Remove a2f (#219)
Co-authored-by: Maijin <maijin21@gmail.com> Co-authored-by: Riccardo Schirone <ret2libc@users.noreply.github.com>
This commit is contained in:
Maijin
GitHub
parent
dfbb7a71f5
commit
feb7feb19a
23 changed files with 2 additions and 675 deletions
|
|
@ -1965,10 +1965,6 @@ RZ_API int rz_core_analysis_fcn(RzCore *core, ut64 at, ut64 from, int reftype, i
|
|||
return false;
|
||||
}
|
||||
}
|
||||
if (rz_config_get_i (core->config, "analysis.a2f")) {
|
||||
rz_core_cmd0 (core, ".a2f");
|
||||
return 0;
|
||||
}
|
||||
if (use_esil) {
|
||||
return rz_core_analysis_esil_fcn (core, at, from, reftype, depth);
|
||||
}
|
||||
|
|
@ -5727,84 +5723,6 @@ RZ_API void rz_core_analysis_paths(RzCore *core, ut64 from, ut64 to, bool follow
|
|||
rz_list_free (rcap.path);
|
||||
}
|
||||
|
||||
static bool __cb(RzFlagItem *fi, void *user) {
|
||||
rz_list_append (user, rz_str_newf ("0x%08"PFMT64x, fi->offset));
|
||||
return true;
|
||||
}
|
||||
|
||||
static int __addrs_cmp(void *_a, void *_b) {
|
||||
ut64 a = rz_num_get (NULL, _a);
|
||||
ut64 b = rz_num_get (NULL, _b);
|
||||
if (a > b) {
|
||||
return 1;
|
||||
}
|
||||
if (a < b) {
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
RZ_API void rz_core_analysis_inflags(RzCore *core, const char *glob) {
|
||||
RzList *addrs = rz_list_newf (free);
|
||||
RzListIter *iter;
|
||||
bool a2f = rz_config_get_i (core->config, "analysis.a2f");
|
||||
char *analysis_in = strdup (rz_config_get (core->config, "analysis.in"));
|
||||
rz_config_set (core->config, "analysis.in", "block");
|
||||
// aaFa = use a2f instead of af+
|
||||
bool simple = (!glob || *glob != 'a');
|
||||
glob = rz_str_trim_head_ro (glob);
|
||||
char *addr;
|
||||
rz_flag_foreach_glob (core->flags, glob, __cb, addrs);
|
||||
// should be sorted already
|
||||
rz_list_sort (addrs, (RzListComparator)__addrs_cmp);
|
||||
rz_list_foreach (addrs, iter, addr) {
|
||||
if (!iter->n || rz_cons_is_breaked ()) {
|
||||
break;
|
||||
}
|
||||
char *addr2 = iter->n->data;
|
||||
if (!addr || !addr2) {
|
||||
break;
|
||||
}
|
||||
ut64 a0 = rz_num_get (NULL, addr);
|
||||
ut64 a1 = rz_num_get (NULL, addr2);
|
||||
if (a0 == a1) {
|
||||
// ignore
|
||||
continue;
|
||||
}
|
||||
if (a0 > a1) {
|
||||
eprintf ("Warning: unsorted flag list 0x%llx 0x%llx\n", a0, a1);
|
||||
continue;
|
||||
}
|
||||
st64 sz = a1 - a0;
|
||||
if (sz < 1 || sz > core->analysis->opt.bb_max_size) {
|
||||
eprintf ("Warning: invalid flag range from 0x%08"PFMT64x" to 0x%08"PFMT64x"\n", a0, a1);
|
||||
continue;
|
||||
}
|
||||
if (simple) {
|
||||
RzFlagItem *fi = rz_flag_get_at (core->flags, a0, 0);
|
||||
rz_core_cmdf (core, "af+ %s fcn.%s", addr, fi? fi->name: addr);
|
||||
rz_core_cmdf (core, "afb+ %s %s %d", addr, addr, (int)sz);
|
||||
} else {
|
||||
rz_core_cmdf (core, "aab@%s!%s-%s\n", addr, addr2, addr);
|
||||
RzAnalysisFunction *fcn = rz_analysis_get_fcn_in (core->analysis, rz_num_math (core->num, addr), 0);
|
||||
if (fcn) {
|
||||
eprintf ("%s %s %"PFMT64d" # %s\n", addr, "af", sz, fcn->name);
|
||||
} else {
|
||||
if (a2f) {
|
||||
rz_core_cmdf (core, "a2f@%s!%s-%s\n", addr, addr2, addr);
|
||||
} else {
|
||||
rz_core_cmdf (core, "af@%s!%s-%s\n", addr, addr2, addr);
|
||||
}
|
||||
fcn = rz_analysis_get_fcn_in (core->analysis, rz_num_math (core->num, addr), 0);
|
||||
eprintf ("%s %s %.4"PFMT64d" # %s\n", addr, "aab", sz, fcn?fcn->name: "");
|
||||
}
|
||||
}
|
||||
}
|
||||
rz_list_free (addrs);
|
||||
rz_config_set (core->config, "analysis.in", analysis_in);
|
||||
free (analysis_in);
|
||||
}
|
||||
|
||||
static bool analyze_noreturn_function(RzCore *core, RzAnalysisFunction *f) {
|
||||
RzListIter *iter;
|
||||
RzAnalysisBlock *bb;
|
||||
|
|
|
|||
|
|
@ -2885,7 +2885,6 @@ RZ_API int rz_core_config_init(RzCore *core) {
|
|||
SETBPREF ("analysis.detectwrites", "false", "Automatically reanalyze function after a write");
|
||||
SETPREF ("analysis.fcnprefix", "fcn", "Prefix new function names with this");
|
||||
SETCB ("analysis.verbose", "false", &cb_analverbose, "Show RzAnalysis warnings when analyzing code");
|
||||
SETBPREF ("analysis.a2f", "false", "Use the new WIP analysis algorithm (core/p/a2f), analysis.depth ignored atm");
|
||||
SETCB ("analysis.roregs", "gp,zero", (RzConfigCallback)&cb_analysis_roregs, "Comma separated list of register names to be readonly");
|
||||
SETICB ("analysis.gp", 0, (RzConfigCallback)&cb_analysis_gp, "Set the value of the GP register (MIPS)");
|
||||
SETBPREF ("analysis.gpfixed", "true", "Set gp register to analysis.gp before emulating each instruction in aae");
|
||||
|
|
|
|||
|
|
@ -47,8 +47,6 @@ static const char *help_msg_aa[] = {
|
|||
"aad", " [len]", "analyze data references to code",
|
||||
"aae", " [len] ([addr])", "analyze references with ESIL (optionally to address)",
|
||||
"aaf", "[e|r|t] ", "analyze all functions (e analysis.hasnext=1;afr @@c:isq) (aafe=aef@@f)",
|
||||
"aaF", " [sym*]", "set analysis.in=block for all the spaces between flags matching glob",
|
||||
"aaFa", " [sym*]", "same as aaF but uses af/a2f instead of af+/afb+ (slower but more accurate)",
|
||||
"aai", "[j]", "show info of all analysis parameters",
|
||||
"aan", "[gr?]", "autoname functions (aang = golang, aanr = noreturn propagation)",
|
||||
"aao", "", "analyze all objc references",
|
||||
|
|
@ -9599,13 +9597,6 @@ static int cmd_analysis_all(RzCore *core, const char *input) {
|
|||
rz_core_cmd0 (core, "af @@ sym.*");
|
||||
rz_core_cmd0 (core, "af @@ entry*");
|
||||
break;
|
||||
case 'F': // "aaF" "aaFa"
|
||||
if (!input[1] || input[1] == ' ' || input[1] == 'a') {
|
||||
rz_core_analysis_inflags (core, input + 1);
|
||||
} else {
|
||||
eprintf ("Usage: aaF[a] - analyze functions in flag bounds (aaFa uses af/a2f instead of af+/afb+)\n");
|
||||
}
|
||||
break;
|
||||
case 'n': // "aan"
|
||||
switch (input[1]) {
|
||||
case 'r': // "aanr" // all noreturn propagation
|
||||
|
|
|
|||
|
|
@ -852,7 +852,7 @@ static const char *rizin_argv[] = {
|
|||
"/w", "/wi", "/x", "/z",
|
||||
"!?", "!", "!!", "!!!", "!!!-", "!-", "!-*", "!=!",
|
||||
"a?", "a", "aa", "aa*",
|
||||
"aaa", "aab", "aac", "aac*", "aad", "aae", "aaf", "aaF", "aaFa", "aai", "aaij", "aan", "aang", "aao", "aap",
|
||||
"aaa", "aab", "aac", "aac*", "aad", "aae", "aaf", "aai", "aaij", "aan", "aang", "aao", "aap",
|
||||
"aar?", "aar", "aar*", "aarj", "aas", "aat", "aaT", "aau", "aav",
|
||||
"a8", "ab", "abb",
|
||||
"acl", "acll", "aclj", "acl*", "ac?", "ac", "ac-", "acn", "acv", "acvf", "acv-", "acb", "acb-", "acm", "acm-", "acmn",
|
||||
|
|
|
|||
|
|
@ -78,7 +78,6 @@ rz_core_sources = [
|
|||
'vmenus_graph.c',
|
||||
'vmenus_zigns.c',
|
||||
'yank.c',
|
||||
'p/core_a2f.c',
|
||||
'p/core_java.c',
|
||||
'cannotated_code.c',
|
||||
'serialize_core.c'
|
||||
|
|
|
|||
|
|
@ -26,7 +26,7 @@ ifeq ($(WITHPIC),1)
|
|||
all: ${ALL_TARGETS}
|
||||
|
||||
ALL_TARGETS=
|
||||
PLUGS=java.mk a2f.mk
|
||||
PLUGS=java.mk
|
||||
include $(PLUGS)
|
||||
|
||||
clean:
|
||||
|
|
|
|||
|
|
@ -1,15 +0,0 @@
|
|||
CORE_OBJ_A2F=core_a2f.o
|
||||
|
||||
