2f97762b09
* Remove RIZIN command output for the old projects * Fix cmeta.c * Fix ik command * Revert back pc* * fix formatting cmd_descs_generate.py * Fix rz_cons_pal_list_as_css * Fill all info about colors for ec commands. * Fix all tests
1047 lines
24 KiB
Text
1047 lines
24 KiB
Text
NAME=pf QeQ
|
|
FILE==
|
|
CMDS=<<EOF
|
|
b 256
|
|
woe 0 255 0x11
|
|
e cfg.bigendian=false
|
|
pf Q
|
|
e cfg.bigendian=true
|
|
pf QeQ
|
|
pfq QeQ
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = (uint128_t)0xffeeddccbbaa99887766554433221100
|
|
0x00000000 = (uint128_t)0x00112233445566778899aabbccddeeff
|
|
0x00000010 = (uint128_t)0xffeeddccbbaa99887766554433221100
|
|
0x00112233445566778899aabbccddeeff
|
|
0xffeeddccbbaa99887766554433221100
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf.-x
|
|
FILE==
|
|
CMDS=<<EOF
|
|
pfn foo xxd
|
|
pfn~foo
|
|
pf- foo
|
|
pfn~foo
|
|
EOF
|
|
EXPECT=<<EOF
|
|
foo "xxd"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf-*
|
|
FILE==
|
|
CMDS=<<EOF
|
|
pfn foo xxd
|
|
pfn~foo
|
|
pf-*
|
|
pfn~foo
|
|
EOF
|
|
EXPECT=<<EOF
|
|
foo "xxd"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf i foo @x:0x01
|
|
FILE==
|
|
ARGS=-a x86 -b 32
|
|
CMDS=pf i foo @x:0x01
|
|
EXPECT=<<EOF
|
|
foo : 0x00000000 = 1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf [3]ub
|
|
FILE==
|
|
CMDS=pf [3]ub
|
|
EXPECT=<<EOF
|
|
0x00000000 = [ 0, 0, 0 ]
|
|
0x00000003 = 0x00
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Cf main
|
|
FILE==
|
|
CMDS=Cf main;C*
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=Cf 1 n2
|
|
FILE==
|
|
CMDS=Cf 1 n2;C
|
|
EXPECT=<<EOF
|
|
0x00000000 format 1 n2
|
|
EOF
|
|
RUN
|
|
|
|
NAME=seteq
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
pfn foo "xd foo bar"
|
|
pf. foo
|
|
EOF
|
|
EXPECT=<<EOF
|
|
foo : 0x00000000 = 0x00000000
|
|
bar : 0x00000004 = 0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=float
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 00007a45457a0000
|
|
e cfg.bigendian=0
|
|
pf ff
|
|
wx 00007a45457a0000
|
|
e cfg.bigendian=1
|
|
pf ff
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = 4000
|
|
0x00000004 = 4.38620432e-41
|
|
0x00000000 = 4.38620432e-41
|
|
0x00000004 = 4000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=seteq2
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
pfn foo "xd foo bar"
|
|
pf. foo
|
|
EOF
|
|
EXPECT=<<EOF
|
|
foo : 0x00000000 = 0x00000000
|
|
bar : 0x00000004 = 0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=types
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 00007a452a4b9a0200002a
|
|
pf fcbiC foo bar fool beer plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
foo : 0x00000000 = 4000
|
|
bar : 0x00000004 = '*'
|
|
fool : 0x00000005 = 0x4b
|
|
beer : 0x00000006 = 666
|
|
plop : 0x0000000a = 42
|
|
EOF
|
|
RUN
|
|
|
|
NAME=word types
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx efbeadde002a0000adde
|
|
pf qw bigWord beef
|
|
EOF
|
|
EXPECT=<<EOF
|
|
bigWord : 0x00000000 = (qword)0x00002a00deadbeef
