d9950f7479
Variables on the stack are not identified by bp/sp+<offset> anymore, but by their address from the bottom of the stack frame (RzStackAddr), independent of how they are accessed. So now there are only two kinds of variables: stack and register. This required some major refactoring and other changes: * RzAnalysisVar.isarg was removed. Whether a variable is an argument is now specified implicitly by its storage location. * Varsub of struct fields had to be rewritten so fields can be queried by arbitrary stack addresses using the recently introduced sp tracking, as the old approach to fill a list with all fields would not work anymore. * analysis.vars.stackname was removed, new behavior is more similar to this being true before. * Variables will not be created at stack+0 now, because the return address is there. Before, vars were only created sometimes in such cases. * Variables created from bp offsets in x86 are not deleted anymore if the function's bp_frame is false (see removed rz_analysis_function_delete_vars_by_kind(fcn, RZ_ANALYSIS_VAR_KIND_BPV); calls). This may lead to some false-positive detected variables. Whether this really is a practical issue is yet to be seen. At least there are no meaningful tests that are broken by this. * Applying variables from dwarf needed some fixes for determining the correct stack locations of variables in order to write meaningful tests. The handling is still not entirely correct for all possibilities of dwarf info, but at least the changed/added test cases are right and serve as a reference for future changes. * Projects version 11 is introduced. * afvb commands have been removed, afvs now handles all stack vars.
144 lines
6.5 KiB
Text
144 lines
6.5 KiB
Text
NAME=pipe args
|
||
FILE==
|
||
CMDS=#!pipe echo hello world
|
||
EXPECT=<<EOF
|
||
hello world
|
||
EOF
|
||
RUN
|
||
|
||
NAME=rzpipe.py
|
||
FILE=bins/elf/_Exit (42)
|
||
CMDS=<<EOF
|
||
?q `env~?^ASAN_LD_PRELOAD=`
|
||
?+ env LD_PRELOAD=`env ASAN_LD_PRELOAD`
|
||
#!pipe python3 scripts/get-funcs.py
|
||
EOF
|
||
EXPECT=<<EOF
|
||
|
||
Function names:
|
||
entry0
|
||
sym.imp._Exit
|
||
|
||
Disassembly of entry0:
|
||
;-- section..text:
|
||
;-- .text:
|
||
;-- _start():
|
||
/ entry0 ();
|
||
| 0x08049020 push ebp ; [09] -r-x section size 16 named .text
|
||
| 0x08049021 mov ebp, esp
|
||
| 0x08049023 sub esp, 8
|
||
| 0x08049026 sub esp, 0xc
|
||
| 0x08049029 push 0x2a ; '*' ; 42
|
||
\ 0x0804902b call sym.imp._Exit ; void _Exit(int status)
|
||
|
||
EOF
|
||
RUN
|
||
|
||
NAME=rzpipe load project
|
||
FILE=--
|
||
CMDS=<<EOF
|
||
?q `env~?^ASAN_LD_PRELOAD=`
|
||
?+ env LD_PRELOAD=`env ASAN_LD_PRELOAD`
|
||
!python3 -c 'import rzpipe;rz=rzpipe.open("--");rz.cmd("Po bins/other/ls.rzdb");print(rz.cmd("?v custom_main"))'
|
||
EOF
|
||
EXPECT=<<EOF
|
||
0x4070
|
||
|
||
EOF
|
||
RUN
|
||
|
||
NAME=rzpipe.py - shared memory (shm://)
|
||
FILE=bins/elf/_Exit (42)
|
||
CMDS=<<EOF
|
||
?q `env~?^ASAN_LD_PRELOAD=`
|
||
?+ env LD_PRELOAD=`env ASAN_LD_PRELOAD`
|
||
#!pipe python3 scripts/shared_memory.py
|
||
EOF
|
||
EXPECT=<<EOF
|
||
Copying bins/elf/_Exit (42)...
|
||
Copied bins/elf/_Exit (42) succesfully
|
||
-------------
|
||
Shared buffer size 0x360c
|
||
-------------
|
||
{'arch': 'x86', 'baddr': 134512640, 'binsz': 13073, 'bintype': 'elf', 'bits': 32, 'class': 'ELF32', 'compiler': 'GCC: (GNU) 9.2.1 20190827 (Red Hat 9.2.1-1)', 'endian': 'LE', 'intrp': '/lib/ld-linux.so.2', 'laddr': 0, 'lang': 'c++', 'machine': 'Intel 80386', 'maxopsz': 16, 'minopsz': 1, 'os': 'linux', 'pcalign': 0, 'relro': 'partial', 'rpath': 'NONE', 'subsys': 'linux', 'stripped': False, 'crypto': False, 'havecode': True, 'va': True, 'sanitiz': False, 'static': False, 'linenum': True, 'lsyms': True, 'canary': False, 'PIE': False, 'RELROCS': True, 'NX': True}
|
||
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
||
0x08049020 5589 e583 ec08 83ec 0c6a 2ae8 e0ff ffff U........j*.....
|
||
|
||
0x08049020 1 16 entry0
|
||
0x08049010 1 6 sym.imp._Exit
|
||
|
||
;-- section..text:
|
||
;-- .text:
|
||
;-- _start():
|
||
/ entry0 ();
|
||
| 0x08049020 push ebp ; [09] -r-x section size 16 named .text
|
||
| 0x08049021 mov ebp, esp
|
||
| 0x08049023 sub esp, 8
|
||
| 0x08049026 sub esp, 0xc
|
||
| 0x08049029 push 0x2a ; '*' ; 42 ; int status
|
||
\ 0x0804902b call sym.imp._Exit ; void _Exit(int status)
|
||
|
||
Copying bins/pe/winver.exe...
