rizin/test/db/cmd/midbb
Florian Märkl d9950f7479
Replace bp/sp-vars by generic stack-based ones (#3167)
Variables on the stack are not identified by bp/sp+<offset> anymore, but
by their address from the bottom of the stack frame (RzStackAddr),
independent of how they are accessed.
So now there are only two kinds of variables: stack and register.

This required some major refactoring and other changes:
* RzAnalysisVar.isarg was removed. Whether a variable is an argument is
  now specified implicitly by its storage location.
* Varsub of struct fields had to be rewritten so fields can be queried
  by arbitrary stack addresses using the recently introduced sp
  tracking, as the old approach to fill a list with all fields would not
  work anymore.
* analysis.vars.stackname was removed, new behavior is more similar to
  this being true before.
* Variables will not be created at stack+0 now, because the return
  address is there. Before, vars were only created sometimes in such
  cases.
* Variables created from bp offsets in x86 are not deleted anymore if
  the function's bp_frame is false (see removed
  rz_analysis_function_delete_vars_by_kind(fcn,
  RZ_ANALYSIS_VAR_KIND_BPV); calls). This may lead to some
  false-positive detected variables. Whether this really is a practical
  issue is yet to be seen. At least there are no meaningful tests that
  are broken by this.
* Applying variables from dwarf needed some fixes for determining the
  correct stack locations of variables in order to write meaningful
  tests. The handling is still not entirely correct for all
  possibilities of dwarf info, but at least the changed/added test cases
  are right and serve as a reference for future changes.
* Projects version 11 is introduced.
* afvb commands have been removed, afvs now handles all stack vars.
2023-01-02 11:36:21 +08:00

645 lines
14 KiB
Text
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

NAME=asm.bb.middle disasm
FILE=bins/pe/cmd_adf_sample0.exe
CMDS=<<EOF
e asm.bytes=false
e asm.comments=false
e asm.var=false
s 0x560e67
af
e asm.bb.middle=true
pD 0x560eb3-$$
?e
e asm.bb.middle=false
pD 0x560eb3-$$
EOF
EXPECT=<<EOF
/ fcn.00560e67 (int32_t arg_4h, int32_t arg_7fbf5070h);
| 0x00560e67 push esi
| ,=< 0x00560e68 jmp 0x560e7d
| 0x00560e6d push ecx
| 0x00560e6e in eax, 0xd6
| 0x00560e70 sbb eax, 0x5ceea31
| 0x00560e75 push es
| 0x00560e76 cmp edx, esp
| 0x00560e78 aam 0x1b
| 0x00560e7a ~ add byte [ebp + 0x52505e96], al
| `-> 0x00560e7d pop esi
| 0x00560e7e push eax
| 0x00560e7f push edx
| ,=< 0x00560e80 jmp 0x560e96
| 0x00560e85 mov ebx, 0x4fd160dd
| 0x00560e8a in al, dx
| 0x00560e8b mov esp, 0x60bdf441
| 0x00560e90 lodsd eax, dword [esi]
,==< 0x00560e91 ja 0x560ed9
|| 0x00560e93 aaa
|| 0x00560e94 sahf
|| 0x00560e95 ~ mov edx, 0x14e9310f
| |`-> 0x00560e96 rdtsc
| | 0x00560e98 jmp 0x560eb1
| 0x00560e9d test al, 0x36
| 0x00560e9f fcom qword [edx + 0x64]
| 0x00560ea2 xlatb
| 0x00560ea3 push 0x27
| 0x00560ea5 sub esp, edx
| 0x00560ea7 mov eax, dword [0xe8c1cf5d]
|,=< 0x00560eac jle 0x560f29
|| 0x00560eae inc ecx