STATIC_OBJ+=${CORE_OBJ_A2F}
|
||||
CORE_TARGET_A2F=core_a2f.${EXT_SO}
|
||||
|
||||
ifeq ($(WITHPIC),1)
|
||||
ALL_TARGETS+=${CORE_TARGET_A2F}
|
||||
|
||||
${CORE_TARGET_A2F}: ${CORE_OBJ_A2F}
|
||||
${CC} $(call libname,core_analysis) ${CFLAGS} \
|
||||
-o core_a2f.${EXT_SO} \
|
||||
$(SHLR)/sdb/src/libsdb.a \
|
||||
-L$(LIBR)/crypto -lrz_crypto \
|
||||
${CORE_OBJ_A2F}
|
||||
endif
|
||||
|
|
@ -1,407 +0,0 @@
|
|||
// SPDX-License-Identifier: LGPL-3.0-only
|
||||
|
||||
#include <rz_types.h>
|
||||
#include <rz_core.h>
|
||||
#include <rz_io.h>
|
||||
|
||||
#define MAXFCNSIZE 4096
|
||||
|
||||
#define Fbb(x) sdb_fmt("bb.%"PFMT64x,x)
|
||||
#define Fhandled(x) sdb_fmt("handled.%"PFMT64x,x)
|
||||
#define FbbTo(x) sdb_fmt("bb.%"PFMT64x".to",x)
|
||||
|
||||
static ut64 getCrossingBlock(Sdb *db, const char *key, ut64 start, ut64 end) {
|
||||
ut64 block_start, block_end;
|
||||
ut64 nearest_start = UT64_MAX;
|
||||
const char *s = sdb_const_get (db, key, NULL);
|
||||
const char *next = NULL;
|
||||
const char *ptr = NULL;
|
||||
if (!s) {
|
||||
return UT64_MAX;
|
||||
}
|
||||
ptr = s;
|
||||
do {
|
||||
next = sdb_const_anext (ptr);
|
||||
block_start = sdb_atoi (ptr);
|
||||
|
||||
if (start == block_start) { // case 5
|
||||
return start;
|
||||
}
|
||||
|
||||
block_end = sdb_num_get (db, Fbb(block_start), NULL);
|
||||
if (block_end) {
|
||||
if (start > block_start && start < block_end) { // case 2
|
||||
// start is inside the block
|
||||
return block_start;
|
||||
}
|
||||
if (start < block_start && end >= block_end) {
|
||||
// crossing the start of the block
|
||||
if (nearest_start > block_start) {
|
||||
nearest_start = block_start;
|
||||
}
|
||||
}
|
||||
}
|
||||
ptr = next;
|
||||
} while (next);
|
||||
|
||||
return nearest_start;
|
||||
}
|
||||
|
||||
/*
|
||||
bb.<addr-of-basic-block>=<end-address-of-basic-block>
|
||||
bb.<addr-of-basic-block>.to=array,of,destination,addresses
|
||||
*/
|
||||
|
||||
static int bbAdd(Sdb *db, ut64 from, ut64 to, ut64 jump, ut64 fail) {
|
||||
ut64 block_start = getCrossingBlock (db, "bbs", from, to);
|
||||
int add = 1;
|
||||
if (block_start == UT64_MAX) {
|
||||
// add = 1;
|
||||
} else if (block_start == from) {
|
||||
// check if size is the same,
|
||||
add = 0;
|
||||
} else {
|
||||
/*
|
||||
from = start address of new basic block
|
||||
to = end address of new basic block
|
||||
jump = destination basic block
|
||||
fail = fallback jump of basic block
|
||||
addr = previous closer basic block start address
|
||||
addr_end = previous closer basic block start address
|
||||
*/
|
||||
// found a possible block
|
||||
if (from > block_start) {
|
||||
// from inside
|
||||
// RESIZE this
|
||||
sdb_num_set (db, Fbb(block_start), from, 0);
|
||||
sdb_num_set (db, FbbTo(block_start), from, 0);
|
||||
sdb_array_set_num (db, FbbTo(block_start), 0, from, 0);
|
||||
sdb_array_set_num (db, FbbTo(block_start), 1, UT64_MAX, 0);
|
||||
} else {
|
||||
// < the current runs into a known block
|
||||
to = block_start;
|
||||
jump = block_start;
|
||||
fail = UT64_MAX;
|
||||
}
|
||||
}
|
||||
if (add) {
|
||||
sdb_array_add_num (db, "bbs", from, 0);
|
||||
sdb_num_set (db, Fbb(from), to, 0);
|
||||
sdb_array_set_num (db, FbbTo(from), 0, jump, 0);
|
||||
sdb_array_set_num (db, FbbTo(from), 1, fail, 0);
|
||||
sdb_num_min (db, "min", from, 0);
|
||||
sdb_num_max (db, "max", to, 0);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
void addTarget(RzCore *core, RzStack *stack, Sdb *db, ut64 addr) {
|
||||
