* Added build files [Capstone to Zydis] * x86 Analysis [Capstone to Zydis] * Changed x86 RzIL [Capstone to Zydis] * Changed asm and arch files [Capstone to Zydis] * Compilation, build error and test fixes [Capstone to Zydis] * Test changes [Capstone to Zydis] * Remaining changes [Capstone to Zydis] * Added BE support [Capstone to Zydis] --------- Co-authored-by: tushar3q34 <tushar3q34@gmail.com>
1038 lines
18 KiB
Text
1038 lines
18 KiB
Text
NAME=Error config to < from
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e search.from=2
|
|
e search.to=3
|
|
e search.to=2
|
|
e search.to=1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
search.to cannot be smaller than search.from.
|
|
EOF
|
|
EXPECT_ERR=
|
|
RUN
|
|
|
|
NAME=trailing comment
|
|
FILE==
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
/z #
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=search esil
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
/E $$,[1],0xe1,-,!
|
|
s@ hit0_0
|
|
EOF
|
|
EXPECT=<<EOF
|
|
hit0_0
|
|
0x8048364
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search esil json
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
/Ej $$,[1],0xe1,-,!
|
|
s@ hit0_0
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"addr":134513508,"value":1}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/r push [imm] refs
|
|
FILE=bins/pe/x.dll
|
|
CMDS=/r 0x69682004
|
|
EXPECT=<<EOF
|
|
(nofunc); [00] -r-x section size 4096 named .text 0x69681000 [DATA] push dword [0x69682004]
|
|
(nofunc); [00] -r-x section size 4096 named .text 0x69681000 [DATA] push dword [0x69682004]
|
|
(nofunc) 0x69681006 [DATA] push 0x69682004
|
|
(nofunc) 0x6968100b [DATA] mov eax, dword [0x69682004]
|
|
(nofunc) 0x69681010 [DATA] mov eax, 0x69682004
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/aI infinite loop instructions
|
|
FILE=bins/mach0/ls-osx-x86_64
|
|
CMDS=/aI
|
|
EXPECT=<<EOF
|
|
0x10000166f
|
|
0x10000221d
|
|
0x1000047ca
|
|
0x10000482e
|
|
0x100004838
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/ai finding immediates
|
|
FILE=bins/mach0/ls-osx-x86_64
|
|
CMDS=/ai 0x648
|
|
EXPECT=<<EOF
|
|
0x1000013e5 # 7: sub rsp, 0x648
|
|
0x1000013e6 # 6: sub esp, 0x648
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/as begin of file
|
|
FILE=bins/pe/a.exe
|
|
ARGS=-n
|
|
BROKEN=1
|
|
CMDS=s/ MZ
|
|
EXPECT=<<EOF
|
|
0x00000000 hit0_0 .MZ.
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/as in arm32
|
|
FILE=bins/elf/libexploit.so
|
|
CMDS=/as
|
|
EXPECT=<<EOF
|
|
0x00012434 execve
|
|
0x000124d4 gettid
|
|
0x000125d4 read
|
|
0x000125f4 write
|
|
0x00012614 close
|
|
0x00012654 getpid
|
|
0x00012674 munmap
|
|
0x00012744 unlink
|
|
0x00012764 chdir
|
|
0x00012784 chmod
|
|
0x000127f4 fstat64
|
|
0x00012894 access
|
|
0x00012be4 kill
|
|
0x00013604 exit
|
|
0x00013624 fork
|
|
0x000136a4 open
|
|
0x000136cc mmap2
|
|
0x000136f4 mprotect
|
|
0x00013714 ioctl
|
|
0x00013774 fcntl64
|
|
0x00013844 munmap
|
|
0x00013850 exit
|
|
0x00013870 clone
|
|
0x000138b4 clone
|
|
0x00013904 brk
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/zj escaped
|
|
FILE=bins/mach0/escaped
|
|
CMDS=<<EOF
|
|
/zj hello
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"address":8019,"size":5,"flag":"hit.string.ascii.0"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/ search from/to (seek 0)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x00000050
|
|
e search.str.min_length=3
|
|
/z ELF
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000001 3 hit.string.ascii.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/ search from/to (seek beyond data)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e scr.color=false
|
|
e io.va=false
|
|
s 0x1000
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x50
|
|
e search.str.min_length=3
|
|
/z ELF
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000001 3 hit.string.ascii.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/zj search
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 666f6f005c
|
|
e search.str.min_length=3
|
|
/zj foo
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"address":0,"size":3,"flag":"hit.string.ascii.0"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/a search
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
