Commit graph

28580 commits

Author SHA1 Message Date
billow
37e1f0aae5 Add rz_read_ble128 2023-07-30 16:16:52 +08:00
billow
34ed8c2aea Fix rz_buf_uleb128 2023-07-30 16:16:52 +08:00
Giovanni
a3ad6221fb
Fix #3647 (#3690) 2023-07-29 16:20:19 +08:00
frmdstryr
c9fe729ce0
Make rz_core_analysis_var_display work with stack vars when debugging (#3687) 2023-07-28 01:40:22 +08:00
Riccardo Schirone
594e5885ab
core: fix 'pxj' command to not use core->block (#3693) 2023-07-27 22:59:46 +08:00
Hertatijanto Hartono
d1fd135df3 Reopening file should not be identified as an error 2023-07-25 11:02:11 +08:00
Anton Kochkov
ba84a920ad Improve parsing C syntax up to C23 2023-07-23 19:04:05 +08:00
Anton Kochkov
dd6c3a6437 Update Tree-Sitter C grammer 2023-07-23 19:04:05 +08:00
Anton Kochkov
fd8086bcc8
Show realname in fl.t table output (#3682) 2023-07-23 13:46:26 +08:00
svr
832e5b0d36
Rewrite LE plugin (#3666)
* Apply relocations, jump tables are detected correctly now
* Use virtual files for patching and relocation targets
* Create continous sections where possible instead of a section per page
* Support for DOS extender bound LE executables
* Support page compression of type 1 (iterated) and 5 (compressed)
* Add support for 16 bit relocations
* Fix numerous issues, leaks, UB, etc
2023-07-22 21:39:30 +08:00
Anton Kochkov
2ec61704c0
Move RzOutputMode to rz_cmd.h (#3672) 2023-07-22 17:48:55 +08:00
frmdstryr
c4cb0d3e59
Move rz_core_analysis_var_display to public api (#3679) 2023-07-21 19:52:45 +08:00
Anton Kochkov
b30cd7fc83
Update TinyCC CI job (#3683) 2023-07-21 17:10:25 +08:00
Anton Kochkov
831c472f09
Improve help for ~: command (#3681) 2023-07-21 14:55:20 +08:00
Anton Kochkov
07747e2ba8
Update rz-libdemangle (#3680) 2023-07-21 13:01:23 +08:00
Anton Kochkov
47701f65b4
Fix fl. commands and add tests (#3678) 2023-07-20 21:17:14 +08:00
Anton Kochkov
f1006f97c2
arm: use cortexm cpu instead of cortex (#3674) 2023-07-20 16:20:04 +08:00
Anton Kochkov
8f1710a403
reuse: fix DEP5 format for multiline copyright (#3675) 2023-07-20 15:29:57 +08:00
Anton Kochkov
d581fc2528
test: remove duplicate dbg.fds.count test (#3673) 2023-07-20 13:33:20 +08:00
Heersin
c0850845f1
RzIL: asm tests for ARM32 VFP and NEON (#3662) 2023-07-20 11:30:17 +08:00
Parth Bansal
0ed81d522b
Add p=r command to display entropy edges (#3671) 2023-07-20 11:21:50 +08:00
Florian Märkl
aa2c54f128
Add support for PT_OPENBSD_NOBTCFI detection (#3663)
OpenBSD enables arm64 BTI or Intel IBT by default, except when the
binary was linked with -Wl,-z,nobtcfi in order to opt-out. In this case,
a PT_OPENBSD_NOBTCFI segment will exist, which we can indicate in the
bin info.
See also https://undeadly.org/cgi?action=article;sid=20230714121907

Original Commit: 4551bf03461595a9645051347ad026974227ac6d

Co-authored-by: pancake <pancake@nopcode.org>
2023-07-18 08:26:21 +08:00
Giovanni
8f2eb45b84
Add bin.demangle.flags to allow users to simplify or not mangled strings (#3659) 2023-07-17 23:31:09 +08:00
wargio
99c5f833c5 Mark as broken the ARM 16 test which fails to disassemble. 2023-07-16 13:22:47 +08:00
wargio
de33b0acc4 Fix v3 build due fall-thru 2023-07-16 13:22:47 +08:00
wargio
3578cbb4fc Improve sparc analysis and fix tests. 2023-07-16 13:22:47 +08:00
billow
e456c60e20 Fix tests for capstone v3/v4/v5
Co-authored-by: wargio <wargio@libero.it>
2023-07-16 13:22:47 +08:00
billow
d20fe00bc8 Fixes capstone update 2023-07-16 13:22:47 +08:00
billow
6e57bf6261 Adding new cs-based tricore analysis and asm plugin 2023-07-16 13:22:47 +08:00
billow
b1ab2adf6e Removing GNU tricore analysis and asm plugin 2023-07-16 13:22:47 +08:00
yossizap
0cf4cd75b3 Update capstone instruction ids 2023-07-16 13:22:47 +08:00
yossizap
d235371abc Update capstone versions in the docs 2023-07-16 13:22:47 +08:00
yossizap
4aadd18f7e Set the default capstone version to v5 instead of v4
Co-authored-by: wargio <wargio@libero.it>
2023-07-16 13:22:47 +08:00
Anton Kochkov
f29171ceb1
Remove rzk and gprobe IO plugins (#3654) 2023-07-12 00:21:43 +08:00
Anton Kochkov
8e41d975bf
Easier API for creating global variable (#3655) 2023-07-11 20:53:34 +08:00
Anton Kochkov
3599ba226f
Fix capstone v3 support (#3651) 2023-07-10 13:13:54 +08:00
Heersin
803aa3951e
ARMv7 NEON and VFP for rzil (#3528)
* Export float basic op to op_builder header

