Remove zignatures and move aaF[l] -> F[al] , zf[sdc] -> F[sdc] (#2682)

This commit is contained in:
Giovanni 2022-06-29 01:49:43 +02:00 committed by GitHub
parent 2987e035da
commit ea02b0d25f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
57 changed files with 858 additions and 7703 deletions

1
.github/labeler.yml vendored
View file

@ -149,7 +149,6 @@ visual:
- librz/core/visual_tabs.inc
- librz/core/vmenus.c
- librz/core/vmenus_graph.c
- librz/core/vmenus_zigns.c
panel:
- librz/core/panels.c

View file

@ -94,11 +94,9 @@ RZ_API RzAnalysis *rz_analysis_new(void) {
analysis->type_links = ht_up_new0();
analysis->sdb_fmts = sdb_ns(analysis->sdb, "spec", 1);
analysis->sdb_cc = sdb_ns(analysis->sdb, "cc", 1);
analysis->sdb_zigns = sdb_ns(analysis->sdb, "zigns", 1);
analysis->sdb_classes = sdb_ns(analysis->sdb, "classes", 1);
analysis->sdb_classes_attrs = sdb_ns(analysis->sdb_classes, "attrs", 1);
analysis->sdb_noret = sdb_ns(analysis->sdb, "noreturn", 1);
analysis->zign_path = strdup("");
(void)rz_analysis_xrefs_init(analysis);
analysis->diff_thbb = RZ_ANALYSIS_THRESHOLDBB;
analysis->diff_thfcn = RZ_ANALYSIS_THRESHOLDFCN;
@ -155,11 +153,9 @@ RZ_API RzAnalysis *rz_analysis_free(RzAnalysis *a) {
rz_interval_tree_fini(&a->meta);
free(a->cpu);
free(a->os);
free(a->zign_path);
rz_list_free(a->plugins);
rz_rbtree_free(a->bb_tree, __block_free_rb, NULL);
rz_spaces_fini(&a->meta_spaces);
rz_spaces_fini(&a->zign_spaces);
rz_syscall_free(a->syscall);
rz_platform_target_free(a->arch_target);
rz_platform_target_index_free(a->platform_target);
@ -443,7 +439,6 @@ RZ_API void rz_analysis_purge(RzAnalysis *analysis) {
rz_type_db_purge(analysis->typedb);
ht_up_free(analysis->type_links);
analysis->type_links = ht_up_new0();
sdb_reset(analysis->sdb_zigns);
sdb_reset(analysis->sdb_classes);
sdb_reset(analysis->sdb_classes_attrs);
sdb_reset(analysis->sdb_cc);

View file

@ -42,10 +42,6 @@
* /attrs
* <direct dump of RzAnalysis.sdb_classes_attrs>
*
* /zigns
* <direct dump of RzAnalysis.sdb_zigns>
* /spaces
* see spaces.c
*
* /imports
* <str>=i
@ -2169,25 +2165,6 @@ RZ_API bool rz_serialize_analysis_typelinks_load(RZ_NONNULL Sdb *db, RZ_NONNULL
return rz_serialize_typelinks_load(db, analysis, res);
}
RZ_API void rz_serialize_analysis_sign_save(RZ_NONNULL Sdb *db, RZ_NONNULL RzAnalysis *analysis) {
sdb_copy(analysis->sdb_zigns, db);
rz_serialize_spaces_save(sdb_ns(db, "spaces", true), &analysis->zign_spaces);
}
RZ_API bool rz_serialize_analysis_sign_load(RZ_NONNULL Sdb *db, RZ_NONNULL RzAnalysis *analysis, RZ_NULLABLE RzSerializeResultInfo *res) {
sdb_reset(analysis->sdb_zigns);
sdb_copy(db, analysis->sdb_zigns);
Sdb *spaces_db = sdb_ns(db, "spaces", false);
if (!spaces_db) {
RZ_SERIALIZE_ERR(res, "missing spaces namespace");
return false;
}
if (!rz_serialize_spaces_load(spaces_db, &analysis->zign_spaces, false, res)) {
return false;
}
return true;
}
RZ_API void rz_serialize_analysis_imports_save(RZ_NONNULL Sdb *db, RZ_NONNULL RzAnalysis *analysis) {
RzListIter *it;
const char *imp;
@ -2225,7 +2202,6 @@ RZ_API void rz_serialize_analysis_save(RZ_NONNULL Sdb *db, RZ_NONNULL RzAnalysis
rz_serialize_analysis_types_save(sdb_ns(db, "types", true), analysis);
rz_serialize_analysis_callables_save(sdb_ns(db, "callables", true), analysis);
rz_serialize_analysis_typelinks_save(sdb_ns(db, "typelinks", true), analysis);
rz_serialize_analysis_sign_save(sdb_ns(db, "zigns", true), analysis);
rz_serialize_analysis_imports_save(sdb_ns(db, "imports", true), analysis);
rz_serialize_analysis_cc_save(sdb_ns(db, "cc", true), analysis);
rz_serialize_analysis_global_var_save(sdb_ns(db, "vars", true), analysis);
@ -2273,7 +2249,6 @@ RZ_API bool rz_serialize_analysis_load(RZ_NONNULL Sdb *db, RZ_NONNULL RzAnalysis
SUB("meta", rz_serialize_analysis_meta_load(subdb, analysis, res));
SUB("hints", rz_serialize_analysis_hints_load(subdb, analysis, res));
SUB("zigns", rz_serialize_analysis_sign_load(subdb, analysis, res));
SUB("imports", rz_serialize_analysis_imports_load(subdb, analysis, res));
SUB("cc", rz_serialize_analysis_cc_load(subdb, analysis, res));
SUB("vars", rz_serialize_analysis_global_var_load(subdb, analysis, res));

View file

@ -5898,14 +5898,6 @@ RZ_API bool rz_core_analysis_everything(RzCore *core, bool experimental, char *d
rz_core_task_yield(&core->tasks);
}
if (!sdb_isempty(core->analysis->sdb_zigns)) {
notify = "Check for zignature from zigns folder";
rz_core_notify_begin(core, "%s", notify);
rz_core_cmd0(core, "z/");
rz_core_notify_done(core, "%s", notify);
rz_core_task_yield(&core->tasks);
}
if (plugin_supports_esil) {
notify = "Type matching analysis for all functions";
rz_core_notify_begin(core, "%s", notify);

View file

@ -517,22 +517,6 @@ static void autocmplt_cmd_arg_rznum(RzCore *core, RzLineNSCompletionResult *res,
autocmplt_cmd_arg_help_var(core, res, s, len);
}
static void autocmplt_cmd_arg_zign_space(RzCore *core, RzLineNSCompletionResult *res, const char *s, size_t len) {
RzSpaces *zs = &core->analysis->zign_spaces;
RzSpace *space;
RzSpaceIter it;
rz_spaces_foreach(zs, it, space) {
if (!strncmp(space->name, s, len)) {
rz_line_ns_completion_result_add(res, space->name);
}
}
if (len == 0) {
rz_line_ns_completion_result_add(res, "*");
}
}
static void autocmplt_cmd_arg_choices(RzCore *core, RzLineNSCompletionResult *res, const char *s, size_t len, const RzCmdDescArg *arg) {
char **oc, **c;
oc = c = arg->choices_cb ? arg->choices_cb(core) : (char **)arg->choices;
@ -694,9 +678,6 @@ static void autocmplt_cmd_arg(RzCore *core, RzLineNSCompletionResult *res, const
case RZ_CMD_ARG_TYPE_ENV:
autocmplt_cmd_arg_env(res, s, len);
break;
case RZ_CMD_ARG_TYPE_ZIGN_SPACE:
autocmplt_cmd_arg_zign_space(core, res, s, len);
break;
case RZ_CMD_ARG_TYPE_CHOICES:
autocmplt_cmd_arg_choices(core, res, s, len, arg);
break;

View file

@ -1062,14 +1062,6 @@ static bool cb_asmsyntax(void *user, void *data) {
return true;
}
static bool cb_dirzigns(void *user, void *data) {
RzCore *core = (RzCore *)user;
RzConfigNode *node = (RzConfigNode *)data;
free(core->analysis->zign_path);
core->analysis->zign_path = strdup(node->value);
return true;
}
static bool cb_bigendian(void *user, void *data) {
RzCore *core = (RzCore *)user;
RzConfigNode *node = (RzConfigNode *)data;
@ -3256,26 +3248,6 @@ RZ_API int rz_core_config_init(RzCore *core) {
SETCB("log.events", "false", &cb_log_events, "Remote HTTP server to sync events with");
// zign
SETPREF("zign.prefix", "sign", "Default prefix for zignatures matches");
SETI("zign.maxsz", 500, "Maximum zignature length");
SETI("zign.minsz", 16, "Minimum zignature length for matching");
SETI("zign.mincc", 10, "Minimum cyclomatic complexity for matching");
SETBPREF("zign.match.graph", "true", "Use graph metrics for matching");
SETBPREF("zign.match.bytes", "true", "Use bytes patterns for matching");
SETBPREF("zign.match.offset", "false", "Use original offset for matching");
SETBPREF("zign.match.refs", "true", "Use references for matching");
SETBPREF("zign.match.hash", "true", "Use Hash for matching");
SETBPREF("zign.match.types", "false", "Use types for matching");
char home_zigns_msg[1024];
char *home_zigns_dir = rz_path_home_prefix(RZ_ZIGNS);
rz_strf(home_zigns_msg, "Autoload all zignatures located in %s", home_zigns_dir);
free(home_zigns_dir);
SETBPREF("zign.autoload", "false", home_zigns_msg);
SETPREF("zign.diff.bthresh", "1.0", "Threshold for diffing zign bytes [0, 1] (see zc?)");
SETPREF("zign.diff.gthresh", "1.0", "Threshold for diffing zign graphs [0, 1] (see zc?)");
SETPREF("zign.threshold", "0.0", "Minimum similarity required for inclusion in zb output");
/* diff */
SETCB("diff.sort", "addr", &cb_diff_sort, "Specify function diff sorting column see (e diff.sort=?)");
SETI("diff.from", 0, "Set source diffing address for px (uses cc command)");
@ -3309,9 +3281,6 @@ RZ_API int rz_core_config_init(RzCore *core) {
SETPREF("dir.projects", projects_dir, "Default path for projects");
free(projects_dir);
#endif
home_zigns_dir = rz_path_home_prefix(RZ_ZIGNS);
SETCB("dir.zigns", home_zigns_dir, &cb_dirzigns, "Default path for zignatures (see zo command)");
free(home_zigns_dir);
SETPREF("stack.reg", "SP", "Which register to use as stack pointer in the visual debug");
SETBPREF("stack.bytes", "true", "Show bytes instead of words in stack");
SETBPREF("stack.anotated", "false", "Show anotated hexdump in visual debug");

View file

@ -1373,8 +1373,6 @@ static void fill_args_json(const RzCmd *cmd, const RzCmdDesc *cd, PJ *j) {
CASE_TYPE(RZ_CMD_ARG_TYPE_RZNUM, "expression");
CASE_TYPE(RZ_CMD_ARG_TYPE_STRING, "string");
CASE_TYPE(RZ_CMD_ARG_TYPE_ENV, "environment_variable");
CASE_TYPE(RZ_CMD_ARG_TYPE_ZIGN, "zignature");
CASE_TYPE(RZ_CMD_ARG_TYPE_ZIGN_SPACE, "zignature_space");
CASE_TYPE(RZ_CMD_ARG_TYPE_CHOICES, "choice");
CASE_TYPE(RZ_CMD_ARG_TYPE_FCN, "function");
CASE_TYPE(RZ_CMD_ARG_TYPE_FILE, "filename");

View file

@ -0,0 +1,43 @@
// SPDX-FileCopyrightText: 2021-2022 RizinOrg <info@rizin.re>
// SPDX-FileCopyrightText: 2021-2022 deroad <wargio@libero.it>
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_core.h>
#include <rz_cons.h>
#include <rz_flirt.h>
RZ_IPI RzCmdStatus rz_flirt_create_handler(RzCore *core, int argc, const char **argv) {
const char *filename = argv[1];
ut32 written_nodes = 0;
if (!rz_core_flirt_create_file(core, filename, &written_nodes)) {
RZ_LOG_ERROR("failed to create FLIRT file '%s'\n", filename);
return RZ_CMD_STATUS_ERROR;
}
rz_cons_printf("%u FLIRT signatures were written in '%s'\n", written_nodes, filename);
return RZ_CMD_STATUS_OK;
}
RZ_IPI RzCmdStatus rz_flirt_dump_handler(RzCore *core, int argc, const char **argv) {
rz_core_flirt_dump_file(argv[1]);
return RZ_CMD_STATUS_OK;
}
RZ_IPI RzCmdStatus rz_flirt_scan_handler(RzCore *core, int argc, const char **argv) {
int new, old;
int depth = rz_config_get_i(core->config, "dir.depth");
const char *arch = rz_config_get(core->config, "asm.arch");
char *file = NULL;
RzListIter *iter = NULL;
RzList *files = rz_file_globsearch(argv[1], depth);
ut8 arch_id = rz_core_flirt_arch_from_name(arch);
old = rz_flag_count(core->flags, "flirt");
rz_list_foreach (files, iter, file) {
rz_sign_flirt_apply(core->analysis, file, arch_id);
}
rz_list_free(files);
new = rz_flag_count(core->flags, "flirt");
rz_cons_printf("Found %d FLIRT signatures via %s\n", new - old, argv[1]);
return RZ_CMD_STATUS_OK;
}

File diff suppressed because it is too large Load diff

View file

@ -79,24 +79,6 @@ commands:
summary: Performs recursive type matching in all functions
cname: analyze_recursively_all_function_types
args: []
- name: aaF
summary: Signature database commands
subcommands:
- name: aaF
summary: Apply signatures from sigdb
cname: apply_signatures_from_sigdb
args:
- name: filter
type: RZ_CMD_ARG_TYPE_STRING
optional: true
- name: aaFl
summary: Lists all available signatures in sigdb
cname: list_signatures_in_sigdb
type: RZ_CMD_DESC_TYPE_ARGV_STATE
default_mode: RZ_OUTPUT_MODE_TABLE
modes:
- RZ_OUTPUT_MODE_TABLE
args: []
- name: aai
summary: Print preformed analysis details
cname: print_analysis_details