|
|
beef : 0x00000008 = 0xdead
|
|
EOF
|
|
RUN
|
|
|
|
NAME=uleb type
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx e58e26
|
|
pf u ulebtest
|
|
wx 00000000e58e258e2525 @ 0x10
|
|
pfn plop [4]u ulebtest
|
|
pf. plop @ 0x14
|
|
pfw plop.ulebtest[2]=42 @ 0x14
|
|
.pfw plop.ulebtest[2]=42 @ 0x14
|
|
pf. plop @ 0x14
|
|
pf.j plop @ 0x14
|
|
EOF
|
|
EXPECT=<<EOF
|
|
ulebtest : 0x00000000 = 624485
|
|
ulebtest : 0x00000014 = [ 608101, 4750, 37, 0 ]
|
|
wx 2a @ 0x00000019
|
|
ulebtest : 0x00000014 = [ 608101, 4750, 42, 0 ]
|
|
[{"name":"ulebtest","type":"u","offset":20,"value":[ "608101", "4750", "42", "0" ]}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Register
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
ar eax=4000
|
|
ar eip=42
|
|
pfn plop "rr (eax)reg1 (eip)reg2"
|
|
pf. plop
|
|
pf.j plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
reg1 : eax : 0x00000fa0
|
|
reg2 : eip : 0x0000002a
|
|
[{"name":"reg1","type":"r","offset":0,"value":4000},{"name":"reg2","type":"r","offset":0,"value":42}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Pointers
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 30
|
|
wx 20 @ 0x04
|
|
wx 40 @ 0x08
|
|
wx 2a @ 0x20
|
|
w TROLL @ 0x30
|
|
wx a00f @ 0x40
|
|
e asm.bits=32 # pointer size
|
|
pfn plop *z*i*w nb name blob
|
|
pf. plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
nb : (*0x30)0x00000000 = "TROLL"
|
|
name : (*0x20)0x00000004 = 42
|
|
blob : (*0x40)0x00000008 = 0x0fa0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Pointer sizes
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx added0dec0de5eba7ada1eab11caefbeadde0bb0
|
|
pf p2p4p8pp2
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = 0xdead
|
|
0x00000002 = 0xdec0ded0
|
|
0x00000006 = (qword)0xca11ab1eda7aba5e
|
|
0x0000000e = 0xdeadbeef
|
|
0x00000012 = 0xb00b
|
|
EOF
|
|
RUN
|
|
|
|
NAME=swap endianess
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx deadbeef00000000adde
|
|
pf eqew bigWord beef
|
|
EOF
|
|
EXPECT=<<EOF
|
|
bigWord : 0x00000000 = (qword)0xdeadbeef00000000
|
|
beef : 0x00000008 = 0xdead
|
|
EOF
|
|
RUN
|
|
|
|
NAME=String pointer
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w TROLL @ 0x30
|
|
wx 30
|
|
wx a00f @ 0x04
|
|
e asm.bits=32
|
|
pf *zi Pouet Plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Pouet : (*0x30)0x00000000 = "TROLL"
|
|
Plop : 0x00000004 = 4000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=timestamp
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 321ED92D90DF5254
|
|
pf tt troll plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
troll : 0x00000000 = Tue May 17 19:42:42 1994
|
|
plop : 0x00000004 = Fri Oct 31 01:02:08 2014
|
|
EOF
|
|
RUN
|
|
|
|
NAME=named obj
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx a00f00004b
|
|
pfn troll "ic lol cat"
|
|
pf. troll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
lol : 0x00000000 = 4000
|
|
cat : 0x00000004 = 'K'
|
|
EOF
|
|
RUN
|
|
|
|
NAME=array obj
