flirt.gettext_free_exp
|
|
0x0040d100 2128 flirt.gettextparse
|
|
0x0040d950 256 flirt.gettext_extract_plural
|
|
0x0040da50 60 flirt.hash_string
|
|
0x0040da90 7 flirt.umount
|
|
0x0040dbb0 561 flirt.abort
|
|
0x0040ddf0 1092 flirt.msort_with_tmp.part.0
|
|
0x0040e240 1152 flirt.qsort_r
|
|
0x0040e6c0 8 flirt.qsort
|
|
0x0040e6d0 212 flirt.getenv
|
|
0x0040e7b0 636 flirt.run_exit_handlers
|
|
0x0040ea30 32 flirt.exit
|
|
0x0040ea50 288 flirt.new_exitfn
|
|
0x0040ec70 250 flirt.cxa_atexit
|
|
0x0040f430 542 flirt.correctly_grouped_prefixmb
|
|
0x0040f650 192 flirt.asprintf
|
|
0x0040f710 368 flirt.locked_vfxprintf
|
|
0x0040f880 784 flirt.fxprintf
|
|
0x0040fe20 33103 flirt.IO_fflush
|
|
0x00410210 429 flirt.IO_puts
|
|
0x00410410 1898 flirt.adjust_wide_data
|
|
0x004115d0 1182 flirt.IO_wdo_write
|
|
0x00411f00 400 flirt.IO_vasprintf
|
|
0x00412090 374 flirt.libc_message.constprop.0
|
|
0x00412210 743 flirt.libc_message
|
|
0x00412500 32 flirt.libc_fatal
|
|
0x00412520 32 flirt.IO_vtable_check
|
|
0x00412540 164 flirt.fgets_unlocked
|
|
0x00415430 461 flirt.save_for_backup
|
|
0x00415b80 720 flirt.IO_un_link
|
|
0x00415e50 661 flirt.IO_link_in
|
|
0x004160f0 43 flirt.IO_switch_to_main_get_area
|
|
0x00416150 151 flirt.IO_switch_to_get_mode
|
|
0x004161f0 74 flirt.IO_free_backup_area
|
|
0x00416240 112 flirt.overflow
|
|
0x004162b0 490 flirt.underflow
|
|
0x004164a0 514 flirt.uflow
|
|
0x004166b0 93 flirt.IO_setb
|
|
0x00416710 175 flirt.IO_doallocbuf
|
|
0x00416830 258 flirt.IO_default_xsputn
|
|
0x00416c30 292 flirt.IO_default_setbuf
|
|
0x004170c0 327 flirt.IO_no_init
|
|
0x00417550 127 flirt.IO_sputbackc
|
|
0x00417650 64 flirt.IO_adjust_column
|
|
0x00418090 106 flirt.IO_unsave_markers
|
|
0x004234b0 65 flirt.strdup
|
|
0x0042b6b0 1022 flirt.memcmp_sse2
|
|
0x00447cf0 1568 flirt.handle_amd
|
|
0x00448310 37 flirt.cache_sysconf
|
|
0x00448380 9 flirt.wmemcpy
|
|
0x004491d0 80 flirt.get_child_max
|
|
0x004492c0 288 flirt.libc_open64
|
|
0x004493e0 160 flirt.open64_nocancel
|
|
0x00449480 153 flirt.libc_read
|
|
0x00449520 36 flirt.read_nocancel
|
|
0x00449550 153 flirt.libc_write
|
|
0x004495f0 44 flirt.write_nocancel
|
|
0x00449650 464 flirt.libc_fcntl
|
|
0x00449820 125 flirt.close
|
|
0x004498a0 42 flirt.close_nocancel
|
|
0x004498d0 1811 flirt.getcwd
|
|
0x0044a030 142 flirt.sbrk
|
|
0x0044a0c0 64 flirt.getpagesize
|
|
0x0044a100 80 flirt.getdtablesize
|
|
0x0044b070 432 flirt.next_line
|
|
0x0044b220 1168 flirt.get_nprocs
|
|
0x0044b6b0 224 flirt.get_nprocs_conf
|
|
0x0044b790 144 flirt.get_phys_pages
|
|
0x0044b820 144 flirt.get_avphys_pages
|
|
0x0044b8b0 17 flirt.getclktck
|
|
0x0044b8d0 82 flirt.init_misc
|
|
0x0044b990 64 flirt.libc_alloca_cutoff
|
|
0x0044ba20 86 flirt.libc_enable_asynccancel
|
|
0x0044ba80 89 flirt.libc_disable_asynccancel
|
|
0x0044baf0 32 flirt.stack_chk_fail