|| 0x00560eaf ~ mov byte [eax + 0x5a], dl
| || 0x00560eb1 pop edx
| || 0x00560eb2 pop eax
/ fcn.00560e67 (int32_t arg_4h, int32_t arg_7fbf5070h);
| 0x00560e67 push esi
| ,=< 0x00560e68 jmp 0x560e7d
| 0x00560e6d push ecx
| 0x00560e6e in eax, 0xd6
| 0x00560e70 sbb eax, 0x5ceea31
| 0x00560e75 push es
| 0x00560e76 cmp edx, esp
| 0x00560e78 aam 0x1b
| 0x00560e7a add byte [ebp + 0x52505e96], al
| ,=< 0x00560e80 jmp 0x560e96
| 0x00560e85 mov ebx, 0x4fd160dd
| 0x00560e8a in al, dx
| 0x00560e8b mov esp, 0x60bdf441
| 0x00560e90 lodsd eax, dword [esi]
,==< 0x00560e91 ja 0x560ed9
|| 0x00560e93 aaa
|| 0x00560e94 sahf
|| 0x00560e95 mov edx, 0x14e9310f
| | 0x00560e9a add byte [eax], al
| | 0x00560e9c add byte [eax + 0x6452dc36], ch
| 0x00560ea2 xlatb
| 0x00560ea3 push 0x27
| 0x00560ea5 sub esp, edx
| 0x00560ea7 mov eax, dword [0xe8c1cf5d]
|,=< 0x00560eac jle 0x560f29
|| 0x00560eae inc ecx
|| 0x00560eaf mov byte [eax + 0x5a], dl
| || 0x00560eb2 pop eax
EOF
RUN
NAME=asm.bb.middle json
FILE==
CMDS=<<EOF
e asm.arch=x86
e asm.bits=64
e analysis.nopskip=false
e analysis.jmp.mid=true
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
af
?e
?e ----1----
?e
e asm.bb.middle=true
pDj 19~{}
?e
?e ----2----
?e
e asm.bb.middle=false
pDj 19~{}
?e
?e ----3----
?e
e asm.bb.middle=true
pdfj~{}
EOF
EXPECT=<<EOF
----1----
[
{
"offset": 0,
"esil": ",",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 16,
"size": 5,
"opcode": "nop dword [rax + rax]",
"disasm": "nop dword [rax + rax]",
"bytes": "0f1f440000",
"family": "cpu",
"type": "nop",
"reloc": false,
"type_num": 8,
"type2_num": 0,
"flags": [
"fcn.00000000"
]
},
{
"offset": 3,
"esil": "al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=",
"refptr": true,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "add byte [rax], al",
"disasm": "add byte [rax], al",
"bytes": "0000",
"family": "cpu",
"type": "add",
"reloc": false,
"type_num": 17,
"type2_num": 0,
"xrefs_to": [
{
"addr": 17,
"type": "CODE"
}
]
},
{
"offset": 5,
"ptr": 3238002721,
"val": 3238002721,
"esil": "3238002721,rax,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 15,
"size": 5,
"opcode": "mov eax, 0xc1000021",
"disasm": "mov eax, 0xc1000021",
"bytes": "b8210000c1",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0
},
{
"offset": 9,
"val": 253,
"esil": "0,cf,:=,1,253,-,1,<<,ebx,&,?{,1,cf,:=,},253,ebx,>>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 16,
"size": 3,
"opcode": "shr ebx, 0xfd",
"disasm": "shr ebx, 0xfd",
"bytes": "c1ebfd",
"family": "cpu",
"type": "shr",
"reloc": false,
"type_num": 22,
"type2_num": 0,
"xrefs_to": [
{
"addr": 10,
"type": "CODE"
}
]
},
{
"offset": 12,
"ptr": 44,
"val": 44,
"esil": "44,rbx,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "mov ebx, 0x2c",
"disasm": "mov ebx, 0x2c",
"bytes": "bb2c000000",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0,
"xrefs_from": [
{
"addr": 44,
"type": "DATA"
}
]
},
{
"offset": 17,
"esil": "0x3,rip,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "jmp 3",
"disasm": "jmp 3",
"bytes": "ebf0",
"family": "cpu",
"type": "jmp",
"reloc": false,
"type_num": 1,