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx a00f00004b2a0000004c
|
|
pfn troll "2ic nb plop"
|
|
pf. troll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 [0] {
|
|
nb : 0x00000000 = 4000
|
|
plop : 0x00000004 = 'K'
|
|
}
|
|
0x00000005 [1] {
|
|
nb : 0x00000005 = 42
|
|
plop : 0x00000009 = 'L'
|
|
}
|
|
EOF
|
|
RUN
|
|
|
|
NAME=write test
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 32000000424c41424c41424c41424c41
|
|
pfn troll "izi hu swagg plop"
|
|
.pfw troll.hu 42
|
|
.pfw troll.swagg "B*A AA"
|
|
.pfw troll.plop 4000
|
|
pf. troll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
hu : 0x00000000 = 42
|
|
swagg : 0x00000004 = "B*A AABLABLA"
|
|
plop : 0x00000011 = 4000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=write wide string
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 42004c00410042004c00410042004c00410042004c0041000000a00f0000
|
|
pfn troll "Zi swagg plop"
|
|
pf. troll
|
|
.pfw troll.swagg "BWA AA"
|
|
.pfw troll.plop "42"
|
|
pf. troll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
swagg : 0x00000000 = BLABLABLABLA
|
|
plop : 0x0000001a = 4000
|
|
swagg : 0x00000000 = BWA AA
|
|
plop : 0x0000000e = 42
|
|
EOF
|
|
RUN
|
|
|
|
NAME=fixed size variable
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx a00f0000000000002a412f00007a4500000000402a44adde00000000efbeadde00000000000000000000000040
|
|
pf [2]i[3]b[2]f[3]c[3]w[2]q[6]x
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = [ 4000, 0 ]
|
|
0x00000008 = [ 0x2a, 0x41, 0x2f ]
|
|
0x0000000b = [ 4000, 0 ]
|
|
0x00000013 = [ '@', '*', 'D' ]
|
|
0x00000016 = [ 0xdead, 0x0000, 0x0000 ]
|
|
0x0000001c = (qword)[ 0x00000000deadbeef, 0x0000000000000000 ]
|
|
0x0000002c = [ 0x00000040, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 ]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=fixed size str, widechar, and var
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w TROLL
|
|
wx 12 @ 0x02
|
|
wx a00f @ 0x0a
|
|
ww PLOP @ 0x16
|
|
wx 2a @ 0x2a
|
|
pf [10]z[3]i[10]Zb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = "TR\x12LL"
|
|
0x0000000a = [ 4000, 0, 0 ]
|
|
0x00000016 = PLOP
|
|
0x0000002a = 0x2a
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Enum test
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
td enum troll { BITE=42, PATE=4000};
|
|
wx a00f
|
|
pf E (troll)plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
plop : 0x00000000 = plop (enum troll) = 0xfa0 ; PATE
|
|
EOF
|
|
RUN
|
|
|
|
NAME=32 bit twice then string
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wv 0x10
|
|
wv 0x10 @ 4
|
|
w hello @ 0x10
|
|
pf ss
|
|
pf *x*x
|
|
pf *z*z
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = 0x00000000 -> 0x00000010 "hello"
|
|
0x00000004 = 0x00000004 -> 0x00000010 "hello"
|
|
(*0x10)0x00000000 = 0x6c6c6568
|
|
(*0x10)0x00000004 = 0x6c6c6568
|
|
(*0x10)0x00000000 = "hello"
|
|
(*0x10)0x00000004 = "hello"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=simple union test
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wv 0x2a
|