|
||
Copied bins/pe/winver.exe succesfully
|
||
-------------
|
||
Shared buffer size 0x400
|
||
-------------
|
||
{'arch': 'x86', 'baddr': 4194304, 'binsz': 1024, 'bintype': 'pe', 'bits': 32, 'retguard': False, 'class': 'PE32', 'cmp.csum': '0x00005082', 'compiled': 'Thu Jan 1 00:00:00 1970 UTC', 'endian': 'LE', 'hdr.csum': '0x00000000', 'laddr': 0, 'lang': 'c', 'machine': 'i386', 'maxopsz': 16, 'minopsz': 1, 'os': 'windows', 'overlay': False, 'cc': 'cdecl', 'pcalign': 0, 'signed': False, 'subsys': 'Windows CUI', 'stripped': False, 'crypto': False, 'havecode': True, 'va': True, 'sanitiz': False, 'static': False, 'linenum': False, 'lsyms': False, 'canary': False, 'PIE': False, 'RELROCS': False, 'NX': False}
|
||
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
||
0x00401000 6880 1040 00ff 15b4 1140 00ff 3590 1040 h..@.....@..5..@
|
||
|
||
0x00401000 1 58 entry0
|
||
|
||
;-- section.sect_0:
|
||
/ entry0 ();
|
||
| 0x00401000 push 0x401080 ; LPOSVERSIONINFOA lpVersionInformation [0m; [00] -rwx section size 4096 named sect_0
|
||
| 0x00401005 call dword [sym.imp.kernel32.dll_GetVersionExA] ; 0x4011b4 ; BOOL GetVersionExA(LPOSVERSIONINFOA lpVersionInformation)
|
||
| 0x0040100b push dword [0x401090]
|
||
| 0x00401011 push dword [0x40108c]
|
||
| 0x00401017 push dword [0x401088]
|
||
| 0x0040101d push dword [0x401084]
|
||
| 0x00401023 push str.a_PE_overriding_OS_values:_OS_Ver__i._i._i_PlatformID__i ; 0x40103c ; " * a PE overriding OS values: OS Ver %i.%i.%i PlatformID %i\n\n" ; const char *format
|
||
| 0x00401028 call dword [sym.imp.msvcrt.dll_printf] ; 0x4011bc ; int printf(const char *format)
|
||
| 0x0040102e add esp, 0x10
|
||
| 0x00401031 nop
|
||
| 0x00401032 push 0 ; UINT uExitCode
|
||
\ 0x00401034 call dword [sym.imp.kernel32.dll_ExitProcess] ; 0x4011b0 ; VOID ExitProcess(UINT uExitCode)
|
||
|
||
Copying bins/mach0/mach0_2-x86_64...
|
||
Copied bins/mach0/mach0_2-x86_64 succesfully
|
||
-------------
|
||
Shared buffer size 0x10e8
|
||
-------------
|
||
{'arch': 'x86', 'baddr': 4294967296, 'binsz': 4328, 'bintype': 'mach0', 'bits': 64, 'class': 'MACH064', 'endian': 'LE', 'intrp': '/usr/lib/dyld', 'laddr': 0, 'lang': 'c', 'machine': 'x86 64 all', 'maxopsz': 16, 'minopsz': 1, 'os': 'macos', 'pcalign': 0, 'subsys': 'darwin', 'stripped': False, 'crypto': False, 'havecode': True, 'va': True, 'sanitiz': False, 'static': False, 'linenum': False, 'lsyms': False, 'canary': False, 'PIE': True, 'RELROCS': False, 'NX': False}
|
||
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
||
0x100000f70 5548 89e5 4883 ec10 c745 fc00 0000 0089 UH..H....E......
|
||
|
||
0x100000f70 1 36 entry0
|
||
0x100000f40 1 45 sym._foo
|
||
0x100000ef0 4 65 sym._bar
|
||
0x1000001d5 1 171 fcn.1000001d5
|
||
0x1000002e0 13 3088 -> 3110 fcn.1000002e0
|
||
|
||
;-- main:
|
||
;-- _main:
|
||
;-- func.100000f70:
|
||
/ entry0 (int64_t arg1, int64_t arg2);
|
||
| ; arg int64_t arg1 @ rdi
|
||
| ; arg int64_t arg2 @ rsi
|
||
| ; var int64_t var_18h @ stack - 0x18
|
||
| ; var int64_t var_10h @ stack - 0x10
|
||
| ; var int64_t var_ch @ stack - 0xc
|
||
| 0x100000f70 push rbp
|
||
| 0x100000f71 mov rbp, rsp
|
||
| 0x100000f74 sub rsp, 0x10
|
||
| 0x100000f78 mov dword [var_ch], 0
|
||
| 0x100000f7f mov dword [var_10h], edi ; arg1
|
||
| 0x100000f82 mov qword [var_18h], rsi ; arg2
|
||
| 0x100000f86 mov edi, dword [var_10h] ; int64_t arg1
|
||
| 0x100000f89 call sym._foo
|
||
| 0x100000f8e add rsp, 0x10
|
||
| 0x100000f92 pop rbp
|
||
\ 0x100000f93 ret
|
||
|
||
EOF
|
||
RUN
|