if (!sdb_num_get (db, Fhandled(addr), NULL)) {
|
||||
ut64* value = (ut64*) malloc (1 * sizeof (ut64));
|
||||
if (!value) {
|
||||
eprintf ("Failed to allocate memory for address stack\n");
|
||||
return;
|
||||
}
|
||||
*value = addr;
|
||||
if (!rz_stack_push (stack, (void*)value)) {
|
||||
eprintf ("Failed to push address on stack\n");
|
||||
free (value);
|
||||
return;
|
||||
}
|
||||
sdb_num_set (db, Fhandled (addr), 1, 0);
|
||||
}
|
||||
}
|
||||
|
||||
static ut64 analyzeStackBased(RzCore *core, Sdb *db, ut64 addr, RzList *delayed_commands) {
|
||||
#define addCall(x) sdb_array_add_num (db, "calls", x, 0);
|
||||
#define addUcall(x) sdb_array_add_num (db, "ucalls", x, 0);
|
||||
#define addUjmp(x) sdb_array_add_num (db, "ujmps", x, 0);
|
||||
#define addCjmp(x) sdb_array_add_num (db, "cjmps", x, 0);
|
||||
#define addRet(x) sdb_array_add_num (db, "rets", x, 0);
|
||||
#define bbAddOpcode(x) sdb_array_insert_num (db, sdb_fmt ("bb.%"PFMT64x, addr+cur), -1, x, 0);
|
||||
ut64 oaddr = addr;
|
||||
ut64 *value = NULL;
|
||||
RzAnalysisOp *op;
|
||||
int cur = 0;
|
||||
bool block_end = false;
|
||||
RzStack *stack = rz_stack_newf (10, free);
|
||||
addTarget (core, stack, db, addr);
|
||||
const ut64 maxfcnsize = 4096;
|
||||
|
||||
while (!rz_stack_is_empty (stack)) {
|
||||
block_end = false;
|
||||
value = (ut64*) rz_stack_pop (stack);
|
||||
if (!value) {
|
||||
eprintf ("Failed to pop next address from stack\n");
|
||||
break;
|
||||
}
|
||||
|
||||
addr = *value;
|
||||
free (value);
|
||||
cur = 0;
|
||||
while (!block_end && cur < maxfcnsize) {
|
||||
op = rz_core_analysis_op (core, addr + cur, RZ_ANALYSIS_OP_MASK_BASIC | RZ_ANALYSIS_OP_MASK_DISASM);
|
||||
if (!op || !op->mnemonic) {
|
||||
eprintf ("a2f: Cannot analyze opcode at 0x%"PFMT64x"\n", addr+cur);
|
||||
oaddr = UT64_MAX;
|
||||
break;
|
||||
}
|
||||
if (op->mnemonic[0] == '?') {
|
||||
eprintf ("a2f: Cannot analyze opcode at 0x%"PFMT64x"\n", addr+cur);
|
||||
oaddr = UT64_MAX;
|
||||
break;
|
||||
}
|
||||
|
||||
bbAddOpcode (addr + cur);
|
||||
switch (op->type) {
|
||||
case RZ_ANALYSIS_OP_TYPE_NOP:
|
||||
// skip nops
|
||||
if (cur == 0) {
|
||||
cur -= op->size;
|
||||
addr += op->size;
|
||||
oaddr += op->size;
|
||||
}
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_CALL:
|
||||
/* A call instruction implies that the destination
|
||||
* is a new function unless the address is inside
|
||||
* the same range than the current function */
|
||||
addCall (op->jump);
|
||||
rz_list_append (delayed_commands, rz_str_newf ("axC %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_UCALL:
|
||||
case RZ_ANALYSIS_OP_TYPE_ICALL:
|
||||
case RZ_ANALYSIS_OP_TYPE_RCALL:
|
||||
case RZ_ANALYSIS_OP_TYPE_IRCALL:
|
||||
/* unknown calls depend on ESIL or DEBUG tracing
|
||||
* information to know the destination, we can mark
|
||||
* those 'calls' for later adding tracepoints in
|
||||
* there to record all possible destinations */
|
||||
addUcall (addr+cur);
|
||||
if (op->ptr != UT64_MAX) {
|
||||
rz_list_append (delayed_commands, rz_str_newf ("axC %"PFMT64d" %"PFMT64d, op->ptr, addr + cur));
|
||||
}
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_UJMP:
|
||||
case RZ_ANALYSIS_OP_TYPE_RJMP:
|
||||
case RZ_ANALYSIS_OP_TYPE_IJMP:
|
||||
case RZ_ANALYSIS_OP_TYPE_IRJMP:
|
||||
/* an unknown jump use to go into computed destinations
|
||||
* outside the current function, but it may result
|
||||
* on an antidisasm trick */
|
||||
addUjmp (addr + cur);
|
||||
/* An unknown jump breaks the basic blocks */
