ba8c170852
* Added build files [Capstone to Zydis] * x86 Analysis [Capstone to Zydis] * Changed x86 RzIL [Capstone to Zydis] * Changed asm and arch files [Capstone to Zydis] * Compilation, build error and test fixes [Capstone to Zydis] * Test changes [Capstone to Zydis] * Remaining changes [Capstone to Zydis] * Added BE support [Capstone to Zydis] --------- Co-authored-by: tushar3q34 <tushar3q34@gmail.com>
645 lines
14 KiB
Text
645 lines
14 KiB
Text
NAME=asm.bb.middle disasm
|
||
FILE=bins/pe/cmd_adf_sample0.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=false
|
||
e asm.comments=false
|
||
e asm.var=false
|
||
s 0x560e67
|
||
af
|
||
e asm.bb.middle=true
|
||
pD 0x560eb3-$$
|
||
echo
|
||
e asm.bb.middle=false
|
||
pD 0x560eb3-$$
|
||
EOF
|
||
EXPECT=<<EOF
|
||
/ fcn.00560e67(int32_t arg_4h, int32_t arg_7fbf5070h);
|
||
| 0x00560e67 push esi
|
||
| ,=< 0x00560e68 jmp 0x560e7d
|
||
| 0x00560e6d push ecx
|
||
| 0x00560e6e in eax, 0xd6
|
||
| 0x00560e70 sbb eax, 0x5ceea31
|
||
| 0x00560e75 push es
|
||
| 0x00560e76 cmp edx, esp
|
||
| 0x00560e78 aam 0x1b
|
||
| 0x00560e7a ~ add byte [ebp+0x52505e96], al
|
||
| `-> 0x00560e7d pop esi
|
||
| 0x00560e7e push eax
|
||
| 0x00560e7f push edx
|
||
| ,=< 0x00560e80 jmp 0x560e96
|
||
| 0x00560e85 mov ebx, 0x4fd160dd
|
||
| 0x00560e8a in al, dx
|
||
| 0x00560e8b mov esp, 0x60bdf441
|
||
| 0x00560e90 lodsd
|
||
,==< 0x00560e91 jnbe 0x560ed9
|
||
|| 0x00560e93 aaa
|
||
|| 0x00560e94 sahf
|
||
|| 0x00560e95 ~ mov edx, 0x14e9310f
|
||
| |`-> 0x00560e96 rdtsc
|
||
| | 0x00560e98 jmp 0x560eb1
|
||
| 0x00560e9d test al, 0x36
|
||
| 0x00560e9f fcom qword [edx+0x64]
|
||
| 0x00560ea2 xlat
|
||
| 0x00560ea3 push 0x27
|
||
| 0x00560ea5 sub esp, edx
|
||
| 0x00560ea7 mov eax, dword [0xe8c1cf5d]
|
||
|,=< 0x00560eac jle 0x560f29
|
||
|| 0x00560eae inc ecx
|
||
|| 0x00560eaf ~ mov byte [eax+0x5a], dl
|
||
| || 0x00560eb1 pop edx
|
||
| || 0x00560eb2 pop eax
|
||
|
||
/ fcn.00560e67(int32_t arg_4h, int32_t arg_7fbf5070h);
|
||
| 0x00560e67 push esi
|
||
| ,=< 0x00560e68 jmp 0x560e7d
|
||
| 0x00560e6d push ecx
|
||
| 0x00560e6e in eax, 0xd6
|
||
| 0x00560e70 sbb eax, 0x5ceea31
|
||
| 0x00560e75 push es
|
||
| 0x00560e76 cmp edx, esp
|
||
| 0x00560e78 aam 0x1b
|
||
| 0x00560e7a add byte [ebp+0x52505e96], al
|
||
| ,=< 0x00560e80 jmp 0x560e96
|
||
| 0x00560e85 mov ebx, 0x4fd160dd
|
||
| 0x00560e8a in al, dx
|
||
| 0x00560e8b mov esp, 0x60bdf441
|
||
| 0x00560e90 lodsd
|
||
,==< 0x00560e91 jnbe 0x560ed9
|
||
|| 0x00560e93 aaa
|
||
|| 0x00560e94 sahf
|
||
|| 0x00560e95 mov edx, 0x14e9310f
|
||
| | 0x00560e9a add byte [eax], al
|
||
| | 0x00560e9c add byte [eax+0x6452dc36], ch
|
||
| 0x00560ea2 xlat
|
||
| 0x00560ea3 push 0x27
|
||
| 0x00560ea5 sub esp, edx
|
||
| 0x00560ea7 mov eax, dword [0xe8c1cf5d]
|
||
