88a4121d70
The COFF section table walker assumed every COFF section header is 40 bytes -- the standard COFF1 form. The TI Common Object File Format (SPRAAO8) extends this for TI COFF v2 (file magic 0x00C2) used by the TI tools (asm55, cl55, cl6x, cl28, etc.): ------------------------------------------------------------------ offset size field standard COFF1 TI COFF v2 ------------------------------------------------------------------ 0x00 8 s_name char[8] char[8] 0x08 4 s_paddr ut32 ut32 0x0c 4 s_vaddr ut32 ut32 0x10 4 s_size ut32 ut32 0x14 4 s_scnptr ut32 ut32 0x18 4 s_relptr ut32 ut32 0x1c 4 s_lnnoptr ut32 ut32 0x20 2/4 s_nreloc ut16 ut32 <-- widened 0x22 2/4 s_nlnno ut16 ut32 <-- widened 0x24 4 s_flags ut32 ut32 0x28 - reserved - ut16 <-- new 0x2a - mempage - ut16 <-- new ------------------------------------------------------------------ TOTAL 40 48 Reading TI COFF v2 with the standard 40-byte stride walks the section table off-by-8 per section, producing nonsense values for every section after the first. In practice, vaddr and size for the second section spill into the next section's name field, surfacing as attention-grabbing decimal values like 0x7461642e (ASCII '.dat' reversed -- bytes from the upcoming '.data' name being interpreted as a size). Concrete reproducer with TI asm55p output: $ wine asm55p.exe -v5505 03_branches_calls.s $ rz-bin -S 03_branches_calls.obj # before this fix ... 0x00000061 0x7461642e 0x00000040 0x7461642e ... # garbage size ... $ rz-bin -S 03_branches_calls.obj # after this fix 0x000000fa 0x34 0x00000030 0x34 -r-x .text ... Fix: add a parallel coff_init_scn_hdr_ti() that reads the 48-byte layout, with nreloc/nlnno as ut32 (clamped to ut16 because the rest of the COFF code keeps them as 16-bit and counts above 64K are not encountered in practice). bin_coff_init_scn_hdr() picks the variant based on coff_is_ti_machine() -- the same predicate already used in the file-header parser to consume TI's f_target_id field. Tested with TI asm55p output for C55x, C55x+, and C5500 (machine ids 0x9c, 0xa1, and TI_1/TI_2 file magics) -- sections now parse with the correct sizes, vaddrs, and flags, and the resulting binaries open cleanly under 'rizin -A' for analysis. |
||
|---|---|---|
| .builds | ||
| .github | ||
| .woodpecker | ||
| binrz | ||
| dist | ||
| doc | ||
| examples | ||
| librz | ||
| LICENSES | ||
| patches | ||
| subprojects | ||
| sys | ||
| test | ||
| .appveyor.yml | ||
| .clang-format | ||
| .dockerignore | ||
| .git-blame-ignore-revs | ||
| .gitattributes | ||
| .gitignore | ||
| .lgtm.yml | ||
| .prettierignore | ||
| .pylintrc | ||
| .travis.yml | ||
| AGENTS.md | ||
| BUILDING.md | ||
| CODE_OF_CONDUCT.md | ||
| codecov.yml | ||
| CODEOWNERS | ||
| CONTRIBUTING.md | ||
| COPYING | ||
| COPYING.LESSER | ||
| DEVELOPERS.md | ||
| Dockerfile | ||
| Doxyfile | ||
| meson.build | ||
| meson_options.txt | ||
| README.md | ||
| REUSE.toml | ||
| SECURITY.md | ||
| snapcraft.yaml | ||
| travis-extract-var.sh | ||
| travis-script | ||
Rizin
Rizin is a reverse engineering framework, born as a fork of the radare2, with a focus on usability, features and cleanliness.
Rizin is portable and it can be used to analyze binaries, disassemble code, debug programs, as a forensic tool, as a scriptable command-line hexadecimal editor able to open disk files, and much more!
To learn more on Rizin you may want to read the official Rizin book.
How to install
Look at install instructions on our web page.
How to build
Use meson to compile and install Rizin. Please make sure to get an updated
meson (e.g. get it with pip install meson if your system does not provide
one that is at least version 0.55.0).
Clone this repository:
$ git clone https://github.com/rizinorg/rizin
Then compile and install with:
$ meson setup build
$ meson compile -C build
$ sudo meson install -C build
Now you can use rizin:
$ rizin
-- Thank you for using rizin. Have a nice night!
[0x00000000]>
To uninstall rizin, execute sudo ninja -C build uninstall.
Please have a look at BUILDING.md for more information about building Rizin.
Contributing
We very much welcome any kind of contributions, from typos, to documentation, to refactoring, up to completely new features you may think of. Before contributing, we would like you to read the file CONTRIBUTING.md, so that we can all be on the same page.
Tests
Look at test/README.md.
Supported features
Supported Operating Systems
Windows 7 and higher, Apple macOS/iOS/iPadOS, GNU/Linux, [Dragonfly|Net|Free|Open]BSD, Android, QNX, Solaris/Illumos, Haiku, GNU/Darwin, GNU/Hurd.
Supported Architectures
i386, x86-64, ARM/ARM64, RISC-V, PowerPC, MIPS, AVR, SPARC, System Z (S390), SuperH, m68k, m680x, XAP, XCore, CR16, HPPA, ARC, Blackfin, Z80, H8/300, Renesas (V810, V850, RL78), CRIS, XAP, PIC, LM32, 8051, 6502, i4004, i8080, Propeller, Tricore, CHIP-8, LH5801, T8200, GameBoy, SNES, SPC700, MSP430, Xtensa, NIOS II, TMS320 (c54x, c55x, c55+, c64x), Hexagon, DCPU16, LANAI, MCORE, mcs96, RSP, C-SKY(MCore), VAX, AMD Am29000.
There is also support for the following bytecode formats:
Dalvik, EBC, Java, Lua, Python, WebAssembly, Brainfuck, Malbolge
Supported File Formats
ELF, Mach-O, Fatmach-O, PE, PE+, MZ, COFF, OMF, NE, LE, LX, TE, XBE, BIOS/UEFI, Dyldcache, DEX, ART, CGC, ELF, Java class, Android boot image, Plan9 executable, ZIMG, MBN/SBL bootloader, ELF coredump, MDMP (Windows minidump), DMP (Windows pagedump), WASM (WebAssembly binary), Commodore VICE emulator, QNX, Game Boy (Advance), Nintendo DS ROMs and Nintendo 3DS FIRMs.
Tools
Apart from the main tool rizin, there are also other tools tailored for specific purposes and
useful for shell scripting or as separate standalone tools:
rz-bin- provides all kind of information about binary formatsrz-ar- list and extract members from static archives (.a and .lib)rz-asm- a command-line assembler and disassemblersrz-diff- a tool to compare two binaries as raw data or analyzed executablesrz-hash- allows to calculate different hashes or even encrypt datarz-gg- a small "eggs" code generator useful for exploitation purposesrz-find- binary analog offindtool, allowing to search patterns and bit masksrz-sign- tool to create, convert and parse FLIRT signaturesrz-ax- a calculator and number format converterrz-run- a tool that allows to specify running environment and arguments for debugged file
Scripting
We provide a way to interact with Rizin from Python, Haskell, OCaml, Ruby, Rust, and Go languages through rzpipe. Other languages although not currently supported could be easily added.
Community
Our website and blog: https://www.rizin.re/
Join our Mattermost community to discuss Rizin, its development, and general topics related to the project.
We also provide the following partial bridges to other messaging platforms: