portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rizin/test/db/analysis/mips

1866 lines
55 KiB
Text
Raw Blame History

NAME=mips ensure correct cpu is selected
FILE=bins/elf/analysis/mips-hello
CMDS=<<EOF
iI~cpu
iI~pie
iI~features
aaa
pdf @ entry0
pdf @ main
ao~0x @ 0x000804fc
EOF
EXPECT=<<EOF
cpu mips32
pie true
features noreorder pic cpic o32 n32
;-- section..text:
;-- _ftext:
;-- .text:
;-- __start:
;-- _start:
;-- pc:
/ entry0();
| ; var int32_t var_4h @ stack - 0x4
| 0x000804d0 bal 0x804d8 ; [06] -r-x section size 304 named .text ; entry0(void)
| 0x000804d4 nop
| ; CALL XREF from entry0 @ 0x804d0
| 0x000804d8 lui gp, 2
| 0x000804dc addiu gp, gp, -0x74d8
| 0x000804e0 addu gp, gp, ra
| 0x000804e4 move a0, sp
| 0x000804e8 addiu sp, sp, -0x20
| 0x000804ec sw zero, (var_4h)
| 0x000804f0 lw t9, -sym.do_mips_start(gp) ; [data.00091018:4]=0x8051c sym.do_mips_start
| 0x000804f4 jalr t9
| 0x000804f8 nop
| @-> 0x000804fc b 0x804fc
\ 0x00080500 nop
; DATA XREF from sym.do_mips_start @ 0x80544
/ int main(int argc, char **argv, char **envp);
| ; var int32_t var_10h @ stack - 0x10
| ; var int32_t var_8h @ stack - 0x8
| ; var int32_t var_4h @ stack - 0x4
| ; arg int32_t arg_10h @ stack + 0x10
| 0x000805a0 lui gp, 2
| 0x000805a4 addiu gp, gp, -0x75a0
| 0x000805a8 addu gp, gp, t9
| 0x000805ac addiu sp, sp, -0x20
| 0x000805b0 sw ra, (var_4h)
| 0x000805b4 sw fp, (var_8h)
| 0x000805b8 move fp, sp
| 0x000805bc sw gp, (var_10h)
| 0x000805c0 lw v0, -segment.LOAD0(gp) ; [data.0009103c:4]=0x80000 segment.ehdr
| 0x000805c4 addiu a0, v0, 0x640 ; 0x80640 ; "Hello World" ; str.Hello_World
| 0x000805c8 lw v0, -sym._MIPS_STUBS(gp) ; [data.00091048:4]=0x80600 sym.imp.puts
| 0x000805cc move t9, v0
| 0x000805d0 jalr t9
| 0x000805d4 nop
| 0x000805d8 lw gp, (arg_10h)
| 0x000805dc move sp, fp
| 0x000805e0 lw ra, (var_4h)
| 0x000805e4 lw fp, (var_8h)
| 0x000805e8 addiu sp, sp, 0x20
| 0x000805ec jr ra
\ 0x000805f0 nop
address: 0x804fc
opcode: b 0x804fc
disasm: b 0x804fc
pseudo: goto 0x804fc
rzil: (jmp (bv 32 0x804fc))
jump: 0x000804fc
EOF
RUN
NAME=micromips ensure correct cpu is selected
FILE=bins/elf/micromips.elf
CMDS=<<EOF
iI~cpu
iI~features
af
pdf
EOF
EXPECT=<<EOF
cpu micro32r3
features noreorder cpic o32 n32
;-- entry0:
;-- section..text:
;-- .text:
;-- _ftext:
/ int main(int argc, char **argv);
| ; arg int32_t arg_10h @ stack + 0x10
| ; arg int32_t arg_24h @ stack + 0x24
| 0x004000d0 lui gp, 2 ; [02] -r-x section size 512 named .text
| 0x004000d4 addiu gp, gp, -0x7de1
| 0x004000d8 addu gp, gp, t9
| 0x004000dc addiusp -0x28
| 0x004000de lw t9, -0x7fe4(gp) ; [0x41030c:4]=0x400221
| 0x004000e2 sw gp, (arg_10h)
| 0x004000e6 sw ra, (arg_24h)
| 0x004000e8 addiur1sp a1, 0x18
| 0x004000ea jalr t9
| 0x004000ec addiu a0, zero, 5
| 0x004000f0 lw ra, (arg_24h)
| 0x004000f2 jraddiusp 0x28
| ;-- deregister_tm_clones:
| 0x004000f4 lui a0, 0x41
| 0x004000f8 lui v0, 0x41
| 0x004000fc addiu a0, a0, 0x300
| 0x00400100 addiu v0, v0, 0x303
| 0x00400104 subu16 v0, v0, a0
| 0x00400106 sltiu v0, v0, 7
| ,=< 0x0040010a bnez16 v0, 0x400118
| | 0x0040010c lui t9, 0
| | 0x00400110 addiu t9, t9, 0
| ,==< 0x00400114 beqzc t9, loc..L6
| |`-> 0x00400118 jrc t9
| | ;-- .L6:
| `--> 0x0040011a jrc ra
EOF
RUN
NAME=nanomips ensure correct cpu is selected
FILE=bins/elf/emulateme.nanomips_i7200
CMDS=<<EOF
iI~cpu
iI~features
aaa
pdf @ entry0
pdf @ main
EOF
EXPECT=<<EOF
cpu i7200
features o32 n32
;-- section..text:
;-- __start:
;-- _start:
;-- pc:
/ entry0(int32_t arg4);
| ; arg int32_t arg4 @ a3
\ 0x004003d4 move fp, zero ; [08] -r-x section size 474 named .text
| 0x004003d6 lapc.h t0, sym._start_c
| 0x004003da lapc.h a1, obj._DYNAMIC
| 0x004003de lapc.h gp, loc._gp
| 0x004003e2 move a0, sp
| 0x004003e4 li at, -0x10
| 0x004003e8 and sp, sp, at
| 0x004003ec jalrc ra, t0
/ int main(int argc, char **argv, char **envp);
| ::: ; arg int32_t arg_8h @ stack + 0x8
| ::: ; arg int32_t arg_ch @ stack + 0xc
| ::: ; arg int32_t arg_1ch @ stack + 0x1c
| ::: 0x00400536 save 0x30, fp, ra, gp
| ::: 0x0040053a addiu fp, sp, -0xfd0
| ::: 0x0040053e lapc.h gp, loc._gp
| ::: 0x00400542 sw a0, (arg_ch)
| ::: 0x00400544 sw a1, (arg_8h)
| ::: 0x00400546 lw a3, (arg_ch)
| ::`=< 0x00400548 beqic a3, loc.__reloc_align___1, loc..L9
| :: 0x0040054c lw a3, (arg_8h)
| :: 0x0040054e lw a3, 0(a3)
| :: 0x00400550 move a1, a3
| :: 0x00400552 lapc.h a0, loc..LC0
| :: 0x00400556 lw a3, 0x28(gp) ; reloc.printf
| :: ; [0x420044:4]=0x4003ba
| :: 0x0040055a jalrc ra, a3
| :: 0x0040055c li a3, 1
| ::,=< 0x0040055e bc loc..L10
| ::| ;-- .L9:
| ::| 0x00400560 lw a3, (arg_8h)
| ::| 0x00400562 lw a3, 4(a3)
| ::| 0x00400564 sw a3, (arg_1ch)
| ::| 0x00400566 lw a0, (arg_1ch)
| ::| 0x00400568 lw a3, 0x24(gp) ; reloc.strlen
| ::| ; [0x420040:4]=0x4003b4 section..nanoMIPS.stubs
| ::| 0x0040056c jalrc ra, a3
| ::| 0x0040056e move a3, a0
| :`==< 0x00400570 beqic a3, 0x10, 0x400582
| : | 0x00400574 lapc.h a0, loc..LC1
| : | 0x00400578 lw a3, 0x2c(gp) ; reloc.puts
| : | ; [0x420048:4]=0x4003c0
| : | 0x0040057c jalrc ra, a3
| : | 0x0040057e li a3, 1
| :,==< 0x00400580 bc loc..L10
| :|| ;-- .L11:
| :|| 0x00400582 lw a0, (arg_1ch)
| `===< 0x00400584 balc[16] sym.decrypt
| || 0x00400586 move a3, a0
| ,===< 0x00400588 bnezc a3, loc..L12
| ||| 0x0040058a lapc.h a0, loc..LC2
| ||| 0x0040058e lw a3, 0x2c(gp) ; reloc.puts
| ||| ; [0x420048:4]=0x4003c0
| ||| 0x00400592 jalrc ra, a3
| ||| 0x00400594 li a3, 1
| ,====< 0x00400596 bc loc..L10
| |||| ;-- .L12:
| |`---> 0x00400598 lapc.h a1, obj.seckrit
| | || 0x0040059c lapc.h a0, loc..LC3
| | || 0x004005a0 lw a3, 0x28(gp) ; reloc.printf
| | || ; [0x420044:4]=0x4003ba
| | || 0x004005a4 jalrc ra, a3
| | || 0x004005a6 move a3, zero
| | || ;-- .L10:
| `-``-> 0x004005a8 move a0, a3
| 0x004005aa restore.jrc 0x30, fp, ra, gp
| ;-- (0x004005b0) section..fini:
| ;-- (0x004005b0) _fini:
\ 0x004005ae ~ sigrie 0x83e2
EOF
RUN
NAME=mips hello reference analysis
FILE=bins/elf/analysis/mips-hello
CMDS=<<EOF
s sym.main
aac
afl~?
