2f638cad1e
* Changed behavior of `f` to only add flag if there is none * Changed behavior of `f+` to add flag in any case * Moved listing subcommands from `f` to `fl` * Moved listing subcommands from `f.` to `f.l` * Added subcommand `f.l*` to list all local flags in all functions * Listing flags at the current offset became `fl.` * Moved `f=` to `fl=` * Old `fl` (flag length) now became `fL` * Removed original `fe` commands * Old `f?` (check if flag exists) now became `fe` * Removed `fV` commands * Removed `fn` commands in favor of `fl` and `asm.flags.real=true` * Removed `fS` commands (`fSo` and `fSn`) * `fo` became `fortune` and moved from "flags" to "shell" category * Removed oldshell handlers of the `z` commands
460 lines
20 KiB
Text
460 lines
20 KiB
Text
NAME=pe entrypoint
|
|
FILE=bins/pe/base.exe
|
|
CMDS=ie~program
|
|
EXPECT=<<EOF
|
|
0x00401280 0x00000680 ---------- 0x000000a8 program
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe overlay
|
|
FILE=bins/pe/base.exe
|
|
ARGS=-nn
|
|
CMDS=fl~pe_overlay
|
|
EXPECT=<<EOF
|
|
0x00032600 10233 pe_overlay
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe no overlay
|
|
FILE=bins/pe/normal.exe
|
|
CMDS=iI~overlay
|
|
EXPECT=<<EOF
|
|
overlay false
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe relocs [r2]
|
|
FILE=bins/pe/base.exe
|
|
CMDS=<<EOF
|
|
e asm.functions=false
|
|
e asm.flags=false
|
|
pd 1@0x401820~!imp
|
|
EOF
|
|
EXPECT=<<EOF
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe relocs [rz-bin a.exe]
|
|
FILE=bins/pe/a.exe
|
|
CMDS=ir
|
|
EXPECT=<<EOF
|
|
vaddr paddr type name
|
|
----------------------------------------------------------------------
|
|
0x000050fc 0x000012a0 SET_32 KERNEL32.dll_AddAtomA
|
|
0x00005108 0x000012a4 SET_32 KERNEL32.dll_ExitProcess
|
|
0x00005116 0x000012a8 SET_32 KERNEL32.dll_FindAtomA
|
|
0x00005122 0x000012ac SET_32 KERNEL32.dll_GetAtomNameA
|
|
0x00005132 0x000012b0 SET_32 KERNEL32.dll_SetUnhandledExceptionFilter
|
|
0x00005150 0x000012bc SET_32 msvcrt.dll___getmainargs
|
|
0x00005160 0x000012c0 SET_32 msvcrt.dll___p__environ
|
|
0x00005170 0x000012c4 SET_32 msvcrt.dll___p__fmode
|
|
0x0000517e 0x000012c8 SET_32 msvcrt.dll___set_app_type
|
|
0x00005190 0x000012cc SET_32 msvcrt.dll__assert
|
|
0x0000519a 0x000012d0 SET_32 msvcrt.dll__cexit
|
|
0x000051a4 0x000012d4 SET_32 msvcrt.dll__iob
|
|
0x000051ac 0x000012d8 SET_32 msvcrt.dll__onexit
|
|
0x000051b6 0x000012dc SET_32 msvcrt.dll__setmode
|
|
0x000051c2 0x000012e0 SET_32 msvcrt.dll_abort
|
|
0x000051ca 0x000012e4 SET_32 msvcrt.dll_atexit
|
|
0x000051d4 0x000012e8 SET_32 msvcrt.dll_free
|
|
0x000051dc 0x000012ec SET_32 msvcrt.dll_malloc
|
|
0x000051e6 0x000012f0 SET_32 msvcrt.dll_printf
|
|
0x000051f0 0x000012f4 SET_32 msvcrt.dll_signal
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe relocs [rz-bin b.exe]
|
|
FILE=bins/pe/b.exe
|
|
CMDS=ir
|
|