View file

@ -54,7 +54,6 @@ static const RzCmdDescDetail write_extend_hexbytes_details[2];
static const RzCmdDescDetail write_assembly_opcode_details[2];
static const RzCmdDescDetail write_op_sequence_details[2];
static const RzCmdDescDetail wo_details[2];
static const RzCmdDescDetail zign_add_details[5];
static const RzCmdDescDetail tmp_modifiers_details[2];
static const RzCmdDescDetail iterators_details[2];
static const RzCmdDescDetail redirection_details[2];
@ -91,7 +90,6 @@ static const RzCmdDescArg cmd_help_search_args[2];
static const RzCmdDescArg push_escaped_args[2];
static const RzCmdDescArg analysis_all_esil_args[2];
static const RzCmdDescArg analyze_all_consecutive_functions_in_section_args[2];
static const RzCmdDescArg apply_signatures_from_sigdb_args[2];
static const RzCmdDescArg analyze_xrefs_section_bytes_args[2];
static const RzCmdDescArg analyze_function_linked_offsets_args[2];
static const RzCmdDescArg print_commands_after_traps_args[2];
@ -383,6 +381,10 @@ static const RzCmdDescArg flag_tag_search_args[2];
static const RzCmdDescArg flag_zone_add_args[2];
static const RzCmdDescArg flag_zone_remove_args[2];
static const RzCmdDescArg flag_hexdump_args[2];
static const RzCmdDescArg flirt_create_args[2];
static const RzCmdDescArg flirt_dump_args[2];
static const RzCmdDescArg flirt_scan_args[2];
static const RzCmdDescArg apply_signatures_from_sigdb_args[2];
static const RzCmdDescArg egg_compile_args[2];
static const RzCmdDescArg egg_config_args[2];
static const RzCmdDescArg egg_syscall_args[3];
@ -589,25 +591,6 @@ static const RzCmdDescArg yank_hexpairs_args[2];
static const RzCmdDescArg yank_hex_print_args[2];
static const RzCmdDescArg yank_paste_args[2];
static const RzCmdDescArg yank_string_args[2];
static const RzCmdDescArg zign_best_args[2];
static const RzCmdDescArg zign_best_name_args[3];
static const RzCmdDescArg zign_delete_args[2];
static const RzCmdDescArg zign_add_args[4];
static const RzCmdDescArg zign_add_fcn_args[3];
static const RzCmdDescArg zign_load_sdb_args[2];
static const RzCmdDescArg zign_save_sdb_args[2];
static const RzCmdDescArg zign_load_gzip_sdb_args[2];
static const RzCmdDescArg zign_flirt_create_args[2];
static const RzCmdDescArg zign_flirt_dump_args[2];
static const RzCmdDescArg zign_flirt_scan_args[2];
static const RzCmdDescArg zign_cmp_args[2];
static const RzCmdDescArg zign_cmp_name_args[2];
static const RzCmdDescArg zign_cmp_diff_name_args[2];
static const RzCmdDescArg zign_space_select_args[2];
static const RzCmdDescArg zign_space_delete_args[2];
static const RzCmdDescArg zign_space_add_args[2];
static const RzCmdDescArg zign_space_rename_args[2];
static const RzCmdDescArg zign_info_range_args[3];
static const RzCmdDescArg cmd_shell_env_args[3];
static const RzCmdDescArg cmd_shell_ls_args[2];
static const RzCmdDescArg cmd_shell_rm_args[2];
@ -1355,32 +1338,6 @@ static const RzCmdDescHelp analyze_recursively_all_function_types_help = {
.args = analyze_recursively_all_function_types_args,
};
static const RzCmdDescHelp aaF_help = {
.summary = "Signature database commands",
};
static const RzCmdDescArg apply_signatures_from_sigdb_args[] = {
{
.name = "filter",
.type = RZ_CMD_ARG_TYPE_STRING,
.flags = RZ_CMD_ARG_FLAG_LAST,
.optional = true,
},
{ 0 },
};
static const RzCmdDescHelp apply_signatures_from_sigdb_help = {
.summary = "Apply signatures from sigdb",
.args = apply_signatures_from_sigdb_args,
};
static const RzCmdDescArg list_signatures_in_sigdb_args[] = {
{ 0 },
};
static const RzCmdDescHelp list_signatures_in_sigdb_help = {
.summary = "Lists all available signatures in sigdb",
.args = list_signatures_in_sigdb_args,
};
static const RzCmdDescArg print_analysis_details_args[] = {
{ 0 },
};
@ -8681,6 +8638,71 @@ static const RzCmdDescHelp flag_hexdump_help = {
.args = flag_hexdump_args,
};
static const RzCmdDescHelp F_help = {
.summary = "FLIRT signature management",
};
static const RzCmdDescArg flirt_create_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp flirt_create_help = {
.summary = "Create a FLIRT file (.pat or .sig)",
.args = flirt_create_args,
};
static const RzCmdDescArg flirt_dump_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp flirt_dump_help = {
.summary = "Open a FLIRT file (.pat or .sig) and dumps its contents",
.args = flirt_dump_args,
};
static const RzCmdDescArg flirt_scan_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp flirt_scan_help = {
.summary = "Open a FLIRT file (.pat or .sig) and tries to apply the signatures to the loaded binary",
.args = flirt_scan_args,
};
static const RzCmdDescArg apply_signatures_from_sigdb_args[] = {
{
.name = "filter",
.type = RZ_CMD_ARG_TYPE_STRING,
.flags = RZ_CMD_ARG_FLAG_LAST,
.optional = true,
},
{ 0 },
};
static const RzCmdDescHelp apply_signatures_from_sigdb_help = {
.summary = "Apply signatures from sigdb",
.args = apply_signatures_from_sigdb_args,
};
static const RzCmdDescArg list_signatures_in_sigdb_args[] = {
{ 0 },
};
static const RzCmdDescHelp list_signatures_in_sigdb_help = {
.summary = "Lists all available signatures in sigdb",
.args = list_signatures_in_sigdb_args,
};
static const RzCmdDescHelp g_help = {
.summary = "Generate shellcodes with rz_egg",
};
@ -13386,424 +13408,6 @@ static const RzCmdDescHelp yank_string_help = {
.args = yank_string_args,
};
static const RzCmdDescHelp z_help = {
.summary = "Zignatures management",
};
static const RzCmdDescArg zign_show_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_show_help = {
.summary = "Show zignatures",
.args = zign_show_args,
};
static const RzCmdDescArg zign_find_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_find_help = {
.summary = "Find matching zignatures",
.args = zign_find_args,
};
static const RzCmdDescHelp zb_help = {
.summary = "Search for best match",
};
static const RzCmdDescArg zign_best_args[] = {
{
.name = "n",
.type = RZ_CMD_ARG_TYPE_NUM,
.default_value = "5",
},
{ 0 },
};
static const RzCmdDescHelp zign_best_help = {
.summary = "Find <n> closest matching zignatures to function at current offset",
.args = zign_best_args,
};
static const RzCmdDescArg zign_best_name_args[] = {
{
.name = "zigname",
.type = RZ_CMD_ARG_TYPE_ZIGN,
},
{
.name = "n",
.type = RZ_CMD_ARG_TYPE_NUM,
.default_value = "5",
},
{ 0 },
};
static const RzCmdDescHelp zign_best_name_help = {
.summary = "Search for <n> most similar functions to zigname",
.args = zign_best_name_args,
};
static const RzCmdDescArg zign_delete_args[] = {
{
.name = "zigname|*",
.type = RZ_CMD_ARG_TYPE_ZIGN,
},
{ 0 },
};
static const RzCmdDescHelp zign_delete_help = {
.summary = "Delete zignature",
.args = zign_delete_args,
};
static const RzCmdDescHelp za_help = {
.summary = "Add zignature",
};
static const RzCmdDescDetailEntry zign_add_Zignature_space_types_detail_entries[] = {
{ .text = "a", .arg_str = NULL, .comment = "bytes pattern (analysis mask)" },
{ .text = "b", .arg_str = NULL, .comment = "bytes pattern" },
{ .text = "c", .arg_str = NULL, .comment = "base64 comment" },
{ .text = "n", .arg_str = NULL, .comment = "real function name" },
{ .text = "g", .arg_str = NULL, .comment = "graph metrics" },
{ .text = "o", .arg_str = NULL, .comment = "original offset" },
{ .text = "r", .arg_str = NULL, .comment = "references" },
{ .text = "t", .arg_str = NULL, .comment = "types" },
{ .text = "x", .arg_str = NULL, .comment = "cross references" },
{ .text = "h", .arg_str = NULL, .comment = "bbhash (hashing of function basic blocks)" },
{ .text = "v", .arg_str = NULL, .comment = "vars (and args)" },
{ 0 },
};
static const RzCmdDescDetailEntry zign_add_Bytes_space_patterns_detail_entries[] = {
{ .text = "", .arg_str = NULL, .comment = "bytes can contain '..' (dots) to specify a binary mask" },
{ 0 },
};
static const RzCmdDescDetailEntry zign_add_Graph_space_metrics_detail_entries[] = {
{ .text = "cc", .arg_str = NULL, .comment = "cyclomatic complexity" },
{ .text = "edges", .arg_str = NULL, .comment = "number of edges" },
{ .text = "nbbs", .arg_str = NULL, .comment = "number of basic blocks" },
{ .text = "ebbs", .arg_str = NULL, .comment = "number of end basic blocks" },
{ 0 },
};
static const RzCmdDescDetailEntry zign_add_Examples_detail_entries[] = {
{ .text = "za", .arg_str = " foo b 558bec..e8........", .comment = "" },
{ .text = "za", .arg_str = " foo a e811223344", .comment = "" },
{ .text = "za", .arg_str = " foo g cc=2 nbbs=3 edges=3 ebbs=1", .comment = "" },
{ .text = "za", .arg_str = " foo g nbbs=3 edges=3", .comment = "" },
{ .text = "za", .arg_str = " foo v b-32 b-48 b-64", .comment = "" },
{ .text = "za", .arg_str = " foo o 0x08048123", .comment = "" },
{ .text = "za", .arg_str = " foo c this is a comment (base64?)", .comment = "" },
{ .text = "za", .arg_str = " foo r sym.imp.strcpy sym.imp.sprintf sym.imp.strlen", .comment = "" },
{ .text = "za", .arg_str = " foo t func.sym.imp.strlen.ret=int", .comment = "" },
{ .text = "za", .arg_str = " foo h 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae", .comment = "" },
{ 0 },
};
static const RzCmdDescDetail zign_add_details[] = {
{ .name = "Zignature types", .entries = zign_add_Zignature_space_types_detail_entries },
{ .name = "Bytes patterns", .entries = zign_add_Bytes_space_patterns_detail_entries },
{ .name = "Graph metrics", .entries = zign_add_Graph_space_metrics_detail_entries },
{ .name = "Examples", .entries = zign_add_Examples_detail_entries },
{ 0 },
};
static const char *zign_add_type_choices[] = { "a", "b", "c", "n", "g", "o", "r", "t", "x", "h", "v", NULL };
static const RzCmdDescArg zign_add_args[] = {
{
.name = "zigname",
.type = RZ_CMD_ARG_TYPE_STRING,
},
{
.name = "type",
.type = RZ_CMD_ARG_TYPE_CHOICES,
.choices = zign_add_type_choices,
},
{
.name = "param",
.type = RZ_CMD_ARG_TYPE_STRING,
.flags = RZ_CMD_ARG_FLAG_ARRAY,
},
{ 0 },
};
static const RzCmdDescHelp zign_add_help = {
.summary = "Add zignature",
.details = zign_add_details,
.args = zign_add_args,
};
static const RzCmdDescArg zign_add_fcn_args[] = {
{
.name = "fcnname",
.type = RZ_CMD_ARG_TYPE_FCN,
.optional = true,
},
{
.name = "zigname",
.type = RZ_CMD_ARG_TYPE_STRING,
.flags = RZ_CMD_ARG_FLAG_LAST,
.optional = true,
},
{ 0 },
};
static const RzCmdDescHelp zign_add_fcn_help = {
.summary = "Create zignature for function",
.args = zign_add_fcn_args,
};
static const RzCmdDescArg zign_add_all_fcns_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_add_all_fcns_help = {
.summary = "Generate zignatures for all functions",
.args = zign_add_all_fcns_args,
};
static const RzCmdDescArg zign_generate_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_generate_help = {
.summary = "Generate zignatures (alias for zaF)",
.args = zign_generate_args,
};
static const RzCmdDescHelp zo_help = {
.summary = "Manage zignature files",
};
static const RzCmdDescArg zign_load_sdb_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_load_sdb_help = {
.summary = "Load zinatures from sdb file",
.args = zign_load_sdb_args,
};
static const RzCmdDescArg zign_save_sdb_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_save_sdb_help = {
.summary = "Save zinatures to sdb file",
.args = zign_save_sdb_args,
};
static const RzCmdDescArg zign_load_gzip_sdb_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_load_gzip_sdb_help = {
.summary = "Load zinatures from gzipped sdb file",
.args = zign_load_gzip_sdb_args,
};
static const RzCmdDescHelp zf_help = {
.summary = "Manage FLIRT signatures",
};
static const RzCmdDescArg zign_flirt_create_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_flirt_create_help = {
.summary = "Create a FLIRT file (.pat or .sig)",
.args = zign_flirt_create_args,
};
static const RzCmdDescArg zign_flirt_dump_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_flirt_dump_help = {
.summary = "Open a FLIRT file (.pat or .sig) and dumps its contents",
.args = zign_flirt_dump_args,
};
static const RzCmdDescArg zign_flirt_scan_args[] = {
{
.name = "filename",
.type = RZ_CMD_ARG_TYPE_FILE,
},
{ 0 },
};
static const RzCmdDescHelp zign_flirt_scan_help = {
.summary = "Open a FLIRT file (.pat or .sig) and tries to apply the signatures to the loaded binary",
.args = zign_flirt_scan_args,
};
static const RzCmdDescHelp z_slash__help = {
.summary = "Search zignatures",
};
static const RzCmdDescArg zign_search_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_search_help = {
.summary = "Search zignatures on range and flag matches",
.args = zign_search_args,
};
static const RzCmdDescArg zign_search_fcn_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_search_fcn_help = {
.summary = "Search only function zignatures",
.args = zign_search_fcn_args,
};
static const RzCmdDescHelp zc_help = {
.summary = "Compare zignatures in current zignspace with another one",
};
static const RzCmdDescArg zign_cmp_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
},
{ 0 },
};
static const RzCmdDescHelp zign_cmp_help = {
.summary = "Compare all zignatures in current space with <zignspace>",
.args = zign_cmp_args,
};
static const RzCmdDescHelp zcn_help = {
.summary = "Compare current zignspace with zigns on other <zignspace>",
};
static const RzCmdDescArg zign_cmp_name_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
},
{ 0 },
};
static const RzCmdDescHelp zign_cmp_name_help = {
.summary = "Compare current zignspace with zigns with same name on other <zignspace>",
.args = zign_cmp_name_args,
};
static const RzCmdDescArg zign_cmp_diff_name_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
},
{ 0 },
};
static const RzCmdDescHelp zign_cmp_diff_name_help = {
.summary = "Compare current zignspace with zigns with different name on other <zignspace>",
.args = zign_cmp_diff_name_args,
};
static const RzCmdDescHelp zs_help = {
.summary = "Manage zignspaces",
};
static const RzCmdDescArg zign_space_select_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
.optional = true,
},
{ 0 },
};
static const RzCmdDescHelp zign_space_select_help = {
.summary = "Display/select zignspaces",
.args = zign_space_select_args,
};
static const RzCmdDescArg zign_space_delete_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
.optional = true,
},
{ 0 },
};
static const RzCmdDescHelp zign_space_delete_help = {
.summary = "Pop last zignspace or delete <zignspace>",
.args = zign_space_delete_args,
};
static const RzCmdDescArg zign_space_add_args[] = {
{
.name = "zignspace",
.type = RZ_CMD_ARG_TYPE_ZIGN_SPACE,
},
{ 0 },
};
static const RzCmdDescHelp zign_space_add_help = {
.summary = "Push previous zignspace and set",
.args = zign_space_add_args,
};
static const RzCmdDescArg zign_space_rename_args[] = {
{
.name = "newname",
.type = RZ_CMD_ARG_TYPE_STRING,
.flags = RZ_CMD_ARG_FLAG_LAST,
},
{ 0 },
};
static const RzCmdDescHelp zign_space_rename_help = {
.summary = "Rename selected zignspace",
.args = zign_space_rename_args,
};
static const RzCmdDescHelp zi_help = {
.summary = "Show zignatures matching information",
};
static const RzCmdDescArg zign_info_args[] = {
{ 0 },
};
static const RzCmdDescHelp zign_info_help = {
.summary = "Show zignatures matching information",
.args = zign_info_args,
};
static const RzCmdDescArg zign_info_range_args[] = {
{
.name = "from",
.type = RZ_CMD_ARG_TYPE_NUM,
},
{
.name = "to",
.type = RZ_CMD_ARG_TYPE_NUM,
},
{ 0 },
};
static const RzCmdDescHelp zign_info_range_help = {
.summary = "Show zignatures matching information in range",
.args = zign_info_range_args,
};
static const RzCmdDescDetailEntry tmp_modifiers_empty_detail_entries[] = {
{ .text = "<cmd> @ ", .arg_str = "<addr>", .comment = "Temporary seek to <addr>" },
{ .text = "<cmd> @ ", .arg_str = "..<addr>", .comment = "Temporary partial address seek (see s..)" },
@ -14464,12 +14068,6 @@ RZ_IPI void rzshell_cmddescs_init(RzCore *core) {
RzCmdDesc *analyze_recursively_all_function_types_cd = rz_cmd_desc_argv_new(core->rcmd, aaf_cd, "aaft", rz_analyze_recursively_all_function_types_handler, &analyze_recursively_all_function_types_help);
rz_warn_if_fail(analyze_recursively_all_function_types_cd);
RzCmdDesc *aaF_cd = rz_cmd_desc_group_new(core->rcmd, aa_cd, "aaF", rz_apply_signatures_from_sigdb_handler, &apply_signatures_from_sigdb_help, &aaF_help);
rz_warn_if_fail(aaF_cd);
RzCmdDesc *list_signatures_in_sigdb_cd = rz_cmd_desc_argv_state_new(core->rcmd, aaF_cd, "aaFl", RZ_OUTPUT_MODE_TABLE, rz_list_signatures_in_sigdb_handler, &list_signatures_in_sigdb_help);
rz_warn_if_fail(list_signatures_in_sigdb_cd);
rz_cmd_desc_set_default_mode(list_signatures_in_sigdb_cd, RZ_OUTPUT_MODE_TABLE);
RzCmdDesc *print_analysis_details_cd = rz_cmd_desc_argv_state_new(core->rcmd, aa_cd, "aai", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_JSON, rz_print_analysis_details_handler, &print_analysis_details_help);
rz_warn_if_fail(print_analysis_details_cd);
@ -16068,6 +15666,24 @@ RZ_IPI void rzshell_cmddescs_init(RzCore *core) {
RzCmdDesc *flag_hexdump_cd = rz_cmd_desc_argv_new(core->rcmd, f_cd, "fx", rz_flag_hexdump_handler, &flag_hexdump_help);
rz_warn_if_fail(flag_hexdump_cd);
RzCmdDesc *F_cd = rz_cmd_desc_group_new(core->rcmd, root_cd, "F", NULL, NULL, &F_help);
rz_warn_if_fail(F_cd);
RzCmdDesc *flirt_create_cd = rz_cmd_desc_argv_new(core->rcmd, F_cd, "Fc", rz_flirt_create_handler, &flirt_create_help);
rz_warn_if_fail(flirt_create_cd);
RzCmdDesc *flirt_dump_cd = rz_cmd_desc_argv_new(core->rcmd, F_cd, "Fd", rz_flirt_dump_handler, &flirt_dump_help);
rz_warn_if_fail(flirt_dump_cd);
RzCmdDesc *flirt_scan_cd = rz_cmd_desc_argv_new(core->rcmd, F_cd, "Fs", rz_flirt_scan_handler, &flirt_scan_help);
rz_warn_if_fail(flirt_scan_cd);
RzCmdDesc *apply_signatures_from_sigdb_cd = rz_cmd_desc_argv_new(core->rcmd, F_cd, "Fa", rz_apply_signatures_from_sigdb_handler, &apply_signatures_from_sigdb_help);
rz_warn_if_fail(apply_signatures_from_sigdb_cd);
RzCmdDesc *list_signatures_in_sigdb_cd = rz_cmd_desc_argv_state_new(core->rcmd, F_cd, "Fl", RZ_OUTPUT_MODE_TABLE, rz_list_signatures_in_sigdb_handler, &list_signatures_in_sigdb_help);
rz_warn_if_fail(list_signatures_in_sigdb_cd);
rz_cmd_desc_set_default_mode(list_signatures_in_sigdb_cd, RZ_OUTPUT_MODE_TABLE);
RzCmdDesc *g_cd = rz_cmd_desc_group_new(core->rcmd, root_cd, "g", rz_egg_compile_handler, &egg_compile_help, &g_help);
rz_warn_if_fail(g_cd);
RzCmdDesc *egg_config_cd = rz_cmd_desc_argv_new(core->rcmd, g_cd, "gc", rz_egg_config_handler, &egg_config_help);
@ -17096,79 +16712,6 @@ RZ_IPI void rzshell_cmddescs_init(RzCore *core) {
RzCmdDesc *yank_string_cd = rz_cmd_desc_argv_new(core->rcmd, y_cd, "yz", rz_yank_string_handler, &yank_string_help);
rz_warn_if_fail(yank_string_cd);
RzCmdDesc *z_cd = rz_cmd_desc_group_modes_new(core->rcmd, root_cd, "z", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_QUIET | RZ_OUTPUT_MODE_RIZIN | RZ_OUTPUT_MODE_JSON | RZ_OUTPUT_MODE_SDB, rz_zign_show_handler, &zign_show_help, &z_help);
rz_warn_if_fail(z_cd);
RzCmdDesc *zign_find_cd = rz_cmd_desc_argv_modes_new(core->rcmd, z_cd, "z.", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_RIZIN, rz_zign_find_handler, &zign_find_help);
rz_warn_if_fail(zign_find_cd);
RzCmdDesc *zb_cd = rz_cmd_desc_group_new(core->rcmd, z_cd, "zb", rz_zign_best_handler, &zign_best_help, &zb_help);
rz_warn_if_fail(zb_cd);
RzCmdDesc *zign_best_name_cd = rz_cmd_desc_argv_new(core->rcmd, zb_cd, "zbr", rz_zign_best_name_handler, &zign_best_name_help);
rz_warn_if_fail(zign_best_name_cd);
RzCmdDesc *zign_delete_cd = rz_cmd_desc_argv_new(core->rcmd, z_cd, "z-", rz_zign_delete_handler, &zign_delete_help);
rz_warn_if_fail(zign_delete_cd);
RzCmdDesc *za_cd = rz_cmd_desc_group_new(core->rcmd, z_cd, "za", rz_zign_add_handler, &zign_add_help, &za_help);
rz_warn_if_fail(za_cd);
RzCmdDesc *zign_add_fcn_cd = rz_cmd_desc_argv_new(core->rcmd, za_cd, "zaf", rz_zign_add_fcn_handler, &zign_add_fcn_help);
rz_warn_if_fail(zign_add_fcn_cd);
RzCmdDesc *zign_add_all_fcns_cd = rz_cmd_desc_argv_new(core->rcmd, za_cd, "zaF", rz_zign_add_all_fcns_handler, &zign_add_all_fcns_help);
rz_warn_if_fail(zign_add_all_fcns_cd);
RzCmdDesc *zign_generate_cd = rz_cmd_desc_argv_new(core->rcmd, z_cd, "zg", rz_zign_generate_handler, &zign_generate_help);
rz_warn_if_fail(zign_generate_cd);
RzCmdDesc *zo_cd = rz_cmd_desc_group_new(core->rcmd, z_cd, "zo", rz_zign_load_sdb_handler, &zign_load_sdb_help, &zo_help);
rz_warn_if_fail(zo_cd);
RzCmdDesc *zign_save_sdb_cd = rz_cmd_desc_argv_new(core->rcmd, zo_cd, "zos", rz_zign_save_sdb_handler, &zign_save_sdb_help);
rz_warn_if_fail(zign_save_sdb_cd);
RzCmdDesc *zign_load_gzip_sdb_cd = rz_cmd_desc_argv_new(core->rcmd, zo_cd, "zoz", rz_zign_load_gzip_sdb_handler, &zign_load_gzip_sdb_help);
rz_warn_if_fail(zign_load_gzip_sdb_cd);
RzCmdDesc *zf_cd = rz_cmd_desc_group_new(core->rcmd, z_cd, "zf", NULL, NULL, &zf_help);
rz_warn_if_fail(zf_cd);
RzCmdDesc *zign_flirt_create_cd = rz_cmd_desc_argv_new(core->rcmd, zf_cd, "zfc", rz_zign_flirt_create_handler, &zign_flirt_create_help);
rz_warn_if_fail(zign_flirt_create_cd);
RzCmdDesc *zign_flirt_dump_cd = rz_cmd_desc_argv_new(core->rcmd, zf_cd, "zfd", rz_zign_flirt_dump_handler, &zign_flirt_dump_help);
rz_warn_if_fail(zign_flirt_dump_cd);
RzCmdDesc *zign_flirt_scan_cd = rz_cmd_desc_argv_new(core->rcmd, zf_cd, "zfs", rz_zign_flirt_scan_handler, &zign_flirt_scan_help);
rz_warn_if_fail(zign_flirt_scan_cd);
RzCmdDesc *z_slash__cd = rz_cmd_desc_group_modes_new(core->rcmd, z_cd, "z/", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_RIZIN, rz_zign_search_handler, &zign_search_help, &z_slash__help);
rz_warn_if_fail(z_slash__cd);
RzCmdDesc *zign_search_fcn_cd = rz_cmd_desc_argv_modes_new(core->rcmd, z_slash__cd, "z/f", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_RIZIN, rz_zign_search_fcn_handler, &zign_search_fcn_help);
rz_warn_if_fail(zign_search_fcn_cd);
RzCmdDesc *zc_cd = rz_cmd_desc_group_new(core->rcmd, z_cd, "zc", rz_zign_cmp_handler, &zign_cmp_help, &zc_help);
rz_warn_if_fail(zc_cd);
RzCmdDesc *zcn_cd = rz_cmd_desc_group_new(core->rcmd, zc_cd, "zcn", rz_zign_cmp_name_handler, &zign_cmp_name_help, &zcn_help);
rz_warn_if_fail(zcn_cd);
RzCmdDesc *zign_cmp_diff_name_cd = rz_cmd_desc_argv_new(core->rcmd, zcn_cd, "zcn!", rz_zign_cmp_diff_name_handler, &zign_cmp_diff_name_help);
rz_warn_if_fail(zign_cmp_diff_name_cd);
RzCmdDesc *zs_cd = rz_cmd_desc_group_modes_new(core->rcmd, z_cd, "zs", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_JSON | RZ_OUTPUT_MODE_RIZIN, rz_zign_space_select_handler, &zign_space_select_help, &zs_help);
rz_warn_if_fail(zs_cd);
RzCmdDesc *zign_space_delete_cd = rz_cmd_desc_argv_new(core->rcmd, zs_cd, "zs-", rz_zign_space_delete_handler, &zign_space_delete_help);
rz_warn_if_fail(zign_space_delete_cd);
RzCmdDesc *zign_space_add_cd = rz_cmd_desc_argv_new(core->rcmd, zs_cd, "zs+", rz_zign_space_add_handler, &zign_space_add_help);
rz_warn_if_fail(zign_space_add_cd);
RzCmdDesc *zign_space_rename_cd = rz_cmd_desc_argv_new(core->rcmd, zs_cd, "zsr", rz_zign_space_rename_handler, &zign_space_rename_help);
rz_warn_if_fail(zign_space_rename_cd);
RzCmdDesc *zi_cd = rz_cmd_desc_group_state_new(core->rcmd, z_cd, "zi", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_JSON | RZ_OUTPUT_MODE_RIZIN | RZ_OUTPUT_MODE_QUIET, rz_zign_info_handler, &zign_info_help, &zi_help);
rz_warn_if_fail(zi_cd);
rz_cmd_desc_set_default_mode(zi_cd, RZ_OUTPUT_MODE_STANDARD);
RzCmdDesc *zign_info_range_cd = rz_cmd_desc_argv_state_new(core->rcmd, zi_cd, "zii", RZ_OUTPUT_MODE_STANDARD | RZ_OUTPUT_MODE_JSON, rz_zign_info_range_handler, &zign_info_range_help);
rz_warn_if_fail(zign_info_range_cd);
rz_cmd_desc_set_default_mode(zign_info_range_cd, RZ_OUTPUT_MODE_STANDARD);
RzCmdDesc *tmp_modifiers_cd = rz_cmd_desc_fake_new(core->rcmd, root_cd, "@", &tmp_modifiers_help);
rz_warn_if_fail(tmp_modifiers_cd);