|
||||
block_end = true; // XXX more investigation here
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_TRAP:
|
||||
if (cur == 0) {
|
||||
// skip leading int3
|
||||
cur -= op->size;
|
||||
addr += op->size;
|
||||
oaddr += op->size;
|
||||
} else {
|
||||
block_end = true;
|
||||
}
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_RET:
|
||||
addRet (addr + cur);
|
||||
bbAdd (db, addr, addr + cur + op->size, UT64_MAX, UT64_MAX);
|
||||
block_end = true;
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_CJMP:
|
||||
addCjmp (addr+cur);
|
||||
bbAdd (db, addr, addr + cur + op->size, op->jump, addr + cur + op->size);
|
||||
addTarget (core, stack, db, op->jump);
|
||||
addTarget (core, stack, db, addr + cur + op->size);
|
||||
block_end = true;
|
||||
rz_list_append (delayed_commands, rz_str_newf ("axc %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_JMP:
|
||||
addUjmp (addr+cur);
|
||||
bbAdd (db, addr, addr + cur + op->size, op->jump, UT64_MAX);
|
||||
addTarget (core, stack, db, op->jump);
|
||||
block_end = true;
|
||||
rz_list_append (delayed_commands, rz_str_newf ("axc %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
|
||||
break;
|
||||
case RZ_ANALYSIS_OP_TYPE_UNK:
|
||||
case RZ_ANALYSIS_OP_TYPE_ILL:
|
||||
eprintf ("a2f: Invalid instruction\n");
|
||||
block_end = true;
|
||||
break;
|
||||
default:
|
||||
if (op->ptr != UT64_MAX) {
|
||||
rz_list_append (delayed_commands, rz_str_newf ("axd %"PFMT64d" %"PFMT64d, op->ptr, addr + cur));
|
||||
}
|
||||
break;
|
||||
}
|
||||
cur += op->size;
|
||||
rz_analysis_op_free (op);
|
||||
op = NULL;
|
||||
}
|
||||
}
|
||||
|
||||
rz_stack_free (stack);
|
||||
return oaddr;
|
||||
}
|
||||
|
||||
static ut64 getFunctionSize(Sdb *db) {
|
||||
ut64 min = UT64_MAX, max = 0;
|
||||
char *c, *bbs = sdb_get (db, "bbs", NULL);
|
||||
bool first = true;
|
||||
sdb_aforeach (c, bbs) {
|
||||
ut64 addr = sdb_atoi (c);
|
||||
ut64 addr_end = sdb_num_get (db, Fbb (addr), NULL);
|
||||
if (first) {
|
||||
min = addr;
|
||||
max = addr_end;
|
||||
first = false;
|
||||
} else {
|
||||
if (addr < min) {
|
||||
min = addr;
|
||||
}
|
||||
if (addr_end > max) {
|
||||
max = addr_end;
|
||||
}
|
||||
}
|
||||
sdb_aforeach_next (c);
|
||||
}
|
||||
free (bbs);
|
||||
return max - min;
|
||||
}
|
||||
|
||||
static int analyzeFunction(RzCore *core, ut64 addr) {
|
||||
Sdb *db = sdb_new0 ();
|
||||
RzFlagItem *fi;
|
||||
RzList *delayed_commands = NULL;
|
||||
RzListIter *iter;
|
||||
ut64 loc_addr = 0;
|
||||
char *command = NULL;
|
||||
char *function_label;
|
||||
bool vars = rz_config_get_i (core->config, "analysis.vars");
|
||||
if (!db) {
|
||||
eprintf ("Cannot create db\n");
|
||||
return false;
|
||||
}
|
||||
|
||||
delayed_commands = rz_list_newf (free);
|
||||
if (!delayed_commands) {
|
||||
eprintf ("Failed to initialize the delayed command list\n");
|
||||
sdb_free (db);
|
||||
return false;
|
||||
}
|
||||
|
||||
ut64 a = analyzeStackBased (core, db, addr, delayed_commands);
|
||||
if (addr == UT64_MAX) {
|
||||
eprintf ("Initial analysis failed\n");
|
||||
return false;
|
||||
}
|
||||
if (a != UT64_MAX) {
|
||||
addr = a;
|
||||
}
|
||||
sdb_num_set (db, "addr", addr, 0);
|
||||
|
||||
//TODO add the possible addresses to the analysis stack
|
||||
//TODO add xrefs
|
||||
//eprintf ("addr: %s\n", sdb_const_get (db, "addr", NULL));
|
||||
//eprintf ("calls: %s\n", sdb_const_get (db, "calls", NULL));
|
||||
//eprintf ("ucalls: %s\n", sdb_const_get (db, "ucalls", NULL));
|
||||