/a add esp, 8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 3 hit.asm_text.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/a search from/to (seek 0)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x50
|
|
/a xor al, 0x80
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 hit.asm_text.0
|
|
0x00000040 2 hit.asm_text.1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/a search from/to (seek 0)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x50
|
|
/a xor al, 0x80
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 hit.asm_text.0
|
|
0x00000040 2 hit.asm_text.1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/a push esp
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=/a push esp
|
|
EXPECT=<<EOF
|
|
0x08048058 1 hit.asm_text.0
|
|
0x0804805c 1 hit.asm_text.1
|
|
0x08048060 1 hit.asm_text.2
|
|
0x08048369 1 hit.asm_text.3
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/ac mov ebx
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
/ac mov ebx
|
|
echo --
|
|
/ac MoV ebX
|
|
echo --
|
|
/acj mov ebx
|
|
echo --
|
|
/acj MoV ebX
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048515 # 3: mov ebx, dword [esp]
|
|
0x08048527 # 5: mov ebx, obj.__CTOR_LIST
|
|
--
|
|
--
|
|
[{"offset":134513941,"len":3,"code":"mov ebx, dword [esp]"},{"offset":134513959,"len":5,"code":"mov ebx, 0x8049f0c"}]
|
|
--
|
|
[]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/aa mov ebx
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
/aa mov ebx
|
|
echo --
|
|
/aa MoV ebX
|
|
echo --
|
|
/aaj mov ebx
|
|
echo --
|
|
/aaj MoV ebX
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048515 # 3: mov ebx, dword [esp]
|
|
0x08048527 # 5: mov ebx, obj.__CTOR_LIST
|
|
--
|
|
0x08048515 # 3: mov ebx, dword [esp]
|
|
0x08048527 # 5: mov ebx, obj.__CTOR_LIST
|
|
--
|
|
[{"offset":134513941,"len":3,"code":"mov ebx, dword [esp]"},{"offset":134513959,"len":5,"code":"mov ebx, 0x8049f0c"}]
|
|
--
|
|
[{"offset":134513941,"len":3,"code":"mov ebx, dword [esp]"},{"offset":134513959,"len":5,"code":"mov ebx, 0x8049f0c"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/a search from/to (seek beyond data)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0x1000
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x00000050
|
|
/a xor al, 0x80
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 hit.asm_text.0
|
|
0x00000040 2 hit.asm_text.1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x search from/to (seek beyond data)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0x1000
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x00000050
|
|
/x 3480
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 hit.bytes.0
|
|
0x00000040 2 hit.bytes.1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/A search
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
e asm.bits=32
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
/at ret
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000005 1 ret
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/A search from/to (seek 0)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x00000050
|
|
/at xor
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 xor al, 0x80
|
|
0x00000040 2 xor al, 0x80
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/A search from/to (seek beyond data)
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
s 0x1000
|
|
e search.in=file
|
|
e search.from=0
|
|
e search.to=0x00000050
|
|
/at xor
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000003c 2 xor al, 0x80
|
|
0x00000040 2 xor al, 0x80
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Rop search
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
e asm.bits=32
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
e scr.color=false
|
|
/R
|
|
q
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 83c408 add esp, 0x08
|
|
0x00000003 5b pop ebx
|
|
0x00000004 5d pop ebp
|
|
0x00000005 c3 ret
|
|
Gadget size: 6
|
|
|
|
0x00000001 c408 les ecx, fword [eax]
|
|
0x00000003 5b pop ebx
|
|
0x00000004 5d pop ebp
|
|
0x00000005 c3 ret
|
|
Gadget size: 5
|
|
|
|
0x00000002 085b5d or byte [ebx+0x5d], bl
|
|
0x00000005 c3 ret
|
|
Gadget size: 4
|
|
|
|
0x00000003 5b pop ebx
|
|
0x00000004 5d pop ebp
