rizin/test/db/analysis/arm64
NOT XVilka f91ef729bf
Improve ARM/AArch64 DATA xrefs analysis (#6506)
Co-authored-by: Anton Kochkov <anton.kochkov@gmail.com>
2026-06-14 21:10:30 +08:00

385 lines
7.3 KiB
Text

NAME=rcall
FILE==
CMDS=<<EOF
e asm.arch=arm
e asm.bits=64
e cfg.bigendian=false
wx e18f1394 # BL XXX
sd +4
wx 00013fd6 # BLR x8
ao~type[1]
ao@ 0~type[1]
/at call
echo --
/at ucall
echo --
/at rcall
EOF
EXPECT=<<EOF
rcall
type:
call
type:
0x00000000 4 bl 0x4e3f84
--
--
0x00000004 4 blr x8
EOF
RUN
NAME=syscall
FILE==
CMDS=<<EOF
e asm.arch=arm
e asm.bits=64
e cfg.bigendian=false
e asm.os=linux
asn fstat
asr 80
EOF
EXPECT=<<EOF
80
fstat
EOF
RUN
NAME=noreturn errno
FILE=bins/mach0/BatteryLife.arm_64.1
CMDS=<<EOF
e emu.str=1
s 0x100011130
pd 2~addChild
EOF
EXPECT=
RUN
NAME=adrp string
FILE=bins/mach0/SwiftUITest
CMDS=<<EOF
e emu.str=1
s. 886c
pds 10
EOF
EXPECT=<<EOF
0x100008870 str.Hello_World
EOF
RUN
NAME=symbol with invalid offset
FILE=bins/elf/libarm64.so
CMDS=<<EOF
ii
iE
EOF
EXPECT=<<EOF
nth vaddr bind type lib name
--------------------------------------------------
3 0x00020060 GLOBAL NOTYPE _bss_end__
4 0x000006b0 GLOBAL FUNC realloc
5 0x000006c0 GLOBAL FUNC __cxa_finalize
7 0x000006d0 GLOBAL FUNC __stack_chk_fail
8 0x00020058 GLOBAL NOTYPE __bss_start
9 0x00020060 GLOBAL NOTYPE __end__
10 0x00020058 GLOBAL NOTYPE __bss_start__
11 0x00020058 GLOBAL NOTYPE _edata
12 0x000006e0 GLOBAL FUNC malloc
13 0x000006f0 GLOBAL FUNC memcpy
14 0x00020060 GLOBAL NOTYPE __bss_end__
15 0x00000700 GLOBAL FUNC memset
16 0x00020060 GLOBAL NOTYPE _end
17 0x00000710 GLOBAL FUNC free
18 0x00000720 GLOBAL FUNC __cxa_atexit
nth paddr vaddr bind type size lib name
---------------------------------------------------------------
6 0x0000aa20 0x0000aa20 GLOBAL FUNC 1176 Java_o__003dc_e
EOF
RUN
NAME=ao mte irg addg
FILE=bins/mach0/hello-mte
CMDS=<<EOF
ao@ 0x100007f10
echo --
ao@ 0x100007f14
EOF
EXPECT=<<EOF
address: 0x100007f10
opcode: irg x8, sp, x8
disasm: irg x8, sp, x8
pseudo: asm("irg x8, sp, x8")
mnemonic: irg
mask: ffffffff
prefix: 0
id: 508
bytes: e813c89a
refptr: 0
size: 4
sign: false
type: mov
cycles: 0
opex:
operands:
- type: "reg"
value: "x8"
- type: "reg"
value: "sp"
- type: "reg"
value: "x8"
family: sec
--
address: 0x100007f14
opcode: addg x9, x8, 0x20, 0
disasm: addg x9, x8, 0x20, 0
pseudo: asm("addg x9, x8, 0x20, 0")
mnemonic: addg
mask: ffffffff
prefix: 0
id: 6
bytes: 09018291
refptr: 0
size: 4
sign: false
type: add
cycles: 0
opex:
operands:
- type: "reg"
value: "x9"
- type: "reg"
value: "x8"
- type: "imm"
value: 32
- type: "imm"
value: 0
family: sec
EOF
RUN
NAME=ao mte big endian
FILE==
ARGS=-a arm -b 64 -E big
CMDS=<<EOF
wx 91a0090c918201099ac813e8
ao@ 0
echo ---
ao@ 4
echo ---
ao@ 8
EOF
EXPECT=<<EOF
address: 0x0
opcode: addg x12, x8, 0x200, 2
disasm: addg x12, x8, 0x200, 2
pseudo: asm("addg x12, x8, 0x200, 2")
mnemonic: addg
mask: ffffffff
prefix: 0
id: 6
bytes: 91a0090c
refptr: 0
size: 4
sign: false
type: add
cycles: 0
opex:
operands:
- type: "reg"
value: "x12"
- type: "reg"
value: "x8"
- type: "imm"
value: 512
- type: "imm"
value: 2
family: sec
---
address: 0x4
opcode: addg x9, x8, 0x20, 0
disasm: addg x9, x8, 0x20, 0
pseudo: asm("addg x9, x8, 0x20, 0")
mnemonic: addg
mask: ffffffff
prefix: 0
id: 6
bytes: 91820109
refptr: 0
size: 4
sign: false
type: add
cycles: 0
opex:
operands:
- type: "reg"
value: "x9"
- type: "reg"
value: "x8"
- type: "imm"
value: 32
- type: "imm"
value: 0
family: sec
---
address: 0x8
opcode: irg x8, sp, x8
disasm: irg x8, sp, x8
pseudo: asm("irg x8, sp, x8")
mnemonic: irg
mask: ffffffff
prefix: 0
id: 508
bytes: 9ac813e8
refptr: 0
size: 4
sign: false
type: mov
cycles: 0
opex:
operands:
- type: "reg"
value: "x8"
- type: "reg"
value: "sp"
- type: "reg"
value: "x8"
family: sec
EOF
RUN
NAME=Variable analysis with stp/preindexed str
FILE=malloc://1024
ARGS=-a arm -b 64
CMDS=<<EOF
e cfg.bigendian=false
wx 00000000000000000000000000000000f30f1ef8fd7b01a9fd430091fd7b41a9e00313aaf30742f8c0035fd6
aap
s 0x10
aaef
afvx
e asm.comments=0
e asm.bytes=0
e asm.stackptr=1
pdf
EOF
EXPECT=<<EOF
afvR
var_10h 0x18,0x1c
var_20h
var_8h 0x1c
afvW
var_10h 0x14
var_20h 0x10
var_8h 0x14
/ fcn.00000010();
| ; var int64_t var_20h @ stack - 0x20
| ; var int64_t var_10h @ stack - 0x10
| ; var int64_t var_8h @ stack - 0x8
| 0x00000010 0 -= 32 str x19, [var_20h]!