//eprintf ("cjmps: %s\n", sdb_const_get (db, "cjmps", NULL));
|
||||
//eprintf ("ujmps: %s\n", sdb_const_get (db, "ujmps", NULL));
|
||||
//eprintf ("rets: %s\n", sdb_const_get (db, "rets", NULL));
|
||||
//eprintf ("bbs: %s\n", sdb_const_get (db, "bbs", NULL));
|
||||
|
||||
// fcnfit to get fcn size
|
||||
sdb_num_set (db, "size", getFunctionSize (db), 0);
|
||||
|
||||
// receiving a possible flag to label the new function
|
||||
fi = rz_flag_get_at (core->flags, addr, false);
|
||||
if (fi && fi->name && strncmp (fi->name, "sect", 4)) {
|
||||
function_label = strdup (fi->name);
|
||||
} else {
|
||||
function_label = rz_str_newf ("fcn2.%08"PFMT64x, addr);
|
||||
}
|
||||
// loc_addr = core->offset; // sdb_num_get (db, "addr", NULL);
|
||||
loc_addr = sdb_num_get (db, "addr", NULL);
|
||||
// rz_cons_printf ("af+ 0x%08"PFMT64x" %s\n", loc_addr, function_label);
|
||||
rz_core_cmdf (core, "af+ 0x%08"PFMT64x" %s", loc_addr, function_label);
|
||||
{
|
||||
char *c, *bbs = sdb_get (db, "bbs", NULL);
|
||||
sdb_aforeach (c, bbs) {
|
||||
ut64 addr = sdb_atoi (c);
|
||||
ut64 addr_end = sdb_num_get (db, Fbb (addr), NULL);
|
||||
// check if call destination is inside the function boundaries
|
||||
ut64 jump = sdb_array_get_num (db, FbbTo (addr), 0, NULL);
|
||||
ut64 fail = sdb_array_get_num (db, FbbTo (addr), 1, NULL);
|
||||
|
||||
// rz_cons_printf ("afb+ 0x%"PFMT64x" 0x%"PFMT64x" %d 0x%"PFMT64x" 0x%"PFMT64x"\n",
|
||||
// loc_addr, addr, (int)(addr_end - addr), jump, fail);
|
||||
rz_core_cmdf (core, "afb+ 0x%"PFMT64x" 0x%"PFMT64x" %d 0x%"PFMT64x" 0x%"PFMT64x,
|
||||
loc_addr, addr, (int)(addr_end - addr), jump, fail);
|
||||
sdb_aforeach_next (c);
|
||||
}
|
||||
|
||||
if (vars) {
|
||||
// handling arguments
|
||||
rz_core_cmdf (core, "afva @ 0x%"PFMT64x, addr);
|
||||
}
|
||||
free (bbs);
|
||||
free (function_label);
|
||||
}
|
||||
rz_list_foreach (delayed_commands, iter, command) {
|
||||
if (command) {
|
||||
rz_core_cmd0 (core, command);
|
||||
command = NULL;
|
||||
}
|
||||
}
|
||||
// TODO
|
||||
// xrefs are added but are not mentioned in afi
|
||||
// analyze next calls
|
||||
// {
|
||||
// char *c, *calls = sdb_get (db, "calls", NULL);
|
||||
// sdb_aforeach (c, calls) {
|
||||
// ut64 addr = sdb_atoi (c);
|
||||
// rz_cons_printf ("a2f @ 0x%"PFMT64x"\n", addr);
|
||||
// sdb_aforeach_next (c);
|
||||
// }
|
||||
// free (calls);
|
||||
// }
|
||||
rz_list_free (delayed_commands);
|
||||
sdb_free (db);
|
||||
return true;
|
||||
}
|
||||
|
||||
static int rz_cmd_analysis_call(void *user, const char *input) {
|
||||
RzCore *core = (RzCore *) user;
|
||||
if (!strncmp (input, "a2", 2)) {
|
||||
switch (input[2]) {
|
||||
case 'f':
|
||||
if (!analyzeFunction (core, core->offset)) {
|
||||
eprintf ("a2f: Failed to analyze function.\n");
|
||||
}
|
||||
break;
|
||||
default:
|
||||
eprintf ("Usage: a2f\n");
|
||||
eprintf ("a2f is the new (experimental) analysis engine\n");
|
||||
eprintf ("Use with caution.\n");
|
||||
break;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
// PLUGIN Definition Info
|
||||
RzCorePlugin rz_core_plugin_a2f = {
|
||||
.name = "a2f",
|
||||
.desc = "The reworked analysis from scratch thing",
|
||||
.license = "LGPL3",
|
||||
.call = rz_cmd_analysis_call,
|
||||
};
|
||||
|
||||
#ifndef RZ_PLUGIN_INCORE
|
||||
RZ_API RzLibStruct rizin_plugin = {
|
||||
.type = RZ_LIB_TYPE_CORE,
|
||||
.data = &rz_core_plugin_a2f,
|
||||
.version = RZ_VERSION
|
||||
};
|
||||
#endif
|
||||
|
|
@ -470,7 +470,6 @@ RZ_API char* rz_core_add_asmqjmp(RzCore *core, ut64 addr);
