d9950f7479
Variables on the stack are not identified by bp/sp+<offset> anymore, but by their address from the bottom of the stack frame (RzStackAddr), independent of how they are accessed. So now there are only two kinds of variables: stack and register. This required some major refactoring and other changes: * RzAnalysisVar.isarg was removed. Whether a variable is an argument is now specified implicitly by its storage location. * Varsub of struct fields had to be rewritten so fields can be queried by arbitrary stack addresses using the recently introduced sp tracking, as the old approach to fill a list with all fields would not work anymore. * analysis.vars.stackname was removed, new behavior is more similar to this being true before. * Variables will not be created at stack+0 now, because the return address is there. Before, vars were only created sometimes in such cases. * Variables created from bp offsets in x86 are not deleted anymore if the function's bp_frame is false (see removed rz_analysis_function_delete_vars_by_kind(fcn, RZ_ANALYSIS_VAR_KIND_BPV); calls). This may lead to some false-positive detected variables. Whether this really is a practical issue is yet to be seen. At least there are no meaningful tests that are broken by this. * Applying variables from dwarf needed some fixes for determining the correct stack locations of variables in order to write meaningful tests. The handling is still not entirely correct for all possibilities of dwarf info, but at least the changed/added test cases are right and serve as a reference for future changes. * Projects version 11 is introduced. * afvb commands have been removed, afvs now handles all stack vars.
859 lines
22 KiB
Text
859 lines
22 KiB
Text
NAME=mips hello reference analysis
|
|
FILE=bins/elf/analysis/mips-hello
|
|
CMDS=<<EOF
|
|
s sym.main
|
|
aac
|
|
afl~?
|
|
EOF
|
|
EXPECT=<<EOF
|
|
1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mozi aae functions
|
|
FILE=bins/elf/mips-mozi
|
|
CMDS=<<EOF
|
|
aae
|
|
aflc
|
|
EOF
|
|
EXPECT=<<EOF
|
|
436
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips hello ref anal
|
|
FILE=bins/elf/analysis/mips.elf
|
|
ARGS=-e bin.strings=false -e analysis.strings=true
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
s entry0
|
|
aae
|
|
s 0x0041ed50
|
|
pd 5~IGNORE
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0041ed58 24a54268 addiu a1, a1, 0x4268 ; 0x474268 ; "IGNORE" ; str.IGNORE
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips hello ref analysis subtract
|
|
FILE=bins/elf/analysis/busybox-mips
|
|
ARGS=-e bin.strings=false -e analysis.strings=true
|
|
CMDS=<<EOF
|
|
e analysis.resolve.pointers=false
|
|
e asm.bytes=true
|
|
aae @ entry0
|
|
pd 1 @ 0x00406228
|
|
fs strings
|
|
axt @ str.busybox
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00406228 fcc38424 addiu a0, a0, -0x3c04 ; 0x44c3fc ; "busybox" ; str.busybox
|
|
(nofunc); str.busybox 0x406228 [DATA] addiu a0, a0, -str.busybox
|
|
EOF
|
|
RUN
|
|
|
|
NAME=Calculate GP
|
|
FILE=bins/elf/analysis/mips64r2-ld-2.28.so
|
|
CMDS=<<EOF
|
|
s 0x000023f0
|
|
e asm.bytes=true
|
|
pd 1
|
|
s 0x00002494
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000023f0 208084df ld a0, -0x7fe0(gp) ; [0x37020:8]=0x10a0 segment.DYNAMIC
|
|
0x00002494 488099df ld t9, -0x7fb8(gp) ; [0x37048:8]=0x134f0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips ld(load doubleword) instruction
|
|
FILE=bins/elf/analysis/mips64r2-busybox-loongson