EOF
EXPECT=<<EOF
1
EOF
RUN
NAME=mozi aae functions
FILE=bins/elf/mips-mozi
CMDS=<<EOF
aae
aflc
EOF
EXPECT=<<EOF
433
EOF
RUN
NAME=mips hello ref anal
FILE=bins/elf/analysis/mips.elf
ARGS=-e bin.strings=false -e analysis.strings=true
CMDS=<<EOF
e asm.bytes=true
s entry0
aae
s 0x0041ed50
pd 5~IGNORE
EOF
EXPECT=<<EOF
0x0041ed58 24a54268 addiu a1, a1, 0x4268 ; 0x474268 ; "IGNORE" ; str.IGNORE
EOF
RUN
NAME=mips hello ref analysis subtract
FILE=bins/elf/analysis/busybox-mips
ARGS=-e bin.strings=false -e analysis.strings=true
CMDS=<<EOF
e analysis.resolve.pointers=false
e asm.bytes=true
aae @ entry0
pd 1 @ 0x00406228
fs strings
axt @ str.busybox
EOF
EXPECT=<<EOF
0x00406228 fcc38424 addiu a0, a0, -0x3c04 ; 0x44c3fc ; "busybox" ; str.busybox
(nofunc); str.busybox 0x405fec [DATA] addiu a1, a1, -str.busybox
(nofunc); str.busybox 0x406228 [DATA] addiu a0, a0, -str.busybox
EOF
RUN
NAME=Calculate GP
FILE=bins/elf/analysis/mips64r2-ld-2.28.so
CMDS=<<EOF
s 0x000023f0
e asm.bytes=true
ar a0=0
pd 1
s 0x00002494
pd 1
EOF
EXPECT=<<EOF
0x000023f0 208084df ld a0, -0x7fe0(gp) ; [0x37020:8]=0x10a0 segment.DYNAMIC
0x00002494 488099df ld t9, -0x7fb8(gp) ; [0x37048:8]=0x134f0
EOF
RUN
NAME=mips ld(load doubleword) instruction
FILE=bins/elf/analysis/mips64r2-busybox-loongson
CMDS=<<EOF
s 0x120004460
e asm.bytes=true
f-*
fs-*
pd 1
EOF
EXPECT=<<EOF
0x120004460 208084df ld a0, -0x7fe0(gp) ; [0x1200ee290:8]=0x120005074
EOF
RUN
NAME=gp-based ref
FILE=bins/elf/analysis/mips-hello
CMDS=<<EOF
aae @ entry0
axt @ str.Hello_World
EOF
EXPECT=<<EOF
(nofunc); str.Hello_World 0x805c4 [DATA] addiu a0, v0, str.Hello_World
EOF
RUN
NAME=assembler
FILE==
CMDS=<<EOF
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=false
pa lui t9, 0x41
e cfg.bigendian=true
pa lui t9, 0x41
e cfg.bigendian=false
pad 4100193c
e cfg.bigendian=true
pad 3c190041
EOF
EXPECT=<<EOF
4100193c
3c190041
lui t9, 0x41
lui t9, 0x41
EOF
RUN
NAME=with-spaces
FILE==
CMDS=<<EOF
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=0
pa addiu v0, v1, 33
pa addiu v0 v1 33
e cfg.bigendian=1
pa addiu v0, v1, 33
pa addiu v0 v1 33
EOF
EXPECT=<<EOF
21006224
21006224
24620021
24620021
EOF
RUN
NAME=mips hello pseudo move instruction
FILE=bins/elf/analysis/mips-hello
ARGS=-e bin.strings=false -e analysis.strings=false
CMDS=<<EOF
e asm.bytes=true
pd 1 @ main+0x18
e asm.pseudo=true
pd 1 @ main+0x18
EOF
EXPECT=<<EOF
0x000805b8 21f0a003 move fp, sp
0x000805b8 21f0a003 fp = sp
EOF
RUN
NAME=mips pseudo sw + 0
FILE=malloc://32
ARGS=-a mips -m 0x80100000
CMDS=<<EOF
e cfg.bigendian=false
e io.va=true
e asm.bytes=true
wx 0000beaf
pd 1
e asm.pseudo=true
pd 1
EOF
EXPECT=<<EOF
0x80100000 0000beaf sw fp, 0(sp)
0x80100000 0000beaf word [sp] = fp
EOF
RUN
NAME=mips LE analisys
FILE=malloc://32
CMDS=<<EOF
wx 01001104
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips3
e cfg.bigendian=false
e asm.nbytes=4
ao
EOF
EXPECT=<<EOF
address: 0x0
opcode: bal 8
disasm: bal 8
pseudo: call 8
mnemonic: bal
description: branch and link
mask: ff000000
prefix: 0
id: 225
bytes: 01001104
refptr: 0
size: 4
sign: false
type: call
cycles: 0
esil: 0,1,8,<<<,1,&,==,$z,?{,pc,4,+,ra,=,,pc,=,}
rzil: (seq (set ra (bv 64 0x8)) (jmp (bv 64 0x8)))
opex:
operands:
- type: "imm"
value: 8
jump: 0x00000008
direction: exec
delay: 1
family: cpu
EOF
RUN
NAME=mips LE back reference
FILE=malloc://32
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
wx 0000000000000000010000100000000000000000
e asm.arch=mips
e asm.bits=32
e asm.nbytes=4
e cfg.bigendian=false
af+ fcn.test @ 0x80100000
afb+ 0x80100000 0x80100000 20
pif
EOF
EXPECT=<<EOF
nop
nop
b 0x80100010
nop
nop
EOF
RUN
NAME=mips LE correct relative jump reference if not mapped from command line.
FILE=malloc://40
CMDS=<<EOF
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=false
e analysis.nopskip=false
e asm.cmtcol=0
e asm.comments=false
e asm.lines.bb=0
e asm.lines.fcn=0
e asm.nbytes=4
wx 0800040c000000000000000000000000000000000000000040040408000000000800e00300000000
aa
pdf
EOF
EXPECT=<<EOF
fcn.00000000();
0x00000000 0800040c jal 0x100020
0x00000004 00000000 nop
0x00000008 00000000 nop
0x0000000c 00000000 nop
0x00000010 00000000 nop
0x00000014 00000000 nop
0x00000018 40040408 j 0x101100
0x0000001c 00000000 nop
EOF
RUN
NAME=mips LE correct relative jump reference if mapped from command line.
FILE=malloc://40
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=false
e asm.lines.bb=0
e asm.lines.fcn=false
e asm.nbytes=4
wx 0800040c000000000000000000000000000000000000000040040408000000000800e00300000000
af
pd 10
afl
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 0800040c jal fcn.80100020
0x80100004 00000000 nop
0x80100008 00000000 nop
0x8010000c 00000000 nop
0x80100010 00000000 nop
0x80100014 00000000 nop
0x80100018 40040408 j 0x80101100
0x8010001c 00000000 nop
; CALL XREF from fcn.80100000 @ 0x80100000
fcn.80100020();
0x80100020 0800e003 jr ra
0x80100024 00000000 nop
0x80100000 1 32 fcn.80100000
0x80100020 1 8 fcn.80100020
EOF
RUN
NAME=mips branch delay function sizing.
FILE=malloc://20
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e cfg.bigendian=false
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
s 0x80100000
wx 0800e0030a1844000000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 0800e003 jr ra
0x80100004 0a184400 movz v1, v0, a0
EOF
RUN
NAME=mips branch delay function sizing.