EXPECT=<<EOF
|
|
vaddr paddr type name
|
|
----------------------------------------------------------------------
|
|
0x000050fc 0x000012a0 SET_32 KERNEL32.dll_AddAtomA
|
|
0x00005108 0x000012a4 SET_32 KERNEL32.dll_ExitProcess
|
|
0x00005116 0x000012a8 SET_32 KERNEL32.dll_FindAtomA
|
|
0x00005122 0x000012ac SET_32 KERNEL32.dll_GetAtomNameA
|
|
0x00005132 0x000012b0 SET_32 KERNEL32.dll_SetUnhandledExceptionFilter
|
|
0x00005150 0x000012bc SET_32 msvcrt.dll___getmainargs
|
|
0x00005160 0x000012c0 SET_32 msvcrt.dll___p__environ
|
|
0x00005170 0x000012c4 SET_32 msvcrt.dll___p__fmode
|
|
0x0000517e 0x000012c8 SET_32 msvcrt.dll___set_app_type
|
|
0x00005190 0x000012cc SET_32 msvcrt.dll__assert
|
|
0x0000519a 0x000012d0 SET_32 msvcrt.dll__cexit
|
|
0x000051a4 0x000012d4 SET_32 msvcrt.dll__iob
|
|
0x000051ac 0x000012d8 SET_32 msvcrt.dll__onexit
|
|
0x000051b6 0x000012dc SET_32 msvcrt.dll__setmode
|
|
0x000051c2 0x000012e0 SET_32 msvcrt.dll_abort
|
|
0x000051ca 0x000012e4 SET_32 msvcrt.dll_atexit
|
|
0x000051d4 0x000012e8 SET_32 msvcrt.dll_free
|
|
0x000051dc 0x000012ec SET_32 msvcrt.dll_malloc
|
|
0x000051e6 0x000012f0 SET_32 msvcrt.dll_printf
|
|
0x000051f0 0x000012f4 SET_32 msvcrt.dll_signal
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe string
|
|
FILE=bins/pe/base.exe
|
|
CMDS=<<EOF
|
|
e asm.lines.bb=false
|
|
e asm.bytes=false
|
|
e asm.comments=false
|
|
pd 1@ 0x0040131a~str.Hello
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x0040131a mov dword [esp], str.Hello
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe32 imported libs (il)
|
|
FILE=bins/pe/imports_1210.exe
|
|
CMDS=il
|
|
EXPECT=<<EOF
|
|
library
|
|
-------------
|
|
kernel32.dll
|
|
user32.dll
|
|
advapi32.dll
|
|
oleaut32.dll
|
|
ole32.dll
|
|
pstorec.dll
|
|
rasapi32.dll
|
|
shell32.dll
|
|
crypt32.dll
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe32 imported functions (ii)
|
|
FILE=bins/pe/imports_1210.exe
|
|
CMDS=ii
|
|
EXPECT=<<EOF
|
|
nth vaddr bind type lib name
|
|
----------------------------------------------------------------
|
|
1 0x0041217c NONE FUNC kernel32.dll DeleteCriticalSection
|
|
2 0x00412180 NONE FUNC kernel32.dll LeaveCriticalSection
|
|
3 0x00412184 NONE FUNC kernel32.dll EnterCriticalSection
|
|
4 0x00412188 NONE FUNC kernel32.dll InitializeCriticalSection
|
|
5 0x0041218c NONE FUNC kernel32.dll VirtualFree
|
|
6 0x00412190 NONE FUNC kernel32.dll VirtualAlloc
|
|
7 0x00412194 NONE FUNC kernel32.dll LocalFree
|
|
8 0x00412198 NONE FUNC kernel32.dll LocalAlloc
|
|
9 0x0041219c NONE FUNC kernel32.dll GetVersion
|
|
10 0x004121a0 NONE FUNC kernel32.dll GetCurrentThreadId
|
|
11 0x004121a4 NONE FUNC kernel32.dll WideCharToMultiByte
|
|
12 0x004121a8 NONE FUNC kernel32.dll MultiByteToWideChar
|
|
13 0x004121ac NONE FUNC kernel32.dll GetThreadLocale
|
|
14 0x004121b0 NONE FUNC kernel32.dll GetStartupInfoA
|
|