|,=< 0x00560eac jle 0x560f29
|
||
|| 0x00560eae inc ecx
|
||
|| 0x00560eaf mov byte [eax+0x5a], dl
|
||
| || 0x00560eb2 pop eax
|
||
EOF
|
||
RUN
|
||
|
||
NAME=asm.bb.middle json
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.nopskip=false
|
||
e analysis.jmp.mid=true
|
||
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
|
||
af
|
||
echo
|
||
echo ----1----
|
||
echo
|
||
e asm.bb.middle=true
|
||
pDj 19~{}
|
||
echo
|
||
echo ----2----
|
||
echo
|
||
e asm.bb.middle=false
|
||
pDj 19~{}
|
||
echo
|
||
echo ----3----
|
||
echo
|
||
e asm.bb.middle=true
|
||
pdfj~{}
|
||
EOF
|
||
EXPECT=<<EOF
|
||
|
||
----1----
|
||
|
||
[
|
||
{
|
||
"offset": 0,
|
||
"esil": ",",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 16,
|
||
"size": 5,
|
||
"opcode": "nop dword [rax+rax*1], eax",
|
||
"disasm": "nop dword [rax+rax*1], eax",
|
||
"bytes": "0f1f440000",
|
||
"family": "cpu",
|
||
"type": "nop",
|
||
"reloc": false,
|
||
"type_num": 8,
|
||
"type2_num": 0,
|
||
"flags": [
|
||
"fcn.00000000"
|
||
]
|
||
},
|
||
{
|
||
"offset": 3,
|
||
"esil": "al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=",
|
||
"refptr": true,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "add byte [rax], al",
|
||
"disasm": "add byte [rax], al",
|
||
"bytes": "0000",
|
||
"family": "cpu",
|
||
"type": "add",
|
||
"reloc": false,
|
||
"type_num": 17,
|
||
"type2_num": 0,
|
||
"xrefs_to": [
|
||
{
|
||
"addr": 17,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 5,
|
||
"ptr": 18446744072652587041,
|
||
"val": 18446744072652587041,
|
||
"esil": "18446744072652587041,rax,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 15,
|
||
"size": 5,
|
||
"opcode": "mov eax, 0xc1000021",
|
||
"disasm": "mov eax, 0xc1000021",
|
||
"bytes": "b8210000c1",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0
|
||
},
|
||
{
|
||
"offset": 9,
|
||
"val": 253,
|
||
"esil": "0,cf,:=,1,253,-,1,<<,ebx,&,?{,1,cf,:=,},253,ebx,>>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 16,
|
||
"size": 3,
|
||
"opcode": "shr ebx, 0xfd",
|
||
"disasm": "shr ebx, 0xfd",
|
||
"bytes": "c1ebfd",
|
||
"family": "cpu",
|
||
"type": "shr",
|
||
"reloc": false,
|
||
"type_num": 22,
|
||
"type2_num": 0,
|
||
"xrefs_to": [
|
||
{
|
||
"addr": 10,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 12,
|
||
"ptr": 44,
|
||
"val": 44,
|
||
"esil": "44,rbx,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "mov ebx, 0x2c",
|
||
"disasm": "mov ebx, 0x2c",
|
||
"bytes": "bb2c000000",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 44,
|
||
"type": "DATA"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 17,
|
||
"esil": "0x3,rip,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "jmp 0x3",
|
||
"disasm": "jmp 0x3",
|
||
"bytes": "ebf0",
|
||
"family": "cpu",
|
||
"type": "jmp",
|
||
"reloc": false,
|
||
"type_num": 1,
|
||
"type2_num": 0,
|
||
"jump": 3,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 3,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
|
||
----2----
|
||
|
||
[
|
||
{
|
||
"offset": 0,
|
||
"esil": ",",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "nop dword [rax+rax*1], eax",
|
||
"disasm": "nop dword [rax+rax*1], eax",
|
||
"bytes": "0f1f440000",
|
||
"family": "cpu",
|
||
"type": "nop",
|
||
"reloc": false,
|
||
"type_num": 8,
|
||
"type2_num": 0,
|
||
"flags": [
|
||
"fcn.00000000"
|
||
]
|
||
},
|
||
{
|
||
"offset": 5,
|
||
"ptr": 18446744072652587041,
|
||
"val": 18446744072652587041,
|
||
"esil": "18446744072652587041,rax,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "mov eax, 0xc1000021",
|
||
"disasm": "mov eax, 0xc1000021",
|
||
"bytes": "b8210000c1",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0
|
||
},
|
||
{
|
||
"offset": 10,
|
||
"esil": "0x9,rip,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "jmp 0x9",
|
||
"disasm": "jmp 0x9",
|
||
"bytes": "ebfd",
|
||
"family": "cpu",
|
||
"type": "jmp",
|
||
"reloc": false,
|
||
"type_num": 1,
|
||
"type2_num": 0,
|
||
"jump": 9,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 9,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 12,
|
||
"ptr": 44,
|
||
"val": 44,
|
||
"esil": "44,rbx,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "mov ebx, 0x2c",
|
||
"disasm": "mov ebx, 0x2c",
|
||
"bytes": "bb2c000000",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 44,
|
||
"type": "DATA"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 17,
|
||
"esil": "0x3,rip,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "jmp 0x3",
|
||
"disasm": "jmp 0x3",
|
||
"bytes": "ebf0",
|
||
"family": "cpu",
|
||
"type": "jmp",
|
||
"reloc": false,
|
||
"type_num": 1,
|
||
"type2_num": 0,
|
||
"jump": 3,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 3,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
|
||
----3----
|
||
|
||
{
|
||
"name": "fcn.00000000",
|
||
"size": 24,
|
||
"addr": 0,
|
||
"ops": [
|
||
{
|
||
"offset": 0,
|
||
"esil": ",",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "nop dword [rax+rax*1], eax",
|
||
"disasm": "nop dword [rax+rax*1], eax",
|
||
"bytes": "0f1f440000",
|
||
"family": "cpu",
|
||
"type": "nop",
|
||
"reloc": false,
|
||
"type_num": 8,
|
||
"type2_num": 0,
|
||
"flags": [
|
||
"fcn.00000000"
|
||
]
|
||
},
|
||
{
|
||
"offset": 3,
|
||
"esil": "al,rax,+=[1],7,$o,of,:=,7,$s,sf,:=,$z,zf,:=,7,$c,cf,:=,$p,pf,:=,3,$c,af,:=",
|
||
"refptr": true,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "add byte [rax], al",
|
||
"disasm": "add byte [rax], al",
|
||
"bytes": "0000",
|
||
"family": "cpu",
|
||
"type": "add",
|
||
"reloc": false,
|
||
"type_num": 17,
|
||
"type2_num": 0,