FILE=malloc://20
CMDS=<<EOF
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e cfg.bigendian=false
e asm.nbytes=4
e asm.lines.fcn=false
wx 0800e0030a1844000000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.00000000();
0x00000000 0800e003 jr ra
0x00000004 0a184400 movz v1, v0, a0
EOF
RUN
NAME=mips branch delay function sizing with conditional jump loop.
FILE=malloc://40
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e asm.comments=false
e cfg.bigendian=false
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
s 0x80100000
wx e0ffbd27000000000100001000000000fdff09150a1844000800e0032000bd270000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 e0ffbd27 addiu sp, sp, -0x20
0x80100004 00000000 nop
0x80100008 01000010 b 0x80100010
0x8010000c 00000000 nop
0x80100010 fdff0915 bne t0, t1, 0x80100008
0x80100014 0a184400 movz v1, v0, a0
0x80100018 0800e003 jr ra
0x8010001c 2000bd27 addiu sp, sp, 0x20
EOF
RUN
NAME=mips branch delay function sizing with conditional jump forward.
FILE=malloc://40
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e cfg.bigendian=false
e asm.comments=false
e analysis.nopskip=false
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
s 0x80100000
wx e0ffbd27000000000100001000000000000000000a1844000800e003 2000bd270000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 e0ffbd27 addiu sp, sp, -0x20
0x80100004 00000000 nop
0x80100008 01000010 b 0x80100010
0x8010000c 00000000 nop
0x80100010 00000000 nop
0x80100014 0a184400 movz v1, v0, a0
0x80100018 0800e003 jr ra
0x8010001c 2000bd27 addiu sp, sp, 0x20
EOF
RUN
NAME=mips branch delay function sizing with conditional jump back.
FILE=malloc://40
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e cfg.bigendian=false
e asm.comments=false
e asm.bytes=true
e analysis.nopskip=false
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
wx e0ffbd27000000000000000000000000fdff09150a1844000800e0032000bd270000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 e0ffbd27 addiu sp, sp, -0x20
0x80100004 00000000 nop
0x80100008 00000000 nop
0x8010000c 00000000 nop
0x80100010 fdff0915 bne t0, t1, 0x80100008
0x80100014 0a184400 movz v1, v0, a0
0x80100018 0800e003 jr ra
0x8010001c 2000bd27 addiu sp, sp, 0x20
EOF
RUN
NAME=mips branch delay function sizing with conditional jump back then forward.
FILE=malloc://56
ARGS=-m 0x80100000
CMDS=<<EOF
e io.va=true
e asm.bytes=true
e asm.calls=false
e asm.arch=mips
e asm.bits=32
e asm.cpu=mips4
e cfg.bigendian=false
e asm.comments=false
e analysis.nopskip=false
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
wx e0ffbd27000000000000000000000000fdff09150000000001000010000000000a1844000800e0032000bd270000000000000000000000
af
pdf
EOF
EXPECT=<<EOF
fcn.80100000();
0x80100000 e0ffbd27 addiu sp, sp, -0x20
0x80100004 00000000 nop
0x80100008 00000000 nop
0x8010000c 00000000 nop
0x80100010 fdff0915 bne t0, t1, 0x80100008
0x80100014 00000000 nop
0x80100018 01000010 b 0x80100020
0x8010001c 00000000 nop
0x80100020 0a184400 movz v1, v0, a0
0x80100024 0800e003 jr ra
0x80100028 2000bd27 addiu sp, sp, 0x20
EOF
RUN
NAME=mips branch delay function detection #1.
FILE=malloc://160
ARGS=-m 0x8060b4f8
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=false
e asm.comments=0
e analysis.hasnext=1
e analysis.nopskip=1
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=false
s 0x8060b4f8
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
aa
pd 38
EOF
EXPECT=<<EOF
0x8060b4f8 00000000 nop
0x8060b4fc 00000000 nop
fcn.8060b500(int32_t arg1, int32_t arg2);
; arg int32_t arg1 @ a0
; arg int32_t arg2 @ a1
0x8060b500 002e0500 sll a1, a1, 0x18
0x8060b504 032e0500 sra a1, a1, 0x18
0x8060b508 0f008010 beqz a0, 0x8060b548
0x8060b50c 21100000 move v0, zero
0x8060b510 492d1808 j 0x8060b524
0x8060b514 00008290 lbu v0, (arg1)
0x8060b518 0800e003 jr ra
0x8060b51c 21108000 move v0, a0
0x8060b520 00008290 lbu v0, (arg1)
0x8060b524 07004010 beqz v0, 0x8060b544
0x8060b528 00000000 nop
0x8060b52c 00160200 sll v0, v0, 0x18
0x8060b530 03160200 sra v0, v0, 0x18
0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
0x8060b538 00000000 nop
0x8060b53c 482d1808 j 0x8060b520
0x8060b540 01008424 addiu a0, a0, 1
0x8060b544 21100000 move v0, zero
0x8060b548 0800e003 jr ra
0x8060b54c 00000000 nop
fcn.8060b550(int32_t arg1, int32_t arg2);
; arg int32_t arg1 @ a0
; arg int32_t arg2 @ a1
0x8060b550 0000a290 lbu v0, (arg2)
0x8060b554 05004010 beqz v0, 0x8060b56c
0x8060b558 0100a524 addiu a1, a1, 1
0x8060b55c 000082a0 sb v0, (arg1)
0x8060b560 0000a290 lbu v0, (arg2)
0x8060b564 552d1808 j 0x8060b554
0x8060b568 01008424 addiu a0, a0, 1
0x8060b56c 0800e003 jr ra
0x8060b570 000080a0 sb zero, (arg1)
0x8060b574 00000000 nop
fcn.8060b578();
0x8060b578 e0ffbd27 addiu sp, sp, -0x20
0x8060b57c 542d180c jal fcn.8060b550
0x8060b580 00000000 nop
0x8060b584 0800e003 jr ra
0x8060b588 2000bd27 addiu sp, sp, 0x20
0x8060b58c 00000000 nop
EOF
RUN
NAME=capstone: mips branch delay function detection #2.