15 0x004121b4 NONE FUNC kernel32.dll GetModuleFileNameA
|
|
16 0x004121b8 NONE FUNC kernel32.dll GetLocaleInfoA
|
|
17 0x004121bc NONE FUNC kernel32.dll GetCommandLineA
|
|
18 0x004121c0 NONE FUNC kernel32.dll FreeLibrary
|
|
19 0x004121c4 NONE FUNC kernel32.dll ExitProcess
|
|
20 0x004121c8 NONE FUNC kernel32.dll WriteFile
|
|
21 0x004121cc NONE FUNC kernel32.dll UnhandledExceptionFilter
|
|
22 0x004121d0 NONE FUNC kernel32.dll RtlUnwind
|
|
23 0x004121d4 NONE FUNC kernel32.dll RaiseException
|
|
24 0x004121d8 NONE FUNC kernel32.dll GetStdHandle
|
|
1 0x004121e0 NONE FUNC user32.dll GetKeyboardType
|
|
2 0x004121e4 NONE FUNC user32.dll MessageBoxA
|
|
3 0x004121e8 NONE FUNC user32.dll CharNextA
|
|
1 0x004121f0 NONE FUNC advapi32.dll RegQueryValueExA
|
|
2 0x004121f4 NONE FUNC advapi32.dll RegOpenKeyExA
|
|
3 0x004121f8 NONE FUNC advapi32.dll RegCloseKey
|
|
1 0x00412200 NONE FUNC oleaut32.dll SysFreeString
|
|
2 0x00412204 NONE FUNC oleaut32.dll SysReAllocStringLen
|
|
3 0x00412208 NONE FUNC oleaut32.dll SysAllocStringLen
|
|
1 0x00412210 NONE FUNC kernel32.dll TlsSetValue
|
|
2 0x00412214 NONE FUNC kernel32.dll TlsGetValue
|
|
3 0x00412198 NONE FUNC kernel32.dll LocalAlloc
|
|
4 0x0041221c NONE FUNC kernel32.dll GetModuleHandleA
|
|
1 0x00412224 NONE FUNC advapi32.dll RegSetValueExA
|
|
2 0x004121f0 NONE FUNC advapi32.dll RegQueryValueExA
|
|
3 0x004121f4 NONE FUNC advapi32.dll RegOpenKeyExA
|
|
4 0x00412230 NONE FUNC advapi32.dll RegEnumValueA
|
|
5 0x00412234 NONE FUNC advapi32.dll RegDeleteKeyA
|
|
6 0x00412238 NONE FUNC advapi32.dll RegCreateKeyExA
|
|
7 0x0041223c NONE FUNC advapi32.dll RegCreateKeyA
|
|
8 0x004121f8 NONE FUNC advapi32.dll RegCloseKey
|
|
9 0x00412244 NONE FUNC advapi32.dll OpenProcessToken
|
|
10 0x00412248 NONE FUNC advapi32.dll LookupAccountNameA
|
|
11 0x0041224c NONE FUNC advapi32.dll IsValidSid
|
|
12 0x00412250 NONE FUNC advapi32.dll GetUserNameA
|
|
1 0x00412258 NONE FUNC kernel32.dll lstrlenA
|
|
2 0x0041225c NONE FUNC kernel32.dll lstrcmpiA
|
|
3 0x00412260 NONE FUNC kernel32.dll WriteProcessMemory
|
|
4 0x004121c8 NONE FUNC kernel32.dll WriteFile
|
|
5 0x00412268 NONE FUNC kernel32.dll WaitForSingleObject
|
|
6 0x0041226c NONE FUNC kernel32.dll VirtualProtect
|
|
7 0x0041218c NONE FUNC kernel32.dll VirtualFree
|
|
8 0x00412274 NONE FUNC kernel32.dll VirtualAllocEx
|
|
9 0x00412190 NONE FUNC kernel32.dll VirtualAlloc
|
|
10 0x0041227c NONE FUNC kernel32.dll Sleep
|
|
11 0x00412280 NONE FUNC kernel32.dll SizeofResource
|
|
12 0x00412284 NONE FUNC kernel32.dll SetFilePointer
|
|
13 0x00412288 NONE FUNC kernel32.dll SetFileAttributesA
|
|
14 0x0041228c NONE FUNC kernel32.dll ReadProcessMemory
|
|
15 0x00412290 NONE FUNC kernel32.dll ReadFile
|
|
16 0x00412294 NONE FUNC kernel32.dll OpenProcess
|
|
17 0x00412298 NONE FUNC kernel32.dll LockResource
|
|
18 0x0041229c NONE FUNC kernel32.dll LoadResource
|
|
19 0x004122a0 NONE FUNC kernel32.dll LoadLibraryA
|
|
20 0x004122a4 NONE FUNC kernel32.dll GlobalFree
|
|
21 0x004122a8 NONE FUNC kernel32.dll GetVersionExA
|
|
22 0x004122ac NONE FUNC kernel32.dll GetTickCount
|
|
23 0x004122b0 NONE FUNC kernel32.dll GetProcAddress
|
|
24 0x004122b4 NONE FUNC kernel32.dll GetPrivateProfileStringA
|
|
25 0x004122b8 NONE FUNC kernel32.dll GetPrivateProfileIntA
|
|
26 0x0041221c NONE FUNC kernel32.dll GetModuleHandleA
|
|
27 0x004122c0 NONE FUNC kernel32.dll GetLastError
|
|
28 0x004122c4 NONE FUNC kernel32.dll GetFileSize
|
|
29 0x004122c8 NONE FUNC kernel32.dll GetFileAttributesA
|
|
30 0x004122cc NONE FUNC kernel32.dll GetExitCodeThread
|
|
31 0x004122d0 NONE FUNC kernel32.dll GetCurrentProcess
|
|
32 0x004122d4 NONE FUNC kernel32.dll FreeResource
|
|
33 0x004121c0 NONE FUNC kernel32.dll FreeLibrary
|
|
34 0x004122dc NONE FUNC kernel32.dll FindResourceA
|
|
35 0x004122e0 NONE FUNC kernel32.dll FindFirstFileA
|
|
36 0x004122e4 NONE FUNC kernel32.dll FindClose
|
|
37 0x004121c4 NONE FUNC kernel32.dll ExitProcess
|
|
38 0x004122ec NONE FUNC kernel32.dll DeleteFileA
|
|
39 0x004122f0 NONE FUNC kernel32.dll CreateRemoteThread
|
|
40 0x004122f4 NONE FUNC kernel32.dll CreateProcessA
|
|
41 0x004122f8 NONE FUNC kernel32.dll CreateMutexA
|
|
42 0x004122fc NONE FUNC kernel32.dll CreateFileA
|
|
43 0x00412300 NONE FUNC kernel32.dll CreateDirectoryA
|
|
44 0x00412304 NONE FUNC kernel32.dll CopyFileA
|
|
45 0x00412308 NONE FUNC kernel32.dll CloseHandle
|
|
1 0x00412310 NONE FUNC user32.dll wvsprintfA
|
|
2 0x00412314 NONE FUNC user32.dll TranslateMessage
|
|
3 0x00412318 NONE FUNC user32.dll ToAscii
|
|
4 0x0041231c NONE FUNC user32.dll SetWindowsHookExA
|
|
5 0x00412320 NONE FUNC user32.dll PeekMessageA
|
|
6 0x00412324 NONE FUNC user32.dll GetWindowThreadProcessId
|
|
7 0x00412328 NONE FUNC user32.dll GetKeyboardState
|
|
8 0x0041232c NONE FUNC user32.dll FindWindowA
|
|
9 0x00412330 NONE FUNC user32.dll DispatchMessageA
|
|
10 0x00412334 NONE FUNC user32.dll CharLowerA
|
|
11 0x00412338 NONE FUNC user32.dll CharUpperA
|
|
1 0x00412340 NONE FUNC ole32.dll OleInitialize
|
|
2 0x00412344 NONE FUNC ole32.dll CoCreateInstance
|
|
1 0x0041234c NONE FUNC ole32.dll CoTaskMemFree
|
|
1 0x00412354 NONE FUNC pstorec.dll PStoreCreateInstance
|
|
1 0x0041235c NONE FUNC ole32.dll StringFromCLSID
|
|
1 0x00412364 NONE FUNC rasapi32.dll RasGetEntryDialParamsA
|
|
2 0x00412368 NONE FUNC rasapi32.dll RasEnumEntriesA
|
|
1 0x00412370 NONE FUNC shell32.dll SHGetSpecialFolderPathA
|
|
1 0x00412378 NONE FUNC advapi32.dll LsaFreeMemory
|
|
2 0x0041237c NONE FUNC advapi32.dll LsaClose
|
|
3 0x00412380 NONE FUNC advapi32.dll LsaRetrievePrivateData
|
|
4 0x00412384 NONE FUNC advapi32.dll LsaOpenPolicy
|
|
5 0x00412388 NONE FUNC advapi32.dll ConvertSidToStringSidA
|
|
1 0x00412390 NONE FUNC crypt32.dll CryptUnprotectData
|
|
1 0x00412398 NONE FUNC advapi32.dll CredEnumerateA
|
|
1 0x004123a0 NONE FUNC advapi32.dll CryptDestroyHash
|
|
2 0x004123a4 NONE FUNC advapi32.dll CryptHashData
|
|
3 0x004123a8 NONE FUNC advapi32.dll CryptCreateHash
|
|
4 0x004123ac NONE FUNC advapi32.dll CryptGetHashParam
|
|
5 0x004123b0 NONE FUNC advapi32.dll CryptReleaseContext
|
|
6 0x004123b4 NONE FUNC advapi32.dll CryptAcquireContextA
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe32 imported relocations (ir)
|
|
FILE=bins/pe/imports_1210.exe
|
|
CMDS=ir
|
|
EXPECT=<<EOF
|
|
vaddr paddr type name
|
|
--------------------------------------------------------------------
|
|
0x000123ca 0x0000097c SET_32 kernel32.dll_DeleteCriticalSection
|
|
0x000123e2 0x00000980 SET_32 kernel32.dll_LeaveCriticalSection
|
|
0x000123fa 0x00000984 SET_32 kernel32.dll_EnterCriticalSection
|
|
0x00012412 0x00000988 SET_32 kernel32.dll_InitializeCriticalSection
|
|
0x0001242e 0x0000098c SET_32 kernel32.dll_VirtualFree
|
|
0x0001243c 0x00000990 SET_32 kernel32.dll_VirtualAlloc
|
|
0x0001244c 0x00000994 SET_32 kernel32.dll_LocalFree
|
|
0x00012458 0x00000998 SET_32 kernel32.dll_LocalAlloc
|
|
0x00012466 0x0000099c SET_32 kernel32.dll_GetVersion
|
|
0x00012474 0x000009a0 SET_32 kernel32.dll_GetCurrentThreadId
|
|
0x0001248a 0x000009a4 SET_32 kernel32.dll_WideCharToMultiByte
|
|
0x000124a0 0x000009a8 SET_32 kernel32.dll_MultiByteToWideChar
|
|
0x000124b6 0x000009ac SET_32 kernel32.dll_GetThreadLocale
|
|
0x000124c8 0x000009b0 SET_32 kernel32.dll_GetStartupInfoA
|
|
0x000124da 0x000009b4 SET_32 kernel32.dll_GetModuleFileNameA
|
|
0x000124f0 0x000009b8 SET_32 kernel32.dll_GetLocaleInfoA
|
|
0x00012502 0x000009bc SET_32 kernel32.dll_GetCommandLineA
|
|
0x00012514 0x000009c0 SET_32 kernel32.dll_FreeLibrary
|
|
0x00012522 0x000009c4 SET_32 kernel32.dll_ExitProcess
|
|
0x00012530 0x000009c8 SET_32 kernel32.dll_WriteFile
|
|
0x0001253c 0x000009cc SET_32 kernel32.dll_UnhandledExceptionFilter
|
|
0x00012558 0x000009d0 SET_32 kernel32.dll_RtlUnwind
|
|
0x00012564 0x000009d4 SET_32 kernel32.dll_RaiseException
|
|
0x00012576 0x000009d8 SET_32 kernel32.dll_GetStdHandle
|
|
0x00012592 0x000009e0 SET_32 user32.dll_GetKeyboardType
|
|
0x000125a4 0x000009e4 SET_32 user32.dll_MessageBoxA
|
|
0x000125b2 0x000009e8 SET_32 user32.dll_CharNextA
|
|
0x000125cc 0x000009f0 SET_32 advapi32.dll_RegQueryValueExA
|
|
0x000125e0 0x000009f4 SET_32 advapi32.dll_RegOpenKeyExA
|
|
0x000125f0 0x000009f8 SET_32 advapi32.dll_RegCloseKey
|
|
0x0001260c 0x00000a00 SET_32 oleaut32.dll_SysFreeString
|
|
0x0001261c 0x00000a04 SET_32 oleaut32.dll_SysReAllocStringLen
|
|
0x00012632 0x00000a08 SET_32 oleaut32.dll_SysAllocStringLen
|
|
0x00012654 0x00000a10 SET_32 kernel32.dll_TlsSetValue
|
|
0x00012662 0x00000a14 SET_32 kernel32.dll_TlsGetValue
|
|
0x00012670 0x00000a18 SET_32 kernel32.dll_LocalAlloc
|
|