|
|
CMDS=<<EOF
|
|
s 0x120004460
|
|
e asm.bytes=true
|
|
f-*
|
|
fs-*
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x120004460 208084df ld a0, -0x7fe0(gp) ; [0x1200ee290:8]=0x120005074
|
|
EOF
|
|
RUN
|
|
|
|
NAME=gp-based ref
|
|
FILE=bins/elf/analysis/mips-hello
|
|
CMDS=<<EOF
|
|
aae @ entry0
|
|
axt @ str.Hello_World
|
|
EOF
|
|
EXPECT=<<EOF
|
|
(nofunc); str.Hello_World 0x805c4 [DATA] addiu a0, v0, str.Hello_World
|
|
EOF
|
|
RUN
|
|
|
|
NAME=assembler
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e asm.arch=mips.gnu
|
|
e asm.bits=32
|
|
e cfg.bigendian=0
|
|
pa lui t9, 0x41
|
|
e cfg.bigendian=1
|
|
pa lui t9, 0x41
|
|
e cfg.bigendian=0
|
|
pad 4100193c
|
|
e cfg.bigendian=1
|
|
pad 3c190041
|
|
EOF
|
|
EXPECT=<<EOF
|
|
4100193c
|
|
3c190041
|
|
lui t9, 0x41
|
|
lui t9, 0x41
|
|
EOF
|
|
RUN
|
|
|
|
NAME=with-spaces
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e asm.arch=mips.gnu
|
|
e asm.bits=32
|
|
e cfg.bigendian=0
|
|
pa addiu v0, v1, 33
|
|
pa addiu v0 v1 33
|
|
e cfg.bigendian=1
|
|
pa addiu v0, v1, 33
|
|
pa addiu v0 v1 33
|
|
EOF
|
|
EXPECT=<<EOF
|
|
21006224
|
|
21006224
|
|
24620021
|
|
24620021
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips hello pseudo move instruction
|
|
FILE=bins/elf/analysis/mips-hello
|
|
ARGS=-e bin.strings=false -e analysis.strings=false
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
pd 1 @ main+0x18
|
|
e asm.pseudo=true
|
|
pd 1 @ main+0x18
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x000805b8 21f0a003 move fp, sp
|
|
0x000805b8 21f0a003 fp = sp
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips pseudo sw + 0
|
|
FILE=malloc://32
|
|
ARGS=-a mips -m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.bytes=true
|
|
wx 0000beaf
|
|
pd 1
|
|
e asm.pseudo=true
|
|
pd 1
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x80100000 0000beaf sw fp, (sp)
|
|
0x80100000 0000beaf word [sp] = fp
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips LE anal
|
|
FILE=malloc://32
|
|
CMDS=<<EOF
|
|
wx 01001104
|
|
e asm.arch=mips
|
|
e asm.bits=32
|
|
e asm.nbytes=4
|
|
ao 1~type:[1]
|
|
EOF
|
|
EXPECT=<<EOF
|
|
call
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips LE back reference
|
|
FILE=malloc://32
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
wx 0000000000000000010000100000000000000000
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e asm.nbytes=4
|
|
af+ fcn.test @ 0x80100000
|
|
afb+ 0x80100000 0x80100000 20
|
|
pif
|
|
EOF
|
|
EXPECT=<<EOF
|
|
nop
|
|
nop
|
|
b 0x80100010
|
|
nop
|
|
nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips LE correct relative jump reference if not mapped from command line.
|
|
FILE=malloc://40
|
|
CMDS=<<EOF
|
|
e asm.calls=false
|
|
e asm.bits=32
|
|
e asm.bytes=true
|
|
e asm.arch=mips
|
|
e analysis.jmp.eob=true
|
|
e analysis.nopskip=false
|
|
e asm.cmtcol=0
|
|
e asm.comments=false
|
|
e asm.lines.bb=0
|
|
e asm.lines.fcn=0
|
|
e asm.nbytes=4
|
|
wx 0800040c000000000000000000000000000000000000000040040408000000000800e00300000000
|
|
aa 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.00000000 ();
|
|
0x00000000 0800040c jal 0x100020
|
|
0x00000004 00000000 nop
|
|
0x00000008 00000000 nop
|
|
0x0000000c 00000000 nop
|
|
0x00000010 00000000 nop
|
|
0x00000014 00000000 nop
|
|
0x00000018 40040408 j 0x101100
|
|
0x0000001c 00000000 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips LE correct relative jump reference if mapped from command line.