FILE=malloc://160
ARGS=-m 0x8060b4f8
CMDS=<<EOF
e io.va=true
e asm.calls=false
e asm.bytes=true
e asm.arch=mips
e asm.bits=32
e cfg.bigendian=false
e analysis.noncode=1
e asm.comments=0
e analysis.hasnext=1
e analysis.nopskip=1
e asm.nbytes=4
e asm.lines.bb=false
e asm.lines.fcn=true
s 0x8060b4f8
wx 0000000000000000002e0500032e05000f00801021100000492d1808000082900800e003211080000000829007004010000000000016020003160200f8ff451000000000482d180801008424211000000800e003000000000000a290050040100100a524000082a00000a290552d1808010084240800e003000080a000000000e0ffbd27542d180c000000000800e0032000bd270000000000000000
aa
pd 38
EOF
EXPECT=<<EOF
0x8060b4f8 00000000 nop
0x8060b4fc 00000000 nop
/ fcn.8060b500(int32_t arg1, int32_t arg2);
| ; arg int32_t arg1 @ a0
| ; arg int32_t arg2 @ a1
| 0x8060b500 002e0500 sll a1, a1, 0x18
| 0x8060b504 032e0500 sra a1, a1, 0x18
| 0x8060b508 0f008010 beqz a0, 0x8060b548
| 0x8060b50c 21100000 move v0, zero
| 0x8060b510 492d1808 j 0x8060b524
| 0x8060b514 00008290 lbu v0, (arg1)
| 0x8060b518 0800e003 jr ra
| 0x8060b51c 21108000 move v0, a0
| 0x8060b520 00008290 lbu v0, (arg1)
| 0x8060b524 07004010 beqz v0, 0x8060b544
| 0x8060b528 00000000 nop
| 0x8060b52c 00160200 sll v0, v0, 0x18
| 0x8060b530 03160200 sra v0, v0, 0x18
| 0x8060b534 f8ff4510 beq v0, a1, 0x8060b518
| 0x8060b538 00000000 nop
| 0x8060b53c 482d1808 j 0x8060b520
| 0x8060b540 01008424 addiu a0, a0, 1
| 0x8060b544 21100000 move v0, zero
| 0x8060b548 0800e003 jr ra
\ 0x8060b54c 00000000 nop
/ fcn.8060b550(int32_t arg1, int32_t arg2);
| ; arg int32_t arg1 @ a0
| ; arg int32_t arg2 @ a1
| 0x8060b550 0000a290 lbu v0, (arg2)
| 0x8060b554 05004010 beqz v0, 0x8060b56c
| 0x8060b558 0100a524 addiu a1, a1, 1
| 0x8060b55c 000082a0 sb v0, (arg1)
| 0x8060b560 0000a290 lbu v0, (arg2)
| 0x8060b564 552d1808 j 0x8060b554
| 0x8060b568 01008424 addiu a0, a0, 1
| 0x8060b56c 0800e003 jr ra
\ 0x8060b570 000080a0 sb zero, (arg1)
0x8060b574 00000000 nop
/ fcn.8060b578();
| 0x8060b578 e0ffbd27 addiu sp, sp, -0x20
| 0x8060b57c 542d180c jal fcn.8060b550
| 0x8060b580 00000000 nop
| 0x8060b584 0800e003 jr ra
\ 0x8060b588 2000bd27 addiu sp, sp, 0x20
0x8060b58c 00000000 nop
EOF
RUN
NAME=mips big endian strings, calls, etc. analysis
FILE=bins/elf/analysis/mipsbe-ip
CMDS=<<EOF
s 0x00402088
e asm.bytes=true
pd 10
EOF
EXPECT=<<EOF
0x00402088 8f84814c lw a0, -main(gp) ; [0x43522c:4]=0x402558 sym.main
0x0040208c 8fa50000 lw a1, 0(sp)
0x00402090 27a60004 addiu a2, sp, 4
0x00402094 2401fff8 addiu at, zero, -8
0x00402098 03a1e824 and sp, sp, at
0x0040209c 27bdffe0 addiu sp, sp, -0x20
0x004020a0 8f878230 lw a3, -sym._init(gp) ; [0x435310:4]=0x401ff4 sym._init
0x004020a4 8f888114 lw t0, -sym._fini(gp) ; [0x4351f4:4]=0x41eca0 sym._fini
0x004020a8 afa80010 sw t0, 0x10(sp)
0x004020ac afa20014 sw v0, 0x14(sp)
EOF
RUN
NAME=mips sp/bp tracking
FILE=bins/elf/vars-mips-bp
ARGS=-e bin.dbginfo=0
CMDS=<<EOF
s sym.varfunc
af
e asm.sub.var=0
e asm.comments=0
e asm.stackptr=0
pdf
afvx
EOF
EXPECT=<<EOF
/ sym.varfunc(int32_t arg_10h, int32_t arg_18h, int32_t arg_1ch, int32_t arg_20h, int32_t arg_24h);
| ; var int32_t var_20h @ stack - 0x20
| ; var int32_t var_8h @ stack - 0x8
| ; var int32_t var_4h @ stack - 0x4
| ; arg int32_t arg_10h @ stack + 0x10
| ; arg int32_t arg_18h @ stack + 0x18
| ; arg int32_t arg_1ch @ stack + 0x1c
| ; arg int32_t arg_20h @ stack + 0x20
| ; arg int32_t arg_24h @ stack + 0x24
| 0x00000794 lui gp, 2
| 0x00000798 addiu gp, gp, -0x7db4
| 0x0000079c addu gp, gp, t9
| 0x000007a0 addiu sp, sp, -0x30
| 0x000007a4 sw ra, 0x2c(sp)
| 0x000007a8 sw fp, 0x28(sp)
| 0x000007ac move fp, sp
| 0x000007b0 sw gp, 0x10(sp)
| 0x000007b4 addiu v0, zero, 1
| 0x000007b8 sw v0, 0x18(fp)
| 0x000007bc addiu v0, zero, 2
| 0x000007c0 sw v0, 0x1c(fp)
| 0x000007c4 addiu v0, zero, 3
| 0x000007c8 sw v0, 0x20(fp)
| 0x000007cc addiu v0, zero, 4
| 0x000007d0 sw v0, 0x24(fp)
| 0x000007d4 lw v0, -sym.leaffunc(gp)
| 0x000007d8 move t9, v0
| 0x000007dc bal sym.leaffunc
| 0x000007e0 nop
| 0x000007e4 lw gp, 0x10(fp)
| 0x000007e8 lw v0, 0x24(fp)
| 0x000007ec sw v0, 0x1c(fp)
| 0x000007f0 lw v0, 0x18(fp)
| 0x000007f4 move sp, fp
| 0x000007f8 lw ra, 0x2c(sp)
| 0x000007fc lw fp, 0x28(sp)
| 0x00000800 addiu sp, sp, 0x30
| 0x00000804 jr ra
\ 0x00000808 nop
afvR
arg_18h 0x7f0
arg_1ch
arg_20h
arg_24h 0x7e8
arg_10h 0x7e4
var_8h 0x7fc
var_4h 0x7f8
var_20h
afvW
arg_18h 0x7b8
arg_1ch 0x7c0,0x7ec
arg_20h 0x7c8
arg_24h 0x7d0
arg_10h
var_8h 0x7a8
var_4h 0x7a4
var_20h 0x7b0
EOF
RUN
NAME=pdf main mips be
FILE=bins/elf/analysis/mipsbe-ip
CMDS=<<EOF
aa
pdf @ main
EOF
EXPECT=<<EOF
/ int main(int argc, char **argv, char **envp);
| ; arg int argc @ a0
| ; arg char **argv @ a1
| ; arg char **envp @ a2
| ; var int32_t var_40h @ stack - 0x40
| ; var int32_t var_38h @ stack - 0x38
| ; var int32_t var_30h @ stack - 0x30
| ; var int32_t var_2ch @ stack - 0x2c
| ; var int32_t var_28h @ stack - 0x28
| ; var int32_t var_24h @ stack - 0x24
| ; var int32_t var_20h @ stack - 0x20
| ; var int32_t var_1ch @ stack - 0x1c
| ; var int32_t var_18h @ stack - 0x18
| ; var int32_t var_14h @ stack - 0x14
| ; var int32_t var_10h @ stack - 0x10
| ; var int32_t var_ch @ stack - 0xc
| ; var int32_t var_8h @ stack - 0x8
| ; var int32_t var_4h @ stack - 0x4
| 0x00402558 addiu sp, sp, -0x50
| 0x0040255c sw ra, (var_4h)
| 0x00402560 sw fp, (var_8h)
| 0x00402564 sw s7, (var_ch)
| 0x00402568 sw s6, (var_10h)
| 0x0040256c sw s5, (var_14h)
| 0x00402570 sw s4, (var_18h)
| 0x00402574 sw s3, (var_1ch)
| 0x00402578 sw s2, (var_20h)
| 0x0040257c sw s1, (var_24h)
| 0x00402580 sw s0, (var_28h)
| 0x00402584 lui gp, 0x44
| 0x00402588 addiu gp, gp, -0x2f20
| 0x0040258c sw gp, (var_40h)
| 0x00402590 move s0, a1 ; argv
| 0x00402594 lw t9, -sym.imp.strrchr(gp) ; [0x4352f8:4]=0x41e910 sym.imp.strrchr
| 0x00402598 addiu a1, zero, 0x2f
| 0x0040259c lw s6, 0(s0)
| 0x004025a0 move s1, a0 ; argc
| 0x004025a4 jalr t9
| 0x004025a8 move a0, s6
| 0x004025ac slti v1, s1, 2
| 0x004025b0 addiu a0, v0, 1
| 0x004025b4 lw gp, (var_40h)
| ,=< 0x004025b8 bnez v1, 0x402708
..
| .--> 0x004025ec sw s0, (var_30h)
| :| 0x004025f0 addiu s0, s0, 4
| :| 0x004025f4 lw v1, 0(s0)
| :| 0x004025f8 addiu a1, s2, -0x10c0
| :| 0x004025fc lw t9, -sym.imp.strcmp(gp) ; [0x435200:4]=0x41eb40 sym.imp.strcmp
| :| 0x00402600 move a0, v1
| :| 0x00402604 jalr t9
| :| 0x00402608 sw v1, (var_2ch)
| :| 0x0040260c lw gp, (var_40h)
| :| 0x00402610 lw v1, (var_2ch)
| ,===< 0x00402614 beqz v0, 0x402944
| |:| 0x00402618 addiu v0, zero, 0x2d
| |:| 0x0040261c lb a0, 0(v1)
| ,====< 0x00402620 bne a0, v0, 0x40295c
| ||:| 0x00402624 addiu a2, v1, 1
| ||:| 0x00402628 lb v0, 1(v1)
| ||:| 0x0040262c move a1, s3
| ||:| 0x00402630 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ||:| 0x00402634 xori v0, v0, 0x2d
..