|
|
0x00000005 c3 ret
|
|
Gadget size: 3
|
|
|
|
0x00000004 5d pop ebp
|
|
0x00000005 c3 ret
|
|
Gadget size: 2
|
|
|
|
0x00000005 c3 ret
|
|
Gadget size: 1
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Rop search w/ regexp
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
e asm.bits=32
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
e scr.color=false
|
|
/R/ or.*bl
|
|
q
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000002 085b5d or byte [ebx+0x5d], bl
|
|
0x00000005 c3 ret
|
|
Gadget size: 4
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Rop search w/ branch delay (mips)
|
|
FILE=malloc://128
|
|
BROKEN=1
|
|
CMDS=<<EOF
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e scr.color=false
|
|
e rop.len=8
|
|
wx 1b000000040000001a0000004c08410018000000040000000800000000000070
|
|
/R
|
|
q
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000000 1b000000 divu zero, zero, zero
|
|
0x00000004 04000000 sllv zero, zero, zero
|
|
0x00000008 1a000000 div zero, zero, zero
|
|
0x0000000c 4c084100 syscall 0x10421
|
|
0x00000010 18000000 mult zero, zero
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 32
|
|
|
|
0x00000004 04000000 sllv zero, zero, zero
|
|
0x00000008 1a000000 div zero, zero, zero
|
|
0x0000000c 4c084100 syscall 0x10421
|
|
0x00000010 18000000 mult zero, zero
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 28
|
|
|
|
0x00000008 1a000000 div zero, zero, zero
|
|
0x0000000c 4c084100 syscall 0x10421
|
|
0x00000010 18000000 mult zero, zero
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 24
|
|
|
|
0x0000000c 4c084100 syscall 0x10421
|
|
0x00000010 18000000 mult zero, zero
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 20
|
|
|
|
0x00000010 18000000 mult zero, zero
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 16
|
|
|
|
0x00000014 04000000 sllv zero, zero, zero
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 12
|
|
|
|
0x00000018 08000000 jr zero
|
|
0x0000001c 00000070 madd zero, zero
|
|
Gadget size: 8
|
|
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/ad/ search instructions extended regex
|
|
FILE=bins/pe/standard.exe
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
e asm.bits=32
|
|
/ad/ "ror (bh|...), (cl|.)"
|
|
q
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x004019d2 # 2: ror esp, cl
|
|
0x004019d5 # 2: ror bh, 0x01
|
|
0x004019da # 3: ror ebp, 0xe5
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/o search offset of instructions backward
|
|
FILE=malloc://1024
|
|
ARGS=-a x86 -b 32
|
|
CMDS=<<EOF
|
|
wx 909089d89090
|
|
s 4
|
|
/o
|
|
/o 2
|
|
/o 3
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000002
|
|
0x00000001
|
|
0x00000000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x search from/to (seek 0)
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
s 0
|
|
e search.from=0
|
|
e search.to=0x200
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x search from/to (seek beyond data)
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
s 0x1000
|
|
e search.in=raw
|
|
e search.from=0
|
|
e search.to=0x200
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/as search syscall
|
|
FILE=bins/elf/analysis/x86-simple
|
|
CMDS=<<EOF
|
|
aeim
|
|
aeip
|
|
/as
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048070 exit
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x search seek
|
|
FILE=bins/pe/standard.exe
|
|
CMDS=<<EOF
|
|
e io.va=false
|
|
e search.in=file
|
|
s 0x1000
|
|
/x 9090cd80
|
|
s
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x1000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x hit in the second map
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
CMDS=<<EOF
|
|
/x f8820408
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08049f2c 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x wrong entries
|
|
FILE=bins/elf/analysis/go_stripped
|
|
CMDS=<<EOF
|
|
/x 653b2530000000724b53b834e7150883ec188.~$[0]
|
|
# Should find nothing, because it gets exended on the lhs and is not aligned.
|
|
/x 653b2530000000724b53b834e7150883ec188~$[0]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0805ae90
|
|
0x0805b030
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x50
|
|
e search.to=0x150
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x50