|
pf 0iw integer word
|
|
EOF
|
|
EXPECT=<<EOF
|
|
integer : 0x00000000 = 42
|
|
word : 0x00000000 = 0x002a
|
|
EOF
|
|
RUN
|
|
|
|
NAME=simple nested struct
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 2a
|
|
wx a00f @ 0x04
|
|
wx 2a @ 0x08
|
|
wx 10 @ 0x0a
|
|
wx efbe @ 0x0e
|
|
wx 20 @ 0x10
|
|
pfn troll "iw integer word"
|
|
pfn plop "i??i firstInt (troll)One (troll)Two secondInt"
|
|
pf. plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
firstInt : 0x00000000 = 42
|
|
One :
|
|
struct<troll>
|
|
integer : 0x00000004 = 4000
|
|
word : 0x00000008 = 0x002a
|
|
Two :
|
|
struct<troll>
|
|
integer : 0x0000000a = 16
|
|
word : 0x0000000e = 0xbeef
|
|
secondInt : 0x00000010 = 32
|
|
EOF
|
|
RUN
|
|
|
|
NAME=nested struct
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 2a000000a00f00001234100000006416
|
|
wx 2a0000002a @ 0x10
|
|
pfn troll "iw*? integer word (troll)Bah"
|
|
pfn plop "i?w firstInt (troll)Boh plop"
|
|
pf. plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
firstInt : 0x00000000 = 42
|
|
Boh :
|
|
struct<troll>
|
|
integer : 0x00000004 = 4000
|
|
word : 0x00000008 = 0x3412
|
|
Bah : (*0x10)
|
|
struct<troll>
|
|
integer : 0x00000010 = 42
|
|
word : 0x00000014 = 0x002a
|
|
Bah : (*0x0) NULL
|
|
plop : 0x0000000e = 0x1664
|
|
EOF
|
|
RUN
|
|
|
|
NAME=nested unions
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 2a000000a00f0000a02000000172
|
|
pfn struct "xx first second"
|
|
pfn union "0i?w integer (struct)swagg word"
|
|
pfn plop "i?w firstInt (union)Boh plop"
|
|
pf. plop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
firstInt : 0x00000000 = 42
|
|
Boh :
|
|
union<union>
|
|
integer : 0x00000004 = 4000
|
|
swagg :
|
|
struct<struct>
|
|
first : 0x00000004 = 0x00000fa0
|
|
second : 0x00000008 = 0x000020a0
|
|
word : 0x00000004 = 0x0fa0
|
|
plop : 0x0000000c = 0x7201
|
|
EOF
|
|
RUN
|
|
|
|
NAME=complex nested struct
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 341289679a020000a00f00002a003000000014426416
|
|
wx 800600000040 @ 0x20
|
|
wx 14000000641620000000 @ 0x30
|
|
pfn troll "iw*? integer word (troll)Bah"
|
|
pfn plop "i?w first (troll)Boh bwa"
|
|
pfn gobelin "ww?x blah meh (plop)Buh foo"
|
|
pf. gobelin
|
|
EOF
|
|
EXPECT=<<EOF
|
|
blah : 0x00000000 = 0x1234
|
|
meh : 0x00000002 = 0x6789
|
|
Buh :
|
|
struct<plop>
|
|
first : 0x00000004 = 666
|
|
Boh :
|
|
struct<troll>
|
|
integer : 0x00000008 = 4000
|
|
word : 0x0000000c = 0x002a
|
|
Bah : (*0x30)
|
|
struct<troll>
|
|
integer : 0x00000030 = 20
|
|
word : 0x00000034 = 0x1664
|
|
Bah : (*0x20)
|
|
struct<troll>
|
|
integer : 0x00000020 = 1664
|
|
word : 0x00000024 = 0x4000
|
|
Bah : (*0x0) NULL
|
|
bwa : 0x00000012 = 0x4214
|
|
foo : 0x00000014 = 0x00001664
|
|
EOF
|
|
RUN
|
|
|
|
NAME=flag for nested struct
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 341289679a020000a00f00002a00300000001442
|
|
wx 800600000040 @ 0x20
|
|
wx 14000000641620000000 @ 0x30
|
|
pfn troll "iw*? integer word (troll)Bah"
|
|
pfn plop "i?w first (troll)Boh bwa"
|