| |||||:| ; XREFS: CODE 0x00402a64 CODE 0x00402a9c CODE 0x00402ae0
| |||||:| ; XREFS: CODE 0x00402b40 CODE 0x00402ba8 CODE 0x00402c0c
| --------> 0x004026f8 addiu s1, s1, -1
| |||||:| 0x004026fc slti v0, s1, 2
| |||||`==< 0x00402700 beqz v0, 0x4025ec
| ||||| | 0x00402704 nop
| ||||| `-> 0x00402708 lui v0, 0x43
| ||||| 0x0040270c lw v0, 0x5470(v0)
| ||||| ,=< 0x00402710 bnez v0, 0x402850
| ||||| | 0x00402714 lui v0, 0x43
| ||||| | ; CODE XREF from main @ 0x402954
| |||||.--> 0x00402718 lui v1, 0x42
| |||||:| ; CODE XREF from main @ 0x402970
| --------> 0x0040271c lw a0, 0x547c(v0)
| |||||:| 0x00402720 addiu v1, v1, 0x3ac
| |||||:| 0x00402724 lui v0, 0x43
| ========< 0x00402728 beqz a0, 0x402868
| |||||:| 0x0040272c sw v1, 0x5478(v0)
| --------> 0x00402730 jal fcn.00402338
| |||||:| 0x00402734 nop
| |||||:| ; CODE XREF from main @ 0x4029c0
| --------> 0x00402738 lw ra, (var_4h)
| |||||:| 0x0040273c lw fp, (var_8h)
| |||||:| 0x00402740 lw s7, (var_ch)
| |||||:| 0x00402744 lw s6, (var_10h)
| |||||:| 0x00402748 lw s5, (var_14h)
| |||||:| 0x0040274c lw s4, (var_18h)
| |||||:| 0x00402750 lw s3, (var_1ch)
| |||||:| 0x00402754 lw s2, (var_20h)
| |||||:| 0x00402758 lw s1, (var_24h)
| |||||:| 0x0040275c lw s0, (var_28h)
| |||||:| 0x00402760 jr ra
| |||||:| 0x00402764 addiu sp, sp, 0x50
..
| .-------> 0x0040284c lui v0, 0x43
| :||||:`-> 0x00402850 lui v1, 0x42
| :||||: 0x00402854 lw a0, 0x547c(v0)
| :||||: 0x00402858 addiu v1, v1, -0xf90
| :||||: 0x0040285c lui v0, 0x43
| ========< 0x00402860 bnez a0, 0x402730
| :||||: 0x00402864 sw v1, 0x5478(v0)
| --------> 0x00402868 lw t9, -sym.rtnl_open(gp) ; [0x435300:4]=0x41a99c sym.rtnl_open
| :||||: 0x0040286c lui s2, 0x43
| :||||: 0x00402870 addiu a0, s2, 0x3c60
| :||||: 0x00402874 jalr t9
| :||||: 0x00402878 move a1, zero
| :||||: 0x0040287c lw gp, (var_40h)
| :||||:,=< 0x00402880 bltz v0, 0x402aa4
| :||||:| 0x00402884 nop
| :||||:| 0x00402888 lw t9, -sym.imp.strlen(gp) ; [0x435174:4]=0x41ec10 sym.imp.strlen
| :||||:| 0x0040288c jalr t9
| :||||:| 0x00402890 move a0, s6
| :||||:| 0x00402894 sltiu v0, v0, 3
| :||||:| 0x00402898 lw gp, (var_40h)
| ========< 0x0040289c beqz v0, 0x4029b4
| :||||:| 0x004028a0 addiu a0, s6, 2
| :||||:| 0x004028a4 slti v0, s1, 2
| ========< 0x004028a8 bnez v0, 0x402a20
| :||||:| 0x004028ac nop
| :||||:| 0x004028b0 lw a0, 4(s0)
| :||||:| 0x004028b4 addiu a1, s1, -1
| :||||:| 0x004028b8 jal fcn.00402210
| :||||:| 0x004028bc addiu a2, s0, 4
| :||||:| 0x004028c0 lw ra, (var_4h)
| :||||:| 0x004028c4 lw fp, (var_8h)
| :||||:| 0x004028c8 lw s7, (var_ch)
| :||||:| 0x004028cc lw s6, (var_10h)
| :||||:| 0x004028d0 lw s5, (var_14h)
| :||||:| 0x004028d4 lw s4, (var_18h)
| :||||:| 0x004028d8 lw s3, (var_1ch)
| :||||:| 0x004028dc lw s2, (var_20h)
| :||||:| 0x004028e0 lw s1, (var_24h)
| :||||:| 0x004028e4 lw s0, (var_28h)
| :||||:| 0x004028e8 jr ra
| :||||:| 0x004028ec addiu sp, sp, 0x50
..
| :|||`---> 0x00402944 lui v0, 0x43
| :||| :| 0x00402948 lw v0, 0x5470(v0)
| ========< 0x0040294c bnez v0, 0x40284c
| :||| :| 0x00402950 addiu s1, s1, -1
| :||| `==< 0x00402954 b 0x402718
| :||| | 0x00402958 lui v0, 0x43
| :||`----> 0x0040295c lui v0, 0x43
| :|| | 0x00402960 lw v0, 0x5470(v0)
| :|| | 0x00402964 lw s0, (var_30h)
| `=======< 0x00402968 bnez v0, 0x40284c
| || | 0x0040296c lui v0, 0x43
| ========< 0x00402970 b 0x40271c
| || | 0x00402974 lui v1, 0x42
..
| --------> 0x004029b4 move a1, s1
| | :|| 0x004029b8 jal fcn.00402210
| | :|| 0x004029bc move a2, s0
| ========< 0x004029c0 b 0x402738
| | :|| 0x004029c4 nop
..
| --------> 0x00402a20 lw t9, -sym.rtnl_close(gp) ; [0x4352c8:4]=0x41a9b8 sym.rtnl_close
| | || 0x00402a24 jalr t9
| | || 0x00402a28 addiu a0, s2, 0x3c60
| -`...---> 0x00402a2c jal fcn.004022e4
| :::|| 0x00402a30 nop
| :::`--> 0x00402a34 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: | 0x00402a38 lui a1, 0x42
| ::: | 0x00402a3c move a0, a2
| ::: | 0x00402a40 sw a2, (var_2ch)
| ::: | 0x00402a44 jalr t9
| ::: | 0x00402a48 addiu a1, a1, -0x1044
| ::: | 0x00402a4c lw gp, (var_40h)
| ::: | 0x00402a50 lw a2, (var_2ch)
| :::,==< 0x00402a54 bnez v0, 0x402a6c
| :::|| 0x00402a58 lui v0, 0x43
| :::|| 0x00402a5c lw v1, 0x546c(v0)
| :::|| 0x00402a60 addiu v1, v1, 1
| ========< 0x00402a64 b 0x4026f8
| :::|| 0x00402a68 sw v1, 0x546c(v0)
| :::`--> 0x00402a6c lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: | 0x00402a70 lui a1, 0x42
| ::: | 0x00402a74 move a0, a2
| ::: | 0x00402a78 sw a2, (var_2ch)
| ::: | 0x00402a7c jalr t9
| ::: | 0x00402a80 addiu a1, a1, -0x1038
| ::: | 0x00402a84 lw gp, (var_40h)
| ::: | 0x00402a88 lw a2, (var_2ch)
| :::,==< 0x00402a8c bnez v0, 0x402ab0
| :::|| 0x00402a90 lui v0, 0x43
| :::|| 0x00402a94 lw v1, 0x5470(v0)
| :::|| 0x00402a98 addiu v1, v1, 1
| ========< 0x00402a9c b 0x4026f8
| :::|| 0x00402aa0 sw v1, 0x5470(v0)
| :::|`-> 0x00402aa4 lw t9, -sym.imp.exit(gp) ; [0x4351a4:4]=0x41ebb0 sym.imp.exit
| :::| 0x00402aa8 jalr t9
| :::| 0x00402aac addiu a0, zero, 1
| :::`--> 0x00402ab0 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: 0x00402ab4 lui a1, 0x42
| ::: 0x00402ab8 move a0, a2 ; envp
| ::: 0x00402abc sw a2, (var_2ch)
| ::: 0x00402ac0 jalr t9
| ::: 0x00402ac4 addiu a1, a1, -0x102c
| ::: 0x00402ac8 lw gp, (var_40h)
| ::: 0x00402acc lw a2, (var_2ch)
| ::: ,=< 0x00402ad0 bnez v0, 0x402ae8
| ::: | 0x00402ad4 lui v0, 0x43
| ::: | 0x00402ad8 lw v1, 0x5474(v0)
| ::: | 0x00402adc addiu v1, v1, 1
| ========< 0x00402ae0 b 0x4026f8