|
|||
RZ_API void rz_core_analysis_type_init(RzCore *core);
|
||||
RZ_API char *rz_core_analysis_hasrefs_to_depth(RzCore *core, ut64 value, PJ *pj, int depth);
|
||||
RZ_API void rz_core_link_stroff(RzCore *core, RzAnalysisFunction *fcn);
|
||||
RZ_API void rz_core_analysis_inflags (RzCore *core, const char *glob);
|
||||
RZ_API bool cmd_analysis_objc (RzCore *core, const char *input, bool auto_analysis);
|
||||
RZ_API void rz_core_analysis_cc_init(RzCore *core);
|
||||
RZ_API void rz_core_analysis_paths(RzCore *core, ut64 from, ut64 to, bool followCalls, int followDepth, bool is_json);
|
||||
|
|
@ -916,7 +915,6 @@ RZ_API void rz_core_analysis_propagate_noreturn(RzCore *core, ut64 addr);
|
|||
|
||||
/* PLUGINS */
|
||||
extern RzCorePlugin rz_core_plugin_java;
|
||||
extern RzCorePlugin rz_core_plugin_a2f;
|
||||
|
||||
/* DECOMPILER PRINTING FUNCTIONS */
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -198,7 +198,6 @@ bp_plugins = [
|
|||
]
|
||||
|
||||
core_plugins = [
|
||||
'a2f',
|
||||
'java'
|
||||
]
|
||||
|
||||
|
|
|
|||
|
|
@ -48,7 +48,6 @@ bp.arm
|
|||
bp.bf
|
||||
bp.x86
|
||||
bp.mips
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
debug.native
|
||||
|
|
|
|||
|
|
@ -18,7 +18,6 @@ bin_xtr.xtr_sep64
|
|||
"
|
||||
SHARED="
|
||||
core.java
|
||||
core.a2f
|
||||
bp.arm
|
||||
bp.x86
|
||||
bp.mips
|
||||
|
|
|
|||
|
|
@ -183,7 +183,6 @@ bp.bf
|
|||
bp.mips
|
||||
bp.ppc
|
||||
bp.x86
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
crypto.des
|
||||
|
|
|
|||
|
|
@ -25,7 +25,6 @@ bin.mach064
|
|||
bin.wasm
|
||||
bin_xtr.xtr_fatmach0
|
||||
bin_xtr.xtr_sep64
|
||||
core.a2f
|
||||
bp.arm
|
||||
bp.x86
|
||||
bp.mips
|
||||
|
|
|
|||
|
|
@ -44,7 +44,6 @@ bp.arm
|
|||
bp.bf
|
||||
bp.x86
|
||||
bp.mips
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
debug.esil
|
||||
|
|
|
|||
|
|
@ -48,7 +48,6 @@ bp.arm
|
|||
bp.bf
|
||||
bp.x86
|
||||
bp.mips
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
debug.native
|
||||
|
|
|
|||
|
|
@ -88,7 +88,6 @@ bp.bf
|
|||
bp.mips
|
||||
bp.ppc
|
||||
bp.x86
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
debug.bf
|
||||
|
|
|
|||
|
|
@ -136,7 +136,6 @@ bp.bf
|
|||
bp.mips
|
||||
bp.ppc
|
||||
bp.x86
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
crypto.des
|
||||
|
|
|
|||
|
|
@ -134,7 +134,6 @@ bp.bf
|
|||
bp.mips
|
||||
bp.ppc
|
||||
bp.x86
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
crypto.des
|
||||
|
|
|
|||
|
|
@ -44,7 +44,6 @@ bp.arm
|
|||
bp.bf
|
||||
bp.x86
|
||||
bp.mips
|
||||
core.a2f
|
||||
core.java
|
||||
crypto.aes
|
||||
debug.native
|
||||
|
|
|
|||
|
|
@ -205,7 +205,6 @@ wx ff0000e2010050e30000001affffffea70009de594008de5e4139fe500f09ee5
|
|||
e asm.arch=arm
|
||||
e asm.bits=32
|
||||
af
|
||||
# .a2f
|
||||
#pdf
|
||||
afb
|
||||
EOF
|
||||
|
|
@ -216,23 +215,6 @@ EXPECT=<<EOF
|
|||
EOF
|
||||
RUN
|
||||
|
||||
NAME=ARM32 bb 0 size -- a2f
|
||||
FILE=malloc://32
|
||||
BROKEN=1
|
||||
CMDS=<<EOF
|
||||
wx ff0000e2010050e30000001affffffea70009de594008de5e4139fe500f09ee5
|
||||
e asm.arch=arm
|
||||
e asm.bits=32
|
||||
.a2f
|
||||
afb
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
0x00000000 0x0000000c 00:0000 12 j 0x00000010 f 0x0000000c
|
||||
0x0000000c 0x00000010 00:0000 4 j 0x00000010
|
||||
0x00000010 0x00000020 00:0000 16
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=ldr code analysis
|
||||
FILE=malloc://32
|
||||
CMDS=<<EOF
|
||||
|
|
|
|||
|
|
@ -75,84 +75,6 @@ EXPECT=<<EOF
|