|
|
0x0044bb10 97 flirt.fortify_fail_abort
|
|
0x0044bb80 32 flirt.fortify_fail
|
|
0x0044c310 1038 flirt.dl_aux_init
|
|
0x0044c720 2296 flirt.dl_non_dynamic_init
|
|
0x0044d020 69 flirt.libc_init_secure
|
|
0x0044de00 1296 flirt.gconv_open
|
|
0x0044e310 528 flirt.gconv
|
|
0x0044e520 89 flirt.gconv_close
|
|
0x0044f6c0 1168 flirt.insert_module
|
|
0x0044fb50 1008 flirt.gconv_get_path
|
|
0x0044ff40 1504 flirt.gconv_read_conf
|
|
0x00450520 602 flirt.gconv_get_builtin_trans
|
|
0x00458320 18 flirt.release_libc_mem
|
|
0x004585d0 692 flirt.new_composite_name
|
|
0x00459170 2074 flirt.nl_find_locale
|
|
0x00459990 576 flirt.nl_intern_locale_data
|
|
0x00459bd0 1488 flirt.nl_load_locale
|
|
0x0045a1a0 94 flirt.nl_unload_locale
|
|
0x0045a200 1312 flirt.nl_load_locale_from_archive
|
|
0x0045a870 80 flirt.setfpucw
|
|
0x0045a8c0 132 flirt.sigsetjmp
|
|
0x0045abc0 6232 flirt.quicksort
|
|
0x0045c620 19 flirt.libc_secure_getenv
|
|
0x0045ce30 10704 flirt.group_number
|
|
0x0045f800 13172 flirt.IO_vfprintf_internal
|
|
0x00462b80 976 flirt.hack_digit
|
|
0x00465a50 11033 flirt.printf_fp
|
|
0x00468470 192 flirt.asprintf_1
|
|
0x00468530 11072 flirt.i18n_number_rewrite
|
|
0x0046b070 13435 flirt.IO_vfwprintf
|
|
0x0046e540 1929 flirt.parse_one_specmb
|
|
0x0046ecd0 2211 flirt.parse_one_specwc
|
|
0x0046f6d0 314 flirt.IO_fputs
|
|
0x0046f8e0 413 flirt.IO_fwrite
|
|
0x0046fae0 727 flirt.IO_getdelim
|
|
0x0046fe10 349 flirt.IO_getline
|
|
0x004700f0 320 flirt.IO_padn
|
|
0x00470230 320 flirt.IO_wpadn
|
|
0x00470370 637 flirt.save_for_wbackup.isra.0
|
|
0x004706b0 109 flirt.IO_wsetb
|
|
0x004709d0 117 flirt.woverflow
|
|
0x00470e40 685 flirt.IO_wdefault_xsputn
|
|
0x00471530 155 flirt.IO_wdoallocbuf
|
|
0x00471640 114 flirt.IO_switch_to_wget_mode
|
|
0x004716c0 99 flirt.IO_free_wbackup_area
|
|
0x004720c0 165 flirt.libc_scratch_buffer_grow_preserve
|
|
0x00472170 184 flirt.libc_scratch_buffer_set_array_size
|
|
0x00472230 73 flirt.strndup
|
|
0x00472280 451 flirt.strerror_r
|
|
0x00472480 102 flirt.strtok_r
|
|
0x00472cc0 218 flirt.argz_create_sep
|
|
0x00472da0 183 flirt.argz_add_sep
|
|
0x00473890 9 flirt.wmemcpy_2
|
|
0x004738a0 9 flirt.wmemcpy_1
|
|
0x00473ab0 480 flirt.wcrtomb
|
|
0x00473c90 806 flirt.wcsrtombs
|
|
0x00473fc0 32 flirt.wcschrnul
|
|
0x00474a40 8 flirt.time
|
|
0x00474f90 139 flirt.rewinddir
|
|
0x00475020 141 flirt.getdents
|
|
0x004750b0 192 flirt.fdopendir
|
|
0x004751a0 8 flirt.getuid
|
|
0x004751b0 8 flirt.geteuid
|
|
0x004751c0 8 flirt.getgid
|
|
0x004751d0 8 flirt.getegid
|
|
0x00475450 256 flirt.isatty
|
|
0x00475640 63 flirt.towctrans
|
|
0x00475680 496 flirt.readonly_area
|
|
0x00475870 8192 flirt.is_trusted_path_normalize
|
|
0x00477870 686 flirt.dl_dst_count
|
|
0x00477b20 2717 flirt.dl_dst_substitute
|
|
0x004785c0 735 flirt.dl_init_paths
|
|
0x004788a0 4202 flirt.dl_map_object
|
|
0x00479910 3696 flirt.do_lookup_x
|
|
0x0047a780 2747 flirt.dl_lookup_symbol_x
|
|
0x0047b240 176 flirt.dl_setup_hash
|
|
0x0047b2f0 181 flirt.dl_add_to_namespace_list
|
|
0x0047b3b0 783 flirt.dl_new_object
|
|
0x0047d260 2000 flirt.dl_important_hwcaps
|
|
0x0047da30 1446 flirt.dl_debug_vdprintf
|
|
0x0047dfe0 138 flirt.dl_sysdep_read_whole_file
|
|
0x0047e070 162 flirt.dl_debug_printf
|
|
0x0047e120 162 flirt.dl_debug_printf_c
|
|
0x0047e1d0 148 flirt.dl_dprintf
|
|
0x0047e270 102 flirt.dl_name_match_p
|
|
0x0047e2e0 117 flirt.dl_higher_prime_number
|
|
0x0047e360 340 flirt.dl_strtoul
|
|
0x0047eed0 354 flirt.dl_next_tls_modid
|
|
0x0047f060 202 flirt.dl_allocate_tls_storage
|
|
0x0047f540 128 flirt.dl_tls_get_addr_soft
|
|
0x0047f5c0 240 flirt.dl_add_to_slotinfo
|
|
0x0047f6b0 416 flirt.dl_get_origin
|
|
0x0047f850 197 flirt.dl_scope_free
|
|
0x00480690 48 flirt.length_mismatch_1
|
|
0x004806c0 210 flirt.dl_exception_create
|
|
0x004807a0 729 flirt.dl_exception_create_format
|
|
0x00480a80 38 flirt.dl_exception_free
|
|
0x00482060 195 flirt.fatal_error
|
|
0x00482130 80 flirt.dl_signal_exception
|
|
0x00482180 80 flirt.dl_signal_error
|
|
0x004821d0 208 flirt.dl_catch_exception
|
|
0x004822a0 112 flirt.dl_catch_error
|
|
0x00482310 82 flirt.longjmp
|
|
0x00482370 59 flirt.mpn_cmp
|
|
0x004823b0 1466 flirt.mpn_divrem
|
|
0x00482970 259 flirt.mpn_lshift
|
|
0x00482a80 259 flirt.mpn_rshift
|
|
0x00482b90 1072 flirt.mpn_mul
|
|
0x00482fc0 281 flirt.mpn_mul_1
|
|
0x004830e0 438 flirt.mpn_impn_mul_n_basecase
|
|
0x004832a0 1378 flirt.mpn_impn_mul_n
|
|
0x00483810 431 flirt.mpn_impn_sqr_n_basecase
|
|
0x004839c0 1262 flirt.mpn_impn_sqr_n
|
|
0x00483f50 173 flirt.mpn_sub_n
|
|
0x00484000 235 flirt.mpn_submul_1
|
|
0x004840f0 144 flirt.mpn_extract_double
|
|
0x00484180 185 flirt.mpn_extract_long_double
|
|
0x00484240 286 flirt.mpn_extract_float128
|
|
0x00484c90 138 flirt.strerror
|
|
0x00484d40 77 flirt.strsep
|
|
0x00484f50 8 flirt.getpid
|
|
0x00485150 7 flirt.profile_frequency
|
|
0x00485160 416 flirt.dl_fixup
|
|
0x00485300 544 flirt.dl_profile_fixup
|
|
0x00485520 2 flirt.dl_call_pltexit
|
|
0x00485530 652 flirt.add_to_global
|
|
0x004857c0 144 flirt.dl_find_dso_for_object
|
|
0x00485850 528 flirt.dl_open
|
|
0x00485a60 298 flirt.dl_show_scope
|
|
0x004863b0 4000 flirt.remove_slotinfo
|
|
0x00487350 121 flirt.dl_close_worker
|
|
0x004874d0 751 flirt.dl_sort_maps
|
|
0x004877c0 416 flirt.dl_tlsdesc_resolve_rela_fixup
|
|
0x00487960 101 flirt.dl_tlsdesc_resolve_hold_fixup
|
|
0x004879d0 25 flirt.dl_unmap
|
|
0x00487cf0 83 flirt.dl_addr_inside_object
|
|
0x00487d50 173 flirt.mpn_add_n
|
|
0x00487e00 235 flirt.mpn_addmul_1
|
|
0x004895d0 877 flirt.dl_init
|
|
0x00489940 1806 flirt.dl_check_map_versions
|
|
0x0048f380 5 flirt.bsd_getpgrp
|
|
0x0048fa10 478 flirt.dl_iterate_phdr