| ::: | 0x00402ae4 sw v1, 0x5474(v0)
| ::: `-> 0x00402ae8 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: 0x00402aec lui a1, 0x42
| ::: 0x00402af0 move a0, a2 ; envp
| ::: 0x00402af4 sw a2, (var_2ch)
| ::: 0x00402af8 jalr t9
| ::: 0x00402afc addiu a1, a1, -0x1020
| ::: 0x00402b00 lw gp, (var_40h)
| ::: 0x00402b04 lw a2, (var_2ch)
| ::: ,=< 0x00402b08 beqz v0, 0x402b48
| ::: | 0x00402b0c lui a0, 0x42
| ::: | 0x00402b10 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: | 0x00402b14 lui a1, 0x42
| ::: | 0x00402b18 move a0, a2 ; envp
| ::: | 0x00402b1c sw a2, (var_2ch)
| ::: | 0x00402b20 jalr t9
| ::: | 0x00402b24 addiu a1, a1, -0xff8
| ::: | 0x00402b28 lw gp, (var_40h)
| ::: | 0x00402b2c lw a2, (var_2ch)
| :::,==< 0x00402b30 bnez v0, 0x402b6c
| :::|| 0x00402b34 lui v0, 0x43
| :::|| 0x00402b38 lw v1, 0x5480(v0)
| :::|| 0x00402b3c addiu v1, v1, 1
| ========< 0x00402b40 b 0x4026f8
| :::|| 0x00402b44 sw v1, 0x5480(v0)
| :::|`-> 0x00402b48 lw t9, -sym.imp.printf(gp) ; [0x4353ec:4]=0x41e7b0 sym.imp.printf
| :::| 0x00402b4c lui a1, 0x42
| :::| 0x00402b50 addiu a0, a0, -0x1014
| :::| 0x00402b54 jalr t9
| :::| 0x00402b58 addiu a1, a1, -0xf20
| :::| 0x00402b5c lw gp, (var_40h)
| :::| 0x00402b60 lw t9, -sym.imp.exit(gp) ; [0x4351a4:4]=0x41ebb0 sym.imp.exit
| :::| 0x00402b64 jalr t9
| :::| 0x00402b68 move a0, zero
| :::`--> 0x00402b6c lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| ::: 0x00402b70 lui a1, 0x42
| ::: 0x00402b74 move a0, a2 ; envp
| ::: 0x00402b78 sw a2, (var_2ch)
| ::: 0x00402b7c jalr t9
| ::: 0x00402b80 addiu a1, a1, -0xff0
| ::: 0x00402b84 lw gp, (var_40h)
| ::: 0x00402b88 lw a2, (var_2ch)
| ::: ,=< 0x00402b8c bnez v0, 0x402bb0
| ::: | 0x00402b90 addiu v0, zero, 1
| ::: | 0x00402b94 addiu s1, s1, -1
| `=====< 0x00402b98 beq s1, v0, 0x402a2c
| :: | 0x00402b9c addiu s0, s0, 4
| :: | 0x00402ba0 lui v0, 0x43
| :: | 0x00402ba4 lw v1, 0(s0)
| ========< 0x00402ba8 b 0x4026f8
..
| :: `-> 0x00402bb0 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| :: 0x00402bb4 lui a1, 0x42
| :: 0x00402bb8 move a0, a2 ; envp
| :: 0x00402bbc sw a2, (var_2ch)
| :: 0x00402bc0 jalr t9
| :: 0x00402bc4 addiu a1, a1, -0xfe8
| :: 0x00402bc8 lw gp, (var_40h)
| :: 0x00402bcc lw a2, (var_2ch)
| :: ,=< 0x00402bd0 bnez v0, 0x402c14
| :: | 0x00402bd4 addiu s1, s1, -1
| :: | 0x00402bd8 addiu v0, zero, 1
| `====< 0x00402bdc beq s1, v0, 0x402a2c
| : | 0x00402be0 addiu s0, s0, 4
| : | 0x00402be4 addiu a0, sp, 0x18
| : | 0x00402be8 lw t9, -sym.get_unsigned(gp) ; [0x435178:4]=0x41bec4 sym.get_unsigned
| : | 0x00402bec lw a1, 0(s0)
| : | 0x00402bf0 jalr t9
| : | 0x00402bf4 move a2, zero
| : | 0x00402bf8 lw gp, (var_40h)
| :,==< 0x00402bfc bnez v0, 0x402c68
| :|| 0x00402c00 nop
| :|| 0x00402c04 lw v1, (var_38h)
| :|| 0x00402c08 lw v0, -obj.rcvbuf(gp) ; [0x4351fc:4]=0x433ca0 obj.rcvbuf
| ========< 0x00402c0c b 0x4026f8
| :|| 0x00402c10 sw v1, 0(v0)
| :|`-> 0x00402c14 lw t9, -sym.matches(gp) ; [0x4351ac:4]=0x41b2b4 sym.matches
| :| 0x00402c18 lui a1, 0x42
| :| 0x00402c1c move a0, a2 ; envp
| :| 0x00402c20 sw a2, (var_2ch)
| :| 0x00402c24 jalr t9
| :| 0x00402c28 addiu a1, a1, -0xfc4
| :| 0x00402c2c lw gp, (var_40h)
| :| 0x00402c30 lw a2, (var_2ch)
| `===< 0x00402c34 beqz v0, 0x402a2c
| | 0x00402c38 nop
| | 0x00402c3c lw v0, -0x7efc(gp) ; [0x4351e4:4]=0
| | 0x00402c40 lui a1, 0x42
| | 0x00402c44 lw t9, -sym.imp.fprintf(gp) ; [0x4352dc:4]=0x41e940 sym.imp.fprintf
| | 0x00402c48 addiu a1, a1, -0xfbc
| | 0x00402c4c lw a0, 0(v0)
| | ; CODE XREF from main @ 0x402c7c
| |.-> 0x00402c50 jalr t9
| |: 0x00402c54 nop
| |: 0x00402c58 lw gp, (var_40h)
| |: 0x00402c5c lw t9, -sym.imp.exit(gp) ; [0x4351a4:4]=0x41ebb0 sym.imp.exit
| |: 0x00402c60 jalr t9
| |: 0x00402c64 addiu a0, zero, -1
| `--> 0x00402c68 lw v0, -0x7efc(gp) ; [0x4351e4:4]=0
| : 0x00402c6c lui a1, 0x42
| : 0x00402c70 lw a2, 0(s0)
| : 0x00402c74 lw a0, 0(v0)
| : 0x00402c78 lw t9, -sym.imp.fprintf(gp) ; [0x4352dc:4]=0x41e940 sym.imp.fprintf
\ `=< 0x00402c7c b 0x402c50
EOF
RUN
NAME=mips ensure family is set
FILE==
CMDS=<<EOF
e asm.arch=mips
e asm.cpu=mips32r2
e cfg.bigendian=false
wx 20204401
ao
echo '==============='
wx b01e727e
ao
echo '==============='
wx 8e422046
ao
echo '==============='
wx 9a92c746
ao
echo '==============='
wx b019477e
ao
echo '==============='
wx b018477e
ao
echo '==============='
wx 12510778
ao
echo '==============='
e asm.cpu=mips32r6
wx 0a000042
ao
echo '==============='
wx ac02447d
ao
echo '==============='
wx 0920407d
ao
echo '==============='
wx 0f00447d
ao
EOF
EXPECT=<<EOF
address: 0x0
opcode: add a0, t2, a0
disasm: add a0, t2, a0
pseudo: a0 = t2 + a0
mnemonic: add
description: adds two registers, trap on overflow
mask: ffffffff
prefix: 0
id: 98
bytes: 20204401
refptr: 0
size: 4
sign: true
type: add
cycles: 0
esil: 30,0x80000000,t2,a0,^,&,>>,31,0x80000000,t2,a0,+,&,>>,|,1,==,$z,?{,$$,1,TRAP,}{,t2,a0,+,a0,=,}
rzil: (set a0 (cast 32 (msb (+ (var t2) (var a0))) (+ (var t2) (var a0))))
opex:
operands:
- type: "reg"
value: "a0"
- type: "reg"
value: "t2"
- type: "reg"
value: "a0"
family: cpu
===============
address: 0x0
opcode: dpaqx_sa.w.ph ac3, s3, s2
disasm: dpaqx_sa.w.ph ac3, s3, s2
pseudo: asm("dpaqx_sa.w.ph ac3, s3, s2")
mnemonic: dpaqx_sa.w.ph
mask: ffffffff
prefix: 0
id: 541
bytes: b01e727e
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands:
- type: "reg"
value: "ac3"
- type: "reg"
value: "s3"
- type: "reg"
value: "s2"
family: mmx
===============