View file

@ -64,8 +64,6 @@ RZ_IPI RzCmdStatus rz_analyze_all_functions_handler(RzCore *core, int argc, cons
RZ_IPI RzCmdStatus rz_analyze_all_functions_esil_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_analyze_all_consecutive_functions_in_section_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_analyze_recursively_all_function_types_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_apply_signatures_from_sigdb_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_list_signatures_in_sigdb_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_print_analysis_details_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_analyze_all_unresolved_jumps_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_recover_all_golang_functions_strings_handler(RzCore *core, int argc, const char **argv);
@ -616,6 +614,11 @@ RZ_IPI RzCmdStatus rz_flag_zone_remove_all_handler(RzCore *core, int argc, const
RZ_IPI RzCmdStatus rz_flag_zone_around_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_flag_zone_list_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_flag_hexdump_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_flirt_create_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_flirt_dump_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_flirt_scan_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_apply_signatures_from_sigdb_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_list_signatures_in_sigdb_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_egg_compile_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_egg_config_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_egg_list_plugins_handler(RzCore *core, int argc, const char **argv);
@ -961,32 +964,6 @@ RZ_IPI RzCmdStatus rz_yank_hexpairs_handler(RzCore *core, int argc, const char *
RZ_IPI RzCmdStatus rz_yank_hex_print_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_yank_paste_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_yank_string_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_show_handler(RzCore *core, int argc, const char **argv, RzOutputMode mode);
RZ_IPI RzCmdStatus rz_zign_find_handler(RzCore *core, int argc, const char **argv, RzOutputMode mode);
RZ_IPI RzCmdStatus rz_zign_best_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_best_name_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_delete_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_add_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_add_fcn_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_add_all_fcns_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_generate_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_load_sdb_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_save_sdb_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_load_gzip_sdb_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_flirt_create_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_flirt_dump_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_flirt_scan_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_search_handler(RzCore *core, int argc, const char **argv, RzOutputMode mode);
RZ_IPI RzCmdStatus rz_zign_search_fcn_handler(RzCore *core, int argc, const char **argv, RzOutputMode mode);
RZ_IPI RzCmdStatus rz_zign_cmp_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_cmp_name_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_cmp_diff_name_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_space_select_handler(RzCore *core, int argc, const char **argv, RzOutputMode mode);
RZ_IPI RzCmdStatus rz_zign_space_delete_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_space_add_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_space_rename_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_zign_info_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_zign_info_range_handler(RzCore *core, int argc, const char **argv, RzCmdStateOutput *state);
RZ_IPI RzCmdStatus rz_cmd_shell_env_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_cmd_shell_exit_handler(RzCore *core, int argc, const char **argv);
RZ_IPI RzCmdStatus rz_cmd_shell_ls_handler(RzCore *core, int argc, const char **argv);

View file

@ -212,6 +212,9 @@ commands:
- name: f
summary: Manage flags
subcommands: cmd_flag
- name: F
summary: FLIRT signature management
subcommands: cmd_flirt
- name: g
summary: Generate shellcodes with rz_egg
subcommands: cmd_egg
@ -269,9 +272,6 @@ commands:
- name: y
summary: Yank/paste bytes from/to memory
subcommands: cmd_yank
- name: z
summary: Zignatures management
subcommands: cmd_zign
- name: "@"
cname: tmp_modifiers
options: "[?]"

View file

@ -0,0 +1,38 @@
# SPDX-FileCopyrightText: 2021 RizinOrg <info@rizin.re>
# SPDX-License-Identifier: LGPL-3.0-only
---
name: cmd_flirt
commands:
- name: Fc
cname: flirt_create
summary: Create a FLIRT file (.pat or .sig)
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: Fd
cname: flirt_dump
summary: Open a FLIRT file (.pat or .sig) and dumps its contents
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: Fs
cname: flirt_scan
summary: Open a FLIRT file (.pat or .sig) and tries to apply the signatures to the loaded binary
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: Fa
summary: Apply signatures from sigdb
cname: apply_signatures_from_sigdb
args:
- name: filter
type: RZ_CMD_ARG_TYPE_STRING
optional: true
- name: Fl
summary: Lists all available signatures in sigdb
cname: list_signatures_in_sigdb
type: RZ_CMD_DESC_TYPE_ARGV_STATE
default_mode: RZ_OUTPUT_MODE_TABLE
modes:
- RZ_OUTPUT_MODE_TABLE
args: []

View file

@ -1,310 +0,0 @@
# SPDX-FileCopyrightText: 2021 RizinOrg <info@rizin.re>
# SPDX-License-Identifier: LGPL-3.0-only
---
name: cmd_zign
commands:
- name: z
cname: zign_show
summary: Show zignatures
args: []
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_QUIET
- RZ_OUTPUT_MODE_RIZIN
- RZ_OUTPUT_MODE_JSON
- RZ_OUTPUT_MODE_SDB
- name: z.
cname: zign_find
summary: Find matching zignatures
args: []
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_RIZIN
- name: zb
summary: Search for best match
subcommands:
- name: zb
cname: zign_best
summary: >
Find <n> closest matching zignatures to function at current offset
args:
- name: n
type: RZ_CMD_ARG_TYPE_NUM
default_value: 5
- name: zbr
cname: zign_best_name
summary: Search for <n> most similar functions to zigname
args:
- name: zigname
type: RZ_CMD_ARG_TYPE_ZIGN
- name: n
type: RZ_CMD_ARG_TYPE_NUM
default_value: 5
- name: z-
cname: zign_delete
summary: Delete zignature
args:
- name: zigname|*
type: RZ_CMD_ARG_TYPE_ZIGN
- name: za
summary: Add zignature
subcommands:
- name: za
cname: zign_add
summary: Add zignature
args:
- name: zigname
type: RZ_CMD_ARG_TYPE_STRING
- name: type
type: RZ_CMD_ARG_TYPE_CHOICES
choices:
- a
- b
- c
- n
- g
- o
- r
- t
- x
- h
- v
- name: param
type: RZ_CMD_ARG_TYPE_STRING
flags: RZ_CMD_ARG_FLAG_ARRAY
details:
- name: Zignature types
entries:
- text: "a"
comment: "bytes pattern (analysis mask)"
- text: "b"
comment: "bytes pattern"
- text: "c"
comment: "base64 comment"
- text: "n"
comment: "real function name"
- text: "g"
comment: "graph metrics"
- text: "o"
comment: "original offset"
- text: "r"
comment: "references"
- text: "t"
comment: "types"
- text: "x"
comment: "cross references"
- text: "h"
comment: "bbhash (hashing of function basic blocks)"
- text: "v"
comment: "vars (and args)"
- name: Bytes patterns
entries:
- text: ""
comment: bytes can contain '..' (dots) to specify a binary mask
- name: Graph metrics
entries:
- text: cc
comment: cyclomatic complexity
- text: edges
comment: number of edges
- text: nbbs
comment: number of basic blocks
- text: ebbs
comment: number of end basic blocks
- name: Examples
entries:
- text: "za"
arg_str: " foo b 558bec..e8........"
comment: ""
- text: "za"
arg_str: " foo a e811223344"
comment: ""
- text: "za"
arg_str: " foo g cc=2 nbbs=3 edges=3 ebbs=1"
comment: ""
- text: "za"
arg_str: " foo g nbbs=3 edges=3"
comment: ""
- text: "za"
arg_str: " foo v b-32 b-48 b-64"
comment: ""
- text: "za"
arg_str: " foo o 0x08048123"
comment: ""
- text: "za"
arg_str: " foo c this is a comment (base64?)"
comment: ""
- text: "za"
arg_str: " foo r sym.imp.strcpy sym.imp.sprintf sym.imp.strlen"
comment: ""
- text: "za"
arg_str: " foo t func.sym.imp.strlen.ret=int"
comment: ""
- text: "za"
arg_str: " foo h 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae"
comment: ""
- name: zaf
cname: zign_add_fcn
summary: Create zignature for function
args:
- name: fcnname
type: RZ_CMD_ARG_TYPE_FCN
optional: true
- name: zigname
type: RZ_CMD_ARG_TYPE_STRING
optional: true
- name: zaF
cname: zign_add_all_fcns
summary: Generate zignatures for all functions
args: []
- name: zg
cname: zign_generate
summary: Generate zignatures (alias for zaF)
args: []
- name: zo
summary: Manage zignature files
subcommands:
- name: zo
cname: zign_load_sdb
summary: Load zinatures from sdb file
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: zos
cname: zign_save_sdb
summary: Save zinatures to sdb file
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: zoz
cname: zign_load_gzip_sdb
summary: Load zinatures from gzipped sdb file
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: zf
summary: Manage FLIRT signatures
subcommands:
- name: zfc
cname: zign_flirt_create
summary: Create a FLIRT file (.pat or .sig)
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: zfd
cname: zign_flirt_dump
summary: Open a FLIRT file (.pat or .sig) and dumps its contents
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: zfs
cname: zign_flirt_scan
summary: Open a FLIRT file (.pat or .sig) and tries to apply the signatures to the loaded binary
args:
- name: filename
type: RZ_CMD_ARG_TYPE_FILE
- name: z/
summary: Search zignatures
subcommands:
- name: z/
cname: zign_search
summary: Search zignatures on range and flag matches
args: []
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_RIZIN
- name: z/f
cname: zign_search_fcn
summary: Search only function zignatures
args: []
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_RIZIN
- name: zc
summary: Compare zignatures in current zignspace with another one
subcommands:
- name: zc
cname: zign_cmp
summary: Compare all zignatures in current space with <zignspace>
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
- name: zcn
summary: Compare current zignspace with zigns on other <zignspace>
subcommands:
- name: zcn
cname: zign_cmp_name
summary: >
Compare current zignspace with zigns with same name on other
<zignspace>
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
- name: zcn!
cname: zign_cmp_diff_name
summary: >
Compare current zignspace with zigns with different name on
other <zignspace>
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
- name: zs
summary: Manage zignspaces
subcommands:
- name: zs
cname: zign_space_select
summary: Display/select zignspaces
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
optional: true
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_JSON
- RZ_OUTPUT_MODE_RIZIN
- name: zs-
cname: zign_space_delete
summary: Pop last zignspace or delete <zignspace>
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
optional: true
- name: zs+
cname: zign_space_add
summary: Push previous zignspace and set
args:
- name: zignspace
type: RZ_CMD_ARG_TYPE_ZIGN_SPACE
- name: zsr
cname: zign_space_rename
summary: Rename selected zignspace
args:
- name: newname
type: RZ_CMD_ARG_TYPE_STRING
- name: zi
summary: Show zignatures matching information
subcommands:
- name: zi
cname: zign_info
summary: Show zignatures matching information
args: []
type: RZ_CMD_DESC_TYPE_ARGV_STATE
default_mode: RZ_OUTPUT_MODE_STANDARD
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_JSON
- RZ_OUTPUT_MODE_RIZIN
- RZ_OUTPUT_MODE_QUIET
- name: zii
cname: zign_info_range
summary: Show zignatures matching information in range
type: RZ_CMD_DESC_TYPE_ARGV_STATE
default_mode: RZ_OUTPUT_MODE_STANDARD
modes:
- RZ_OUTPUT_MODE_STANDARD
- RZ_OUTPUT_MODE_JSON
args:
- name: from
type: RZ_CMD_ARG_TYPE_NUM
- name: to
type: RZ_CMD_ARG_TYPE_NUM

View file

@ -8,6 +8,7 @@ cmd_descs_yaml = files(
'cmd_egg.yaml',
'cmd_eval.yaml',
'cmd_flag.yaml',
'cmd_flirt.yaml',
'cmd_heap_glibc.yaml',
'cmd_history.yaml',
'cmd_info.yaml',
@ -27,7 +28,6 @@ cmd_descs_yaml = files(
'cmd_type.yaml',
'cmd_write.yaml',
'cmd_yank.yaml',
'cmd_zign.yaml',
)
cmd_descs_src_c = files('cmd_descs.c', 'cmd_descs.h')

View file

@ -1329,24 +1329,6 @@ static void autocomplete_sdb(RzCore *core, RzLineCompletion *completion, const c
}
}
static void autocomplete_zignatures(RzCore *core, RzLineCompletion *completion, const char *msg) {
rz_return_if_fail(msg);
int length = strlen(msg);
RzSpaces *zs = &core->analysis->zign_spaces;
RzSpace *s;
RzSpaceIter it;
rz_spaces_foreach(zs, it, s) {
if (!strncmp(msg, s->name, length)) {
rz_line_completion_push(completion, s->name);
}
}
if (strlen(msg) == 0) {
rz_line_completion_push(completion, "*");
}
}
static void autocomplete_flagspaces(RzCore *core, RzLineCompletion *completion, const char *msg) {
rz_return_if_fail(msg);
int length = strlen(msg);
@ -1516,9 +1498,6 @@ static bool find_autocomplete(RzCore *core, RzLineCompletion *completion, RzLine
case RZ_CORE_AUTOCMPLT_FCN:
autocomplete_functions(core, completion, p);
break;
case RZ_CORE_AUTOCMPLT_ZIGN:
autocomplete_zignatures(core, completion, p);
break;
case RZ_CORE_AUTOCMPLT_EVAL:
autocomplete_evals(core, completion, p);
break;
@ -1697,15 +1676,6 @@ RZ_API void rz_core_autocomplete(RZ_NULLABLE RzCore *core, RzLineCompletion *com
rz_line_completion_push(completion, key);
}
}
} else if (!strncmp(buf->data, "zo ", 3) || !strncmp(buf->data, "zoz ", 4)) {
if (core->analysis->zign_path && core->analysis->zign_path[0]) {
char *zignpath = rz_file_abspath(core->analysis->zign_path);
char *paths[2] = { zignpath, NULL };
autocompleteFilename(completion, buf, paths, 1);
free(zignpath);
} else {
autocompleteFilename(completion, buf, NULL, 1);
}
} else if (find_e_opts(core, completion, buf)) {
return;
} else if (prompt_type == RZ_LINE_PROMPT_OFFSET) {
@ -2239,7 +2209,6 @@ static void __init_autocomplete_default(RzCore *core) {
__foreach(core, files, RZ_CORE_AUTOCMPLT_FILE);
rz_core_autocomplete_add(core->autocomplete, "-", RZ_CORE_AUTOCMPLT_MINS, true);
rz_core_autocomplete_add(core->autocomplete, "zs", RZ_CORE_AUTOCMPLT_ZIGN, true);
rz_core_autocomplete_add(core->autocomplete, "fs", RZ_CORE_AUTOCMPLT_FLSP, true);
rz_core_autocomplete_add(
rz_core_autocomplete_add(core->autocomplete, "ls", RZ_CORE_AUTOCMPLT_DFLT, true),
@ -2509,7 +2478,6 @@ RZ_API bool rz_core_init(RzCore *core) {
core->rasm->num = core->num;
core->rasm->core = core;
core->analysis = rz_analysis_new();
rz_sign_analysis_set_hooks(core->analysis);
core->gadgets = rz_list_newf((RzListFree)rz_core_gadget_free);
core->analysis->ev = core->ev;
core->analysis->read_at = rz_core_analysis_read_at;

View file

@ -4,7 +4,6 @@
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_core.h>
#include <rz_sign.h>
#include <rz_flirt.h>
typedef struct map_string_value_t {

View file

@ -68,6 +68,7 @@ rz_core_sources = [
'cmd/cmd_egg.c',
'cmd/cmd_eval.c',
'cmd/cmd_flag.c',
'cmd/cmd_flirt.c',
'cmd/cmd_hash.c',
#'cmd/cmd_help.c',
'cmd/cmd_history.c',
@ -92,14 +93,12 @@ rz_core_sources = [
'cmd/cmd_type.c',
'cmd/cmd_write.c',
'cmd/cmd_yank.c',
'cmd/cmd_zign.c',
'cmd/cmd_regs.c',
'cmd/cmd_linux_heap_glibc.c',
'cmd/cmd_windows_heap.c',
'tui/visual.c',
'tui/vmenus.c',
'tui/vmenus_graph.c',
'tui/vmenus_zigns.c',
'tui/vasm.c',
'tui/panels.c'
]