|
||
"xrefs_to": [
|
||
{
|
||
"addr": 17,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 5,
|
||
"ptr": 18446744072652587041,
|
||
"val": 18446744072652587041,
|
||
"esil": "18446744072652587041,rax,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "mov eax, 0xc1000021",
|
||
"disasm": "mov eax, 0xc1000021",
|
||
"bytes": "b8210000c1",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0
|
||
},
|
||
{
|
||
"offset": 10,
|
||
"esil": "0x9,rip,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "jmp 0x9",
|
||
"disasm": "jmp 0x9",
|
||
"bytes": "ebfd",
|
||
"family": "cpu",
|
||
"type": "jmp",
|
||
"reloc": false,
|
||
"type_num": 1,
|
||
"type2_num": 0,
|
||
"jump": 9,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 9,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 9,
|
||
"val": 253,
|
||
"esil": "0,cf,:=,1,253,-,1,<<,ebx,&,?{,1,cf,:=,},253,ebx,>>,ebx,=,$z,zf,:=,$p,pf,:=,31,$s,sf,:=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 16,
|
||
"size": 3,
|
||
"opcode": "shr ebx, 0xfd",
|
||
"disasm": "shr ebx, 0xfd",
|
||
"bytes": "c1ebfd",
|
||
"family": "cpu",
|
||
"type": "shr",
|
||
"reloc": false,
|
||
"type_num": 22,
|
||
"type2_num": 0,
|
||
"xrefs_to": [
|
||
{
|
||
"addr": 10,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 12,
|
||
"ptr": 44,
|
||
"val": 44,
|
||
"esil": "44,rbx,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 14,
|
||
"size": 5,
|
||
"opcode": "mov ebx, 0x2c",
|
||
"disasm": "mov ebx, 0x2c",
|
||
"bytes": "bb2c000000",
|
||
"family": "cpu",
|
||
"type": "mov",
|
||
"reloc": false,
|
||
"type_num": 9,
|
||
"type2_num": 0,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 44,
|
||
"type": "DATA"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"offset": 17,
|
||
"esil": "0x3,rip,=",
|
||
"refptr": false,
|
||
"fcn_addr": 0,
|
||
"fcn_last": 17,
|
||
"size": 2,
|
||
"opcode": "jmp 0x3",
|
||
"disasm": "jmp 0x3",
|
||
"bytes": "ebf0",
|
||
"family": "cpu",
|
||
"type": "jmp",
|
||
"reloc": false,
|
||
"type_num": 1,
|
||
"type2_num": 0,
|
||
"jump": 3,
|
||
"xrefs_from": [
|
||
{
|
||
"addr": 3,
|
||
"type": "CODE"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
EOF
|
||
RUN
|
||
|
||
NAME=asm.bb.middle and pdq
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.nopskip=false
|
||
e analysis.jmp.mid=true
|
||
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
|
||
af
|
||
e asm.bb.middle=true
|
||
pdq 6
|
||
echo
|
||
e asm.bb.middle=false
|
||
pdq 6
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00000000 fcn.00000000:
|
||
0x00000000 0f1f440000 nop dword [rax+rax*1], eax
|
||
0x00000003 0000 add byte [rax], al
|
||
0x00000005 b8210000c1 mov eax, 0xc1000021
|
||
0x00000009 c1ebfd shr ebx, 0xfd
|
||
0x0000000c bb2c000000 mov ebx, 0x2c
|
||
0x00000011 ebf0 jmp 0x3