|
|
e search.to=0x90
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=search range hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x100
|
|
e search.to=0x104
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x101
|
|
e search.to=0x104
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=search range hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x100
|
|
e search.to=0x103
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range hex @(A..B)
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x50
|
|
e search.to=0x150
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range hex @(A..B)
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
b 0x100
|
|
e search.from=0x50
|
|
e search.to=0x90
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=search hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
e search.from=0x100
|
|
e search.to=0x104
|
|
b 0x100
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 4 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
e search.from=0x100
|
|
e search.to=0x103
|
|
b 0x100
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=search hex
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w ABCD @ 0x100
|
|
e search.from=0x101
|
|
e search.to=0x104
|
|
b 0x100
|
|
/x 41424344
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=/x with bin mask
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx aaaaaabb
|
|
/x aa..bb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000001 3 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x with bin mask
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx aaaaaabb
|
|
/x ..aabb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000001 3 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range /c in arm
|
|
FILE=bins/arm/elf/hello_world
|
|
CMDS=<<EOF
|
|
af @ sym.main
|
|
e search.in=raw
|
|
e search.from=0x0000050c
|
|
e search.to=0x00000510
|
|
/ac add
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000050e # 2: add r7, sp, 0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=search range /ce in arm
|
|
FILE=bins/arm/elf/hello_world
|
|
CMDS=<<EOF
|
|
af @ sym.main
|
|
e search.in=raw
|
|
e search.from=0x00000512
|
|
e search.to=0x00000516
|
|
/ae r3,r0,=
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000514 # 0: r3,r0,=
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/x search hexpairs ignoring spaces
|
|
FILE=bins/elf/ioli/crackme0x00
|
|
ARGS=-n
|
|
CMDS=<<EOF
|
|
# The password
|
|
/x 50617373776F7264
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000581 8 hit.bytes.0
|
|
0x0000059e 8 hit.bytes.1
|
|
0x000005a9 8 hit.bytes.2
|
|
EOF
|
|
RUN
|
|
|
|
NAME=wx and /x with bin mask, both ignoring spaces
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx a5 a5 a5 bf
|
|
/x a5..bf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000001 3 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=wx and /x with bin mask, both ignoring spaces
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 00 cafe 5a5a 5abf affe @ 0x123
|
|
/x ..5abf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000127 3 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=wx and /x with custom bin mask, both ignoring spaces
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 01020304 a5a5a5 bf
|
|
/x a5e3bf:ff81ff
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000005 3 hit.bytes.0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=config search smartcase
|
|
CMDS=<<EOF
|
|
el~rzil
|
|
echo "---"
|
|
el~+rzil
|
|
echo "---"
|
|
el~RzIL
|
|
EOF
|
|
EXPECT=<<EOF
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
EOF
|
|
RUN
|
|
|
|
|
|
NAME=config search sensitive
|
|
CMDS=<<EOF
|
|
e search.case_sensitive=sensitive
|
|
el~rzil
|
|
echo "---"
|
|
el~+rzil
|
|
echo "---"
|
|
el~RzIL
|
|
EOF
|
|
EXPECT=<<EOF
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
EOF
|
|
RUN
|
|
|
|
|
|
NAME=config search insensitive
|
|
CMDS=<<EOF
|
|
e search.case_sensitive=insensitive
|
|
el~rzil
|
|
echo "---"
|
|
el~+rzil
|
|
echo "---"
|
|
el~RzIL
|
|
EOF
|
|
EXPECT=<<EOF
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
---
|
|
asm.cmt.il: Show RzIL expressions as comments
|
|
rzil.step.events.read: enables/disables printing aezse read event