View file

@ -270,6 +270,38 @@ RZ_API bool rz_project_migrate_v6_v7(RzProject *prj, RzSerializeResultInfo *res)
return true;
}
// --
// Migration 7 -> 8
//
// Changes from <commit-hash>
// Removed zignature feature. Namespace deleted: /core/analysis/zigns
// Also removed configs zign.* options.
RZ_API bool rz_project_migrate_v7_v8(RzProject *prj, RzSerializeResultInfo *res) {
Sdb *core_db;
RZ_SERIALIZE_SUB(prj, core_db, res, "core", return false;);
Sdb *analysis_db;
RZ_SERIALIZE_SUB(core_db, analysis_db, res, "analysis", return false;);
sdb_ns_unset(analysis_db, "zigns", NULL);
Sdb *config_db;
RZ_SERIALIZE_SUB(core_db, config_db, res, "config", return false;);
sdb_unset(config_db, "zign.autoload", 0);
sdb_unset(config_db, "zign.diff.bthresh", 0);
sdb_unset(config_db, "zign.diff.gthresh", 0);
sdb_unset(config_db, "zign.match.bytes", 0);
sdb_unset(config_db, "zign.match.graph", 0);
sdb_unset(config_db, "zign.match.hash", 0);
sdb_unset(config_db, "zign.match.offset", 0);
sdb_unset(config_db, "zign.match.refs", 0);
sdb_unset(config_db, "zign.match.types", 0);
sdb_unset(config_db, "zign.maxsz", 0);
sdb_unset(config_db, "zign.mincc", 0);
sdb_unset(config_db, "zign.minsz", 0);
sdb_unset(config_db, "zign.prefix", 0);
sdb_unset(config_db, "zign.threshold", 0);
return true;
}
// --
static bool (*const migrations[])(RzProject *prj, RzSerializeResultInfo *res) = {
@ -278,7 +310,8 @@ static bool (*const migrations[])(RzProject *prj, RzSerializeResultInfo *res) =
rz_project_migrate_v3_v4,
rz_project_migrate_v4_v5,
rz_project_migrate_v5_v6,
rz_project_migrate_v6_v7
rz_project_migrate_v6_v7,
rz_project_migrate_v7_v8
};
/// Migrate the given project to the current version in-place

View file

@ -49,7 +49,6 @@ static const char *const config_exclude[] = {
"dir.source",
"dir.tmp",
"dir.types",
"dir.zigns",
"http.root",
"pdb.symstore",
"scr.color",

View file

@ -2092,7 +2092,6 @@ RZ_API void rz_core_visual_browse(RzCore *core, const char *input) {
" v vars\n"
" x xrefs\n"
" X refs\n"
" z browse function zignatures\n"
" : run command\n";
for (;;) {
rz_cons_clear00();
@ -2110,11 +2109,6 @@ RZ_API void rz_core_visual_browse(RzCore *core, const char *input) {
case '1':
rz_core_visual_bit_editor(core);
break;
case 'z': // "vbz"
if (rz_core_visual_view_zigns(core)) {
return;
}
break;
case 'g': // "vbg"
if (rz_core_visual_view_graph(core)) {
return;

View file

@ -1,179 +0,0 @@
// SPDX-FileCopyrightText: 2019 pancake <pancake@nopcode.org>
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_core.h>
typedef struct {
ut64 addr;
ut64 faddr;
RzAnalysisFunction *fcn;
int pos; // related to columns
int cur; // current row selected
RzList *columns;
RzCore *core;
bool canLeft;
bool canRight;
} RzCoreVisualViewZigns;
static const char *cur_name = NULL;
static char *print_item(void *_core, void *_item, bool selected) {
RzSignItem *item = _item;
int i;
int bytes_mask = 0;
int bytes_size = item->bytes->size;
// int bytes_null = bytes_size - bytes_mask;
if (item->bytes->mask) {
for (i = 0; i < bytes_size; i++) {
if (item->bytes->mask[i]) {
bytes_mask++;
}
}
}
if (selected && item->name) {
cur_name = strdup(item->name);
}
return rz_str_newf("%c 0x%08" PFMT64x " bytes=%d/%d %20s\n", selected ? '>' : ' ',
item->addr, bytes_mask, bytes_size, item->name);
}
static RzList *__signs(RzCoreVisualViewZigns *status, ut64 addr, bool update) {
RzCore *core = status->core;
return rz_sign_get_list(core->analysis);
}
RZ_API int __core_visual_view_zigns_update(RzCore *core, RzCoreVisualViewZigns *status) {
int h, w = rz_cons_get_size(&h);
rz_cons_clear00();
int colh = h - 2;
int colw = w - 1;
RzList *col0 = __signs(status, status->addr, true);
char *col0str = rz_str_widget_list(core, col0, colh, status->cur, print_item);
char *title = rz_str_newf("[rz-visual-signatures] 0x%08" PFMT64x " 0x%08" PFMT64x, status->addr, status->faddr);
if (title) {
rz_cons_strcat_at(title, 0, 0, w - 1, 2);
free(title);
}
rz_cons_strcat_at(col0str, 0, 2, colw, colh);
rz_list_free(col0);
rz_cons_flush();
return 0;
}
RZ_API int rz_core_visual_view_zigns(RzCore *core) {
RzCoreVisualViewZigns status = { 0 };
status.core = core;
status.addr = core->offset;
status.fcn = NULL;
while (true) {
__core_visual_view_zigns_update(core, &status);
int ch = rz_cons_readchar();
if (ch == -1 || ch == 4) {
return true;
}
ch = rz_cons_arrow_to_hjkl(ch); // get ESC+char, return 'hjkl' char
switch (ch) {
case 'g':
rz_core_cmd0(core, "zg");
break;
case 'h':
if (status.canLeft) {
if (status.pos) {
status.addr = status.faddr;
}
status.pos = 1;
status.cur = 0;
}
break;
case 'l':
if (status.canRight) {
if (status.pos) {
status.addr = status.faddr;
}
status.pos = 2;
status.cur = 0;
}
break;
case 'd':
if (cur_name && *cur_name) {
rz_sign_delete(core->analysis, cur_name);
RZ_FREE(cur_name);
}
break;
case 'J':
status.cur += 10;
break;
case 'K':
if (status.cur > 10) {
status.cur -= 10;
} else {
status.cur = 0;
}
break;
case '.':
status.pos = 0;
break;
case 9:
case ' ':
case '\r':
case '\n':
if (status.pos) {
rz_core_seek(core, status.faddr, true);
} else {
rz_core_seek(core, status.addr, true);
}
return true;
break;
case '_':
rz_core_cmd0(core, "z*~...");
break;
case 'j':
status.cur++;
break;
case 'k':
if (status.cur > 0) {
status.cur--;
} else {
status.cur = 0;
}
break;
case '?':
rz_cons_clear00();
rz_cons_printf(
"vbz: Visual Zignatures:\n\n"
" jkJK - scroll up/down\n"
" d - delete current signature\n"
" g - regenerate signatures\n"
" q - quit this visual mode\n"
" _ - enter the hud\n"
" : - enter command\n");
rz_cons_flush();
rz_cons_any_key(NULL);
break;
case 'q':
RZ_FREE(cur_name);
return false;
case ':': // TODO: move this into a separate helper function
{
char cmd[1024];
rz_cons_show_cursor(true);
rz_cons_set_raw(0);
cmd[0] = '\0';
rz_line_set_prompt(":> ");
if (rz_cons_fgets(cmd, sizeof(cmd), 0, NULL) < 0) {
cmd[0] = '\0';
}
rz_core_cmd0(core, cmd);
rz_cons_set_raw(1);
rz_cons_show_cursor(false);
if (cmd[0]) {
rz_cons_any_key(NULL);
}
rz_cons_clear();
} break;
}
}
return false;
}

View file

@ -39,7 +39,6 @@ include_files = [
'rz_reg.h',
'rz_regex.h',
'rz_search.h',
'rz_sign.h',
'rz_skiplist.h',
'rz_skyline.h',
'rz_socket.h',

View file

@ -588,12 +588,9 @@ typedef struct rz_analysis_t {
RzList *plugins;
Sdb *sdb_noret;
Sdb *sdb_fmts;
Sdb *sdb_zigns;
HtUP *ht_xrefs_from;
HtUP *ht_xrefs_to;
bool recursive_noreturn; // analysis.rnr
RzSpaces zign_spaces;
char *zign_path; // dir.zigns
// moved from RzAnalysisFcn
Sdb *sdb; // root
HtUP /*<RzVector<RzAnalysisAddrHintRecord>>*/ *addr_hints; // all hints that correspond to a single address
@ -2008,11 +2005,6 @@ RZ_API bool rz_analysis_noreturn_at_addr(RzAnalysis *analysis, ut64 addr);
RZ_API bool rz_analysis_noreturn_at(RzAnalysis *analysis, ut64 addr);
RZ_API RzList *rz_analysis_noreturn_functions(RzAnalysis *analysis);
/* zign spaces */
RZ_API int rz_sign_space_count_for(RzAnalysis *a, const RzSpace *space);
RZ_API void rz_sign_space_unset_for(RzAnalysis *a, const RzSpace *space);
RZ_API void rz_sign_space_rename_for(RzAnalysis *a, const RzSpace *space, const char *oname, const char *nname);
/* vtables */
typedef struct {
RzAnalysis *analysis;

View file

@ -39,8 +39,6 @@ typedef enum rz_cmd_arg_type_t {
RZ_CMD_ARG_TYPE_RZNUM, ///< Argument that can be interpreted by RzNum (numbers, flags, operations, etc.)
RZ_CMD_ARG_TYPE_STRING, ///< Argument that can be an arbitrary string
RZ_CMD_ARG_TYPE_ENV, ///< Argument can be the name of an existing rizin variable
RZ_CMD_ARG_TYPE_ZIGN, ///< Argument can be the name of an existing zignature
RZ_CMD_ARG_TYPE_ZIGN_SPACE, ///< Argument can be the name of an existing zignature space
RZ_CMD_ARG_TYPE_CHOICES, ///< Argument can be one of the provided choices
RZ_CMD_ARG_TYPE_FCN, ///< Argument can be the name of an existing function
RZ_CMD_ARG_TYPE_FILE, ///< Argument is a filename

View file

@ -33,7 +33,6 @@
#include <rz_util/rz_annotated_code.h>
#include <rz_heap_glibc.h>
#include <rz_windows_heap.h>
#include <rz_flirt.h>
#ifdef __cplusplus
extern "C" {
@ -191,7 +190,6 @@ typedef enum rz_core_autocomplete_types_t {
RZ_CORE_AUTOCMPLT_FLSP,
RZ_CORE_AUTOCMPLT_SEEK,
RZ_CORE_AUTOCMPLT_FCN,
RZ_CORE_AUTOCMPLT_ZIGN,
RZ_CORE_AUTOCMPLT_EVAL,
RZ_CORE_AUTOCMPLT_MINS,
RZ_CORE_AUTOCMPLT_BRKP,
@ -1032,7 +1030,6 @@ RZ_API void rz_core_visual_debugtraces(RzCore *core, const char *input);
RZ_API void rz_core_visual_define(RzCore *core, const char *arg, int distance);
RZ_API int rz_core_visual_trackflags(RzCore *core);
RZ_API int rz_core_visual_view_graph(RzCore *core);
RZ_API int rz_core_visual_view_zigns(RzCore *core);
RZ_API int rz_core_visual_view_rop(RzCore *core);
RZ_API int rz_core_visual_comments(RzCore *core);
RZ_API int rz_core_visual_prompt(RzCore *core);

View file

@ -1,11 +1,12 @@
// SPDX-FileCopyrightText: 2021 RizinOrg <info@rizin.re>
// SPDX-FileCopyrightText: 2021 deroad <wargio@libero.it>
// SPDX-FileCopyrightText: 2021-2022 RizinOrg <info@rizin.re>
// SPDX-FileCopyrightText: 2021-2022 deroad <wargio@libero.it>
// SPDX-FileCopyrightText: 2014-2016 jfrankowski <jody.frankowski@gmail.com>
// SPDX-License-Identifier: LGPL-3.0-only
#ifndef RZ_FLIRT_H
#define RZ_FLIRT_H
#include <rz_types.h>
#include <rz_list.h>
#include <rz_analysis.h>

View file

@ -12,7 +12,7 @@
extern "C" {
#endif
#define RZ_PROJECT_VERSION 7
#define RZ_PROJECT_VERSION 8
typedef Sdb RzProject;

View file

@ -2,8 +2,7 @@
#define RZ_SIGN_H
#include <rz_types.h>
#include <rz_analysis.h>
#include <rz_search.h>
#include <rz_flirt.h>
#ifdef __cplusplus
extern "C" {
@ -11,156 +10,6 @@ extern "C" {
RZ_LIB_VERSION_HEADER(rz_sign);
// XXX those limits should go away
#define RZ_SIGN_KEY_MAXSZ 1024
#define RZ_SIGN_VAL_MAXSZ 10240
#define ZIGN_HASH "sha256"
#define ZIGN_HASH_SIZE 32
typedef enum {
RZ_SIGN_BYTES = 'b', // bytes pattern
RZ_SIGN_BYTES_MASK = 'm', // bytes pattern
RZ_SIGN_BYTES_SIZE = 's', // bytes pattern
RZ_SIGN_ANALYSIS = 'a', // bytes pattern (analysis mask)
RZ_SIGN_COMMENT = 'c', // comment
RZ_SIGN_GRAPH = 'g', // graph metrics
RZ_SIGN_OFFSET = 'o', // addr
RZ_SIGN_NAME = 'n', // real name
RZ_SIGN_REFS = 'r', // xrefs from
RZ_SIGN_XREFS = 'x', // xrefs to
RZ_SIGN_VARS = 'v', // variables
RZ_SIGN_TYPES = 't', // types
RZ_SIGN_BBHASH = 'h', // basic block hash
} RzSignType;
typedef struct rz_sign_graph_t {
int cc;
int nbbs;
int edges;
int ebbs;
int bbsum;
} RzSignGraph;
typedef struct rz_sign_bytes_t {
int size;
ut8 *bytes;
ut8 *mask;
} RzSignBytes;
typedef struct rz_sign_hash_t {
char *bbhash;
} RzSignHash;
typedef struct rz_sign_item_t {
char *name;
char *realname;
char *comment;
const RzSpace *space;
RzSignBytes *bytes;
RzSignGraph *graph;
ut64 addr;
RzList *xrefs_from;
RzList *xrefs_to;
RzList *vars;
RzList *types;
RzSignHash *hash;
} RzSignItem;
typedef int (*RzSignForeachCallback)(RzSignItem *it, void *user);
typedef int (*RzSignSearchCallback)(RzSignItem *it, RzSearchKeyword *kw, ut64 addr, void *user);
typedef int (*RzSignMatchCallback)(RzSignItem *it, RzAnalysisFunction *fcn, RzSignType type, bool seen, void *user);
typedef struct rz_sign_search_met {
/* types is an 0 terminated array of RzSignTypes that are going to be
* searched for. Valid types are: graph, offset, refs, bbhash, types, vars
*/
RzSignType types[7];
int mincc; // min complexity for graph search
RzAnalysis *analysis;
void *user; // user data for callback function
RzSignMatchCallback cb;
RzAnalysisFunction *fcn;
} RzSignSearchMetrics;
typedef struct rz_sign_search_t {
RzSearch *search;
RzList *items;
RzSignSearchCallback cb;
void *user;
} RzSignSearch;
typedef struct rz_sign_options_t {
double bytes_diff_threshold;
double graph_diff_threshold;
} RzSignOptions;
typedef struct {
double score;
double bscore;
double gscore;
RzSignItem *item;
} RzSignCloseMatch;
#ifdef RZ_API
RZ_API void rz_sign_analysis_set_hooks(RZ_NONNULL RzAnalysis *analysis);
RZ_API bool rz_sign_add_bytes(RzAnalysis *a, const char *name, ut64 size, const ut8 *bytes, const ut8 *mask);
RZ_API bool rz_sign_add_analysis(RzAnalysis *a, const char *name, ut64 size, const ut8 *bytes, ut64 at);
RZ_API bool rz_sign_add_graph(RzAnalysis *a, const char *name, RzSignGraph graph);
RZ_API bool rz_sign_addto_item(RzAnalysis *a, RzSignItem *it, RzAnalysisFunction *fcn, RzSignType type);
RZ_API bool rz_sign_add_addr(RzAnalysis *a, const char *name, ut64 addr);
RZ_API bool rz_sign_add_name(RzAnalysis *a, const char *name, const char *realname);
RZ_API bool rz_sign_add_comment(RzAnalysis *a, const char *name, const char *comment);
RZ_API bool rz_sign_add_refs(RzAnalysis *a, const char *name, RzList *refs);
RZ_API bool rz_sign_add_xrefs(RzAnalysis *a, const char *name, RzList *xrefs);
RZ_API bool rz_sign_add_vars(RzAnalysis *a, const char *name, RzList *vars);
RZ_API bool rz_sign_add_types(RzAnalysis *a, const char *name, RzList *vars);
RZ_API bool rz_sign_delete(RzAnalysis *a, const char *name);
RZ_API void rz_sign_list(RzAnalysis *a, RzStrBuf *sb, int format);
RZ_API RzList *rz_sign_get_list(RzAnalysis *a);
RZ_API bool rz_sign_add_hash(RzAnalysis *a, const char *name, int type, const char *val, int len);
RZ_API bool rz_sign_add_bb_hash(RzAnalysis *a, RzAnalysisFunction *fcn, const char *name);
RZ_API char *rz_sign_calc_bbhash(RzAnalysis *a, RzAnalysisFunction *fcn);
RZ_API bool rz_sign_deserialize(RzAnalysis *a, RzSignItem *it, const char *k, const char *v);
RZ_API RzSignItem *rz_sign_get_item(RzAnalysis *a, const char *name);
RZ_API bool rz_sign_add_item(RzAnalysis *a, RzSignItem *it);
RZ_API bool rz_sign_foreach(RzAnalysis *a, RzSignForeachCallback cb, void *user);
RZ_API RzSignSearch *rz_sign_search_new(void);
RZ_API void rz_sign_search_free(RzSignSearch *ss);
RZ_API void rz_sign_search_init(RzAnalysis *a, RzSignSearch *ss, int minsz, RzSignSearchCallback cb, void *user);
RZ_API int rz_sign_search_update(RzAnalysis *a, RzSignSearch *ss, ut64 *at, const ut8 *buf, int len);
RZ_API int rz_sign_fcn_match_metrics(RzSignSearchMetrics *sm);
RZ_API bool rz_sign_load(RzAnalysis *a, const char *file);
RZ_API bool rz_sign_load_gz(RzAnalysis *a, const char *filename);
RZ_API char *rz_sign_path(RzAnalysis *a, const char *file);
RZ_API bool rz_sign_save(RzAnalysis *a, const char *file);
RZ_API RzSignItem *rz_sign_item_new(void);
RZ_API void rz_sign_item_free(RzSignItem *item);
RZ_API void rz_sign_graph_free(RzSignGraph *graph);
RZ_API void rz_sign_bytes_free(RzSignBytes *bytes);
RZ_API RzList *rz_sign_fcn_xrefs_from(RzAnalysis *a, RzAnalysisFunction *fcn);
RZ_API RzList *rz_sign_fcn_xrefs_to(RzAnalysis *a, RzAnalysisFunction *fcn);
RZ_API RzList *rz_sign_fcn_vars(RzAnalysis *a, RzAnalysisFunction *fcn);
RZ_API RzList *rz_sign_fcn_types(RzAnalysis *a, RzAnalysisFunction *fcn);
RZ_API RzList *rz_sign_find_closest_sig(RzAnalysis *a, RzSignItem *it, int count, double score_threshold);
RZ_API RzList *rz_sign_find_closest_fcn(RzAnalysis *a, RzSignItem *it, int count, double score_threshold);
RZ_API void rz_sign_close_match_free(RzSignCloseMatch *match);
RZ_API RzList *rz_sign_diff(RzAnalysis *a, RzSignOptions *options, const char *other_space_name);
RZ_API RzList *rz_sign_diff_by_name(RzAnalysis *a, RzSignOptions *options, const char *other_space_name, bool not_matching);
RZ_API RzSignOptions *rz_sign_options_new(const char *bytes_thresh, const char *graph_thresh);
RZ_API void rz_sign_options_free(RzSignOptions *options);
#endif
#ifdef __cplusplus
}
#endif

View file

@ -69,7 +69,6 @@
#define RZ_PLUGINS "@PLUGINS@"
#define RZ_DATADIR "@DATADIR_RZ@"
#define RZ_SDB "@SDB@"
#define RZ_ZIGNS "@ZIGNS@"
#define RZ_SIGDB "@SIGDB@"
#define RZ_THEMES "@THEMES@"
#define RZ_FORTUNES "@FORTUNES@"

View file

@ -17,7 +17,7 @@ extern "C" {
* "*"/""/NULL is reserved to indicate "all spaces".
*
* You can have groups of "meta" (e.g. bin meta, format meta, etc.), groups of
* zign info, groups of flags, etc.
* flags, etc.
*
* It is possible to hook into the RzSpaces functions by using RzEvent.
* RZ_SPACE_EVENT_COUNT: called when you need to count how many elements there are in a given RzSpace

View file

@ -156,7 +156,6 @@ static int main_help(int line) {
char *system_magic = rz_path_system(RZ_SDB_MAGIC);
char *home_plugins = rz_path_home_prefix(RZ_PLUGINS);
char *system_plugins = rz_path_system(RZ_PLUGINS);
char *home_zigns = rz_path_home_prefix(RZ_ZIGNS);
char *system_sigdb = rz_path_system(RZ_SIGDB);
char *dirPrefix = rz_path_prefix(NULL);
// clang-format off
@ -169,7 +168,6 @@ static int main_help(int line) {
" binrc %s (elf, elf64, mach0, ..)\n"
" RZ_USER_PLUGINS %s\n"
" RZ_LIBR_PLUGINS %s\n"
" RZ_USER_ZIGNS %s\n"
"Environment:\n"
" RZ_DEBUG if defined, show error messages and crash signal\n"
" RZ_DEBUG_ASSERT=1 set a breakpoint when hitting an assert\n"
@ -189,7 +187,6 @@ static int main_help(int line) {
binrc,
home_plugins,
system_plugins,
home_zigns,
system_magic,
home_rc,
datahome,
@ -210,7 +207,6 @@ static int main_help(int line) {
free(system_magic);
free(home_plugins);
free(system_plugins);
free(home_zigns);
free(system_sigdb);
free(dirPrefix);
}
@ -226,7 +222,6 @@ static int main_print_var(const char *var_name) {
char *datahome = rz_path_home_prefix(RZ_DATADIR);
char *cachehome = rz_path_home_cache();
char *homeplugins = rz_path_home_prefix(RZ_PLUGINS);
char *homezigns = rz_path_home_prefix(RZ_ZIGNS);
char *sigdbdir = rz_path_system(RZ_SIGDB);
char *plugins = rz_path_system(RZ_PLUGINS);
char *magicpath = rz_path_system(RZ_SDB_MAGIC);
@ -247,7 +242,6 @@ static int main_print_var(const char *var_name) {
{ "RZ_RCACHEHOME", cachehome },
{ "RZ_LIBR_PLUGINS", plugins },
{ "RZ_USER_PLUGINS", homeplugins },
{ "RZ_USER_ZIGNS", homezigns },
{ "RZ_IS_PORTABLE", is_portable },
{ NULL, NULL }
};
@ -275,7 +269,6 @@ static int main_print_var(const char *var_name) {
free(datahome);
free(cachehome);
free(homeplugins);
free(homezigns);
free(sigdbdir);
free(plugins);
free(magicpath);
@ -885,27 +878,6 @@ RZ_API int rz_main_rizin(int argc, const char **argv) {
rz_config_set(r->config, "scr.utf8", "false");
}
if (rz_config_get_i(r->config, "zign.autoload")) {
char *path = rz_file_abspath(rz_config_get(r->config, "dir->zigns"));
char *complete_path = NULL;
RzList *list = rz_sys_dir(path);
RzListIter *iter;
char *file = NULL;
rz_list_foreach (list, iter, file) {
if (file && *file && *file != '.') {
complete_path = rz_str_newf("%s" RZ_SYS_DIR "%s", path, file);
if (rz_str_endswith(complete_path, "gz")) {
rz_sign_load_gz(r->analysis, complete_path);
} else {
rz_sign_load(r->analysis, complete_path);
}
free(complete_path);
}
}
rz_list_free(list);
free(path);
}
if (pfile && rz_file_is_directory(pfile)) {
if (debug) {
RZ_LOG_ERROR("Error: Cannot debug directories, yet.\n");

View file

@ -23,7 +23,7 @@ subdir('lang')
subdir('asm')
subdir('il')
subdir('analysis')
subdir('signature')
subdir('sign')
subdir('egg')
subdir('debug')
subdir('core')

View file

@ -4,7 +4,6 @@ rz_sign_sources = [
'pat.c',
'sigdb.c',
'sign.c',
'zignature.c',
]
rz_sign_inc = [

File diff suppressed because it is too large Load diff

View file

@ -199,7 +199,6 @@ if host_machine.system() == 'windows'
rizin_datdir_rz = rizin_datdir
rizin_wwwroot = rizin_datdir + '\\\\' + 'www'
rizin_sdb = rizin_datdir
rizin_zigns = rizin_datdir + '\\\\' + 'zigns'
rizin_sigdb = rizin_datdir + '\\\\' + 'sigdb'
rizin_themes = rizin_datdir + '\\\\' + 'cons'
rizin_fortunes = rizin_datdir + '\\\\' + 'fortunes'
@ -211,7 +210,6 @@ else
rizin_datdir_rz = rizin_datdir / 'rizin'
rizin_wwwroot = rizin_datdir_rz / 'www'
rizin_sdb = rizin_datdir_rz
rizin_zigns = rizin_datdir_rz / 'zigns'
rizin_sigdb = rizin_datdir_rz / 'sigdb'
rizin_themes = rizin_datdir_rz / 'cons'
rizin_fortunes = rizin_datdir_rz / 'fortunes'
@ -230,7 +228,6 @@ bindir_depth = py_cmd.stdout().strip()
opts_overwrite = [
'rizin_wwwroot',
'rizin_sdb',
'rizin_zigns',
'rizin_sigdb',
'rizin_themes',
'rizin_fortunes',
@ -416,7 +413,6 @@ userconf.set10('HAVE_JEMALLOC', host_machine.system() != 'windows' and (host_mac
userconf.set('DATADIR', rizin_datdir)
userconf.set('WWWROOT', rizin_wwwroot)
userconf.set('SDB', rizin_sdb)
userconf.set('ZIGNS', rizin_zigns)
userconf.set('SIGDB', rizin_sigdb)
userconf.set('THEMES', rizin_themes)
userconf.set('FORTUNES', rizin_fortunes)
@ -747,7 +743,6 @@ summary({
'datadir': rizin_datdir,
'wwwroot': rizin_wwwroot,
'sdb': rizin_sdb,
'zigns': rizin_zigns,
'sigdb': rizin_sigdb,
'themes': rizin_themes,
'fortunes': rizin_fortunes,

View file

@ -9,7 +9,6 @@ option('portable', type: 'boolean', value: false, description: 'Make rizin insta
option('rizin_wwwroot', type: 'string', value: '', description: 'Install path for www files')
option('rizin_sdb', type: 'string', value: '', description: '')
option('rizin_zigns', type: 'string', value: '', description: 'Install path for zignatures files')
option('rizin_sigdb', type: 'string', value: '', description: 'Install path for sigdb files')
option('rizin_themes', type: 'string', value: '', description: 'Install path for themes (colors, etc.)')
option('rizin_fortunes', type: 'string', value: '', description: 'Install path for fortunes displayed when starting')

View file

@ -1,44 +0,0 @@
NAME=Print SigDB contents
FILE==
ARGS=-eflirt.sigdb.load.system=false -eflirt.sigdb.load.home=false
CMDS=<<EOF
e flirt.sigdb.path=bins/sigdb/fake-db
aaFl
EOF
EXPECT=<<EOF
bin arch bits name modules details
---------------------------------------------------------------
elf x86 64 match.sig 1 Built with rizin 0.4.0-git
elf x86 64 not-match.pat 1
EOF
RUN
NAME=Do analysis and apply SigDB automatically
FILE=bins/sigdb/elf-x86-64-static-libc
ARGS=-eflirt.sigdb.load.system=false -eflirt.sigdb.load.home=false
CMDS=<<EOF
e flirt.sigdb.path=bins/sigdb/fake-db
aaa
afl~printf
EOF
EXPECT=<<EOF
0x00409c70 18 516 -> 514 flirt.printf
0x0046fc50 7 516 -> 342 flirt.printf_1
EOF
RUN
NAME=Do analysis and apply SigDB manually
FILE=bins/sigdb/elf-x86-64-static-libc
ARGS=-eflirt.sigdb.load.system=false -eflirt.sigdb.load.home=false
CMDS=<<EOF
aaa
e flirt.sigdb.path=bins/sigdb/fake-db
aaF match.sig
afl~printf
EOF
EXPECT=<<EOF
Applying elf/x86/64/match.sig signature file
0x00409c70 18 516 -> 514 flirt.printf
0x0046fc50 7 516 -> 342 flirt.printf_1
EOF
RUN

View file

@ -456,15 +456,37 @@ RUN
NAME=recursive help
FILE==
CMDS=<<EOF
?* zi
?* aa
EOF
EXPECT=<<EOF
| zi # Show zignatures matching information
| zij # Show zignatures matching information (JSON mode)
| zi* # Show zignatures matching information (rizin mode)
| ziq # Show zignatures matching information (quiet mode)
| zii <from> <to> # Show zignatures matching information in range
| ziij <from> <to> # Show zignatures matching information in range (JSON mode)
| aa # Analyze all flags starting with sym. and entry
| aaa # Analyze all calls, references, emulation and applies signatures
| aaaa # Experimental analysis
| aac # Analyze function calls
| aaci # Analyze all function calls to imports
| aad # Analyze data references to code
| aae [<len>] # Analyze references with ESIL
| aaef # Analyze references with ESIL in all functions
| aaf # Analyze all functions
| aafe # Analyze all functions using ESIL
| aafr <length> # Analyze all consecutive functions in section
| aaft # Performs recursive type matching in all functions
| aai # Print preformed analysis details
| aaij # Print preformed analysis details (JSON mode)
| aaj # Analyze all unresolved jumps
| aalg # Recovers and analyze all Golang functions and strings
| aalo # Analyze all Objective-C references
| aan # Renames all functions based on their strings or calls
| aanr # Renames all functions which does not return
| aap # Analyze all preludes
| aar [<n_bytes>] # Analyze xrefs in current section or by n_bytes
| aas # Analyze only the symbols
| aaS # Analyze only the flags starting as sym.* and entry*
| aat [<func_name>] # Analyze all/given function to convert immediate to linked structure offsets
| aaT [<n_bytes>] # Prints commands to create functions after a trap call
| aau [<min_len>] # Print memory areas not covered by functions
| aav # Analyze values referencing a specific section or map
| aav* # Analyze values referencing a specific section or map (rizin mode)
EOF
RUN
@ -505,35 +527,57 @@ RUN
NAME=recursive help (json)
FILE==
CMDS=<<EOF
?*j zi
?*j aa
EOF
EXPECT=<<EOF
{"zi":{"cmd":"zi","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information"},"zij":{"cmd":"zij","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (JSON mode)"},"zi*":{"cmd":"zi*","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (rizin mode)"},"ziq":{"cmd":"ziq","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (quiet mode)"},"zii":{"cmd":"zii","type":"argv_state","args_str":" <from> <to>","args":[{"type":"number","name":"from","required":true},{"type":"number","name":"to","required":true}],"description":"","summary":"Show zignatures matching information in range"},"ziij":{"cmd":"ziij","type":"argv_state","args_str":" <from> <to>","args":[{"type":"number","name":"from","required":true},{"type":"number","name":"to","required":true}],"description":"","summary":"Show zignatures matching information in range (JSON mode)"}}
{"aa":{"cmd":"aa","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all flags starting with sym. and entry"},"aaa":{"cmd":"aaa","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all calls, references, emulation and applies signatures"},"aaaa":{"cmd":"aaaa","type":"argv","args_str":"","args":[],"description":"","summary":"Experimental analysis"},"aac":{"cmd":"aac","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze function calls"},"aaci":{"cmd":"aaci","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all function calls to imports"},"aad":{"cmd":"aad","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze data references to code"},"aae":{"cmd":"aae","type":"argv","args_str":" [<len>]","args":[{"type":"expression","name":"len","is_last":true}],"description":"","summary":"Analyze references with ESIL"},"aaef":{"cmd":"aaef","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze references with ESIL in all functions"},"aaf":{"cmd":"aaf","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all functions"},"aafe":{"cmd":"aafe","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all functions using ESIL"},"aafr":{"cmd":"aafr","type":"argv","args_str":" <length>","args":[{"type":"number","name":"length","required":true}],"description":"","summary":"Analyze all consecutive functions in section"},"aaft":{"cmd":"aaft","type":"argv","args_str":"","args":[],"description":"","summary":"Performs recursive type matching in all functions"},"aai":{"cmd":"aai","type":"argv_state","args_str":"","args":[],"description":"","summary":"Print preformed analysis details"},"aaij":{"cmd":"aaij","type":"argv_state","args_str":"","args":[],"description":"","summary":"Print preformed analysis details (JSON mode)"},"aaj":{"cmd":"aaj","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all unresolved jumps"},"aalg":{"cmd":"aalg","type":"argv","args_str":"","args":[],"description":"","summary":"Recovers and analyze all Golang functions and strings"},"aalo":{"cmd":"aalo","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all Objective-C references"},"aan":{"cmd":"aan","type":"argv","args_str":"","args":[],"description":"","summary":"Renames all functions based on their strings or calls"},"aanr":{"cmd":"aanr","type":"argv","args_str":"","args":[],"description":"","summary":"Renames all functions which does not return"},"aap":{"cmd":"aap","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all preludes"},"aar":{"cmd":"aar","type":"argv","args_str":" [<n_bytes>]","args":[{"type":"number","name":"n_bytes"}],"description":"","summary":"Analyze xrefs in current section or by n_bytes"},"aas":{"cmd":"aas","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze only the symbols"},"aaS":{"cmd":"aaS","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze only the flags starting as sym.* and entry*"},"aat":{"cmd":"aat","type":"argv","args_str":" [<func_name>]","args":[{"type":"function","name":"func_name"}],"description":"","summary":"Analyze all/given function to convert immediate to linked structure offsets"},"aaT":{"cmd":"aaT","type":"argv","args_str":" [<n_bytes>]","args":[{"type":"number","name":"n_bytes"}],"description":"","summary":"Prints commands to create functions after a trap call"},"aau":{"cmd":"aau","type":"argv","args_str":" [<min_len>]","args":[{"type":"number","name":"min_len"}],"description":"","summary":"Print memory areas not covered by functions"},"aav":{"cmd":"aav","type":"argv_state","args_str":"","args":[],"description":"","summary":"Analyze values referencing a specific section or map"},"aav*":{"cmd":"aav*","type":"argv_state","args_str":"","args":[],"description":"","summary":"Analyze values referencing a specific section or map (rizin mode)"}}
EOF
RUN
NAME=old recursive help
NAME=recursive help (old style)
FILE==
CMDS=<<EOF
zi?*
aa?*
EOF
EXPECT=<<EOF
| zi # Show zignatures matching information
| zij # Show zignatures matching information (JSON mode)
| zi* # Show zignatures matching information (rizin mode)
| ziq # Show zignatures matching information (quiet mode)
| zii <from> <to> # Show zignatures matching information in range
| ziij <from> <to> # Show zignatures matching information in range (JSON mode)
| aa # Analyze all flags starting with sym. and entry
| aaa # Analyze all calls, references, emulation and applies signatures
| aaaa # Experimental analysis
| aac # Analyze function calls
| aaci # Analyze all function calls to imports
| aad # Analyze data references to code
| aae [<len>] # Analyze references with ESIL
| aaef # Analyze references with ESIL in all functions
| aaf # Analyze all functions
| aafe # Analyze all functions using ESIL
| aafr <length> # Analyze all consecutive functions in section
| aaft # Performs recursive type matching in all functions
| aai # Print preformed analysis details
| aaij # Print preformed analysis details (JSON mode)
| aaj # Analyze all unresolved jumps
| aalg # Recovers and analyze all Golang functions and strings
| aalo # Analyze all Objective-C references
| aan # Renames all functions based on their strings or calls
| aanr # Renames all functions which does not return
| aap # Analyze all preludes
| aar [<n_bytes>] # Analyze xrefs in current section or by n_bytes
| aas # Analyze only the symbols
| aaS # Analyze only the flags starting as sym.* and entry*
| aat [<func_name>] # Analyze all/given function to convert immediate to linked structure offsets
| aaT [<n_bytes>] # Prints commands to create functions after a trap call
| aau [<min_len>] # Print memory areas not covered by functions
| aav # Analyze values referencing a specific section or map
| aav* # Analyze values referencing a specific section or map (rizin mode)
EOF
RUN
NAME=old recursive help (json)
NAME=recursive help json (old style)
FILE==
CMDS=<<EOF
zi?*j
aa?*j
EOF
EXPECT=<<EOF
{"zi":{"cmd":"zi","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information"},"zij":{"cmd":"zij","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (JSON mode)"},"zi*":{"cmd":"zi*","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (rizin mode)"},"ziq":{"cmd":"ziq","type":"argv_state","args_str":"","args":[],"description":"","summary":"Show zignatures matching information (quiet mode)"},"zii":{"cmd":"zii","type":"argv_state","args_str":" <from> <to>","args":[{"type":"number","name":"from","required":true},{"type":"number","name":"to","required":true}],"description":"","summary":"Show zignatures matching information in range"},"ziij":{"cmd":"ziij","type":"argv_state","args_str":" <from> <to>","args":[{"type":"number","name":"from","required":true},{"type":"number","name":"to","required":true}],"description":"","summary":"Show zignatures matching information in range (JSON mode)"}}
{"aa":{"cmd":"aa","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all flags starting with sym. and entry"},"aaa":{"cmd":"aaa","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all calls, references, emulation and applies signatures"},"aaaa":{"cmd":"aaaa","type":"argv","args_str":"","args":[],"description":"","summary":"Experimental analysis"},"aac":{"cmd":"aac","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze function calls"},"aaci":{"cmd":"aaci","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all function calls to imports"},"aad":{"cmd":"aad","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze data references to code"},"aae":{"cmd":"aae","type":"argv","args_str":" [<len>]","args":[{"type":"expression","name":"len","is_last":true}],"description":"","summary":"Analyze references with ESIL"},"aaef":{"cmd":"aaef","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze references with ESIL in all functions"},"aaf":{"cmd":"aaf","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all functions"},"aafe":{"cmd":"aafe","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all functions using ESIL"},"aafr":{"cmd":"aafr","type":"argv","args_str":" <length>","args":[{"type":"number","name":"length","required":true}],"description":"","summary":"Analyze all consecutive functions in section"},"aaft":{"cmd":"aaft","type":"argv","args_str":"","args":[],"description":"","summary":"Performs recursive type matching in all functions"},"aai":{"cmd":"aai","type":"argv_state","args_str":"","args":[],"description":"","summary":"Print preformed analysis details"},"aaij":{"cmd":"aaij","type":"argv_state","args_str":"","args":[],"description":"","summary":"Print preformed analysis details (JSON mode)"},"aaj":{"cmd":"aaj","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all unresolved jumps"},"aalg":{"cmd":"aalg","type":"argv","args_str":"","args":[],"description":"","summary":"Recovers and analyze all Golang functions and strings"},"aalo":{"cmd":"aalo","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all Objective-C references"},"aan":{"cmd":"aan","type":"argv","args_str":"","args":[],"description":"","summary":"Renames all functions based on their strings or calls"},"aanr":{"cmd":"aanr","type":"argv","args_str":"","args":[],"description":"","summary":"Renames all functions which does not return"},"aap":{"cmd":"aap","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze all preludes"},"aar":{"cmd":"aar","type":"argv","args_str":" [<n_bytes>]","args":[{"type":"number","name":"n_bytes"}],"description":"","summary":"Analyze xrefs in current section or by n_bytes"},"aas":{"cmd":"aas","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze only the symbols"},"aaS":{"cmd":"aaS","type":"argv","args_str":"","args":[],"description":"","summary":"Analyze only the flags starting as sym.* and entry*"},"aat":{"cmd":"aat","type":"argv","args_str":" [<func_name>]","args":[{"type":"function","name":"func_name"}],"description":"","summary":"Analyze all/given function to convert immediate to linked structure offsets"},"aaT":{"cmd":"aaT","type":"argv","args_str":" [<n_bytes>]","args":[{"type":"number","name":"n_bytes"}],"description":"","summary":"Prints commands to create functions after a trap call"},"aau":{"cmd":"aau","type":"argv","args_str":" [<min_len>]","args":[{"type":"number","name":"min_len"}],"description":"","summary":"Print memory areas not covered by functions"},"aav":{"cmd":"aav","type":"argv_state","args_str":"","args":[],"description":"","summary":"Analyze values referencing a specific section or map"},"aav*":{"cmd":"aav*","type":"argv_state","args_str":"","args":[],"description":"","summary":"Analyze values referencing a specific section or map (rizin mode)"}}
EOF
RUN