|
pfn gobelin "ww? blah meh (plop)Buh"
|
|
pf. gobelin
|
|
EOF
|
|
EXPECT=<<EOF
|
|
blah : 0x00000000 = 0x1234
|
|
meh : 0x00000002 = 0x6789
|
|
Buh :
|
|
struct<plop>
|
|
first : 0x00000004 = 666
|
|
Boh :
|
|
struct<troll>
|
|
integer : 0x00000008 = 4000
|
|
word : 0x0000000c = 0x002a
|
|
Bah : (*0x30)
|
|
struct<troll>
|
|
integer : 0x00000030 = 20
|
|
word : 0x00000034 = 0x1664
|
|
Bah : (*0x20)
|
|
struct<troll>
|
|
integer : 0x00000020 = 1664
|
|
word : 0x00000024 = 0x4000
|
|
Bah : (*0x0) NULL
|
|
bwa : 0x00000012 = 0x4214
|
|
EOF
|
|
RUN
|
|
|
|
NAME=struct size
|
|
FILE=malloc://256
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
pfn plop "wi word int"
|
|
pfn troll "bciwqfdoxs:S.[4]z[2]B[4]E? byte char int word quad float hexa octal hex strp wstrp str bitfield enum (plop)struct"
|
|
pfs troll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
65
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Print value only
|
|
FILE=bins/pe/ch22.exe
|
|
ARGS=-nn
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
s 0x80
|
|
pfv .pe_nt_image_headers32.optionalHeader.dataDirectory[5].virtualAddress
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000c000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=print signed and unsigned values
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 71776572747975696f706173646667686a6b6c7a786376626e6d71776572747975696f706173646667686a6b6c7a786376626e6d
|
|
pf N8..N4.N2:N1..n8..n4n2n1 a b c d e f
|
|
EOF
|
|
EXPECT=<<EOF
|
|
a : 0x00000000 = 7599113487299999601
|
|
b : 0x0000000a = 1717859169
|
|
c : 0x0000000f = 27240
|
|
d : 0x00000015 = 99
|
|
e : 0x00000018 = 8751745756008901998
|
|
f : 0x00000022 = 1935765615
|
|
0x00000026 = 26212
|
|
0x00000028 = 103
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Combining flags, backtick, and var length array
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
f test 4 @ 0x20
|
|
w SWAG
|
|
wx 04 @ test
|
|
wx 20 @ 0x4
|
|
pfn plop "ip int ptr"
|
|
pf [`pfv p @ test`]c
|
|
pf [*`pfv .plop.ptr`]c
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = [ 'S', 'W', 'A', 'G' ]
|
|
0x00000000 = [ 'S', 'W', 'A', 'G' ]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=print n-times a format
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=64
|
|
wx 71776572747975696f706173646667686a6b6c7a786376626e6d71776572747975696f706173646667686a6b6c7a786376626e6d
|
|
pfn plop "ip int ptr"
|
|
pf {2}? (plop)structname @ 0
|
|
EOF
|
|
EXPECT=<<EOF
|
|
structname :
|
|
struct<plop>
|
|
int : 0x00000000 = 1919252337
|
|
ptr : 0x00000004 = (qword)0x7361706f69757974
|
|
structname :
|
|
struct<plop>
|
|
int : 0x0000000c = 1751606884
|
|
ptr : 0x00000010 = (qword)0x627663787a6c6b6a
|
|
EOF
|
|
RUN
|
|
|
|
NAME=print with byte(s) skip
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=64
|
|
wx 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
|
|
pfn abc "ic...i:pii a b c d e f"
|
|
pf. abc
|
|
EOF
|
|
EXPECT=<<EOF
|
|
a : 0x00000000 = 50462976
|
|
b : 0x00000004 = '.'
