When resizing files through `r` commands, although the buffers seemed to
be resized while the file was opened, the files were not really
truncated. Thus when re-opening the written file, no actual change was
made.
aalo is renamed to aalor to make room for the new aalos command, which
analyzes the __objc_stubs section and assigns names to all detected
selector stubs there. The stub patterns currently supported are all that
are hardcoded in ld64 version 820.
This analysis is also run automatically in aaa if the binary is detected
to potentially having such stubs.
To cleanly rename functions which have been created previously at
unnamed stub locations, rz_core_analysis_function_rename() has been
enhanced to not leave behind flags called fcn.0x<offset>.
* core: 'wow' command was replaced with 'wb'
* io: on_map_skyline returns false when nothing was done
Before this patch on_map_skyline returned true even when the callback
was not called on any part of the skyline. In other words,
reading/writing to an unmapped memory returned true.
This commit changes the behaviour to return false in those cases.
* analysis/esil: mem_read/mem_write were alway returning true
* use o malloc instead of oC
* librz: deal with seek errors
Passing arch and bits as args instead of commands ensures they take
effect earlier. This fixes these tests on platforms where the default
asm.bits is 32.
Applying a function signature with afs to a function was using a
combination of the existing args and wrong stack addresses to apply the
args to function variables. This generally resulted in incorrect
locations. Instead, we now use the info from the cc.
Variables on the stack are not identified by bp/sp+<offset> anymore, but
by their address from the bottom of the stack frame (RzStackAddr),
independent of how they are accessed.
So now there are only two kinds of variables: stack and register.
This required some major refactoring and other changes:
* RzAnalysisVar.isarg was removed. Whether a variable is an argument is
now specified implicitly by its storage location.
* Varsub of struct fields had to be rewritten so fields can be queried
by arbitrary stack addresses using the recently introduced sp
tracking, as the old approach to fill a list with all fields would not
work anymore.
* analysis.vars.stackname was removed, new behavior is more similar to
this being true before.
* Variables will not be created at stack+0 now, because the return
address is there. Before, vars were only created sometimes in such
cases.
* Variables created from bp offsets in x86 are not deleted anymore if
the function's bp_frame is false (see removed
rz_analysis_function_delete_vars_by_kind(fcn,
RZ_ANALYSIS_VAR_KIND_BPV); calls). This may lead to some
false-positive detected variables. Whether this really is a practical
issue is yet to be seen. At least there are no meaningful tests that
are broken by this.
* Applying variables from dwarf needed some fixes for determining the
correct stack locations of variables in order to write meaningful
tests. The handling is still not entirely correct for all
possibilities of dwarf info, but at least the changed/added test cases
are right and serve as a reference for future changes.
* Projects version 11 is introduced.
* afvb commands have been removed, afvs now handles all stack vars.
The stack pointer was previously already tracked during analysis for
variables and their accesses, but not stored in any sensible form for
further use. RzAnalysisBlock.stackptr and parent_stackptr were used in
some places, but they had no evident meaning.
Now we store the sp at the entry of a basic block and the difference
from that for every instruction inside the block to allow for efficient
querying of the sp value at arbitrary analyzed addresses.
RzAnalysisFunction.stackptr is now deprecated as its previous use was
primarily as a temporary accumulator, which is now handled locally, but
full removal of it would go beyond the scope here.
asm.stackptr visualizes both the absolute sp value and the delta of each
instruction in disassembly.
Changes in librz/analysis/p fix some test cases with the new tracking.
Introduces project version v10 with sp_entry/sp_delta instead of
stackptr/parent_stackptr.
This function only did a needlessly inefficient clone of
RzAnalysisFunction.vars, which can also be iterated directly.
Test differences are from different ordering of variables iterated, but
both are fine as there was no deliberate order before either.