View file

@ -92,7 +92,6 @@ EXPECT=<<EOF
"reg=cc",
"stdcall=cc",
"watcom=cc",
"zigns",
"classes",
"noreturn"
]

563
test/db/cmd/cmd_signature Normal file
View file

@ -0,0 +1,563 @@
NAME=aa ; Fs libc-v7.sig ; no old flag
FILE=bins/elf/analysis/pid_stripped
CMDS=aa ; Fs bins/other/sigs/libc-v7.sig ; pd 10 @ flirt.libc_start_main
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
; CALL XREF from entry0 @ 0x401384
/ flirt.libc_start_main (int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg5, int64_t arg6, int64_t arg_c0h);
| ; var int64_t var_ch @ rsp+0xc
| ; var int64_t var_10h @ rsp+0x10
| ; var int64_t var_18h @ rsp+0x18
| ; var int64_t var_20h @ rsp+0x20
| ; var int64_t var_68h @ rsp+0x68
| ; var int64_t var_70h @ rsp+0x70
| ; arg int64_t arg_c0h @ rsp+0xc0
| ; arg int64_t arg1 @ rdi
| ; arg int64_t arg2 @ rsi
| ; arg int64_t arg3 @ rdx
| ; arg int64_t arg4 @ rcx
| ; arg int64_t arg5 @ r8
| ; arg int64_t arg6 @ r9
| 0x004e2420 push r14
| 0x004e2422 push r13
| 0x004e2424 mov eax, 0
| 0x004e2429 push r12
| 0x004e242b push rbp
| 0x004e242c mov r12, r8 ; arg5
| 0x004e242f push rbx
| 0x004e2430 mov rbp, rcx ; arg4
| 0x004e2433 mov r13, r9 ; arg6
| 0x004e2436 sub rsp, 0x90
EOF
RUN
NAME=Fd libc-v7.sig
FILE=bins/elf/analysis/pid_stripped
CMDS=Fd bins/other/sigs/libc-v7.sig
EXPECT=<<EOF
SIG format
Signature: , 1 modules
Version: 7
Architecture: 0 (x86)
41564155B8........4154554D89C4534889CD4D89CD4881EC900000004885C0:
0. 16 D2A2 0298 0000:__libc_start_main
EOF
RUN
NAME=af ; af ; Fs libc-v7.sig - rzshell
FILE=bins/elf/analysis/pid_stripped
CMDS=s 0x4e2420 ; af ; s 0x4e25c7 ; af ; Fs bins/other/sigs/libc-v7.sig ; afl ~4e2420
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
0x004e2420 40 664 flirt.libc_start_main
EOF
RUN
NAME=af ; af ; Fs libc-v7.sig
FILE=bins/elf/analysis/pid_stripped
CMDS=<<EOF
s 0x4e2420
af
s 0x4e25c7
af
Fs bins/other/sigs/libc-v7.sig
afl~4e2420
EOF
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v7.sig
0x004e2420 40 664 flirt.libc_start_main
EOF
RUN
NAME=aa ; Fs libc-v10.sig
FILE=bins/elf/analysis/pid_stripped
CMDS=aa ; Fs bins/other/sigs/libc-v10.sig
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
EOF
RUN
NAME=Fd libc-v10.sig (malformed v10)
FILE=bins/elf/analysis/pid_stripped
CMDS=Fd bins/other/sigs/libc-v10.sig
EXPECT=<<EOF
SIG format
Signature: FLIRT v10, 1 modules
Version: 10
Architecture: 0 (x86)
41564155B8........4154554D89C4534889CD4D89CD4881EC900000004885C0:
0. 16 D2A2 0298 0000:__libc_start_main
EOF
RUN
NAME=af ; af ; Fs libc-v10.sig - rzshell
FILE=bins/elf/analysis/pid_stripped
CMDS=s 0x4e2420 ; af ; s 0x4e25c7 ; af ; Fs bins/other/sigs/libc-v10.sig ; afl ~4e2420
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
0x004e2420 40 664 flirt.libc_start_main
EOF
RUN
NAME=af ; af ; Fs libc-v10.sig
FILE=bins/elf/analysis/pid_stripped
CMDS=<<EOF
s 0x4e2420
af
s 0x4e25c7
af
Fs bins/other/sigs/libc-v10.sig
afl~4e2420
EOF
EXPECT=<<EOF
Found 1 FLIRT signatures via bins/other/sigs/libc-v10.sig
0x004e2420 40 664 flirt.libc_start_main
EOF
RUN
NAME=Fs on static glibc
FILE=bins/elf/static-glibc-2.27
CMDS=<<EOF
aac
Fs bins/other/sigs/libc6_2.27-3ubuntu1_amd64.sig~silence
fl @F:flirt
EOF
EXPECT=<<EOF
0x004004d1 86 flirt.malloc_assert.constprop.13
0x00400527 35 flirt.gconv_release_step.part.1
0x0040054a 79 flirt.length_mismatch
0x00400b70 613 flirt.get_common_indeces.constprop.1
0x00400de0 1657 flirt.libc_start_main
0x00401460 385 flirt.libc_check_standard_fds
0x004015f0 581 flirt.libc_setup_tls
0x00401930 339 flirt.assert_fail_base
0x00401a90 80 flirt.assert_fail
0x00401ae0 7517 flirt.dcgettext
0x00403840 672 flirt.nl_find_domain
0x00403ae0 5366 flirt.nl_load_domain
0x004054e0 601 flirt.cxa_finalize
0x004056b0 1488 flirt.nl_make_l10nflist
0x00405c80 286 flirt.nl_normalize_codeset
0x00405da0 574 flirt.nl_explode_name
0x00405fe0 28945 flirt.gettext_free_exp
0x0040d100 2128 flirt.gettextparse
0x0040d950 256 flirt.gettext_extract_plural
0x0040da50 60 flirt.hash_string
0x0040da90 7 flirt.umount
0x0040dbb0 561 flirt.abort
0x0040ddf0 1092 flirt.msort_with_tmp.part.0
0x0040e6c0 1160 flirt.qsort
0x0040e6d0 212 flirt.getenv
0x0040e7b0 636 flirt.run_exit_handlers
0x0040ea30 32 flirt.exit
0x0040ea50 288 flirt.new_exitfn
0x0040ec70 250 flirt.cxa_atexit
0x0040f430 542 flirt.correctly_grouped_prefixmb
0x0040f650 192 flirt.asprintf
0x0040f710 368 flirt.locked_vfxprintf
0x0040f880 784 flirt.fxprintf
0x0040fe20 33103 flirt.IO_fflush
0x00410210 429 flirt.IO_puts
0x00410410 1898 flirt.adjust_wide_data
0x004115d0 1182 flirt.IO_wdo_write
0x00411f00 400 flirt.IO_vasprintf
0x00412090 374 flirt.libc_message.constprop.0
0x00412210 743 flirt.libc_message
0x00412500 32 flirt.libc_fatal
0x00412520 32 flirt.IO_vtable_check
0x00412540 164 flirt.fgets_unlocked
0x00415430 461 flirt.save_for_backup
0x00415b80 720 flirt.IO_un_link
0x00415e50 661 flirt.IO_link_in
0x004160f0 43 flirt.IO_switch_to_main_get_area
0x00416150 151 flirt.IO_switch_to_get_mode
0x004161f0 74 flirt.IO_free_backup_area
0x00416240 112 flirt.overflow
0x004162b0 490 flirt.underflow
0x004164a0 514 flirt.uflow
0x004166b0 93 flirt.IO_setb
0x00416710 175 flirt.IO_doallocbuf
0x00416830 258 flirt.IO_default_xsputn
0x00416c30 292 flirt.IO_default_setbuf
0x004170c0 327 flirt.IO_no_init
0x00417550 127 flirt.IO_sputbackc
0x00417650 64 flirt.IO_adjust_column
0x00418090 106 flirt.IO_unsave_markers
0x004234b0 65 flirt.strdup
0x0042b6b0 1022 flirt.memcmp_sse2
0x00447cf0 1568 flirt.handle_amd
0x00448310 37 flirt.cache_sysconf
0x00448380 9 flirt.wmemcpy
0x004491d0 80 flirt.get_child_max
0x004492c0 288 flirt.libc_open64
0x004493e0 160 flirt.open64_nocancel
0x00449480 153 flirt.libc_read
0x00449520 36 flirt.read_nocancel
0x00449550 153 flirt.libc_write
0x004495f0 44 flirt.write_nocancel
0x00449650 464 flirt.libc_fcntl
0x00449820 125 flirt.close
0x004498a0 42 flirt.close_nocancel
0x004498d0 1811 flirt.getcwd
0x0044a030 142 flirt.sbrk
0x0044a0c0 64 flirt.getpagesize
0x0044a100 80 flirt.getdtablesize
0x0044a2c0 327 flirt.trecurse
0x0044a410 982 flirt.tsearch
0x0044a7f0 87 flirt.tfind
0x0044ae00 175 flirt.twalk
0x0044aeb0 435 flirt.tdestroy
0x0044b070 432 flirt.next_line
0x0044b220 1168 flirt.get_nprocs
0x0044b6b0 224 flirt.get_nprocs_conf
0x0044b790 144 flirt.get_phys_pages
0x0044b820 144 flirt.get_avphys_pages
0x0044b8b0 17 flirt.getclktck
0x0044b8d0 82 flirt.init_misc
0x0044b990 64 flirt.libc_alloca_cutoff
0x0044b9d0 40 flirt.lll_lock_wait_private
0x0044ba00 28 flirt.lll_unlock_wake_private
0x0044ba20 86 flirt.libc_enable_asynccancel
0x0044ba80 89 flirt.libc_disable_asynccancel
0x0044baf0 32 flirt.stack_chk_fail
0x0044bb10 97 flirt.fortify_fail_abort
0x0044bb80 32 flirt.fortify_fail
0x0044bc30 114 flirt.tunable_set_val
0x0044bcb0 1533 flirt.tunables_init
0x0044c2b0 90 flirt.tunable_get_val
0x0044c310 1038 flirt.dl_aux_init
0x0044c720 2296 flirt.dl_non_dynamic_init
0x0044d020 69 flirt.libc_init_secure
0x0044de00 1296 flirt.gconv_open
0x0044e310 528 flirt.gconv
0x0044e520 89 flirt.gconv_close
0x0044f6c0 1168 flirt.insert_module
0x0044fb50 1008 flirt.gconv_get_path
0x0044ff40 1504 flirt.gconv_read_conf
0x00450520 602 flirt.gconv_get_builtin_trans
0x00458320 18 flirt.release_libc_mem
0x004585d0 692 flirt.new_composite_name
0x00459170 2074 flirt.nl_find_locale
0x00459990 576 flirt.nl_intern_locale_data
0x00459bd0 1488 flirt.nl_load_locale
0x0045a1a0 94 flirt.nl_unload_locale
0x0045a200 1312 flirt.nl_load_locale_from_archive
0x0045a870 80 flirt.setfpucw
0x0045a8c0 132 flirt.sigsetjmp
0x0045abc0 6232 flirt.quicksort
0x0045c620 19 flirt.libc_secure_getenv
0x0045ce30 10704 flirt.group_number
0x0045f800 13172 flirt.IO_vfprintf_internal
0x00462b80 976 flirt.hack_digit
0x00465a50 11033 flirt.printf_fp
0x00468470 192 flirt.asprintf_1
0x00468530 11072 flirt.i18n_number_rewrite
0x0046b070 13435 flirt.IO_vfwprintf
0x0046e540 1929 flirt.parse_one_specmb
0x0046ecd0 2211 flirt.parse_one_specwc
0x0046f6d0 314 flirt.IO_fputs
0x0046f8e0 413 flirt.IO_fwrite
0x0046fae0 727 flirt.IO_getdelim
0x0046fe10 349 flirt.IO_getline
0x004700f0 320 flirt.IO_padn
0x00470230 320 flirt.IO_wpadn
0x00470370 637 flirt.save_for_wbackup.isra.0
0x004706b0 109 flirt.IO_wsetb
0x004709d0 117 flirt.woverflow
0x00470e40 685 flirt.IO_wdefault_xsputn
0x00471530 155 flirt.IO_wdoallocbuf
0x00471640 114 flirt.IO_switch_to_wget_mode
0x004716c0 99 flirt.IO_free_wbackup_area
0x004720c0 165 flirt.libc_scratch_buffer_grow_preserve
0x00472170 184 flirt.libc_scratch_buffer_set_array_size
0x00472230 73 flirt.strndup
0x00472280 451 flirt.strerror_r
0x00472480 102 flirt.strtok_r
0x00472cc0 218 flirt.argz_create_sep
0x00472da0 183 flirt.argz_add_sep
0x00473890 9 flirt.wmemcpy_2
0x004738a0 9 flirt.wmemcpy_1
0x00473ab0 480 flirt.wcrtomb
0x00473c90 806 flirt.wcsrtombs
0x00473fc0 32 flirt.wcschrnul
0x00474a40 8 flirt.time
0x00474f90 139 flirt.rewinddir
0x00475020 141 flirt.getdents
0x004750b0 192 flirt.fdopendir
0x004751a0 8 flirt.getuid
0x004751b0 8 flirt.geteuid
0x004751c0 8 flirt.getgid
0x004751d0 8 flirt.getegid
0x00475450 256 flirt.isatty
0x00475640 63 flirt.towctrans
0x00475680 496 flirt.readonly_area
0x00475870 8192 flirt.is_trusted_path_normalize
0x00477870 686 flirt.dl_dst_count
0x00477b20 2717 flirt.dl_dst_substitute
0x004785c0 735 flirt.dl_init_paths
0x004788a0 4202 flirt.dl_map_object
0x00479910 3696 flirt.do_lookup_x
0x0047a780 2747 flirt.dl_lookup_symbol_x
0x0047b240 176 flirt.dl_setup_hash
0x0047b2f0 181 flirt.dl_add_to_namespace_list
0x0047b3b0 783 flirt.dl_new_object
0x0047d260 2000 flirt.dl_important_hwcaps
0x0047da30 1446 flirt.dl_debug_vdprintf
0x0047dfe0 138 flirt.dl_sysdep_read_whole_file
0x0047e070 162 flirt.dl_debug_printf
0x0047e120 162 flirt.dl_debug_printf_c
0x0047e1d0 148 flirt.dl_dprintf
0x0047e270 102 flirt.dl_name_match_p
0x0047e2e0 117 flirt.dl_higher_prime_number
0x0047e360 340 flirt.dl_strtoul
0x0047eed0 354 flirt.dl_next_tls_modid
0x0047f060 202 flirt.dl_allocate_tls_storage
0x0047f540 128 flirt.dl_tls_get_addr_soft
0x0047f5c0 240 flirt.dl_add_to_slotinfo
0x0047f6b0 416 flirt.dl_get_origin
0x0047f850 197 flirt.dl_scope_free
0x00480690 48 flirt.length_mismatch_1
0x004806c0 210 flirt.dl_exception_create
0x004807a0 729 flirt.dl_exception_create_format
0x00480a80 38 flirt.dl_exception_free
0x00480ab0 236 flirt.dl_cache_libcmp
0x00480ba0 2862 flirt.dl_load_cache_lookup
0x004816d0 56 flirt.dl_unload_cache
0x00482060 195 flirt.fatal_error
0x00482130 80 flirt.dl_signal_exception
0x00482180 80 flirt.dl_signal_error
0x004821d0 208 flirt.dl_catch_exception
0x004822a0 112 flirt.dl_catch_error
0x00482310 162 flirt.longjmp_chk
0x00482370 59 flirt.mpn_cmp
0x004823b0 1466 flirt.mpn_divrem
0x00482970 259 flirt.mpn_lshift
0x00482a80 259 flirt.mpn_rshift
0x00482b90 1072 flirt.mpn_mul
0x00482fc0 281 flirt.mpn_mul_1
0x004830e0 438 flirt.mpn_impn_mul_n_basecase
0x004832a0 1378 flirt.mpn_impn_mul_n
0x00483810 431 flirt.mpn_impn_sqr_n_basecase
0x004839c0 1262 flirt.mpn_impn_sqr_n
0x00483f50 173 flirt.mpn_sub_n_1
0x00484000 235 flirt.mpn_addmul_1
0x004840f0 144 flirt.mpn_extract_double
0x00484180 185 flirt.mpn_extract_long_double
0x00484240 286 flirt.mpn_extract_float128
0x00484360 203 flirt.itoa_word
0x00484c90 138 flirt.strerror
0x00484d40 77 flirt.strsep
0x00484f50 8 flirt.getpid
0x00485160 416 flirt.dl_fixup
0x00485300 544 flirt.dl_profile_fixup
0x00485520 2 flirt.dl_call_pltexit
0x00485530 652 flirt.add_to_global
0x004857c0 144 flirt.dl_find_dso_for_object
0x00485850 528 flirt.dl_open
0x00485a60 298 flirt.dl_show_scope
0x004863b0 4000 flirt.remove_slotinfo
0x00487350 121 flirt.dl_close_worker
0x004874d0 751 flirt.dl_sort_maps
0x004877c0 416 flirt.dl_tlsdesc_resolve_rela_fixup
0x00487960 101 flirt.dl_tlsdesc_resolve_hold_fixup
0x004879d0 25 flirt.dl_unmap
0x00487cf0 83 flirt.dl_addr_inside_object
0x00487d50 173 flirt.mpn_sub_n
0x00487e00 235 flirt.mpn_addmul_1_1
0x004895d0 877 flirt.dl_init
0x00489940 1806 flirt.dl_check_map_versions
0x0048fa10 478 flirt.dl_iterate_phdr
0x0048fbf0 73 flirt.nl_finddomain_subfreeres
0x0048fc40 247 flirt.nl_unload_domain
0x00490bb0 218 flirt.free_slotinfo
EOF
RUN
NAME=FLIRT apply pat signature
FILE=bins/flirt/elf-x86/curl-example
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
aaa
Fs bins/flirt/elf-x86/libcurl.a.pat
EOF
EXPECT=<<EOF
Found 100 FLIRT signatures via bins/flirt/elf-x86/libcurl.a.pat
EOF
RUN
NAME=FLIRT apply pat signature
FILE=bins/flirt/elf-x86/curl-example
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
aaa
Fs bins/flirt/elf-x86/libcurl.a.sig
EOF
EXPECT=<<EOF
Found 205 FLIRT signatures via bins/flirt/elf-x86/libcurl.a.sig
EOF
RUN
NAME=FLIRT dump pat signature
FILE==
CMDS=<<EOF
Fd bins/flirt/elf-x86/libcurl.a.pat~?
EOF
EXPECT=<<EOF
209
EOF
RUN
NAME=FLIRT verify correctness of main (PAT)
FILE=bins/flirt/elf-x86/test.stripped
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
aaa
Fs bins/flirt/elf-x86/test.symbols.pat~silence
pdf @ main
EOF
EXPECT=<<EOF
; DATA XREF from flirt.entry0 @ 0x401791
/ int main (int argc, char **argv, char **envp);
| ; var int64_t var_18h @ rbp-0x18
| ; var int64_t var_dh @ rbp-0xd
| ; var int64_t var_8h @ rbp-0x8
| 0x00401895 push rbp
| 0x00401896 mov rbp, rsp
| 0x00401899 sub rsp, 0x20
| 0x0040189d mov rax, qword fs:[0x28]
| 0x004018a6 mov qword [var_8h], rax
| 0x004018aa xor eax, eax
| 0x004018ac lea rax, [0x00482004] ; "r"
| 0x004018b3 mov rsi, rax ; int64_t arg2
| 0x004018b6 lea rax, str.test ; 0x482006 ; "test"
| 0x004018bd mov rdi, rax ; int64_t arg1
| 0x004018c0 call flirt.IO_fopen64
| 0x004018c5 mov qword [var_18h], rax
| 0x004018c9 mov rax, qword [var_18h]
| 0x004018cd mov edx, 1 ; int64_t arg3
| 0x004018d2 mov esi, 5 ; int64_t arg2
| 0x004018d7 mov rdi, rax ; uint64_t arg1
| 0x004018da call flirt.fseek
| 0x004018df mov rdx, qword [var_18h]
| 0x004018e3 lea rax, [var_dh]
| 0x004018e7 mov rcx, rdx ; int64_t arg4
| 0x004018ea mov edx, 1 ; int64_t arg3
| 0x004018ef mov esi, 5 ; int64_t arg2
| 0x004018f4 mov rdi, rax ; int64_t arg1
| 0x004018f7 call flirt.IO_fread
| 0x004018fc mov rax, qword [var_18h]
| 0x00401900 mov rdi, rax ; int64_t arg1
| 0x00401903 call flirt.IO_fclose
| 0x00401908 mov eax, 0
| 0x0040190d mov rdx, qword [var_8h]
| 0x00401911 sub rdx, qword fs:[0x28]
| ,=< 0x0040191a je 0x401921
| | 0x0040191c call flirt.chk_fail
| `-> 0x00401921 leave
\ 0x00401922 ret
EOF
RUN
NAME=FLIRT verify correctness of main (SIG)
FILE=bins/flirt/elf-x86/test.stripped
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
aaa
Fs bins/flirt/elf-x86/test.symbols.sig~silence
pdf @ main
EOF
EXPECT=<<EOF
; DATA XREF from flirt.entry0 @ 0x401791
/ int main (int argc, char **argv, char **envp);
| ; var int64_t var_18h @ rbp-0x18
| ; var int64_t var_dh @ rbp-0xd
| ; var int64_t var_8h @ rbp-0x8
| 0x00401895 push rbp
| 0x00401896 mov rbp, rsp
| 0x00401899 sub rsp, 0x20
| 0x0040189d mov rax, qword fs:[0x28]
| 0x004018a6 mov qword [var_8h], rax
| 0x004018aa xor eax, eax
| 0x004018ac lea rax, [0x00482004] ; "r"
| 0x004018b3 mov rsi, rax ; int64_t arg2
| 0x004018b6 lea rax, str.test ; 0x482006 ; "test"
| 0x004018bd mov rdi, rax ; int64_t arg1
| 0x004018c0 call flirt.IO_fopen64
| 0x004018c5 mov qword [var_18h], rax
| 0x004018c9 mov rax, qword [var_18h]
| 0x004018cd mov edx, 1 ; int64_t arg3
| 0x004018d2 mov esi, 5 ; int64_t arg2
| 0x004018d7 mov rdi, rax ; uint64_t arg1
| 0x004018da call flirt.fseek
| 0x004018df mov rdx, qword [var_18h]
| 0x004018e3 lea rax, [var_dh]
| 0x004018e7 mov rcx, rdx ; int64_t arg4
| 0x004018ea mov edx, 1 ; int64_t arg3
| 0x004018ef mov esi, 5 ; int64_t arg2
| 0x004018f4 mov rdi, rax ; int64_t arg1
| 0x004018f7 call flirt.IO_fread
| 0x004018fc mov rax, qword [var_18h]
| 0x00401900 mov rdi, rax ; int64_t arg1
| 0x00401903 call flirt.IO_fclose
| 0x00401908 mov eax, 0
| 0x0040190d mov rdx, qword [var_8h]
| 0x00401911 sub rdx, qword fs:[0x28]
| ,=< 0x0040191a je 0x401921
| | 0x0040191c call flirt.chk_fail
| `-> 0x00401921 leave
\ 0x00401922 ret
EOF
RUN
NAME=Print SigDB contents
FILE==
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
e flirt.sigdb.path=bins/sigdb/fake-db
Fl
EOF
EXPECT=<<EOF
bin arch bits name modules details
---------------------------------------------------------------
elf x86 64 match.sig 1 Built with rizin 0.4.0-git
elf x86 64 not-match.pat 1
EOF
RUN
NAME=Do analysis and apply SigDB automatically
FILE=bins/sigdb/elf-x86-64-static-libc
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
e flirt.sigdb.path=bins/sigdb/fake-db
aaa
afl~printf
EOF
EXPECT=<<EOF
0x00409c70 18 516 -> 514 flirt.printf
0x0046fc50 7 516 -> 342 flirt.printf_1
EOF
RUN
NAME=Do analysis and apply SigDB manually
FILE=bins/sigdb/elf-x86-64-static-libc
CMDS=<<EOF
e flirt.sigdb.load.system=false
e flirt.sigdb.load.home=false
aaa
e flirt.sigdb.path=bins/sigdb/fake-db
Fa match.sig
afl~printf
EOF
EXPECT=<<EOF
Applying elf/x86/64/match.sig signature file
0x00409c70 18 516 -> 514 flirt.printf
0x0046fc50 7 516 -> 342 flirt.printf_1
EOF
RUN