|
||
|
||
0x00000000 fcn.00000000:
|
||
0x00000000 0f1f440000 nop dword [rax+rax*1], eax
|
||
0x00000005 b8210000c1 mov eax, 0xc1000021
|
||
0x0000000a ebfd jmp 0x9
|
||
0x0000000c bb2c000000 mov ebx, 0x2c
|
||
0x00000011 ebf0 jmp 0x3
|
||
0x00000013 0000 add byte [rax], al
|
||
EOF
|
||
RUN
|
||
|
||
NAME=asm.bb.middle and pif
|
||
FILE==
|
||
CMDS=<<EOF
|
||
e asm.arch=x86
|
||
e asm.bits=64
|
||
e analysis.nopskip=false
|
||
e analysis.jmp.mid=true
|
||
wx 0f1f440000b8210000c1ebfdbb2c000000ebf0
|
||
af
|
||
e asm.bb.middle=true
|
||
pif
|
||
echo
|
||
e asm.bb.middle=false
|
||
pif
|
||
EOF
|
||
EXPECT=<<EOF
|
||
nop dword [rax+rax*1], eax
|
||
add byte [rax], al
|
||
mov eax, 0xc1000021
|
||
shr ebx, 0xfd
|
||
mov ebx, 0x2c
|
||
jmp 0x3
|
||
|
||
nop dword [rax+rax*1], eax
|
||
mov eax, 0xc1000021
|
||
jmp 0x9
|
||
mov ebx, 0x2c
|
||
jmp 0x3
|
||
EOF
|
||
RUN
|
||
|
||
NAME=asm.bb.middle and asm.flags.middle
|
||
FILE=bins/pe/cmd_adf_sample0.exe
|
||
CMDS=<<EOF
|
||
e asm.bytes=true
|
||
e asm.xrefs=false
|
||
s 0x560e67
|
||
af
|
||
e asm.bb.middle=true
|
||
e asm.flags.middle=2
|
||
f sym.dummy @ 0x560e7d
|
||
pd 2 @ 0x560e7a
|
||
echo
|
||
fm 0x560e7c @ sym.dummy
|
||
pd 3 @ 0x560e7a
|
||
echo
|
||
fm 0x560e96 @ sym.dummy
|
||
pd 2 @ 0x560e95
|
||
echo
|
||
fm 0x560e97 @ sym.dummy
|
||
pd 3 @ 0x560e95
|
||
echo
|
||
e asm.bb.middle=false
|
||
f sym.real @ 0x00560e95
|
||
pd 3 @ 0x560e95
|
||
echo
|
||
pd 3 @ 0x560e95 @e:scr.color=1
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x00560e7a ~ 0085965e5052 add byte [ebp+0x52505e96], al
|
||
| ;-- sym.dummy:
|
||
| 0x00560e7d 5e pop esi
|
||
|
||
0x00560e7a ~ 0085965e5052 add byte [ebp+0x52505e96], al
|
||
;-- sym.dummy:
|
||
0x00560e7c 96 xchg esi, eax
|
||
| 0x00560e7d 5e pop esi
|
||
|
||
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
||
| ;-- sym.dummy:
|
||
| 0x00560e96 0f31 rdtsc
|
||
|
||
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
||
| ;-- (0x00560e97) sym.dummy:
|
||
| 0x00560e96 ~ 0f31 rdtsc
|
||
| 0x00560e98 e914000000 jmp 0x560eb1
|
||
|
||
;-- sym.real:
|
||
| ;-- (0x00560e97) sym.dummy:
|
||
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
||
| 0x00560e9a 0000 add byte [eax], al
|
||
| 0x00560e9c 00a836dc5264 add byte [eax+0x6452dc36], ch
|
||
|
||
[36m;-- sym.real:[0m
|
||
[36m|[0m [36m;-- [32m(0x00560e97)[36m sym.dummy:[0m
|
||
[32m0x00560e95[0m ~ [37mba[37m0f[33m31[37me9[37m14[0m [37mmov[0m[37m [0m[36medx[0m[37m, [0m[33m0x14e9310f[0m[0m[0m
|
||
[36m|[0m [32m0x00560e9a[0m [32m00[32m00[0m [33madd[0m[37m [0m[37mbyte[0m[37m [[0m[36meax[0m[37m], [0m[36mal[0m[0m[0m
|
||
[36m|[0m [32m0x00560e9c[0m [32m00[37ma8[33m36[37mdc[33m52[33m64[0m [33madd[0m[37m [0m[37mbyte[0m[37m [[0m[36meax[0m[37m+[0m[33m0x6452dc36[0m[37m], [0m[36mch[0m[0m[0m
|
||
EOF
|
||
RUN
|