|
|
FILE=malloc://40
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bytes=true
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e analysis.jmp.eob=false
|
|
e asm.lines.bb=0
|
|
e asm.lines.fcn=false
|
|
e asm.nbytes=4
|
|
wx 0800040c000000000000000000000000000000000000000040040408000000000800e00300000000
|
|
af 2> /dev/null
|
|
pd 10
|
|
afl
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 0800040c jal fcn.80100020
|
|
0x80100004 00000000 nop
|
|
0x80100008 00000000 nop
|
|
0x8010000c 00000000 nop
|
|
0x80100010 00000000 nop
|
|
0x80100014 00000000 nop
|
|
0x80100018 40040408 j 0x80101100
|
|
0x8010001c 00000000 nop
|
|
; CALL XREF from fcn.80100000 @ 0x80100000
|
|
fcn.80100020 ();
|
|
0x80100020 0800e003 jr ra
|
|
0x80100024 00000000 nop
|
|
0x80100000 1 32 fcn.80100000
|
|
0x80100020 1 8 fcn.80100020
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing.
|
|
FILE=malloc://20
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bytes=true
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x80100000
|
|
wx 0800e0030a1844000000000000000000000000
|
|
af 2>/dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 0800e003 jr ra
|
|
0x80100004 0a184400 movz v1, v0, a0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing.
|
|
FILE=malloc://20
|
|
CMDS=<<EOF
|
|
e asm.calls=false
|
|
e asm.bits=32
|
|
e asm.bytes=true
|
|
e asm.arch=mips
|
|
e asm.nbytes=4
|
|
e asm.lines.fcn=false
|
|
wx 0800e0030a1844000000000000000000000000
|
|
af 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.00000000 ();
|
|
0x00000000 0800e003 jr ra
|
|
0x00000004 0a184400 movz v1, v0, a0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing with conditional jump loop.
|
|
FILE=malloc://40
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bits=32
|
|
e asm.bytes=true
|
|
e asm.arch=mips
|
|
e analysis.jmp.eob=false
|
|
e asm.comments=false
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x80100000
|
|
wx e0ffbd27000000000100001000000000fdff09150a1844000800e0032000bd270000000000000000000000
|
|
af 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 e0ffbd27 addiu sp, sp, -0x20
|
|
0x80100004 00000000 nop
|
|
0x80100008 01000010 b 0x80100010
|
|
0x8010000c 00000000 nop
|
|
0x80100010 fdff0915 bne t0, t1, 0x80100008
|
|
0x80100014 0a184400 movz v1, v0, a0
|
|
0x80100018 0800e003 jr ra
|
|
0x8010001c 2000bd27 addiu sp, sp, 0x20
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing with conditional jump forward.
|
|
FILE=malloc://40
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bytes=true
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e asm.comments=false
|
|
e analysis.jmp.eob=false
|
|
e analysis.nopskip=false
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x80100000
|
|
wx e0ffbd27000000000100001000000000000000000a1844000800e003 2000bd270000000000000000000000
|
|
af 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 e0ffbd27 addiu sp, sp, -0x20
|
|
0x80100004 00000000 nop
|
|
0x80100008 01000010 b 0x80100010
|
|
0x8010000c 00000000 nop
|
|
0x80100010 00000000 nop
|
|
0x80100014 0a184400 movz v1, v0, a0
|
|
0x80100018 0800e003 jr ra
|
|
0x8010001c 2000bd27 addiu sp, sp, 0x20
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing with conditional jump back.
|
|
FILE=malloc://40
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.arch=mips
|
|
e asm.bits=32
|
|
e asm.comments=false
|
|
e asm.bytes=true
|
|
e analysis.jmp.eob=false
|
|
e analysis.nopskip=false
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
wx e0ffbd27000000000000000000000000fdff09150a1844000800e0032000bd270000000000000000000000
|
|
af 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 e0ffbd27 addiu sp, sp, -0x20
|
|
0x80100004 00000000 nop
|
|
0x80100008 00000000 nop
|
|
0x8010000c 00000000 nop
|
|
0x80100010 fdff0915 bne t0, t1, 0x80100008
|
|
0x80100014 0a184400 movz v1, v0, a0
|
|
0x80100018 0800e003 jr ra
|
|
0x8010001c 2000bd27 addiu sp, sp, 0x20
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function sizing with conditional jump back then forward.