File diff suppressed because it is too large Load diff

View file

@ -366,6 +366,7 @@ Detailed project load info:
project migrated from version 4 to 5.
project migrated from version 5 to 6.
project migrated from version 6 to 7.
project migrated from version 7 to 8.
EOF
RUN

View file

@ -21,7 +21,6 @@ if get_option('enable_tests')
'pdb',
'project_migrate',
'rzpipe',
'sign_integration',
]
unit_test_env = environment()

View file

@ -9,7 +9,7 @@ static RzCmdDescArg xd_args[] = {
{ .name = "f1", .type = RZ_CMD_ARG_TYPE_FILE },
{ .name = "F2", .type = RZ_CMD_ARG_TYPE_FCN },
{ .name = "e3", .type = RZ_CMD_ARG_TYPE_ENV },
{ .name = "Z4", .type = RZ_CMD_ARG_TYPE_ZIGN_SPACE },
{ .name = "Z4", .type = RZ_CMD_ARG_TYPE_REG_TYPE },
{ .name = "E5", .type = RZ_CMD_ARG_TYPE_EVAL_FULL },
{ 0 },
};

View file

@ -95,13 +95,14 @@ bool test_load_v1_noreturn() {
mu_assert_notnull(res, "result info new");
RzProjectErr err = rz_project_load_file(core, "prj/v1-noreturn.rzdb", true, res);
mu_assert_eq(err, RZ_PROJECT_ERR_SUCCESS, "project load err");
mu_assert_eq(rz_list_length(res), 6, "info");
mu_assert_eq(rz_list_length(res), 7, "info");
mu_assert_streq(rz_list_get_n(res, 0), "project migrated from version 1 to 2.", "info");
mu_assert_streq(rz_list_get_n(res, 1), "project migrated from version 2 to 3.", "info");
mu_assert_streq(rz_list_get_n(res, 2), "project migrated from version 3 to 4.", "info");
mu_assert_streq(rz_list_get_n(res, 3), "project migrated from version 4 to 5.", "info");
mu_assert_streq(rz_list_get_n(res, 4), "project migrated from version 5 to 6.", "info");
mu_assert_streq(rz_list_get_n(res, 5), "project migrated from version 6 to 7.", "info");
mu_assert_streq(rz_list_get_n(res, 6), "project migrated from version 7 to 8.", "info");
mu_assert_true(rz_analysis_noreturn_at_addr(core->analysis, 0x4242), "noreturn");
mu_assert_true(rz_analysis_noreturn_at_addr(core->analysis, 0x1337), "noreturn");
@ -119,13 +120,14 @@ bool test_load_v1_noreturn_empty() {
mu_assert_notnull(res, "result info new");
RzProjectErr err = rz_project_load_file(core, "prj/v1-noreturn-empty.rzdb", true, res);
mu_assert_eq(err, RZ_PROJECT_ERR_SUCCESS, "project load err");
mu_assert_eq(rz_list_length(res), 6, "info");
mu_assert_eq(rz_list_length(res), 7, "info");
mu_assert_streq(rz_list_get_n(res, 0), "project migrated from version 1 to 2.", "info");
mu_assert_streq(rz_list_get_n(res, 1), "project migrated from version 2 to 3.", "info");
mu_assert_streq(rz_list_get_n(res, 2), "project migrated from version 3 to 4.", "info");
mu_assert_streq(rz_list_get_n(res, 3), "project migrated from version 4 to 5.", "info");
mu_assert_streq(rz_list_get_n(res, 4), "project migrated from version 5 to 6.", "info");
mu_assert_streq(rz_list_get_n(res, 5), "project migrated from version 6 to 7.", "info");
mu_assert_streq(rz_list_get_n(res, 6), "project migrated from version 7 to 8.", "info");
mu_assert_false(rz_analysis_noreturn_at_addr(core->analysis, 0x4242), "nono");
mu_assert_false(rz_analysis_noreturn_at_addr(core->analysis, 0x1337), "nono");
@ -143,13 +145,14 @@ bool test_load_v1_unknown_type() {
mu_assert_notnull(res, "result info new");
RzProjectErr err = rz_project_load_file(core, "prj/v1-noreturn.rzdb", true, res);
mu_assert_eq(err, RZ_PROJECT_ERR_SUCCESS, "project load err");
mu_assert_eq(rz_list_length(res), 6, "info");
mu_assert_eq(rz_list_length(res), 7, "info");
mu_assert_streq(rz_list_get_n(res, 0), "project migrated from version 1 to 2.", "info");
mu_assert_streq(rz_list_get_n(res, 1), "project migrated from version 2 to 3.", "info");
mu_assert_streq(rz_list_get_n(res, 2), "project migrated from version 3 to 4.", "info");
mu_assert_streq(rz_list_get_n(res, 3), "project migrated from version 4 to 5.", "info");
mu_assert_streq(rz_list_get_n(res, 4), "project migrated from version 5 to 6.", "info");
mu_assert_streq(rz_list_get_n(res, 5), "project migrated from version 6 to 7.", "info");
mu_assert_streq(rz_list_get_n(res, 6), "project migrated from version 7 to 8.", "info");
mu_assert_true(rz_type_exists(core->analysis->typedb, "unknown_t"), "has unknown_t");
RzBaseType *unknown = rz_type_db_get_base_type(core->analysis->typedb, "unknown_t");
@ -169,12 +172,13 @@ bool test_load_v2_typelink() {
mu_assert_notnull(res, "result info new");
RzProjectErr err = rz_project_load_file(core, "prj/v2-typelink-callables.rzdb", true, res);
mu_assert_eq(err, RZ_PROJECT_ERR_SUCCESS, "project load err");
mu_assert_eq(rz_list_length(res), 5, "info");
mu_assert_eq(rz_list_length(res), 6, "info");
mu_assert_streq(rz_list_get_n(res, 0), "project migrated from version 2 to 3.", "info");
mu_assert_streq(rz_list_get_n(res, 1), "project migrated from version 3 to 4.", "info");
mu_assert_streq(rz_list_get_n(res, 2), "project migrated from version 4 to 5.", "info");
mu_assert_streq(rz_list_get_n(res, 3), "project migrated from version 5 to 6.", "info");
mu_assert_streq(rz_list_get_n(res, 4), "project migrated from version 6 to 7.", "info");
mu_assert_streq(rz_list_get_n(res, 5), "project migrated from version 7 to 8.", "info");
mu_assert_true(rz_analysis_type_link_exists(core->analysis, 0x80484b0), "has typelink");
RzType *typelink = rz_analysis_type_link_at(core->analysis, 0x80484b0);
@ -194,12 +198,13 @@ bool test_load_v2_callables() {
mu_assert_notnull(res, "result info new");
RzProjectErr err = rz_project_load_file(core, "prj/v2-typelink-callables.rzdb", true, res);
mu_assert_eq(err, RZ_PROJECT_ERR_SUCCESS, "project load err");
mu_assert_eq(rz_list_length(res), 5, "info");
mu_assert_eq(rz_list_length(res), 6, "info");
mu_assert_streq(rz_list_get_n(res, 0), "project migrated from version 2 to 3.", "info");
mu_assert_streq(rz_list_get_n(res, 1), "project migrated from version 3 to 4.", "info");
mu_assert_streq(rz_list_get_n(res, 2), "project migrated from version 4 to 5.", "info");
mu_assert_streq(rz_list_get_n(res, 3), "project migrated from version 5 to 6.", "info");
mu_assert_streq(rz_list_get_n(res, 4), "project migrated from version 6 to 7.", "info");
mu_assert_streq(rz_list_get_n(res, 5), "project migrated from version 7 to 8.", "info");
RzAnalysisFunction *fcn = rz_analysis_get_function_byname(core->analysis, "entry0");
mu_assert_notnull(fcn, "find \"entry0\" function");

View file

@ -1,177 +0,0 @@
// SPDX-FileCopyrightText: 2020 Florian Märkl <info@florianmaerkl.de>
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_core.h>
#include <rz_analysis.h>
#include <rz_sign.h>
#include "../unit/minunit.h"
static bool test_analysis_sign_za_ppc(void) {
RzCore *core = rz_core_new();
mu_assert_notnull(core, "Couldn't create new RzCore");
ut64 loadaddr = 0x10000000;
const char *fpath = "bins/elf/busybox-powerpc";
RzCoreFile *file = rz_core_file_open(core, fpath, RZ_PERM_R, loadaddr);
mu_assert_notnull(file, "open file");
rz_core_bin_load(core, fpath, loadaddr);
bool analyze_recursively = rz_config_get_i(core->config, "analysis.calls");
bool is_added = rz_core_analysis_function_add(core, NULL, 0x10002d70, analyze_recursively);
mu_assert_eq(is_added, true, "Couldn't add fcn");
RzAnalysisFunction *fcn = rz_analysis_get_function_at(core->analysis, 0x10002d70);
mu_assert_notnull(fcn, "Couldn't get fcn");
RzSignItem *it = rz_sign_item_new();
mu_assert_notnull(it, "Couldn't create new RzSignItem");
char *zigname = NULL;
zigname = rz_str_new(fcn->name);
it->name = zigname;
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_GRAPH);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_BYTES);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_XREFS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_REFS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_VARS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_TYPES);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_BBHASH);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_OFFSET);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_NAME);
is_added = rz_sign_add_item(core->analysis, it);
mu_assert_eq(is_added, true, "Couldn't add RzSignItem");
rz_sign_item_free(it);
it = rz_sign_get_item(core->analysis, fcn->name);
mu_assert_notnull(it, "Couldn't get RzSignItem");
mu_assert_streq(it->name, fcn->name, "name");
mu_assert_notnull(it->bytes, "bytes");
mu_assert_eq(it->bytes->size, 12, "bytes size");
// graph
mu_assert_notnull(it->graph, "graph");
mu_assert_eq(it->graph->bbsum, 304, "graph bbsum");
mu_assert_eq(it->graph->cc, 12, "graph cc");
mu_assert_eq(it->graph->ebbs, 1, "graph ebbs");
mu_assert_eq(it->graph->edges, 29, "graph edges");
mu_assert_eq(it->graph->nbbs, 19, "graph nbbs");
mu_assert_eq(it->addr, 0x10002d70, "addr");
// vars
mu_assert_notnull(it->vars, "vars");
mu_assert_eq(rz_list_length(it->vars), 7, "vars count");
mu_assert_streq(rz_list_get_n(it->vars, 0), "b-4096", "var");
mu_assert_streq(rz_list_get_n(it->vars, 1), "s4", "var");
mu_assert_streq(rz_list_get_n(it->vars, 2), "s-36", "var");
mu_assert_streq(rz_list_get_n(it->vars, 3), "s0", "var");
mu_assert_streq(rz_list_get_n(it->vars, 4), "s-4136", "var");
mu_assert_streq(rz_list_get_n(it->vars, 5), "r5", "var");
mu_assert_streq(rz_list_get_n(it->vars, 6), "r6", "var");
// types
mu_assert_notnull(it->types, "types");
mu_assert_eq(rz_list_length(it->types), 5, "types count");
mu_assert_streq(rz_list_get_n(it->types, 0), "func.fcn.10002d70.args=4", "type");
mu_assert_streq(rz_list_get_n(it->types, 1), "func.fcn.10002d70.arg.0=\"int32_t,arg1\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 2), "func.fcn.10002d70.arg.1=\"int32_t,arg2\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 3), "func.fcn.10002d70.arg.2=\"int32_t,arg_1034h\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 4), "func.fcn.10002d70.arg.3=\"int32_t,arg_1030h\"", "type");
// hash
mu_assert_notnull(it->hash, "hash");
mu_assert_streq(it->hash->bbhash, "b73e65dc846183808d8e385076f9bbcd0b1dcdaa5652254fb55b3b159462a507", "hash val");
rz_sign_item_free(it);
rz_core_file_close(file);
rz_core_free(core);
mu_end;
}
static bool test_analysis_sign_za_mips(void) {
RzCore *core = rz_core_new();
mu_assert_notnull(core, "Couldn't create new RzCore");
ut64 loadaddr = 0;
const char *fpath = "bins/elf/ld-uClibc-0.9.33.2.so";
RzCoreFile *file = rz_core_file_open(core, fpath, RZ_PERM_R, loadaddr);
mu_assert_notnull(file, "open file");
rz_core_bin_load(core, fpath, loadaddr);
bool analyze_recursively = rz_config_get_i(core->config, "analysis.calls");
bool is_added = rz_core_analysis_function_add(core, NULL, 0x2a1c, analyze_recursively);
mu_assert_eq(is_added, true, "Couldn't add fcn");
RzAnalysisFunction *fcn = rz_analysis_get_function_at(core->analysis, 0x2a1c);
mu_assert_notnull(fcn, "Couldn't get fcn");
RzSignItem *it = rz_sign_item_new();
mu_assert_notnull(it, "Couldn't create new RzSignItem");
char *zigname = NULL;
zigname = rz_str_new(fcn->name);
it->name = zigname;
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_GRAPH);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_BYTES);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_XREFS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_REFS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_VARS);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_TYPES);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_BBHASH);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_OFFSET);
rz_sign_addto_item(core->analysis, it, fcn, RZ_SIGN_NAME);
is_added = rz_sign_add_item(core->analysis, it);
mu_assert_eq(is_added, true, "Couldn't add RzSignItem");
rz_sign_item_free(it);
it = rz_sign_get_item(core->analysis, fcn->name);
mu_assert_notnull(it, "Couldn't get RzSignItem");
mu_assert_streq(it->name, fcn->name, "name");
mu_assert_notnull(it->bytes, "bytes");
mu_assert_eq(it->bytes->size, 76, "bytes size");
// graph
mu_assert_notnull(it->graph, "graph");
mu_assert_eq(it->graph->bbsum, 396, "graph bbsum");
mu_assert_eq(it->graph->cc, 8, "graph cc");
mu_assert_eq(it->graph->ebbs, 2, "graph ebbs");
mu_assert_eq(it->graph->edges, 16, "graph edges");
mu_assert_eq(it->graph->nbbs, 12, "graph nbbs");
mu_assert_eq(it->addr, 0x2a1c, "addr");
// vars
mu_assert_notnull(it->vars, "vars");
mu_assert_eq(rz_list_length(it->vars), 17, "vars count");
mu_assert_streq(rz_list_get_n(it->vars, 0), "b16", "var");
mu_assert_streq(rz_list_get_n(it->vars, 1), "s-4", "var");
mu_assert_streq(rz_list_get_n(it->vars, 2), "s-12", "var");
mu_assert_streq(rz_list_get_n(it->vars, 3), "s-16", "var");
mu_assert_streq(rz_list_get_n(it->vars, 4), "s-20", "var");
mu_assert_streq(rz_list_get_n(it->vars, 5), "s-8", "var");
mu_assert_streq(rz_list_get_n(it->vars, 6), "s-24", "var");
mu_assert_streq(rz_list_get_n(it->vars, 7), "s-32", "var");
mu_assert_streq(rz_list_get_n(it->vars, 8), "s-80", "var");
mu_assert_streq(rz_list_get_n(it->vars, 9), "s-76", "var");
mu_assert_streq(rz_list_get_n(it->vars, 10), "s-28", "var");
mu_assert_streq(rz_list_get_n(it->vars, 11), "s-36", "var");
mu_assert_streq(rz_list_get_n(it->vars, 12), "s-40", "var");
mu_assert_streq(rz_list_get_n(it->vars, 13), "r4", "var");
mu_assert_streq(rz_list_get_n(it->vars, 14), "r6", "var");
mu_assert_streq(rz_list_get_n(it->vars, 15), "r7", "var");
mu_assert_streq(rz_list_get_n(it->vars, 16), "r5", "var");
// types
mu_assert_notnull(it->types, "types");
mu_assert_eq(rz_list_length(it->types), 6, "types count");
mu_assert_streq(rz_list_get_n(it->types, 0), "func.sym._dl_malloc.args=5", "type");
mu_assert_streq(rz_list_get_n(it->types, 1), "func.sym._dl_malloc.arg.0=\"int32_t,arg1\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 2), "func.sym._dl_malloc.arg.1=\"int32_t,arg2\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 3), "func.sym._dl_malloc.arg.2=\"int32_t,arg3\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 4), "func.sym._dl_malloc.arg.3=\"int32_t,arg4\"", "type");
mu_assert_streq(rz_list_get_n(it->types, 5), "func.sym._dl_malloc.arg.4=\"int32_t,arg_10h\"", "type");
// hash
mu_assert_notnull(it->hash, "hash");
mu_assert_streq(it->hash->bbhash, "ec986971438cf486e01f14e9bc442d9f4c457854207d30fe4aa9f1ffdf892911", "hash val");
rz_sign_item_free(it);
rz_core_file_close(file);
rz_core_free(core);
mu_end;
}
int all_tests(void) {
mu_run_test(test_analysis_sign_za_ppc);
mu_run_test(test_analysis_sign_za_mips);
return tests_passed != tests_run;
}
mu_main(all_tests)

View file

@ -78,7 +78,6 @@ if get_option('enable_tests')
'serialize_flag',
'serialize_spaces',
'serialize_types',
'sign',
'skiplist',
'skyline',
'spaces',

View file

@ -2,7 +2,6 @@
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_analysis.h>
#include <rz_sign.h>
#include <rz_util/rz_path.h>
#include "test_config.h"
#include "minunit.h"
@ -1332,140 +1331,6 @@ bool test_analysis_classes_load() {
mu_end;
}
Sdb *sign_ref_db() {
Sdb *db = sdb_new0();
Sdb *spaces = sdb_ns(db, "spaces", true);
sdb_set(spaces, "spacestack", "[\"koridai\"]", 0);
sdb_set(spaces, "name", "zs", 0);
Sdb *spaces_spaces = sdb_ns(spaces, "spaces", true);
sdb_set(spaces_spaces, "koridai", "s", 0);
sdb_set(db, "zign|*|sym.mahboi", "|s:4|b:deadbeef|m:c0ffee42|o:4919|g:123,11,12,13,42|r:gwonam,link|x:king,ganon|v:r16,s42,b13|t:func.sym.mahboi.ret=char *,func.sym.mahboi.args=2,func.sym.mahboi.arg.0=\"int,arg0\",func.sym.mahboi.arg.1=\"uint32_t,die\"|c:This peace is what all true warriors strive for|n:sym.Mah.Boi|h:7bfa1358c427e26bc03c2384f41de7be6ebc01958a57e9a6deda5bdba9768851", 0);
sdb_set(db, "zign|koridai|sym.boring", "|c:gee it sure is boring around here", 0);
return db;
}
bool test_analysis_sign_save() {
RzAnalysis *analysis = rz_analysis_new();
rz_sign_analysis_set_hooks(analysis);
RzSignItem *item = rz_sign_item_new();
item->name = strdup("sym.mahboi");
item->realname = strdup("sym.Mah.Boi");
item->comment = strdup("This peace is what all true warriors strive for");
item->bytes = RZ_NEW0(RzSignBytes);
item->bytes->size = 4;
item->bytes->bytes = (ut8 *)strdup("\xde\xad\xbe\xef");
item->bytes->mask = (ut8 *)strdup("\xc0\xff\xee\x42");
item->graph = RZ_NEW0(RzSignGraph);
item->graph->bbsum = 42;
item->graph->cc = 123;
item->graph->ebbs = 13;
item->graph->edges = 12;
item->graph->nbbs = 11;
item->addr = 0x1337;
item->xrefs_from = rz_list_newf(free);
rz_list_append(item->xrefs_from, strdup("gwonam"));
rz_list_append(item->xrefs_from, strdup("link"));
item->xrefs_to = rz_list_newf(free);
rz_list_append(item->xrefs_to, strdup("king"));
rz_list_append(item->xrefs_to, strdup("ganon"));
item->vars = rz_list_newf(free);
rz_list_append(item->vars, strdup("r16"));
rz_list_append(item->vars, strdup("s42"));
rz_list_append(item->vars, strdup("b13"));
item->types = rz_list_newf(free);
rz_list_append(item->types, strdup("func.sym.mahboi.ret=char *"));
rz_list_append(item->types, strdup("func.sym.mahboi.args=2"));
rz_list_append(item->types, strdup("func.sym.mahboi.arg.0=\"int,arg0\""));
rz_list_append(item->types, strdup("func.sym.mahboi.arg.1=\"uint32_t,die\""));
item->hash = RZ_NEW0(RzSignHash);
item->hash->bbhash = strdup("7bfa1358c427e26bc03c2384f41de7be6ebc01958a57e9a6deda5bdba9768851");
rz_sign_add_item(analysis, item);
rz_sign_item_free(item);
rz_spaces_set(&analysis->zign_spaces, "koridai");
rz_sign_add_comment(analysis, "sym.boring", "gee it sure is boring around here");
Sdb *db = sdb_new0();
rz_serialize_analysis_sign_save(db, analysis);
Sdb *expected = sign_ref_db();
assert_sdb_eq(db, expected, "zignatures save");
sdb_free(db);
sdb_free(expected);
rz_analysis_free(analysis);
mu_end;
}
bool test_analysis_sign_load() {
RzAnalysis *analysis = rz_analysis_new();
rz_sign_analysis_set_hooks(analysis);
Sdb *db = sign_ref_db();
bool succ = rz_serialize_analysis_sign_load(db, analysis, NULL);
sdb_free(db);
mu_assert("load success", succ);
rz_spaces_set(&analysis->zign_spaces, NULL);
RzSignItem *item = rz_sign_get_item(analysis, "sym.mahboi");
mu_assert_notnull(item, "get item");
mu_assert_streq(item->name, "sym.mahboi", "name");
mu_assert_streq(item->realname, "sym.Mah.Boi", "realname");
mu_assert_streq(item->comment, "This peace is what all true warriors strive for", "comment");
mu_assert_notnull(item->bytes, "bytes");
mu_assert_eq(item->bytes->size, 4, "bytes size");
mu_assert_memeq(item->bytes->bytes, (ut8 *)"\xde\xad\xbe\xef", 4, "bytes bytes");
mu_assert_memeq(item->bytes->mask, (ut8 *)"\xc0\xff\xee\x42", 4, "bytes mask");
mu_assert_notnull(item->graph, "graph");
mu_assert_eq(item->graph->bbsum, 42, "graph bbsum");
mu_assert_eq(item->graph->cc, 123, "graph cc");
mu_assert_eq(item->graph->ebbs, 13, "graph ebbs");
mu_assert_eq(item->graph->edges, 12, "graph edges");
mu_assert_eq(item->graph->nbbs, 11, "graph nbbs");
mu_assert_eq(item->addr, 0x1337, "addr");
mu_assert_notnull(item->xrefs_from, "xrefs_from");
mu_assert_eq(rz_list_length(item->xrefs_from), 2, "xrefs_from count");
mu_assert_streq(rz_list_get_n(item->xrefs_from, 0), "gwonam", "xrefs_from");
mu_assert_streq(rz_list_get_n(item->xrefs_from, 1), "link", "xrefs_from");
mu_assert_notnull(item->xrefs_to, "xrefs_to");
mu_assert_eq(rz_list_length(item->xrefs_to), 2, "xrefs_to count");
mu_assert_streq(rz_list_get_n(item->xrefs_to, 0), "king", "xrefs_to");
mu_assert_streq(rz_list_get_n(item->xrefs_to, 1), "ganon", "xrefs_to");
mu_assert_notnull(item->vars, "vars");
mu_assert_eq(rz_list_length(item->vars), 3, "vars count");
mu_assert_streq(rz_list_get_n(item->vars, 0), "r16", "var");
mu_assert_streq(rz_list_get_n(item->vars, 1), "s42", "var");
mu_assert_streq(rz_list_get_n(item->vars, 2), "b13", "var");
mu_assert_notnull(item->types, "types");
mu_assert_eq(rz_list_length(item->types), 4, "types count");
mu_assert_streq(rz_list_get_n(item->types, 0), "func.sym.mahboi.ret=char *", "type");
mu_assert_streq(rz_list_get_n(item->types, 1), "func.sym.mahboi.args=2", "type");
mu_assert_streq(rz_list_get_n(item->types, 2), "func.sym.mahboi.arg.0=\"int,arg0\"", "type");
mu_assert_streq(rz_list_get_n(item->types, 3), "func.sym.mahboi.arg.1=\"uint32_t,die\"", "type");
mu_assert_notnull(item->hash, "hash");
mu_assert_streq(item->hash->bbhash, "7bfa1358c427e26bc03c2384f41de7be6ebc01958a57e9a6deda5bdba9768851", "hash val");
rz_sign_item_free(item);
rz_spaces_set(&analysis->zign_spaces, "koridai");
item = rz_sign_get_item(analysis, "sym.boring");
mu_assert_notnull(item, "get item in space");
mu_assert_streq(item->comment, "gee it sure is boring around here", "item in space comment");
rz_sign_item_free(item);
rz_analysis_free(analysis);
mu_end;
}
static Sdb *cc_ref_db() {
Sdb *db = sdb_new0();
sdb_set(db, "cc.sectarian.ret", "rax", 0);
@ -1550,14 +1415,6 @@ Sdb *analysis_ref_db() {
sdb_set(class_attrs, "attr.Aeropause.method", "some_meth", 0);
sdb_set(class_attrs, "attr.Aeropause.method.some_meth", "4919,42,0,some_meth", 0);
Sdb *zigns = sdb_ns(db, "zigns", true);
Sdb *zign_spaces = sdb_ns(zigns, "spaces", true);
sdb_set(zign_spaces, "spacestack", "[\"koridai\"]", 0);
sdb_set(zign_spaces, "name", "zs", 0);
Sdb *zign_spaces_spaces = sdb_ns(zign_spaces, "spaces", true);
sdb_set(zign_spaces_spaces, "koridai", "s", 0);
sdb_set(zigns, "zign|koridai|sym.boring", "|c:gee it sure is boring around here", 0);
Sdb *imports = sdb_ns(db, "imports", true);
sdb_set(imports, "pigs", "i", 0);
sdb_set(imports, "dogs", "i", 0);
@ -1580,7 +1437,6 @@ Sdb *analysis_ref_db() {
bool test_analysis_save() {
RzAnalysis *analysis = rz_analysis_new();
rz_sign_analysis_set_hooks(analysis);
RzAnalysisBlock *ba = rz_analysis_create_block(analysis, 1337, 42);
RzAnalysisBlock *bb = rz_analysis_create_block(analysis, 1234, 32);
@ -1615,9 +1471,6 @@ bool test_analysis_save() {
rz_analysis_class_method_set(analysis, "Aeropause", &crystal);
rz_analysis_class_method_fini(&crystal);
rz_spaces_set(&analysis->zign_spaces, "koridai");
rz_sign_add_comment(analysis, "sym.boring", "gee it sure is boring around here");
rz_analysis_add_import(analysis, "pigs");
rz_analysis_add_import(analysis, "dogs");
rz_analysis_add_import(analysis, "sheep");
@ -1684,12 +1537,6 @@ bool test_analysis_load() {
mu_assert_streq(meth->name, "some_meth", "method name");
rz_vector_free(vals);
rz_spaces_set(&analysis->zign_spaces, "koridai");
RzSignItem *item = rz_sign_get_item(analysis, "sym.boring");
mu_assert_notnull(item, "get item in space");
mu_assert_streq(item->comment, "gee it sure is boring around here", "item in space comment");
rz_sign_item_free(item);
mu_assert_eq(rz_list_length(analysis->imports), 3, "imports count");
mu_assert_notnull(rz_list_find(analysis->imports, "pigs", (RzListComparator)strcmp), "import");
mu_assert_notnull(rz_list_find(analysis->imports, "dogs", (RzListComparator)strcmp), "import");
@ -1724,8 +1571,6 @@ int all_tests() {
mu_run_test(test_analysis_hints_load);
mu_run_test(test_analysis_classes_save);
mu_run_test(test_analysis_classes_load);
mu_run_test(test_analysis_sign_save);
mu_run_test(test_analysis_sign_load);
mu_run_test(test_analysis_cc_save);
mu_run_test(test_analysis_cc_load);
mu_run_test(test_analysis_save);

View file

@ -5,7 +5,6 @@
#include <rz_vector.h>
#include <rz_util/rz_serialize.h>
#include <rz_type.h>
#include <rz_sign.h>
#include <rz_util/rz_path.h>
#include "test_config.h"
#include "minunit.h"

View file

@ -1,119 +0,0 @@
// SPDX-FileCopyrightText: 2020 Florian Märkl <info@florianmaerkl.de>
// SPDX-License-Identifier: LGPL-3.0-only
#include <rz_core.h>
#include <rz_analysis.h>
#include <rz_sign.h>
#include "minunit.h"
static bool test_analysis_sign_get_set(void) {
RzAnalysis *analysis = rz_analysis_new();
rz_sign_analysis_set_hooks(analysis);
RzSignItem *item = rz_sign_item_new();
item->name = strdup("sym.mahboi");
item->realname = strdup("sym.Mah.Boi");
item->comment = strdup("This peace is what all true warriors strive for");
item->bytes = RZ_NEW0(RzSignBytes);
item->bytes->size = 4;
item->bytes->bytes = (ut8 *)strdup("\xde\xad\xbe\xef");
item->bytes->mask = (ut8 *)strdup("\xc0\xff\xee\x42");
item->graph = RZ_NEW0(RzSignGraph);
item->graph->bbsum = 42;
item->graph->cc = 123;
item->graph->ebbs = 13;
item->graph->edges = 12;
item->graph->nbbs = 11;
item->addr = 0x1337;
item->xrefs_from = rz_list_newf(free);
rz_list_append(item->xrefs_from, strdup("gwonam"));
rz_list_append(item->xrefs_from, strdup("link"));
item->xrefs_to = rz_list_newf(free);
rz_list_append(item->xrefs_to, strdup("king"));
rz_list_append(item->xrefs_to, strdup("ganon"));
item->vars = rz_list_newf(free);
rz_list_append(item->vars, strdup("r16"));
rz_list_append(item->vars, strdup("s42"));
rz_list_append(item->vars, strdup("b13"));
item->types = rz_list_newf(free);
rz_list_append(item->types, strdup("func.sym.mahboi.ret=char *"));
rz_list_append(item->types, strdup("func.sym.mahboi.args=2"));
rz_list_append(item->types, strdup("func.sym.mahboi.arg.0=\"int,arg0\""));
rz_list_append(item->types, strdup("func.sym.mahboi.arg.1=\"uint32_t,die\""));
item->hash = RZ_NEW0(RzSignHash);
item->hash->bbhash = strdup("7bfa1358c427e26bc03c2384f41de7be6ebc01958a57e9a6deda5bdba9768851");
rz_sign_add_item(analysis, item);
rz_sign_item_free(item);
rz_spaces_set(&analysis->zign_spaces, "koridai");
rz_sign_add_comment(analysis, "sym.boring", "gee it sure is boring around here");
// --
rz_spaces_set(&analysis->zign_spaces, NULL);
item = rz_sign_get_item(analysis, "sym.mahboi");
mu_assert_notnull(item, "get item");
mu_assert_streq(item->name, "sym.mahboi", "name");
mu_assert_streq(item->realname, "sym.Mah.Boi", "realname");
mu_assert_streq(item->comment, "This peace is what all true warriors strive for", "comment");
mu_assert_notnull(item->bytes, "bytes");
mu_assert_eq(item->bytes->size, 4, "bytes size");
mu_assert_memeq(item->bytes->bytes, (ut8 *)"\xde\xad\xbe\xef", 4, "bytes bytes");
mu_assert_memeq(item->bytes->mask, (ut8 *)"\xc0\xff\xee\x42", 4, "bytes mask");
mu_assert_notnull(item->graph, "graph");
mu_assert_eq(item->graph->bbsum, 42, "graph bbsum");
mu_assert_eq(item->graph->cc, 123, "graph cc");
mu_assert_eq(item->graph->ebbs, 13, "graph ebbs");
mu_assert_eq(item->graph->edges, 12, "graph edges");
mu_assert_eq(item->graph->nbbs, 11, "graph nbbs");
mu_assert_eq(item->addr, 0x1337, "addr");
mu_assert_notnull(item->xrefs_from, "xrefs_from");
mu_assert_eq(rz_list_length(item->xrefs_from), 2, "xrefs_from count");
mu_assert_streq(rz_list_get_n(item->xrefs_from, 0), "gwonam", "xrefs_from");
mu_assert_streq(rz_list_get_n(item->xrefs_from, 1), "link", "xrefs_from");
mu_assert_notnull(item->xrefs_to, "xrefs_to");
mu_assert_eq(rz_list_length(item->xrefs_to), 2, "xrefs count");
mu_assert_streq(rz_list_get_n(item->xrefs_to, 0), "king", "xrefs_to");
mu_assert_streq(rz_list_get_n(item->xrefs_to, 1), "ganon", "xrefs_to");
mu_assert_notnull(item->vars, "vars");
mu_assert_eq(rz_list_length(item->vars), 3, "vars count");
mu_assert_streq(rz_list_get_n(item->vars, 0), "r16", "var");
mu_assert_streq(rz_list_get_n(item->vars, 1), "s42", "var");
mu_assert_streq(rz_list_get_n(item->vars, 2), "b13", "var");
mu_assert_notnull(item->types, "types");
mu_assert_eq(rz_list_length(item->types), 4, "types count");
mu_assert_streq(rz_list_get_n(item->types, 0), "func.sym.mahboi.ret=char *", "type");
mu_assert_streq(rz_list_get_n(item->types, 1), "func.sym.mahboi.args=2", "type");
mu_assert_streq(rz_list_get_n(item->types, 2), "func.sym.mahboi.arg.0=\"int,arg0\"", "type");
mu_assert_streq(rz_list_get_n(item->types, 3), "func.sym.mahboi.arg.1=\"uint32_t,die\"", "type");
mu_assert_notnull(item->hash, "hash");
mu_assert_streq(item->hash->bbhash, "7bfa1358c427e26bc03c2384f41de7be6ebc01958a57e9a6deda5bdba9768851", "hash val");
rz_sign_item_free(item);
rz_spaces_set(&analysis->zign_spaces, "koridai");
item = rz_sign_get_item(analysis, "sym.boring");
mu_assert_notnull(item, "get item in space");
mu_assert_streq(item->comment, "gee it sure is boring around here", "item in space comment");
rz_sign_item_free(item);
rz_analysis_free(analysis);
mu_end;
}
int all_tests(void) {
mu_run_test(test_analysis_sign_get_set);
return tests_passed != tests_run;
}
mu_main(all_tests)