"type2_num": 0,
"jump": 3,
"xrefs_from": [
{
"addr": 3,
"type": "CODE"
}
]
}
]
----2----
[
{
"offset": 0,
"esil": ",",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "nop dword [rax + rax]",
"disasm": "nop dword [rax + rax]",
"bytes": "0f1f440000",
"family": "cpu",
"type": "nop",
"reloc": false,
"type_num": 8,
"type2_num": 0,
"flags": [
"fcn.00000000"
]
},
{
"offset": 5,
"ptr": 3238002721,
"val": 3238002721,
"esil": "3238002721,rax,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "mov eax, 0xc1000021",
"disasm": "mov eax, 0xc1000021",
"bytes": "b8210000c1",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0
},
{
"offset": 10,
"esil": "0x9,rip,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "jmp 9",
"disasm": "jmp 9",
"bytes": "ebfd",
"family": "cpu",
"type": "jmp",
"reloc": false,
"type_num": 1,
"type2_num": 0,
"jump": 9,
"xrefs_from": [
{
"addr": 9,
"type": "CODE"
}
]
},
{
"offset": 12,
"ptr": 44,
"val": 44,
"esil": "44,rbx,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "mov ebx, 0x2c",
"disasm": "mov ebx, 0x2c",
"bytes": "bb2c000000",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0,
"xrefs_from": [
{
"addr": 44,
"type": "DATA"
}
]
},
{
"offset": 17,
"esil": "0x3,rip,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "jmp 3",
"disasm": "jmp 3",
"bytes": "ebf0",
"family": "cpu",
"type": "jmp",
"reloc": false,
"type_num": 1,
"type2_num": 0,
"jump": 3,
"xrefs_from": [
{
"addr": 3,
"type": "CODE"
}
]
}
]
----3----
{
"name": "fcn.00000000",
"size": 24,
"addr": 0,
"ops": [
{
"offset": 0,
"esil": ",",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "nop dword [rax + rax]",
"disasm": "nop dword [rax + rax]",
"bytes": "0f1f440000",
"family": "cpu",
"type": "nop",
"reloc": false,
"type_num": 8,
"type2_num": 0,
"flags": [
"fcn.00000000"
]
},
{
"offset": 3,
"esil": "al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=",
"refptr": true,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "add byte [rax], al",
"disasm": "add byte [rax], al",
"bytes": "0000",
"family": "cpu",
"type": "add",
"reloc": false,
"type_num": 17,
"type2_num": 0,
"xrefs_to": [
{
"addr": 17,
"type": "CODE"
}
]
},
{
"offset": 5,
"ptr": 3238002721,
"val": 3238002721,
"esil": "3238002721,rax,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "mov eax, 0xc1000021",
"disasm": "mov eax, 0xc1000021",
"bytes": "b8210000c1",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0
},
{
"offset": 10,
"esil": "0x9,rip,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "jmp 9",
"disasm": "jmp 9",
"bytes": "ebfd",
"family": "cpu",
"type": "jmp",
"reloc": false,
"type_num": 1,
"type2_num": 0,
"jump": 9,
"xrefs_from": [
{
"addr": 9,
"type": "CODE"
}
]
},
{
"offset": 9,
"val": 253,
"esil": "0,cf,:=,1,253,-,1,<<,ebx,&,?{,1,cf,:=,},253,ebx,>>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 16,
"size": 3,
"opcode": "shr ebx, 0xfd",
"disasm": "shr ebx, 0xfd",
"bytes": "c1ebfd",
"family": "cpu",
"type": "shr",
"reloc": false,
"type_num": 22,
"type2_num": 0,
"xrefs_to": [
{
"addr": 10,
"type": "CODE"
}
]
},
{
"offset": 12,
"ptr": 44,