address: 0x0
opcode: ceil.w.d f10, f8
disasm: ceil.w.d f10, f8
pseudo: asm("ceil.w.d f10, f8")
mnemonic: ceil.w.d
mask: ffffffff
prefix: 0
id: 323
bytes: 8e422046
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands:
- type: "reg"
value: "f10"
- type: "reg"
value: "f8"
family: fpu
===============
address: 0x0
opcode: mulr.ps f10, f18, f7
disasm: mulr.ps f10, f18, f7
pseudo: asm("mulr.ps f10, f18, f7")
mnemonic: mulr.ps
mask: ffffffff
prefix: 0
id: 1003
bytes: 9a92c746
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands:
- type: "reg"
value: "f10"
- type: "reg"
value: "f18"
- type: "reg"
value: "f7"
family: fpu
===============
address: 0x0
opcode: mulsaq_s.w.ph ac3, s2, a3
disasm: mulsaq_s.w.ph ac3, s2, a3
pseudo: asm("mulsaq_s.w.ph ac3, s2, a3")
mnemonic: mulsaq_s.w.ph
mask: ffffffff
prefix: 0
id: 1006
bytes: b019477e
refptr: 0
size: 4
sign: false
type: mul
cycles: 0
opex:
operands:
- type: "reg"
value: "ac3"
- type: "reg"
value: "s2"
- type: "reg"
value: "a3"
family: mmx
===============
address: 0x0
opcode: mulsa.w.ph ac3, s2, a3
disasm: mulsa.w.ph ac3, s2, a3
pseudo: asm("mulsa.w.ph ac3, s2, a3")
mnemonic: mulsa.w.ph
mask: ffffffff
prefix: 0
id: 1007
bytes: b018477e
refptr: 0
size: 4
sign: false
type: mul
cycles: 0
opex:
operands:
- type: "reg"
value: "ac3"
- type: "reg"
value: "s2"
- type: "reg"
value: "a3"
family: mmx
===============
address: 0x0
opcode: mulv.b w4, w10, w7
disasm: mulv.b w4, w10, w7
pseudo: asm("mulv.b w4, w10, w7")
mnemonic: mulv.b
mask: ffffffff
prefix: 0
id: 1011
bytes: 12510778
refptr: 0
size: 4
sign: false
type: mul
cycles: 0
opex:
operands:
- type: "reg"
value: "w4"
- type: "reg"
value: "w10"
- type: "reg"
value: "w7"
family: mmx
===============
address: 0x0
opcode: tlbgwi
disasm: tlbgwi
pseudo: asm("tlbgwi")
mnemonic: tlbgwi
mask: ffffffff
prefix: 0
id: 1321
bytes: 0a000042
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands: []
family: virt
===============
address: 0x0
opcode: lbe a0, 5(t2)
disasm: lbe a0, 5(t2)
pseudo: asm("lbe a0, 5(t2)")
mnemonic: lbe
mask: ffffffff
prefix: 0
id: 797
bytes: ac02447d
refptr: 0
size: 4
sign: false
type: null
cycles: 0
rzil: (set a0 (cast 32 (msb (loadw 0 8 (+ (var t2) (bv 32 0x5)))) (loadw 0 8 (+ (var t2) (bv 32 0x5)))))
opex:
operands:
- type: "reg"
value: "a0"
- type: "mem"
base: "t2"
disp: 5
family: virt
===============
address: 0x0
opcode: yield a0, t2
disasm: yield a0, t2
pseudo: asm("yield a0, t2")
mnemonic: yield
mask: ffffffff
prefix: 0
id: 1359
bytes: 0920407d
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands:
- type: "reg"
value: "a0"
- type: "reg"
value: "t2"
family: thread
===============
address: 0x0
opcode: crc32b a0, t2, a0
disasm: crc32b a0, t2, a0
pseudo: asm("crc32b a0, t2, a0")
mnemonic: crc32b
mask: ffffffff
prefix: 0
id: 425
bytes: 0f00447d
refptr: 0
size: 4
sign: false
type: null
cycles: 0
opex:
operands:
- type: "reg"
value: "a0"
- type: "reg"
value: "t2"
- type: "reg"
value: "a0"
family: crpt
EOF
RUN
NAME=pdf main mips be
FILE=bins/elf/analysis/crackmips
CMDS=<<EOF
aaa
agf @ 0x00400820
EOF
EXPECT=<<EOF
.-----------------------------------------.
| 0x400820 |
| ; [13] -r-x section size 272 named .plt |
| ; XREFS(26) |
| ;-- section..plt: |
| ;-- .plt: |
| sym._PROCEDURE_LINKAGE_TABLE(); |
| ; 'A' |
| lui gp, 0x41 |
| ; [0x422884:4]=-1 |
| lw t9, 0x5424(gp) |
| ;-- waitpid: |
| addiu gp, gp, 0x5424 |
| subu t8, t8, gp |
| move t7, ra |
| srl t8, t8, 2 |
| ;-- SHA256_Update: |
| jalr t9 |
| addiu t8, t8, -2 |
`-----------------------------------------'
EOF
RUN
NAME=mips and nanomips tests for capstone6+
FILE==
ARGS=-a mips
CMDS=<<EOF
e cfg.bigendian=true
echo ---
e asm.cpu=mips32
wx 03e00008 # jr ra
pi 1
ao~type
echo ---
e asm.cpu=mips64
wx 03e00008 # jr ra
pi 1
ao~type
echo ---
e asm.cpu=mips32
wx 27bdff80 # addiu sp, sp, -0x80
pi 1
ao~type
ao~stackop
ao~stackptr
echo ---
e asm.cpu=mips64
wx 27bdff80 # addiu sp, sp, -0x80
pi 1
ao~type
ao~stackop
ao~stackptr
echo ---
e asm.cpu=mips32
wx 8f848000 # lw a0, -0x8000(gp)
pi 1
ao~type
ao~ptr
echo ---
e asm.cpu=mips64
wx df848000 # ld a0, -0x8000(gp)
pi 1
ao~type
ao~ptr
echo ---
e asm.cpu=nanomips
e cfg.bigendian=false
wx e0db # jrc ra
pi 1
ao~type
echo ---
wx 40413200 # lw a6, 0x30(gp)
pi 1
ao~esil
echo ---
wx 3d2050ea # and sp, sp, at
pi 1
ao~type
ao~esil
EOF
EXPECT=<<EOF
---
jr ra
type: ret
- type: "reg"
---
jr ra
type: ret
- type: "reg"
---
addiu sp, sp, -0x80
type: add
- type: "reg"
- type: "reg"
- type: "imm"
stackop: inc
stackptr: 128
---
addiu sp, sp, -0x80
type: add
- type: "reg"
- type: "reg"
- type: "imm"
stackop: inc
stackptr: 128
---
lw a0, -0x8000(gp)
type: load
- type: "reg"
- type: "mem"
ptr: 0xffffffffffff8000
refptr: 4
---
ld a0, -0x8000(gp)
type: load
- type: "reg"
- type: "mem"
ptr: 0xffffffffffff8000
refptr: 8
---
jrc ra
type: ret
- type: "reg"
---
lw a6, 0x30(gp)
esil: 0x30,gp,+,[4],a6,=
---
and sp, sp, at
type: and
- type: "reg"
- type: "reg"
- type: "reg"
esil: at,sp,&=
EOF
RUN
NAME=data xrefs outside functions marked as data
FILE=bins/elf/analysis/mipsbe-ip
CMDS=<<EOF
aaa
s 0x4350f8 # this address is found in `pdf @ sym.rtnl_rttable_n2a`
pd 1
EOF
EXPECT=<<EOF
; XREFS(69)
;-- data.004350f8:
0x004350f8 hex length=256 delta=40
0x004350f8 0043 0000 0043 5420 0043 396c 0042 0000 .C...CT .C9l.B..
0x00435108 0040 0000 0000 0000 0000 0000 0000 0000 .@..............
0x00435118 0000 0000 0041 ec80 0041 ec70 0041 1608 .....A...A.p.A..