|||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f 8 bbs 4 ret and some jumps
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=32
|
||||
wx 85c0740585c07405c385c0eb01c385c07401c3b8efbeaddec3
|
||||
a2f
|
||||
afb
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
0x00000000 0x00000004 00:0000 4 j 0x00000009 f 0x00000004
|
||||
0x00000004 0x00000008 00:0000 4 j 0x0000000d f 0x00000008
|
||||
0x00000008 0x00000009 00:0000 1
|
||||
0x00000009 0x0000000d 00:0000 4 j 0x0000000e
|
||||
0x0000000d 0x0000000e 00:0000 1
|
||||
0x0000000e 0x00000012 00:0000 4 j 0x00000013 f 0x00000012
|
||||
0x00000012 0x00000013 00:0000 1
|
||||
0x00000013 0x00000019 00:0000 6
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f 3bbs with entry in the middle of the function
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=32
|
||||
wx 31c031c983c10183c10285c975f231c931c040c3
|
||||
s 0xa
|
||||
a2f
|
||||
afb
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
0x00000000 0x0000000a 00:0000 10 j 0x0000000a
|
||||
0x0000000a 0x0000000e 00:0000 4 j 0x00000000 f 0x0000000e
|
||||
0x0000000e 0x00000014 00:0000 6
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f 6 bbs with entry at the end of the function
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=32
|
||||
wx 31c083c00183e801750831c083e80183c00131c983c10183e90175e431d283ea0183c2017402ebd831c0c3
|
||||
s 0x26
|
||||
a2f
|
||||
afb
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
0x00000000 0x0000000a 00:0000 10 j 0x00000012 f 0x0000000a
|
||||
0x0000000a 0x00000012 00:0000 8 j 0x00000012
|
||||
0x00000012 0x0000001c 00:0000 10 j 0x00000000 f 0x0000001c
|
||||
0x0000001c 0x00000026 00:0000 10 j 0x00000028 f 0x00000026
|
||||
0x00000026 0x00000028 00:0000 2 j 0x00000000
|
||||
0x00000028 0x0000002b 00:0000 3
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f cjmp
|
||||
FILE=malloc://0x5000
|
||||
CMDS=<<EOF
|
||||
e asm.arch = x86
|
||||
e analysis.arch = x86
|
||||
e io.cache=true
|
||||
e asm.bits=32
|
||||
wx 31c0740140c3
|
||||
a2f
|
||||
afb
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
0x00000000 0x00000004 00:0000 4 j 0x00000005 f 0x00000004
|
||||
0x00000004 0x00000005 00:0000 1 j 0x00000005
|
||||
0x00000005 0x00000006 00:0000 1
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=aaa with axt
|
||||
FILE=bins/pe/keygen.exe
|
||||
|
|
|
|||
|
|
@ -571,55 +571,6 @@ var var_fh = 0x00177fc7 = (qword)0x0000000000000011
|
|||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f jmp after ret
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=64
|
||||
wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3
|
||||
a2f
|
||||
afl~?
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
1
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f jmp after ret - _size (symsize)
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=64
|
||||
wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3
|
||||
a2f
|
||||
afl~?
|
||||
afl~[2]
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
1
|
||||
60
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=a2f jmp after ret - realsize (bbs_sum)
|
||||
FILE=malloc://512
|
||||
CMDS=<<EOF
|
||||
e analysis.hasnext=0
|
||||
e asm.arch=x86
|
||||
e asm.bits=64
|
||||
wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3
|
||||
a2f
|
||||
afl~?
|
||||
afl~[2]
|
||||
EOF
|
||||
EXPECT=<<EOF
|
||||
1
|
||||
60
|
||||
EOF
|
||||
RUN
|
||||
|
||||
NAME=aaa with avra
|
||||
FILE=bins/elf/class_test
|
||||
CMDS=<<EOF
|
||||
|
|
|
|||
Loading…
Reference in a new issue