|
|
FILE=malloc://56
|
|
ARGS=-m 0x80100000
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.bytes=true
|
|
e asm.calls=false
|
|
e asm.arch=mips
|
|
e asm.bits=32
|
|
e asm.comments=false
|
|
e analysis.jmp.eob=false
|
|
e analysis.nopskip=false
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
wx e0ffbd27000000000000000000000000fdff09150000000001000010000000000a1844000800e0032000bd270000000000000000000000
|
|
af 2> /dev/null
|
|
pdf
|
|
EOF
|
|
EXPECT=<<EOF
|
|
fcn.80100000 ();
|
|
0x80100000 e0ffbd27 addiu sp, sp, -0x20
|
|
0x80100004 00000000 nop
|
|
0x80100008 00000000 nop
|
|
0x8010000c 00000000 nop
|
|
0x80100010 fdff0915 bne t0, t1, 0x80100008
|
|
0x80100014 00000000 nop
|
|
0x80100018 01000010 b 0x80100020
|
|
0x8010001c 00000000 nop
|
|
0x80100020 0a184400 movz v1, v0, a0
|
|
0x80100024 0800e003 jr ra
|
|
0x80100028 2000bd27 addiu sp, sp, 0x20
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips branch delay function detection #1.
|
|
FILE=malloc://160
|
|
ARGS=-m 0x8060b4f8
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bytes=true
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e asm.comments=0
|
|
e analysis.hasnext=1
|
|
e analysis.jmp.eob=0
|
|
e analysis.nopskip=1
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x8060b4f8
|
|
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
|
|
aa 2> /dev/null
|
|
pd 38
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x8060b4f8 00000000 nop
|
|
0x8060b4fc 00000000 nop
|
|
fcn.8060b500 (int32_t arg1, int32_t arg2);
|
|
; arg int32_t arg1 @ a0
|
|
; arg int32_t arg2 @ a1
|
|
0x8060b500 002e0500 sll a1, a1, 0x18
|
|
0x8060b504 032e0500 sra a1, a1, 0x18
|
|
0x8060b508 0f008010 beqz a0, 0x8060b548
|
|
0x8060b50c 21100000 move v0, zero
|
|
0x8060b510 492d1808 j 0x8060b524
|
|
0x8060b514 00008290 lbu v0, (a0)
|
|
0x8060b518 0800e003 jr ra
|
|
0x8060b51c 21108000 move v0, a0
|
|
0x8060b520 00008290 lbu v0, (a0)
|
|
0x8060b524 07004010 beqz v0, 0x8060b544
|
|
0x8060b528 00000000 nop
|
|
0x8060b52c 00160200 sll v0, v0, 0x18
|
|
0x8060b530 03160200 sra v0, v0, 0x18
|
|
0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
|
|
0x8060b538 00000000 nop
|
|
0x8060b53c 482d1808 j 0x8060b520
|
|
0x8060b540 01008424 addiu a0, a0, 1
|
|
0x8060b544 21100000 move v0, zero
|
|
0x8060b548 0800e003 jr ra
|
|
0x8060b54c 00000000 nop
|
|
fcn.8060b550 (int32_t arg1, int32_t arg2);
|
|
; arg int32_t arg1 @ a0
|
|
; arg int32_t arg2 @ a1
|
|
0x8060b550 0000a290 lbu v0, (a1)
|
|
0x8060b554 05004010 beqz v0, 0x8060b56c
|
|
0x8060b558 0100a524 addiu a1, a1, 1
|
|
0x8060b55c 000082a0 sb v0, (a0)
|
|
0x8060b560 0000a290 lbu v0, (a1)
|
|
0x8060b564 552d1808 j 0x8060b554
|
|
0x8060b568 01008424 addiu a0, a0, 1
|
|
0x8060b56c 0800e003 jr ra
|
|
0x8060b570 000080a0 sb zero, (a0)
|
|
0x8060b574 00000000 nop
|
|
fcn.8060b578 ();
|
|
0x8060b578 e0ffbd27 addiu sp, sp, -0x20
|
|
0x8060b57c 542d180c jal fcn.8060b550
|
|
0x8060b580 00000000 nop
|
|
0x8060b584 0800e003 jr ra
|
|
0x8060b588 2000bd27 addiu sp, sp, 0x20
|
|
0x8060b58c 00000000 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=GNU mips branch delay function detection #1.