0x0001267e 0x00000a1c SET_32 kernel32.dll_GetModuleHandleA
|
|
0x000126a0 0x00000a24 SET_32 advapi32.dll_RegSetValueExA
|
|
0x000126b2 0x00000a28 SET_32 advapi32.dll_RegQueryValueExA
|
|
0x000126c6 0x00000a2c SET_32 advapi32.dll_RegOpenKeyExA
|
|
0x000126d6 0x00000a30 SET_32 advapi32.dll_RegEnumValueA
|
|
0x000126e6 0x00000a34 SET_32 advapi32.dll_RegDeleteKeyA
|
|
0x000126f6 0x00000a38 SET_32 advapi32.dll_RegCreateKeyExA
|
|
0x00012708 0x00000a3c SET_32 advapi32.dll_RegCreateKeyA
|
|
0x00012718 0x00000a40 SET_32 advapi32.dll_RegCloseKey
|
|
0x00012726 0x00000a44 SET_32 advapi32.dll_OpenProcessToken
|
|
0x0001273a 0x00000a48 SET_32 advapi32.dll_LookupAccountNameA
|
|
0x00012750 0x00000a4c SET_32 advapi32.dll_IsValidSid
|
|
0x0001275e 0x00000a50 SET_32 advapi32.dll_GetUserNameA
|
|
0x0001277c 0x00000a58 SET_32 kernel32.dll_lstrlenA
|
|
0x00012788 0x00000a5c SET_32 kernel32.dll_lstrcmpiA
|
|
0x00012794 0x00000a60 SET_32 kernel32.dll_WriteProcessMemory
|
|
0x000127aa 0x00000a64 SET_32 kernel32.dll_WriteFile
|
|
0x000127b6 0x00000a68 SET_32 kernel32.dll_WaitForSingleObject
|
|
0x000127cc 0x00000a6c SET_32 kernel32.dll_VirtualProtect
|
|
0x000127de 0x00000a70 SET_32 kernel32.dll_VirtualFree
|
|
0x000127ec 0x00000a74 SET_32 kernel32.dll_VirtualAllocEx
|
|
0x000127fe 0x00000a78 SET_32 kernel32.dll_VirtualAlloc
|
|
0x0001280e 0x00000a7c SET_32 kernel32.dll_Sleep
|
|
0x00012816 0x00000a80 SET_32 kernel32.dll_SizeofResource
|
|
0x00012828 0x00000a84 SET_32 kernel32.dll_SetFilePointer
|
|
0x0001283a 0x00000a88 SET_32 kernel32.dll_SetFileAttributesA
|
|
0x00012850 0x00000a8c SET_32 kernel32.dll_ReadProcessMemory
|
|
0x00012864 0x00000a90 SET_32 kernel32.dll_ReadFile
|
|
0x00012870 0x00000a94 SET_32 kernel32.dll_OpenProcess
|
|
0x0001287e 0x00000a98 SET_32 kernel32.dll_LockResource
|
|
0x0001288e 0x00000a9c SET_32 kernel32.dll_LoadResource
|
|
0x0001289e 0x00000aa0 SET_32 kernel32.dll_LoadLibraryA
|
|
0x000128ae 0x00000aa4 SET_32 kernel32.dll_GlobalFree
|
|
0x000128bc 0x00000aa8 SET_32 kernel32.dll_GetVersionExA
|
|
0x000128cc 0x00000aac SET_32 kernel32.dll_GetTickCount
|
|
0x000128dc 0x00000ab0 SET_32 kernel32.dll_GetProcAddress
|
|
0x000128ee 0x00000ab4 SET_32 kernel32.dll_GetPrivateProfileStringA
|
|
0x0001290a 0x00000ab8 SET_32 kernel32.dll_GetPrivateProfileIntA
|
|
0x00012922 0x00000abc SET_32 kernel32.dll_GetModuleHandleA
|
|
0x00012936 0x00000ac0 SET_32 kernel32.dll_GetLastError
|
|
0x00012946 0x00000ac4 SET_32 kernel32.dll_GetFileSize
|
|
0x00012954 0x00000ac8 SET_32 kernel32.dll_GetFileAttributesA
|
|
0x0001296a 0x00000acc SET_32 kernel32.dll_GetExitCodeThread
|
|
0x0001297e 0x00000ad0 SET_32 kernel32.dll_GetCurrentProcess
|
|
0x00012992 0x00000ad4 SET_32 kernel32.dll_FreeResource
|
|
0x000129a2 0x00000ad8 SET_32 kernel32.dll_FreeLibrary
|
|
0x000129b0 0x00000adc SET_32 kernel32.dll_FindResourceA
|
|
0x000129c0 0x00000ae0 SET_32 kernel32.dll_FindFirstFileA