"val": 44,
"esil": "44,rbx,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 14,
"size": 5,
"opcode": "mov ebx, 0x2c",
"disasm": "mov ebx, 0x2c",
"bytes": "bb2c000000",
"family": "cpu",
"type": "mov",
"reloc": false,
"type_num": 9,
"type2_num": 0,
"xrefs_from": [
{
"addr": 44,
"type": "DATA"
}
]
},
{
"offset": 17,
"esil": "0x3,rip,=",
"refptr": false,
"fcn_addr": 0,
"fcn_last": 17,
"size": 2,
"opcode": "jmp 3",
"disasm": "jmp 3",
"bytes": "ebf0",
"family": "cpu",
"type": "jmp",
"reloc": false,
"type_num": 1,
"type2_num": 0,
"jump": 3,
"xrefs_from": [
{
"addr": 3,
"type": "CODE"
}
]
}
]
}
EOF
RUN
NAME=asm.bb.middle and pdq
FILE==
CMDS=<<EOF
e asm.bytes=true
e asm.arch=x86
e asm.bits=64
e analysis.nopskip=false
e analysis.jmp.mid=true
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
af
e asm.bb.middle=true
pdq 6
?e
e asm.bb.middle=false
pdq 6
EOF
EXPECT=<<EOF
0x00000000 fcn.00000000:
0x00000000 0f1f440000 nop dword [rax + rax]
0x00000003 0000 add byte [rax], al
0x00000005 b8210000c1 mov eax, 0xc1000021
0x00000009 c1ebfd shr ebx, 0xfd
0x0000000c bb2c000000 mov ebx, 0x2c
0x00000011 ebf0 jmp 3
0x00000000 fcn.00000000:
0x00000000 0f1f440000 nop dword [rax + rax]
0x00000005 b8210000c1 mov eax, 0xc1000021
0x0000000a ebfd jmp 9
0x0000000c bb2c000000 mov ebx, 0x2c
0x00000011 ebf0 jmp 3
0x00000013 0000 add byte [rax], al
EOF
RUN
NAME=asm.bb.middle and pif
FILE==
CMDS=<<EOF
e asm.arch=x86
e asm.bits=64
e analysis.nopskip=false
e analysis.jmp.mid=true
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
af
e asm.bb.middle=true
pif
?e
e asm.bb.middle=false
pif
EOF
EXPECT=<<EOF
nop dword [rax + rax]
add byte [rax], al
mov eax, 0xc1000021
shr ebx, 0xfd
mov ebx, 0x2c
jmp 3
nop dword [rax + rax]
mov eax, 0xc1000021
jmp 9
mov ebx, 0x2c
jmp 3
EOF
RUN
NAME=asm.bb.middle and asm.flags.middle
FILE=bins/pe/cmd_adf_sample0.exe
CMDS=<<EOF
e asm.bytes=true
e asm.xrefs=false
s 0x560e67
af
e asm.bb.middle=true
e asm.flags.middle=2
f sym.dummy @ 0x560e7d
pd 2 @ 0x560e7a
?e
fm 0x560e7c @ sym.dummy
pd 3 @ 0x560e7a
?e
fm 0x560e96 @ sym.dummy
pd 2 @ 0x560e95
?e
fm 0x560e97 @ sym.dummy
pd 3 @ 0x560e95
?e
e asm.bb.middle=false
f sym.real @ 0x00560e95
pd 3 @ 0x560e95
?e
pd 3 @ 0x560e95 @e:scr.color=1
EOF
EXPECT=<<EOF
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
| ;-- sym.dummy:
| 0x00560e7d 5e pop esi
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
;-- sym.dummy:
0x00560e7c 96 xchg eax, esi
| 0x00560e7d 5e pop esi
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
| ;-- sym.dummy:
| 0x00560e96 0f31 rdtsc
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
| ;-- (0x00560e97) sym.dummy:
| 0x00560e96 ~ 0f31 rdtsc
| 0x00560e98 e914000000 jmp 0x560eb1
;-- sym.real:
| ;-- (0x00560e97) sym.dummy:
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
| 0x00560e9a 0000 add byte [eax], al
| 0x00560e9c 00a836dc5264 add byte [eax + 0x6452dc36], ch
;-- sym.real:
| ;-- (0x00560e97) sym.dummy:
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
| 0x00560e9a 0000 add byte [eax], al
| 0x00560e9c 00a836dc5264 add byte [eax + 0x6452dc36], ch
EOF
RUN