|
|
c : 0x00000008 = 185207048
|
|
d : 0x00000010 = (qword)0x1716151413121110
|
|
e : 0x00000018 = 454695192
|
|
f : 0x0000001c = 522067228
|
|
EOF
|
|
RUN
|
|
|
|
NAME=PE test
|
|
FILE=bins/pe/ch22.exe
|
|
ARGS=-nn
|
|
CMDS=<<EOF
|
|
s 0x80
|
|
pf. pe_nt_image_headers32
|
|
EOF
|
|
EXPECT=<<EOF
|
|
signature : 0x00000080 = "PE"
|
|
fileHeader :
|
|
struct<pe_image_file_header>
|
|
machine : 0x00000084 = machine (enum pe_machine) = 0x14c ; IMAGE_FILE_MACHINE_I386
|
|
numberOfSections : 0x00000086 = 0x0004
|
|
timeDateStamp : 0x00000088 = Thu Sep 11 18:21:46 2014
|
|
pointerToSymbolTable : 0x0000008c = 0x00000000
|
|
numberOfSymbols : 0x00000090 = 0x00000000
|
|
sizeOfOptionalHeader : 0x00000094 = 0x00e0
|
|
characteristics : 0x00000096 = characteristics (bitfield) = 0x00000102 : IMAGE_FILE_EXECUTABLE_IMAGE | IMAGE_FILE_32BIT_MACHINE
|
|
optionalHeader :
|
|
struct<pe_image_optional_header32>
|
|
magic : 0x00000098 = magic (enum pe_magic) = 0x10b ; IMAGE_NT_OPTIONAL_HDR32_MAGIC
|
|
majorLinkerVersion : 0x0000009a = 0x0b
|
|
minorLinkerVersion : 0x0000009b = 0x00
|
|
sizeOfCode : 0x0000009c = 0x00003000
|
|
sizeOfInitializedData : 0x000000a0 = 0x00003400
|
|
sizeOfUninitializedData : 0x000000a4 = 0x00000000
|
|
addressOfEntryPoint : 0x000000a8 = 0x00004f3e
|
|
baseOfCode : 0x000000ac = 0x00002000
|
|
baseOfData : 0x000000b0 = 0x00006000
|
|
imageBase : 0x000000b4 = 0x00400000
|
|
sectionAlignment : 0x000000b8 = 0x00002000
|
|
fileAlignment : 0x000000bc = 0x00000200
|
|
majorOperatingSystemVersion : 0x000000c0 = 0x0004
|
|
minorOperatingSystemVersion : 0x000000c2 = 0x0000
|
|
majorImageVersion : 0x000000c4 = 0x0000
|
|
minorImageVersion : 0x000000c6 = 0x0000
|
|
majorSubsystemVersion : 0x000000c8 = 0x0006
|
|
minorSubsystemVersion : 0x000000ca = 0x0000
|
|
win32VersionValue : 0x000000cc = 0x00000000
|
|
sizeOfImage : 0x000000d0 = 0x0000e000
|
|
sizeOfHeaders : 0x000000d4 = 0x00000400
|
|
checkSum : 0x000000d8 = 0x00000000
|
|
subsystem : 0x000000dc = subsystem (enum pe_subsystem) = 0x2 ; IMAGE_SUBSYSTEM_WINDOWS_GUI
|
|
dllCharacteristics : 0x000000de = dllCharacteristics (bitfield) = 0x00008560 : IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA | IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE | IMAGE_DLLCHARACTERISTICS_NX_COMPAT | IMAGE_DLLCHARACTERISTICS_NO_SEH | IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
|
sizeOfStackReserve : 0x000000e0 = 0x00100000
|
|
sizeOfStackCommit : 0x000000e4 = 0x00001000
|
|
sizeOfHeapReserve : 0x000000e8 = 0x00100000
|
|
sizeOfHeapCommit : 0x000000ec = 0x00001000
|
|
loaderFlags : 0x000000f0 = 0x00000000
|
|
numberOfRvaAndSizes : 0x000000f4 = 0x00000010
|
|
dataDirectory :
|
|
[
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x000000f8 = 0x00000000
|
|
size : 0x000000fc = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000100 = 0x00004ef0
|
|
size : 0x00000104 = 0x0000004b
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000108 = 0x00008000
|
|
size : 0x0000010c = 0x00002e40
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000110 = 0x00000000
|
|
size : 0x00000114 = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000118 = 0x00000000
|
|
size : 0x0000011c = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000120 = 0x0000c000
|
|
size : 0x00000124 = 0x0000000c
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000128 = 0x00006000
|
|
size : 0x0000012c = 0x0000001c
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000130 = 0x00000000
|
|
size : 0x00000134 = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000138 = 0x00000000
|
|