|
|
FILE=malloc://160
|
|
ARGS=-m 0x8060b4f8
|
|
BROKEN=1
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.bits=32
|
|
e asm.arch=mips.gnu
|
|
e asm.comments=0
|
|
e analysis.hasnext=1
|
|
e analysis.jmp.eob=0
|
|
e analysis.nopskip=1
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x8060b4f8
|
|
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
|
|
aa 2> /dev/null
|
|
pd 38
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x8060b4f8 00000000 nop
|
|
0x8060b4fc 00000000 nop
|
|
fcn.8060b500 (int32_t arg1, int32_t arg2);
|
|
0x8060b500 002e0500 sll a1, a1, 0x18
|
|
0x8060b504 032e0500 sra a1, a1, 0x18
|
|
0x8060b508 0f008010 beqz a0, 0x8060b548
|
|
0x8060b50c 21100000 move v0, zero
|
|
0x8060b510 492d1808 j 0x8060b524
|
|
0x8060b514 00008290 lbu v0, 0(a0)
|
|
0x8060b518 0800e003 jr ra
|
|
0x8060b51c 21108000 move v0, a0
|
|
0x8060b520 00008290 lbu v0, 0(a0)
|
|
0x8060b524 07004010 beqz v0, 0x8060b544
|
|
0x8060b528 00000000 nop
|
|
0x8060b52c 00160200 sll v0, v0, 0x18
|
|
0x8060b530 03160200 sra v0, v0, 0x18
|
|
0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
|
|
0x8060b538 00000000 nop
|
|
0x8060b53c 482d1808 j 0x8060b520
|
|
0x8060b540 01008424 addiu a0, a0, 1
|
|
0x8060b544 21100000 move v0, zero
|
|
0x8060b548 0800e003 jr ra
|
|
0x8060b54c 00000000 nop
|
|
fcn.8060b550 (int32_t arg1, int32_t arg2);
|
|
0x8060b550 0000a290 lbu v0, 0(a1)
|
|
0x8060b554 05004010 beqz v0, 0x8060b56c
|
|
0x8060b558 0100a524 addiu a1, a1, 1
|
|
0x8060b55c 000082a0 sb v0, 0(a0)
|
|
0x8060b560 0000a290 lbu v0, 0(a1)
|
|
0x8060b564 552d1808 j 0x8060b554
|
|
0x8060b568 01008424 addiu a0, a0, 1
|
|
0x8060b56c 0800e003 jr ra
|
|
0x8060b570 000080a0 sb zero, (a0)
|
|
0x8060b574 00000000 nop
|
|
fcn.8060b578 ();
|
|
0x8060b578 e0ffbd27 addiu sp, sp, -32
|
|
0x8060b57c 542d180c jal fcn.8060b550
|
|
0x8060b580 00000000 nop
|
|
0x8060b584 0800e003 jr ra
|
|
0x8060b588 2000bd27 addiu sp, sp, 32
|
|
0x8060b58c 00000000 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=capstone: mips branch delay function detection #1.