|
|
0x0048fbf0 73 flirt.nl_finddomain_subfreeres
|
|
0x0048fc40 247 flirt.nl_unload_domain
|
|
0x00490bb0 218 flirt.free_slotinfo
|
|
EOF
|
|
RUN
|
|
|
|
NAME=FLIRT apply pat signature
|
|
FILE=bins/flirt/elf-x86/curl-example
|
|
CMDS=<<EOF
|
|
aaa
|
|
Fs bins/flirt/elf-x86/libcurl.a.pat
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Found 148 FLIRT signatures via bins/flirt/elf-x86/libcurl.a.pat
|
|
EOF
|
|
RUN
|
|
|
|
NAME=FLIRT apply pat signature
|
|
FILE=bins/flirt/elf-x86/curl-example
|
|
CMDS=<<EOF
|
|
aaa
|
|
Fs bins/flirt/elf-x86/libcurl.a.sig
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Found 148 FLIRT signatures via bins/flirt/elf-x86/libcurl.a.sig
|
|
EOF
|
|
RUN
|
|
|
|
NAME=FLIRT dump pat signature
|
|
FILE==
|
|
CMDS=<<EOF
|
|
Fd bins/flirt/elf-x86/libcurl.a.pat~?
|
|
EOF
|
|
EXPECT=<<EOF
|
|
209
|
|
EOF
|
|
RUN
|
|
|
|
NAME=FLIRT dump pat signature with CRLF line endings
|
|
FILE==
|
|
CMDS=<<EOF
|
|
Fd bins/flirt/librust.pat~?
|
|
EOF
|
|
EXPECT=<<EOF
|
|
21174
|
|
EOF
|
|
RUN
|
|
|
|
|
|
NAME=FLIRT verify correctness of main (PAT)
|
|
FILE=bins/flirt/elf-x86/test.stripped
|
|
CMDS=<<EOF
|
|
aaa
|
|
Fs bins/flirt/elf-x86/test.stripped.pat~silence
|
|
af @ data.004011a5
|
|
pdf @ data.004011a5
|
|
EOF
|
|
EXPECT=<<EOF
|
|
; DATA XREF from entry0 @ 0x40105f
|
|
/ data.004011a5(int64_t arg1, int64_t arg2);
|
|
| ; arg int64_t arg1 @ rdi
|
|
| ; arg int64_t arg2 @ rsi
|
|
| ; var int64_t var_78h @ stack - 0x78
|
|
| ; var int64_t var_6ch @ stack - 0x6c
|
|
| ; var int64_t var_68h @ stack - 0x68
|
|
| ; var int64_t var_10h @ stack - 0x10
|
|
| 0x004011a5 push rbp
|
|
| 0x004011a6 mov rbp, rsp
|
|
| 0x004011a9 sub rsp, 0x70
|
|
| 0x004011ad mov dword [var_6ch], edi ; arg1
|
|
| 0x004011b0 mov qword [var_78h], rsi ; arg2
|
|
| 0x004011b4 mov rax, qword fs:[0x28]
|
|
| 0x004011bd mov qword [var_10h], rax
|
|
| 0x004011c1 xor eax, eax
|
|
| 0x004011c3 mov rax, qword [var_78h]
|
|
| 0x004011c7 add rax, 0x08
|
|
| 0x004011cb mov rax, qword [rax]
|
|
| 0x004011ce mov rdi, rax
|
|
| 0x004011d1 call flirt.atoi
|
|
| 0x004011d6 mov edx, eax
|
|
| 0x004011d8 lea rax, qword [var_68h]
|
|
| 0x004011dc mov ecx, edx
|
|
| 0x004011de lea rdx, qword str.Hello__d ; segment.LOAD2
|
|
| ; 0x404000 ; "Hello %d\n"
|
|
| 0x004011e5 mov esi, 0x50 ; 'P' ; 80
|
|
| 0x004011ea mov rdi, rax
|
|
| 0x004011ed mov eax, 0x00
|
|
| 0x004011f2 call flirt.snprintf
|
|
| 0x004011f7 lea rax, qword [var_68h]
|
|
| 0x004011fb mov rdi, rax
|
|
| 0x004011fe call flirt.puts
|
|
| 0x00401203 mov eax, 0x00
|
|
| 0x00401208 mov rdx, qword [var_10h]
|
|
| 0x0040120c sub rdx, qword fs:[0x28]
|
|
| ,=< 0x00401215 jz 0x40121c
|
|
| | 0x00401217 call fcn.0040146f
|
|
| `-> 0x0040121c leave
|
|
\ 0x0040121d ret
|
|
EOF
|
|
RUN
|
|
|
|
|
|
NAME=FLIRT verify correctness of main (SIG)
|
|
FILE=bins/flirt/elf-x86/test.stripped