size : 0x0000013c = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000140 = 0x00000000
|
|
size : 0x00000144 = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000148 = 0x00000000
|
|
size : 0x0000014c = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000150 = 0x00000000
|
|
size : 0x00000154 = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000158 = 0x00002000
|
|
size : 0x0000015c = 0x00000008
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000160 = 0x00000000
|
|
size : 0x00000164 = 0x00000000
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000168 = 0x00002008
|
|
size : 0x0000016c = 0x00000048
|
|
|
|
struct<pe_image_data_directory>
|
|
virtualAddress : 0x00000170 = 0x00000000
|
|
size : 0x00000174 = 0x00000000
|
|
]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Variable length array
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
wx 2a @ 0x20
|
|
pf [*0x20]c
|
|
pf [(42-21-11)/2]c
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = [ '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '.', '*', '.', '.', '.', '.', '.', '.', '.', '.', '.' ]
|
|
0x00000000 = [ '.', '.', '.', '.', '.' ]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Infinite Recursion segfault 1
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
pfn _NT_TIB "? (_NT_TIB)Self"
|
|
pf. _NT_TIB > /dev/null
|
|
pfn~NT_TIB
|
|
EOF
|
|
EXPECT=<<EOF
|
|
_NT_TIB "? (_NT_TIB)Self"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Infinite Recursion segfault 2
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
pfn _NT_TIB "pppppip? ExceptionList StackBase StackLimit SubSystemTib FiberData Version ArbitraryUserPointer (_NT_TIB)Self"
|
|
pf. _NT_TIB > /dev/null
|
|
pfn~NT_TIB
|
|
EOF
|
|
EXPECT=<<EOF
|
|
_NT_TIB "pppppip? ExceptionList StackBase StackLimit SubSystemTib FiberData Version ArbitraryUserPointer (_NT_TIB)Self"
|
|
EOF
|
|
RUN
|
|
|
|
NAME=One byte enum endianness
|
|
BROKEN=1
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e cfg.bigendian=true
|
|
wb 4142434431323334
|
|
td "enum ascii{ LETTER_A=0x41, LETTER_D=0x44, DIGIT_1=0x31, DIGIT_4=0x34}"
|
|
pfn somestring "[1]E[1]E[1]E[1]E[1]E[1]E[1]E[1]E (ascii)B1 (ascii)B2 (ascii)B3 (ascii)B4 (ascii)B5 (ascii)B6 (ascii)B7 (ascii)B8"
|
|
pf. somestring
|
|
EOF
|
|
EXPECT=<<EOF
|
|
B1 : 0x00000000 = B1 (enum ascii) = 0x41 ; LETTER_A
|
|
B2 : 0x00000001 = B2 (enum ascii) = 0x42
|
|
B3 : 0x00000002 = B3 (enum ascii) = 0x43
|
|
B4 : 0x00000003 = B4 (enum ascii) = 0x44 ; LETTER_D
|
|
B5 : 0x00000004 = B5 (enum ascii) = 0x31 ; DIGIT_1
|
|
B6 : 0x00000005 = B6 (enum ascii) = 0x32
|
|
B7 : 0x00000006 = B7 (enum ascii) = 0x33
|
|
B8 : 0x00000007 = B8 (enum ascii) = 0x34 ; DIGIT_4
|
|
EOF
|
|
RUN
|
|
|
|
NAME=union pf
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wv4 1234
|
|
pf "i;i"
|
|
pf "i,,,,i"
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = 1234
|
|
0x00000000 = 1234
|
|
0x00000000 = 1234
|
|
0x00000000 = 1234
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=pf 2F
|
|
EXPECT=<<EOF
|
|
0x080483d0 [0] {
|
|
0x080483d0 = -6.522912219822113e+235
|
|
}
|
|
0x080483d8 [1] {
|
|
0x080483d8 = 4.856118757882428e-270
|
|
}
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pf z, scr.strconv and str.escbslash
|
|
FILE==
|
|
CMDS=<<EOF
|
|
wz \x7fabc\\123\n
|
|
(print strconv escbslash; e scr.strconv=${strconv}; e str.escbslash=${escbslash}; pf z)
|
|
.(print asciiesc false)
|
|
.(print asciiesc true)
|
|
.(print asciidot false)
|
|
.(print asciidot true)
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 = "\x7fabc\123\n"
|
|
0x00000000 = "\x7fabc\\123\n"
|
|
0x00000000 = ".abc\123."