|
|
FILE=malloc://160
|
|
ARGS=-m 0x8060b4f8
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bits=32
|
|
e asm.bytes=true
|
|
e asm.arch=mips
|
|
e analysis.noncode=1
|
|
e asm.comments=0
|
|
e analysis.hasnext=1
|
|
e analysis.jmp.eob=0
|
|
e analysis.nopskip=1
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=false
|
|
s 0x8060b4f8
|
|
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
|
|
aa 2> /dev/null
|
|
pd 38
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x8060b4f8 00000000 nop
|
|
0x8060b4fc 00000000 nop
|
|
fcn.8060b500 (int32_t arg1, int32_t arg2);
|
|
; arg int32_t arg1 @ a0
|
|
; arg int32_t arg2 @ a1
|
|
0x8060b500 002e0500 sll a1, a1, 0x18
|
|
0x8060b504 032e0500 sra a1, a1, 0x18
|
|
0x8060b508 0f008010 beqz a0, 0x8060b548
|
|
0x8060b50c 21100000 move v0, zero
|
|
0x8060b510 492d1808 j 0x8060b524
|
|
0x8060b514 00008290 lbu v0, (a0)
|
|
0x8060b518 0800e003 jr ra
|
|
0x8060b51c 21108000 move v0, a0
|
|
0x8060b520 00008290 lbu v0, (a0)
|
|
0x8060b524 07004010 beqz v0, 0x8060b544
|
|
0x8060b528 00000000 nop
|
|
0x8060b52c 00160200 sll v0, v0, 0x18
|
|
0x8060b530 03160200 sra v0, v0, 0x18
|
|
0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
|
|
0x8060b538 00000000 nop
|
|
0x8060b53c 482d1808 j 0x8060b520
|
|
0x8060b540 01008424 addiu a0, a0, 1
|
|
0x8060b544 21100000 move v0, zero
|
|
0x8060b548 0800e003 jr ra
|
|
0x8060b54c 00000000 nop
|
|
fcn.8060b550 (int32_t arg1, int32_t arg2);
|
|
; arg int32_t arg1 @ a0
|
|
; arg int32_t arg2 @ a1
|
|
0x8060b550 0000a290 lbu v0, (a1)
|
|
0x8060b554 05004010 beqz v0, 0x8060b56c
|
|
0x8060b558 0100a524 addiu a1, a1, 1
|
|
0x8060b55c 000082a0 sb v0, (a0)
|
|
0x8060b560 0000a290 lbu v0, (a1)
|
|
0x8060b564 552d1808 j 0x8060b554
|
|
0x8060b568 01008424 addiu a0, a0, 1
|
|
0x8060b56c 0800e003 jr ra
|
|
0x8060b570 000080a0 sb zero, (a0)
|
|
0x8060b574 00000000 nop
|
|
fcn.8060b578 ();
|
|
0x8060b578 e0ffbd27 addiu sp, sp, -0x20
|
|
0x8060b57c 542d180c jal fcn.8060b550
|
|
0x8060b580 00000000 nop
|
|
0x8060b584 0800e003 jr ra
|
|
0x8060b588 2000bd27 addiu sp, sp, 0x20
|
|
0x8060b58c 00000000 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=capstone: mips branch delay function detection #2.
|
|
FILE=malloc://160
|
|
ARGS=-m 0x8060b4f8
|
|
CMDS=<<EOF
|
|
e io.va=true
|
|
e asm.calls=false
|
|
e asm.bytes=true
|
|
e asm.bits=32
|
|
e asm.arch=mips
|
|
e analysis.noncode=1
|
|
e asm.comments=0
|
|
e analysis.hasnext=1
|
|
e analysis.jmp.eob=0
|
|
e analysis.nopskip=1
|
|
e asm.nbytes=4
|
|
e asm.lines.bb=false
|
|
e asm.lines.fcn=true
|
|
s 0x8060b4f8
|
|
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
|
|
aa 2> /dev/null
|
|
pd 38