|
|
0x000129d2 0x00000ae4 SET_32 kernel32.dll_FindClose
|
|
0x000129de 0x00000ae8 SET_32 kernel32.dll_ExitProcess
|
|
0x000129ec 0x00000aec SET_32 kernel32.dll_DeleteFileA
|
|
0x000129fa 0x00000af0 SET_32 kernel32.dll_CreateRemoteThread
|
|
0x00012a10 0x00000af4 SET_32 kernel32.dll_CreateProcessA
|
|
0x00012a22 0x00000af8 SET_32 kernel32.dll_CreateMutexA
|
|
0x00012a32 0x00000afc SET_32 kernel32.dll_CreateFileA
|
|
0x00012a40 0x00000b00 SET_32 kernel32.dll_CreateDirectoryA
|
|
0x00012a54 0x00000b04 SET_32 kernel32.dll_CopyFileA
|
|
0x00012a60 0x00000b08 SET_32 kernel32.dll_CloseHandle
|
|
0x00012a7a 0x00000b10 SET_32 user32.dll_wvsprintfA
|
|
0x00012a88 0x00000b14 SET_32 user32.dll_TranslateMessage
|
|
0x00012a9c 0x00000b18 SET_32 user32.dll_ToAscii
|
|
0x00012aa6 0x00000b1c SET_32 user32.dll_SetWindowsHookExA
|
|
0x00012aba 0x00000b20 SET_32 user32.dll_PeekMessageA
|
|
0x00012aca 0x00000b24 SET_32 user32.dll_GetWindowThreadProcessId
|
|
0x00012ae6 0x00000b28 SET_32 user32.dll_GetKeyboardState
|
|
0x00012afa 0x00000b2c SET_32 user32.dll_FindWindowA
|
|
0x00012b08 0x00000b30 SET_32 user32.dll_DispatchMessageA
|
|
0x00012b1c 0x00000b34 SET_32 user32.dll_CharLowerA
|
|
0x00012b2a 0x00000b38 SET_32 user32.dll_CharUpperA
|
|
0x00012b42 0x00000b40 SET_32 ole32.dll_OleInitialize
|
|
0x00012b52 0x00000b44 SET_32 ole32.dll_CoCreateInstance
|
|
0x00012b70 0x00000b4c SET_32 ole32.dll_CoTaskMemFree
|
|
0x00012b8c 0x00000b54 SET_32 pstorec.dll_PStoreCreateInstance
|
|
0x00012bae 0x00000b5c SET_32 ole32.dll_StringFromCLSID
|
|
0x00012bce 0x00000b64 SET_32 rasapi32.dll_RasGetEntryDialParamsA
|
|
0x00012be8 0x00000b68 SET_32 rasapi32.dll_RasEnumEntriesA
|
|
0x00012c06 0x00000b70 SET_32 shell32.dll_SHGetSpecialFolderPathA
|
|
0x00012c2e 0x00000b78 SET_32 advapi32.dll_LsaFreeMemory
|
|
0x00012c3e 0x00000b7c SET_32 advapi32.dll_LsaClose
|
|
0x00012c4a 0x00000b80 SET_32 advapi32.dll_LsaRetrievePrivateData
|
|
0x00012c64 0x00000b84 SET_32 advapi32.dll_LsaOpenPolicy
|
|
0x00012c74 0x00000b88 SET_32 advapi32.dll_ConvertSidToStringSidA
|
|
0x00012c9a 0x00000b90 SET_32 crypt32.dll_CryptUnprotectData
|
|
0x00012cbe 0x00000b98 SET_32 advapi32.dll_CredEnumerateA
|
|
0x00012cde 0x00000ba0 SET_32 advapi32.dll_CryptDestroyHash
|
|
0x00012cf2 0x00000ba4 SET_32 advapi32.dll_CryptHashData
|
|
0x00012d02 0x00000ba8 SET_32 advapi32.dll_CryptCreateHash
|
|
0x00012d14 0x00000bac SET_32 advapi32.dll_CryptGetHashParam
|
|
0x00012d28 0x00000bb0 SET_32 advapi32.dll_CryptReleaseContext
|
|
0x00012d3e 0x00000bb4 SET_32 advapi32.dll_CryptAcquireContextA
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe32 imported libs (il)
|
|
FILE=bins/pe/single_import.exe
|
|
CMDS=il
|
|
EXPECT=<<EOF
|
|
library
|
|
-------------
|
|
comctl32.dll
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe32 header
|
|
FILE=bins/pe/single_import.exe
|
|
CMDS=iH~Signature~0x4550?