|
|
CMDS=<<EOF
|
|
aaa
|
|
Fs bins/flirt/elf-x86/test.stripped.sig~silence
|
|
af @ data.004011a5
|
|
pdf @ data.004011a5
|
|
EOF
|
|
EXPECT=<<EOF
|
|
; DATA XREF from entry0 @ 0x40105f
|
|
/ data.004011a5(int64_t arg1, int64_t arg2);
|
|
| ; arg int64_t arg1 @ rdi
|
|
| ; arg int64_t arg2 @ rsi
|
|
| ; var int64_t var_78h @ stack - 0x78
|
|
| ; var int64_t var_6ch @ stack - 0x6c
|
|
| ; var int64_t var_68h @ stack - 0x68
|
|
| ; var int64_t var_10h @ stack - 0x10
|
|
| 0x004011a5 push rbp
|
|
| 0x004011a6 mov rbp, rsp
|
|
| 0x004011a9 sub rsp, 0x70
|
|
| 0x004011ad mov dword [var_6ch], edi ; arg1
|
|
| 0x004011b0 mov qword [var_78h], rsi ; arg2
|
|
| 0x004011b4 mov rax, qword fs:[0x28]
|
|
| 0x004011bd mov qword [var_10h], rax
|
|
| 0x004011c1 xor eax, eax
|
|
| 0x004011c3 mov rax, qword [var_78h]
|
|
| 0x004011c7 add rax, 0x08
|
|
| 0x004011cb mov rax, qword [rax]
|
|
| 0x004011ce mov rdi, rax
|
|
| 0x004011d1 call flirt.atoi
|
|
| 0x004011d6 mov edx, eax
|
|
| 0x004011d8 lea rax, qword [var_68h]
|
|
| 0x004011dc mov ecx, edx
|
|
| 0x004011de lea rdx, qword str.Hello__d ; segment.LOAD2
|
|
| ; 0x404000 ; "Hello %d\n"
|
|
| 0x004011e5 mov esi, 0x50 ; 'P' ; 80
|
|
| 0x004011ea mov rdi, rax
|
|
| 0x004011ed mov eax, 0x00
|
|
| 0x004011f2 call flirt.snprintf
|
|
| 0x004011f7 lea rax, qword [var_68h]
|
|
| 0x004011fb mov rdi, rax
|
|
| 0x004011fe call flirt.puts
|
|
| 0x00401203 mov eax, 0x00
|
|
| 0x00401208 mov rdx, qword [var_10h]
|
|
| 0x0040120c sub rdx, qword fs:[0x28]
|
|
| ,=< 0x00401215 jz 0x40121c
|
|
| | 0x00401217 call fcn.0040146f
|
|
| `-> 0x0040121c leave
|
|
\ 0x0040121d ret
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Print SigDB contents
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e flirt.sigdb.path=bins/sigdb/fake-db
|
|
Fl
|
|
EOF
|
|
EXPECT=<<EOF
|
|
bin arch bits name modules details
|
|
-----------------------------------------------------------
|
|
elf x86 64 match.sig 1 Built with rizin 0.5.0
|
|
elf x86 64 not-match.pat 1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Do analysis and apply SigDB automatically
|
|
FILE=bins/sigdb/elf-x86-64-static-libc
|
|
CMDS=<<EOF
|
|
e flirt.sigdb.path=bins/sigdb/fake-db
|
|
aaa
|
|
afl~flirt
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00409c70 5 208 flirt.printf
|
|
0x0046fc50 4 208 -> 201 flirt.printf_3
|
|
0x0046fe50 4 208 -> 197 flirt.printf_2
|
|
0x0046ffb0 4 208 flirt.printf_1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Do analysis and apply SigDB manually
|
|
FILE=bins/sigdb/elf-x86-64-static-libc
|
|
CMDS=<<EOF
|
|
aaa
|
|
e flirt.sigdb.path=bins/sigdb/fake-db
|
|
Fa match.sig
|
|
afl~printf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Applying elf/x86/64/match.sig signature file
|
|
0x00409c70 5 208 flirt.printf
|
|
0x0046fc50 4 208 -> 201 flirt.printf_3
|
|