* Basic vmov with note and question

* Add vmov for immediate

* Add vmov for NEON and VFP

* Add vmsr, vmrs. shared instruction of vfp and neon done

* Add vector logical operations for arm32 il

* Add vmvn for arm32 il

* Solve op builder for rzil float

* Add vector compare instructions (vceq/vcge/vcle/vcgt/vclt, and abs version)

* Rename vcmp to vec_cmp to avoid conflict with VCMP instruction

* Add vtst of NEON instruction set

* Fix FEQ

* Discard unecessary changes

* Add vldn for multiple n-elements

* Add vldn for single-lane and all-lane

* Add vstn

* Add vcvt for float-integer and float-float

* Check codeql warning

* Add vdup

* Fix according to reviewer

* Add vext

* Add vzip

* Fix reg_bits shadowing

* Add vuzp

* Init some eff as EMPTY for loop-seq

* Add vswap

* Add vadd and vsub

* Add vmul for float point in vfp

* Fix test_validate_forder

* Fix reg binding by add missing reg(fpscr)

* Fix memory broken caused by misuse of REG_VAL and others

* Add vldr and vstr

* Fix some bug in rzil float

* Fix a format typo bug in rzfloat

* Add rzil emulateme test for vfp

* Fix fpscr in db arm32 related tests

* Add extra argument info in vfp test

* Remove duplicated macro of float
2023-07-09 00:43:18 +08:00
Rot127
83e40b0c0c
Fix ESIL issues: Shift by register, double word store (#3645)
* Test for shifting via registers.
* Fix ESIL strd
2023-07-08 01:29:28 +08:00
Riccardo Schirone
40a01ef36f
Show even sections with 0 size/vsize (#3640) 2023-07-07 11:45:39 +08:00
Anton Kochkov
9c1b88903e
Remove typelink remnants (#3638) 2023-07-04 19:57:49 +08:00
Riccardo Schirone
194eabae1c
Fix /wi by removing wrong fallthrough (#3636)
/wi was falling through the switch case and it was not accepting the
input correctly. Fix this by breaking at the end of the '/w' case so
that the search can begin.
2023-07-04 17:09:28 +08:00
Anton Kochkov
1f30b7f761
Remove typelink remnants (#3635) 2023-07-04 10:54:32 +08:00
Giovanni
8efdb3d3a3
Refactoring debug plugin and cleanup output (#3634) 2023-07-04 10:42:41 +08:00
Anton Kochkov
8c1ce710e1
Remove type links and use global vars (#3618) 2023-07-03 02:02:12 +08:00
Giovanni
366dfcfbf0
Limit aap scan like we do for strings. (#3620) 2023-07-02 01:14:12 +08:00
Florian Märkl
54640cb01c Fix rz_buf_read_at() after negative addr
rz_buf_read_at() with a negative addr on a ref (slice) buffer broke all
subsequent calls to rz_buf_read_at(). This is fixed by making sure to
always reset to the initial seek.
This bug was detected through xnu kernelcaches, where we may also skip
any obviously invalid read.
2023-07-01 22:28:28 +08:00
Florian Märkl
1d39c16840 Support IDREF in plist parser
IDREF in plists is an undocumented extension of plist used e.g. in
kernelcaches. This makes it possible to parse certain kext plists.

Backported, original patch b04bc4164cb2875723f3aae870647287e9a331cc

Co-authored-by: Siguza <siguza@siguza.net>
2023-07-01 22:28:28 +08:00
Florian Märkl
6b2d6fed9a Fix naming convention in plist parser 2023-07-01 22:28:28 +08:00
Florian Märkl
8dc8fdd71f Fix some oob reads in xnu kernelcache
A __DATA_CONST.__const section of e.g. size 1 could make these loops
read beyond the end of the allocated buffer.
2023-06-30 18:04:31 +02:00
Florian Märkl
bc9daaabbd Re-add ios syscall files
Initially removed in 4fd9cd7cc1, but may
still be used when loading xnu kernelcaches.
2023-06-30 18:04:31 +02:00