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x8060b4f8 00000000 nop
|
|
0x8060b4fc 00000000 nop
|
|
/ fcn.8060b500 (int32_t arg1, int32_t arg2);
|
|
| ; arg int32_t arg1 @ a0
|
|
| ; arg int32_t arg2 @ a1
|
|
| 0x8060b500 002e0500 sll a1, a1, 0x18
|
|
| 0x8060b504 032e0500 sra a1, a1, 0x18
|
|
| 0x8060b508 0f008010 beqz a0, 0x8060b548
|
|
| 0x8060b50c 21100000 move v0, zero
|
|
| 0x8060b510 492d1808 j 0x8060b524
|
|
| 0x8060b514 00008290 lbu v0, (a0)
|
|
| 0x8060b518 0800e003 jr ra
|
|
| 0x8060b51c 21108000 move v0, a0
|
|
| 0x8060b520 00008290 lbu v0, (a0)
|
|
| 0x8060b524 07004010 beqz v0, 0x8060b544
|
|
| 0x8060b528 00000000 nop
|
|
| 0x8060b52c 00160200 sll v0, v0, 0x18
|
|
| 0x8060b530 03160200 sra v0, v0, 0x18
|
|
| 0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
|
|
| 0x8060b538 00000000 nop
|
|
| 0x8060b53c 482d1808 j 0x8060b520
|
|
| 0x8060b540 01008424 addiu a0, a0, 1
|
|
| 0x8060b544 21100000 move v0, zero
|
|
| 0x8060b548 0800e003 jr ra
|
|
\ 0x8060b54c 00000000 nop
|
|
/ fcn.8060b550 (int32_t arg1, int32_t arg2);
|
|
| ; arg int32_t arg1 @ a0
|
|
| ; arg int32_t arg2 @ a1
|
|
| 0x8060b550 0000a290 lbu v0, (a1)
|
|
| 0x8060b554 05004010 beqz v0, 0x8060b56c
|
|
| 0x8060b558 0100a524 addiu a1, a1, 1
|
|
| 0x8060b55c 000082a0 sb v0, (a0)
|
|
| 0x8060b560 0000a290 lbu v0, (a1)
|
|
| 0x8060b564 552d1808 j 0x8060b554
|
|
| 0x8060b568 01008424 addiu a0, a0, 1
|
|
| 0x8060b56c 0800e003 jr ra
|
|
\ 0x8060b570 000080a0 sb zero, (a0)
|
|
0x8060b574 00000000 nop
|
|
/ fcn.8060b578 ();
|
|
| 0x8060b578 e0ffbd27 addiu sp, sp, -0x20
|
|
| 0x8060b57c 542d180c jal fcn.8060b550
|
|
| 0x8060b580 00000000 nop
|
|
| 0x8060b584 0800e003 jr ra
|
|
\ 0x8060b588 2000bd27 addiu sp, sp, 0x20
|
|
0x8060b58c 00000000 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips big endian strings, calls, etc. analysis
|
|
FILE=bins/elf/analysis/mipsbe-ip
|
|
CMDS=<<EOF
|
|
s 0x00402088
|
|
e asm.bytes=true
|
|
pd 10
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00402088 8f84814c lw a0, -main(gp) ; [0x43522c:4]=0x402558 sym.main
|
|
0x0040208c 8fa50000 lw a1, (sp)
|
|
0x00402090 27a60004 addiu a2, sp, 4
|
|
0x00402094 2401fff8 addiu at, zero, -8
|
|
0x00402098 03a1e824 and sp, sp, at
|
|
0x0040209c 27bdffe0 addiu sp, sp, -0x20
|
|
0x004020a0 8f878230 lw a3, -sym._init(gp) ; [0x435310:4]=0x401ff4 sym._init
|
|
0x004020a4 8f888114 lw t0, -sym._fini(gp) ; [0x4351f4:4]=0x41eca0 sym._fini
|
|
0x004020a8 afa80010 sw t0, 0x10(sp)
|
|
0x004020ac afa20014 sw v0, 0x14(sp)
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips.gnu regs
|
|
FILE=
|
|
CMDS=<<EOF
|
|
e asm.arch=mips.gnu
|
|
ar
|
|
EOF
|
|
EXPECT=<<EOF
|
|
zero = 0x0000000000000000
|
|
at = 0x0000000000000000