|
|
rzil.step.events.write: enables/disables printing aezse write event
|
|
EOF
|
|
RUN
|
|
|
|
|
|
NAME=search wide string
|
|
FILE==
|
|
CMDS=<<EOF
|
|
ww Hello World this is Rizin
|
|
/z World l utf16le
|
|
# Should not match
|
|
/z world l utf16le
|
|
# Should match
|
|
/z world i utf16le
|
|
/zj World l utf16le
|
|
/zj world i utf16le
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000000c 10 hit.string.utf16le.0
|
|
0x0000000c 10 hit.string.utf16le.0
|
|
[{"address":12,"size":10,"flag":"hit.string.utf16le.0"}]
|
|
[{"address":12,"size":10,"flag":"hit.string.utf16le.0"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Check boundaries via %B search.in
|
|
FILE=bins/elf/hello_world
|
|
CMDS=<<EOF
|
|
iSt:perm/str/x
|
|
%Bt @e:search.in=code
|
|
%Bt @e:search.in=bin.sections.x
|
|
%Bt @e:search.in=io.sky.x
|
|
%Bt @e:search.in=block @! 512
|
|
%Bt @e:search.in=raw
|
|
EOF
|
|
EXPECT=<<EOF
|
|
paddr size vaddr vsize align perm name type flags
|
|
-----------------------------------------------------------------------------
|
|
0x00000608 0x17 0x00000608 0x17 0x0 -r-x .init PROGBITS alloc,execute
|
|
0x00000620 0x70 0x00000620 0x70 0x0 -r-x .plt PROGBITS alloc,execute
|
|
0x00000690 0x8 0x00000690 0x8 0x0 -r-x .plt.got PROGBITS alloc,execute
|
|
0x000006a0 0x222 0x000006a0 0x222 0x0 -r-x .text PROGBITS alloc,execute
|
|
0x000008c4 0x9 0x000008c4 0x9 0x0 -r-x .fini PROGBITS alloc,execute
|
|
from to size perms
|
|
-----------------------
|
|
0x608 0x61f 23 r-x
|
|
0x620 0x690 112 r-x
|
|
0x690 0x698 8 r-x
|
|
0x6a0 0x8c2 546 r-x
|
|
0x8c4 0x8cd 9 r-x
|
|
from to size perms
|
|
-----------------------
|
|
0x608 0x61f 23 r-x
|
|
0x620 0x690 112 r-x
|
|
0x690 0x698 8 r-x
|
|
0x6a0 0x8c2 546 r-x
|
|
0x8c4 0x8cd 9 r-x
|
|
from to size perms
|
|
----------------------
|
|
0x0 0xa28 2600 r-x
|
|
from to size perms
|
|
-----------------------
|
|
0x6a0 0x8a0 512 rwx
|
|
from to size perms
|
|
-----------------------
|
|
0x0 0x2148 8520 rwx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=consistency btw /z and /x at 0x20k multiple
|
|
FILE=--
|
|
CMDS=<<EOF
|
|
. scripts/search-consistency-test.rz
|
|
$str=$abc+d
|
|
$bin=$malloc://0x40000+10
|
|
$setup=$"w `$str` @@=0x20000 0x40000"
|
|
$cmd_z=$/z ${str}
|
|
$cmd_x=$/x ${bytes}
|
|
.(search-consistency-test)
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[0x0, 0x207ff): 1
|
|
[0x20000, 0x4000a): 2
|
|
[0x40000, 0x4000a): 1
|
|
0x00020000 5 hit.string.ascii.0
|
|
0x00040000 5 hit.string.ascii.1
|
|
----
|
|
[0x0, 0x1004): 0
|
|
[0x1000, 0x2004): 0
|
|
[0x10000, 0x11004): 0
|
|
[0x11000, 0x12004): 0
|
|
[0x12000, 0x13004): 0
|
|
[0x13000, 0x14004): 0
|
|
[0x14000, 0x15004): 0
|
|
[0x15000, 0x16004): 0
|
|
[0x16000, 0x17004): 0
|
|
[0x17000, 0x18004): 0
|
|
[0x18000, 0x19004): 0
|
|
[0x19000, 0x1a004): 0
|
|
[0x1a000, 0x1b004): 0
|
|
[0x1b000, 0x1c004): 0
|
|
[0x1c000, 0x1d004): 0
|
|
[0x1d000, 0x1e004): 0
|
|
[0x1e000, 0x1f004): 0
|
|
[0x1f000, 0x20004): 0
|
|
[0x2000, 0x3004): 0
|
|
[0x20000, 0x21004): 1
|
|
[0x21000, 0x22004): 0
|
|
[0x22000, 0x23004): 0
|
|
[0x23000, 0x24004): 0
|
|
[0x24000, 0x25004): 0
|
|
[0x25000, 0x26004): 0
|
|
[0x26000, 0x27004): 0
|
|
[0x27000, 0x28004): 0
|
|
[0x28000, 0x29004): 0
|
|
[0x29000, 0x2a004): 0
|
|
[0x2a000, 0x2b004): 0
|
|
[0x2b000, 0x2c004): 0
|
|
[0x2c000, 0x2d004): 0
|
|
[0x2d000, 0x2e004): 0
|
|
[0x2e000, 0x2f004): 0
|
|
[0x2f000, 0x30004): 0
|
|
[0x3000, 0x4004): 0
|
|
[0x30000, 0x31004): 0
|
|
[0x31000, 0x32004): 0
|
|
[0x32000, 0x33004): 0
|
|
[0x33000, 0x34004): 0
|
|
[0x34000, 0x35004): 0
|
|
[0x35000, 0x36004): 0
|
|
[0x36000, 0x37004): 0
|
|
[0x37000, 0x38004): 0
|
|
[0x38000, 0x39004): 0
|
|
[0x39000, 0x3a004): 0
|
|
[0x3a000, 0x3b004): 0
|
|
[0x3b000, 0x3c004): 0
|
|
[0x3c000, 0x3d004): 0
|
|
[0x3d000, 0x3e004): 0
|
|
[0x3e000, 0x3f004): 0
|
|
[0x3f000, 0x40004): 0
|
|
[0x4000, 0x5004): 0
|
|
[0x40000, 0x4000a): 1
|
|
[0x5000, 0x6004): 0
|
|
[0x6000, 0x7004): 0
|
|
[0x7000, 0x8004): 0
|
|
[0x8000, 0x9004): 0
|
|
[0x9000, 0xa004): 0
|
|
[0xa000, 0xb004): 0
|
|
[0xb000, 0xc004): 0
|
|
[0xc000, 0xd004): 0
|
|
[0xd000, 0xe004): 0
|
|
[0xe000, 0xf004): 0
|
|
[0xf000, 0x10004): 0
|
|
0x00020000 5 hit.bytes.0
|
|
0x00040000 5 hit.bytes.1
|
|
EOF
|
|
RUN
|