0x0046fe50 4 208 -> 197 flirt.printf_2
|
|
0x0046ffb0 4 208 flirt.printf_1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Check function signature flirt and rizin
|
|
FILE=bins/sigdb/elf-x86-64-static-libc
|
|
CMDS=<<EOF
|
|
aaa
|
|
afsb @ 0x00409c70
|
|
afsbj ~{} @ 0x00409c70
|
|
Ff @ 0x00409c70
|
|
EOF
|
|
EXPECT=<<EOF
|
|
pattern f30f1efa4881ecd80000004989fa4889742428488954243048894c24384c894424404c894c244884c074370f294424500f294c24600f295424700f299c24800000000f29a424900000000f29ac24a00000000f29b424b00000000f29bc24c000000064488b042528000000488944241831c0488b3d274a0a004889e231c9488d8424e00000004c89d6c70424080000004889442408488d442420c7442404300000004889442410e8842e0000488b54241864482b14252800000075084881c4d8000000c3e8b7e103000f1f8000000000
|
|
mask ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000ffffffffffff00000000ffffffffffffffffffffffffffffff00ffffffffffffffffff00000000ffffffffffffff
|
|
search f30f1efa4881ecd80000004989fa4889742428488954243048894c24384c894424404c894c244884c074..0f294424500f294c24600f295424700f299c24800000000f29a424900000000f29ac24a00000000f29b424b00000000f29bc24c000000064488b042528000000488944241831c048............4889e231c9488d8424e00000004c89d6c70424080000004889442408488d442420c7..............4889442410e8........488b54241864482b14252800000075..4881c4d8000000c3e8........0f1f8000000000
|
|
{
|
|
"pattern": "f30f1efa4881ecd80000004989fa4889742428488954243048894c24384c894424404c894c244884c074370f294424500f294c24600f295424700f299c24800000000f29a424900000000f29ac24a00000000f29b424b00000000f29bc24c000000064488b042528000000488944241831c0488b3d274a0a004889e231c9488d8424e00000004c89d6c70424080000004889442408488d442420c7442404300000004889442410e8842e0000488b54241864482b14252800000075084881c4d8000000c3e8b7e103000f1f8000000000",
|
|
"mask": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000ffffffffffff00000000ffffffffffffffffffffffffffffff00ffffffffffffffffff00000000ffffffffffffff",
|
|
"search": "f30f1efa4881ecd80000004989fa4889742428488954243048894c24384c894424404c894c244884c074..0f294424500f294c24600f295424700f299c24800000000f29a424900000000f29ac24a00000000f29b424b00000000f29bc24c000000064488b042528000000488944241831c048............4889e231c9488d8424e00000004c89d6c70424080000004889442408488d442420c7..............4889442410e8........488b54241864482b14252800000075..4881c4d8000000c3e8........0f1f8000000000"
|
|
}
|
|
F30F1EFA4881ECD80000004989FA4889742428488954243048894C24384C8944 0A CA1D 00D0 :0000 fcn.00409c70 ..0F294424500F294C24600F295424700F299C24800000000F29A424900000000F29AC24A00000000F29B424B00000000F29BC24C000000064488B042528000000488944241831C048............4889E231C9488D8424E00000004C89D6C70424080000004889442408488D442420C7..............4889442410E8........488B54241864482B14252800000075..4881C4D8000000C3E8........0F1F8000000000
|
|
---
|
|
EOF
|
|
RUN
|