| 0x00000014 -32 stp fp, lr, [var_10h]
| 0x00000018 -32 add fp, sp, 0x10
| 0x0000001c -32 ldp fp, lr, [var_10h]
| 0x00000020 -32 mov x0, x19
| 0x00000024 -32 += 32 ldr x19, [sp], 0x20
\ 0x00000028 0 ret
EOF
RUN
NAME=pacibsp considered a valid function preamble
FILE=malloc://1024
ARGS=-a arm -b 64
CMDS=<<EOF
e cfg.bigendian=false
wx 7f2303d5fc6fbaa9fa6701a9f85f02a9
af
pd 4
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 pacibsp
| 0x00000004 stp x28, x27, [sp, -0x60]!
| 0x00000008 stp x26, x25, [sp, 0x10]
| 0x0000000c stp x24, x23, [sp, 0x20]
EOF
RUN
NAME=pacibsp identified as function prologue
FILE=malloc://1024
ARGS=-a arm -b 64
CMDS=<<EOF
e cfg.bigendian=false
wx 7f2303d5fc6fbaa9fa6701a9f85f02a9ff0f5fd6
aap
pd 5
EOF
EXPECT=<<EOF
/ fcn.00000000();
| 0x00000000 pacibsp
| 0x00000004 stp x28, x27, [sp, -0x60]!
| 0x00000008 stp x26, x25, [sp, 0x10]
| 0x0000000c stp x24, x23, [sp, 0x20]
\ 0x00000010 retab
EOF
RUN
NAME=tail call
FILE=bins/elf/static-glibc-2.27
CMDS=<<EOF
s 0x00401ae0
af
pdf
EOF
EXPECT=<<EOF
/ fcn.00401ae0(int64_t arg1, int64_t arg2, int64_t arg3);
| ; arg int64_t arg1 @ rdi
| ; arg int64_t arg2 @ rsi
| ; arg int64_t arg3 @ rdx
| 0x00401ae0 mov r9d, edx ; arg3
| 0x00401ae3 xor r8d, r8d
| 0x00401ae6 xor ecx, ecx
| 0x00401ae8 xor edx, edx
\ ,=< 0x00401aea jmp fcn.00402f40
EOF
RUN
NAME=aarch64 cmn/cmp/tst show char comment for printable immediate
FILE=malloc://1024
ARGS=-a arm -b 64
CMDS=<<EOF
e cfg.bigendian=false
wx 3f0401b13f0401f13f1440f2
pd 3
EOF
EXPECT=<<EOF
0x00000000 cmn x1, 0x41 ; 'A'
0x00000004 cmp x1, 0x41 ; 'A'
0x00000008 tst x1, 0x3f ; '?'
EOF
RUN
NAME=data xrefs outside functions marked as data
FILE=bins/elf/libarm64.so
CMDS=<<EOF
aaa
s 0xe080
pd 1
s 0xe09c
pd 1
e asm.xrefs=false
e asm.comments=false
pd 3 @ 0x810
EOF
EXPECT=<<EOF
; DATA XREFS from fcn.00005b80 @ 0x5bb0, 0x5bec
0x0000e080 hex length=15 delta=0
0x0000e080 787b ffff 587b ffff 887b ffff 4c7b ff x{..X{...{..L{.
; DATA XREFS from sym.Java_o__003dc_e @ 0xaa64, 0xaaa8
0x0000e09c hex length=36 delta=0
0x0000e09c 18ca ffff f8c9 ffff 48ca ffff ecc9 ffff ........H.......
0x0000e0ac 64ca ffff 28ca ffff c8ca ffff 0000 0000 d...(...........
0x0000e0bc 0000 0000 ....
0x00000810 ret
0x00000814 ldr x8, [x0]
0x00000818 add x9, x8, 1
EOF
RUN