0x00435128 0040 da54 0041 88d4 0041 ec60 0043 5430 .@.T.A...A.`.CT0
0x00435138 0041 c174 0041 d118 0041 ec50 0000 0000 .A.t.A...A.P....
0x00435148 0000 0000 0000 0000 0041 ec40 0041 9908 .........A.@.A..
0x00435158 0041 ec30 0041 b97c 0041 12c4 0041 b1e0 .A.0.A.|.A...A..
0x00435168 0040 d844 0041 ec20 0041 ab98 0041 ec10 .@.D.A. .A...A..
0x00435178 0041 bec4 0041 d4e4 0041 a588 0041 ec00 .A...A...A...A..
0x00435188 0041 9c50 0041 ebf0 0041 ab50 0041 ebe0 .A.P.A...A.P.A..
0x00435198 0041 ebd0 0043 5464 0041 ebc0 0041 ebb0 .A...CTd.A...A..
0x004351a8 0041 8830 0041 b2b4 0041 eba0 0041 a5a8 .A.0.A...A...A..
0x004351b8 0041 b054 0041 eb90 0041 b760 0041 dc20 .A.T.A...A.`.A.
0x004351c8 0041 eb80 0041 de40 .A...A.@
.dword 0x00430000
EOF
RUN
NAME=ELF: mips crash + args
FILE=bins/elf/ld-uClibc-0.9.33.2.so
CMDS=<<EOF
ii
iij
echo ---
# verify that the prelude is found when handling b 0x28dc
s sym._dl_malloc
af
pdf
echo ---
# the actual alloc implementation is at 0x000028dc
s 0x000028dc
pdf
EOF
EXPECT=<<EOF
nth vaddr bind type lib name
-----------------------------
[]
---
/ sym._dl_malloc(int32_t arg1);
| : ; arg int32_t arg1 @ a0
| : ; var int32_t var_4h @ stack - 0x4
| : 0x00002a1c lui gp, 2
| : 0x00002a20 addiu gp, gp, -sym._dl_parse_relocation_information
| : 0x00002a24 addu gp, gp, t9
| : 0x00002a28 lw v0, -obj._dl_malloc_function(gp) ; [0x17074:4]=0x17184 obj._dl_malloc_function
| : 0x00002a2c addiu sp, sp, -8
| : 0x00002a30 lw t9, 0(v0)
| : 0x00002a34 sw fp, (var_4h)
| ,==< 0x00002a38 beqz t9, 0x2a50
| |: 0x00002a3c move fp, sp
| |: 0x00002a40 move sp, fp
| |: 0x00002a44 lw fp, (var_4h)
| |: 0x00002a48 jr t9
..
| `--> 0x00002a50 move sp, fp
| : 0x00002a54 lw t9, -0x7fe4(gp) ; [0x1701c:4]=0
| : 0x00002a58 lw fp, (var_4h)
| : 0x00002a5c addiu t9, t9, fcn.000028dc
| `=< 0x00002a60 b fcn.000028dc
\ 0x00002a64 addiu sp, sp, 8
---
; CALL XREF from sym._dl_malloc @ 0x2a60
/ fcn.000028dc(int32_t arg_10h);
| ; var int32_t var_50h @ stack - 0x50
| ; var int32_t var_4ch @ stack - 0x4c
| ; var int32_t var_18h @ stack - 0x18
| ; var int32_t var_14h @ stack - 0x14
| ; var int32_t var_10h @ stack - 0x10
| ; var int32_t var_ch @ stack - 0xc
| ; var int32_t var_8h @ stack - 0x8
| ; var int32_t var_4h @ stack - 0x4
| ; arg int32_t arg_10h @ stack + 0x10
| 0x000028dc lui gp, 2
| 0x000028e0 addiu gp, gp, -0x38dc
| 0x000028e4 addu gp, gp, t9
| 0x000028e8 addiu sp, sp, -0x30
| 0x000028ec lw v0, -obj._dl_pagesize(gp) ; [0x1702c:4]=0x1718c obj._dl_pagesize
| 0x000028f0 sw s3, (var_ch)
| 0x000028f4 sw s2, (var_10h)
| 0x000028f8 lw s3, -0x7fd8(gp) ; [0x17028:4]=0x10000
| 0x000028fc lw s2, -0x7fd8(gp) ; [0x17028:4]=0x10000
| 0x00002900 sw s1, (var_14h)
| 0x00002904 lw v1, 0x71b8(s3)
| 0x00002908 move s1, a0 ; arg1
| 0x0000290c lw a0, 0x71b4(s2)
| 0x00002910 lw v0, 0(v0)
| 0x00002914 subu v1, a0, v1 ; arg1
| 0x00002918 addu v1, v1, s1
| 0x0000291c sw fp, (var_8h)
| 0x00002920 sltu v1, v0, v1
| 0x00002924 move fp, sp
| 0x00002928 sw ra, (var_4h)
| 0x0000292c sw s0, (var_18h)
| 0x00002930 sw gp, (var_4ch + 0x2c)
| ,=< 0x00002934 beqz v1, 0x29e0
| | 0x00002938 sltu v1, s1, v0
| ,==< 0x0000293c beqz v1, 0x2950
| || 0x00002940 move a1, s1
| || 0x00002944 addiu a1, v0, -1
| || 0x00002948 addu a1, a1, s1
| || 0x0000294c and a1, a1, v0
| `--> 0x00002950 lui a3, 0x400
| | 0x00002954 addiu sp, sp, -0x10
| | 0x00002958 move a0, zero
| | 0x0000295c addiu a2, zero, 3
| | 0x00002960 addiu a3, a3, 0x802
| | 0x00002964 move v0, zero
| | 0x00002968 addiu s0, zero, -1
| | 0x0000296c addiu sp, sp, -0x20
| | 0x00002970 sw s0, (var_50h)
| | 0x00002974 sw v0, (var_4ch)
| | 0x00002978 addiu v0, zero, 0xffa
| | 0x0000297c syscall
| | 0x00002980 addiu sp, sp, 0x20
| ,==< 0x00002984 beqz a3, 0x299c
| || 0x00002988 addiu v1, zero, -1
| || 0x0000298c lw v1, -obj._dl_errno(gp) ; [0x17024:4]=0x17190 obj._dl_errno
| || 0x00002990 sw v0, 0(v1)
| || 0x00002994 addiu v0, zero, -1
| || 0x00002998 addiu v1, zero, -1
| `--> 0x0000299c sw v0, 0x71b4(s2)
| ,==< 0x000029a0 bne v0, v1, 0x29e0
| || 0x000029a4 sw v0, 0x71b8(s3)
| || 0x000029a8 lw v0, -loc._fdata(gp) ; [0x17070:4]=0x17000 obj._dl_progname
| || 0x000029ac lw a1, -0x7fe4(gp) ; [0x1701c:4]=0
| || 0x000029b0 lw t9, -sym._dl_dprintf(gp) ; [0x1706c:4]=0x216c sym._dl_dprintf
| || 0x000029b4 lw a2, 0(v0)
| || 0x000029b8 addiu a0, zero, 2
| || 0x000029bc bal sym._dl_dprintf
| || 0x000029c0 addiu a1, a1, 0x692c
| || 0x000029c4 lw gp, (arg_10h)
| || 0x000029c8 addiu a0, zero, 0x14
| || 0x000029cc addiu v0, zero, 0xfa1
| || 0x000029d0 syscall
| ,===< 0x000029d4 beqz a3, 0x29e0
| ||| 0x000029d8 lw v1, -obj._dl_errno(gp) ; [0x17024:4]=0x17190 obj._dl_errno
| ||| 0x000029dc sw v0, 0(v1)
| ```-> 0x000029e0 lw v0, 0x71b4(s2)
| 0x000029e4 move sp, fp
| 0x000029e8 addu s1, v0, s1
| 0x000029ec addiu v1, zero, -4
| 0x000029f0 lw ra, (var_4h)
| 0x000029f4 addiu s1, s1, 3
| 0x000029f8 and s1, s1, v1
| 0x000029fc sw s1, 0x71b4(s2)
| 0x00002a00 lw fp, (var_8h)
| 0x00002a04 lw s3, (var_ch)
| 0x00002a08 lw s2, (var_10h)
| 0x00002a0c lw s1, (var_14h)
| 0x00002a10 lw s0, (var_18h)
| 0x00002a14 jr ra
\ 0x00002a18 addiu sp, sp, 0x30
EOF
RUN
Reference in a new issue View git blame Copy permalink