|
|
EXPECT=<<EOF
|
|
1
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe misaligned section paddr
|
|
FILE=bins/pe/unaligned_sec_paddr.exe
|
|
CMDS=iS~sect_0
|
|
EXPECT=<<EOF
|
|
0x00000200 0x205 0x00401000 0x1000 0x0 -rwx sect_0
|
|
EOF
|
|
RUN
|
|
|
|
NAME=pe sections
|
|
FILE=bins/pe/hello_world_not_stripped.exe
|
|
CMDS=iS
|
|
EXPECT=<<EOF
|
|
paddr size vaddr vsize align perm name type flags
|
|
---------------------------------------------------------------------------------------------------------------------------------
|
|
0x00000400 0x1800 0x00401000 0x2000 0x0 -r-x .text CNT_CODE,CNT_INITIALIZED_DATA,ALIGN_16BYTES
|
|
0x00001c00 0x200 0x00403000 0x1000 0x0 -rw- .data CNT_INITIALIZED_DATA,ALIGN_4BYTES
|
|
0x00001e00 0x600 0x00404000 0x1000 0x0 -r-- .rdata CNT_INITIALIZED_DATA,ALIGN_4BYTES
|
|
0x00000000 0x0 0x00405000 0x1000 0x0 -rw- .bss CNT_UNINITIALIZED,ALIGN_32BYTES
|
|
0x00002400 0x600 0x00406000 0x1000 0x0 -rw- .idata CNT_INITIALIZED_DATA,ALIGN_4BYTES
|
|
0x00002a00 0x200 0x00407000 0x1000 0x0 -rw- .CRT CNT_INITIALIZED_DATA,ALIGN_4BYTES
|
|
0x00002c00 0x200 0x00408000 0x1000 0x0 -rw- .tls CNT_INITIALIZED_DATA,ALIGN_4BYTES
|
|
0x00002e00 0x400 0x00409000 0x1000 0x0 -r-- .debug_aranges CNT_INITIALIZED_DATA,ALIGN_8BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00003200 0x4ba00 0x0040a000 0x4c000 0x0 -r-- .debug_info CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x0004ec00 0x2a00 0x00456000 0x3000 0x0 -r-- .debug_abbrev CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00051600 0x3600 0x00459000 0x4000 0x0 -r-- .debug_line CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00054c00 0x800 0x0045d000 0x1000 0x0 -r-- .debug_frame CNT_INITIALIZED_DATA,ALIGN_4BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00055400 0x800 0x0045e000 0x1000 0x0 -r-- .debug_str CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00055c00 0x1400 0x0045f000 0x2000 0x0 -r-- .debug_loc CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
0x00057000 0x400 0x00461000 0x1000 0x0 -r-- .debug_ranges CNT_INITIALIZED_DATA,ALIGN_1BYTES,IMAGE_SCN_MEM_DISCARDABLE
|
|
EOF
|
|
RUN
|
|
|
|
NAME=EFI bootloader rv64
|
|
FILE=bins/efi/haiku_loader_riscv64.efi
|
|
CMDS=ia~machine
|
|
EXPECT=<<EOF
|
|
machine RISC-V 64-bit
|
|
EOF
|
|
RUN
|
|
|
|
NAME=EFI bootloader x86_64
|
|
FILE=bins/efi/haiku_loader_amd64.efi
|
|
CMDS=ia~machine
|
|
EXPECT=<<EOF
|
|
machine AMD 64
|
|
EOF
|
|
RUN
|