|
|
0x00000000 = ".abc\\123."
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pfj and triply-nested struct
|
|
FILE==
|
|
CMDS=<<EOF
|
|
wv2 0x1234
|
|
wv4 0x56789abc @ 0x2
|
|
wv8 0xdef0123456789abc @ 0x6
|
|
pfn third "w t1"
|
|
pfn second "?x (third)t s1"
|
|
pfn first "?q (second)s f1"
|
|
pf. first
|
|
echo
|
|
pf.j first~{}
|
|
EOF
|
|
EXPECT=<<EOF
|
|
s :
|
|
struct<second>
|
|
t :
|
|
struct<third>
|
|
t1 : 0x00000000 = 0x1234
|
|
s1 : 0x00000002 = 0x56789abc
|
|
f1 : 0x00000006 = (qword)0xdef0123456789abc
|
|
|
|
[
|
|
{
|
|
"name": "s",
|
|
"type": "second",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "t",
|
|
"type": "third",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "t1",
|
|
"type": "w",
|
|
"offset": 0,
|
|
"value": 4660
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "s1",
|
|
"type": "x",
|
|
"offset": 2,
|
|
"value": 1450744508
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "f1",
|
|
"type": "q",
|
|
"offset": 6,
|
|
"value": -2382384186880648516
|
|
}
|
|
]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pfj and Matryoshka dolls
|
|
FILE==
|
|
CMDS=<<EOF
|
|
wx 7f
|
|
wv8 0xdef0123456789abc @ 0x1
|
|
pfn fourth "b fo1"
|
|
pfn third "? (fourth)fo"
|
|
pfn second "? (third)t"
|
|
pfn start "?q (second)s f1"
|
|
pf. start
|
|
echo
|
|
pf.j start~{}
|
|
echo
|
|
pfn full "? (second)s"
|
|
pf. full
|
|
echo
|
|
pf.j full~{}
|
|
EOF
|
|
EXPECT=<<EOF
|
|
s :
|
|
struct<second>
|
|
t :
|
|
struct<third>
|
|
fo :
|
|
struct<fourth>
|
|
fo1 : 0x00000000 = 0x7f
|
|
f1 : 0x00000001 = (qword)0xdef0123456789abc
|
|
|
|
[
|
|
{
|
|
"name": "s",
|
|
"type": "second",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "t",
|
|
"type": "third",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "fo",
|
|
"type": "fourth",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "fo1",
|
|
"type": "b",
|
|
"offset": 0,
|
|
"value": 127
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "f1",
|
|
"type": "q",
|
|
"offset": 1,
|
|
"value": -2382384186880648516
|
|
}
|
|
]
|
|
|
|
s :
|
|
struct<second>
|
|
t :
|
|
struct<third>
|
|
fo :
|
|
struct<fourth>
|
|
fo1 : 0x00000000 = 0x7f
|
|
|
|
[
|
|
{
|
|
"name": "s",
|
|
"type": "second",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "t",
|
|
"type": "third",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "fo",
|
|
"type": "fourth",
|
|
"offset": 0,
|
|
"value": [
|
|
{
|
|
"name": "fo1",
|
|
"type": "b",
|
|
"offset": 0,
|
|
"value": 127
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
EOF
|
|
RUN
|