ba8c170852
* Added build files [Capstone to Zydis] * x86 Analysis [Capstone to Zydis] * Changed x86 RzIL [Capstone to Zydis] * Changed asm and arch files [Capstone to Zydis] * Compilation, build error and test fixes [Capstone to Zydis] * Test changes [Capstone to Zydis] * Remaining changes [Capstone to Zydis] * Added BE support [Capstone to Zydis] --------- Co-authored-by: tushar3q34 <tushar3q34@gmail.com>
187 lines
2.3 KiB
Text
187 lines
2.3 KiB
Text
NAME=cmd.hit sugar for /x
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 90 @ 10
|
|
e cmd.hit="wx 91"
|
|
/x 90
|
|
p8 1 @ 10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
91
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit sugar for /z
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
w hello @ 10
|
|
ps @@/z hello i
|
|
EOF
|
|
EXPECT=<<EOF
|
|
hello
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/xj utf16
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 005c
|
|
/xj 005c
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"address":0,"size":2,"flag":"hit.bytes.0"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=/z utf16be
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e search.str.min_length=1
|
|
wx 0067
|
|
/zj g i utf16be
|
|
EOF
|
|
EXPECT=<<EOF
|
|
[{"address":0,"size":2,"flag":"hit.string.utf16be.0"}]
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit sugar for /x
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
wx 90 @ 10
|
|
wx 91 @@/x 90
|
|
p8 1 @ 10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
91
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit sugar for /
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=64
|
|
w A @ 10
|
|
wx 33 @@/z A
|
|
p8 1 @ 10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
41
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit sugar for /
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
wx 90 @ 10
|
|
wx 33 @@/ad nop
|
|
p8 1 @ 10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0000000a # 1: nop
|
|
33
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit for /+
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e cmd.hit="p8 3"
|
|
w ABCDEF
|
|
/+ ABC
|
|
EOF
|
|
EXPECT=<<EOF
|
|
414243
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit for /a
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e asm.bits=32
|
|
e cmd.hit="pi 4"
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
/a add esp, 8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
add esp, 0x08
|
|
pop ebx
|
|
pop ebp
|
|
ret
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit for /A
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e asm.arch=x86
|
|
e analysis.arch=x86
|
|
e cmd.hit="pi 1"
|
|
e asm.bits=32
|
|
wa "add esp,8;pop ebx; pop ebp; ret"
|
|
/at pop
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000003 1 pop ebx
|
|
pop ebx
|
|
0x00000004 1 pop ebp
|
|
pop ebp
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit for /z i
|
|
FILE=malloc://1024
|
|
CMDS=<<EOF
|
|
e cmd.hit=ps
|
|
e search.from=0
|
|
e search.to=0x10
|
|
w AAAAAAAAAAB
|
|
/z aaaaaaaaaab i
|
|
EOF
|
|
EXPECT=<<EOF
|
|
AAAAAAAAAAB
|
|
EOF
|
|
RUN
|
|
|
|
NAME=cmd.hit for /r
|
|
FILE=bins/elf/analysis/ls-linux64
|
|
CMDS=<<EOF
|
|
e cmd.hit="pi 1"
|
|
e search.from=0x00005c20
|
|
e search.to=0x00005c49
|
|
/r sym.imp.__libc_start_main
|
|
EOF
|
|
EXPECT=<<EOF
|
|
(nofunc) 0x5c44 [CALL] call sym.imp.__libc_start_main
|
|
call sym.imp.__libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=from/to for /r
|
|
FILE=bins/elf/analysis/ls-linux64
|
|
CMDS=<<EOF
|
|
e cmd.hit="pi 1"
|
|
e search.from=0x00005c20
|
|
e search.to=0x00005c44
|
|
/r sym.imp.__cxa_finalize
|
|
EOF
|
|
EXPECT=
|
|
RUN
|
|
|
|
NAME=cmd.hit for /s
|
|
FILE=bins/elf/analysis/x86-simple
|
|
CMDS=<<EOF
|
|
aeim
|
|
aeip
|
|
e cmd.hit="pi 1"
|
|
/as
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x08048070 exit
|
|
int 0x80
|
|
EOF
|
|
RUN
|