|
|
v0 = 0x0000000000000000
|
|
v1 = 0x0000000000000000
|
|
a0 = 0x0000000000000000
|
|
a1 = 0x0000000000000000
|
|
a2 = 0x0000000000000000
|
|
a3 = 0x0000000000000000
|
|
t0 = 0x0000000000000000
|
|
t1 = 0x0000000000000000
|
|
t2 = 0x0000000000000000
|
|
t3 = 0x0000000000000000
|
|
t4 = 0x0000000000000000
|
|
t5 = 0x0000000000000000
|
|
t6 = 0x0000000000000000
|
|
t7 = 0x0000000000000000
|
|
s0 = 0x0000000000000000
|
|
s1 = 0x0000000000000000
|
|
s2 = 0x0000000000000000
|
|
s3 = 0x0000000000000000
|
|
s4 = 0x0000000000000000
|
|
s5 = 0x0000000000000000
|
|
s6 = 0x0000000000000000
|
|
s7 = 0x0000000000000000
|
|
t8 = 0x0000000000000000
|
|
t9 = 0x0000000000000000
|
|
k0 = 0x0000000000000000
|
|
k1 = 0x0000000000000000
|
|
gp = 0x0000000000000000
|
|
sp = 0x0000000000000000
|
|
fp = 0x0000000000000000
|
|
ra = 0x0000000000000000
|
|
pc = 0x0000000000000000
|
|
EOF
|
|
RUN
|
|
|
|
NAME=mips sp/bp tracking
|
|
FILE=bins/elf/vars-mips-bp
|
|
ARGS=-e bin.dbginfo=0
|
|
CMDS=<<EOF
|
|
s sym.varfunc
|
|
af
|
|
e asm.sub.var=0
|
|
e asm.comments=0
|
|
e asm.stackptr=0
|
|
pdf
|
|
afvx
|
|
EOF
|
|
EXPECT=<<EOF
|
|
/ sym.varfunc ();
|
|
| ; var int32_t var_20h @ stack - 0x20
|
|
| ; var int32_t var_18h @ stack - 0x18
|
|
| ; var int32_t var_14h @ stack - 0x14
|
|
| ; var int32_t var_10h @ stack - 0x10
|
|
| ; var int32_t var_ch @ stack - 0xc
|
|
| ; var int32_t var_8h @ stack - 0x8
|
|
| ; var int32_t var_4h @ stack - 0x4
|
|
| 0x00000794 lui gp, 2
|
|
| 0x00000798 addiu gp, gp, -0x7db4
|
|
| 0x0000079c addu gp, gp, t9
|
|
| 0x000007a0 addiu sp, sp, -0x30
|
|
| 0x000007a4 sw ra, 0x2c(sp)
|
|
| 0x000007a8 sw fp, 0x28(sp)
|
|
| 0x000007ac move fp, sp
|
|
| 0x000007b0 sw gp, 0x10(sp)
|
|
| 0x000007b4 addiu v0, zero, 1
|
|
| 0x000007b8 sw v0, 0x18(fp)
|
|
| 0x000007bc addiu v0, zero, 2
|
|
| 0x000007c0 sw v0, 0x1c(fp)
|
|
| 0x000007c4 addiu v0, zero, 3
|
|
| 0x000007c8 sw v0, 0x20(fp)
|
|
| 0x000007cc addiu v0, zero, 4
|
|
| 0x000007d0 sw v0, 0x24(fp)
|
|
| 0x000007d4 lw v0, -sym.leaffunc(gp)
|
|
| 0x000007d8 move t9, v0
|
|
| 0x000007dc bal sym.leaffunc
|
|
| 0x000007e0 nop
|
|
| 0x000007e4 lw gp, 0x10(fp)
|
|
| 0x000007e8 lw v0, 0x24(fp)
|
|
| 0x000007ec sw v0, 0x1c(fp)
|
|
| 0x000007f0 lw v0, 0x18(fp)
|
|
| 0x000007f4 move sp, fp
|
|
| 0x000007f8 lw ra, 0x2c(sp)
|
|
| 0x000007fc lw fp, 0x28(sp)
|
|
| 0x00000800 addiu sp, sp, 0x30
|
|
| 0x00000804 jr ra
|
|
\ 0x00000808 nop
|
|
afvR
|
|
var_4h 0x7f8
|
|
var_8h 0x7fc
|
|
var_20h 0x7e4
|
|
var_18h 0x7f0
|
|
var_14h
|
|
var_10h
|
|
var_ch 0x7e8
|
|
afvW
|
|
var_4h 0x7a4
|
|
var_8h 0x7a8
|
|
var_20h 0x7b0
|
|
var_18h 0x7b8
|
|
var_14h 0x7c0,0x7ec
|
|
var_10h 0x7c8
|
|
var_ch 0x7d0
|
|
EOF
|
|
RUN
|