Variables on the stack are not identified by bp/sp+<offset> anymore, but by their address from the bottom of the stack frame (RzStackAddr), independent of how they are accessed. So now there are only two kinds of variables: stack and register. This required some major refactoring and other changes: * RzAnalysisVar.isarg was removed. Whether a variable is an argument is now specified implicitly by its storage location. * Varsub of struct fields had to be rewritten so fields can be queried by arbitrary stack addresses using the recently introduced sp tracking, as the old approach to fill a list with all fields would not work anymore. * analysis.vars.stackname was removed, new behavior is more similar to this being true before. * Variables will not be created at stack+0 now, because the return address is there. Before, vars were only created sometimes in such cases. * Variables created from bp offsets in x86 are not deleted anymore if the function's bp_frame is false (see removed rz_analysis_function_delete_vars_by_kind(fcn, RZ_ANALYSIS_VAR_KIND_BPV); calls). This may lead to some false-positive detected variables. Whether this really is a practical issue is yet to be seen. At least there are no meaningful tests that are broken by this. * Applying variables from dwarf needed some fixes for determining the correct stack locations of variables in order to write meaningful tests. The handling is still not entirely correct for all possibilities of dwarf info, but at least the changed/added test cases are right and serve as a reference for future changes. * Projects version 11 is introduced. * afvb commands have been removed, afvs now handles all stack vars.
406 lines
11 KiB
Text
406 lines
11 KiB
Text
NAME=load with file without moving anything
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
f i_do_hope_that_no_entity_knocks_over_my_beverage @ 0x080483d8
|
|
Ps .tmp_load_no_move.rzdb
|
|
o--
|
|
Po .tmp_load_no_move.rzdb
|
|
rm .tmp_load_no_move.rzdb
|
|
pdq 3 @ 0x080483d8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x080483d8 i_do_hope_that_no_entity_knocks_over_my_beverage:
|
|
0x080483d8 50 push eax
|
|
0x080483d9 54 push esp
|
|
0x080483da 52 push edx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load with file using saved absolute file path after project file was moved
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
f i_do_hope_that_no_entity_knocks_over_my_beverage @ 0x080483d8
|
|
Ps .tmp_load_move_project.rzdb
|
|
o--
|
|
mkdir -p .tmp_load_move_project
|
|
mv .tmp_load_move_project.rzdb .tmp_load_move_project/
|
|
cd .tmp_load_move_project
|
|
Po .tmp_load_move_project.rzdb
|
|
rm .tmp_load_move_project.rzdb
|
|
cd ..
|
|
rm .tmp_load_move_project
|
|
pdq 3 @ 0x080483d8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x080483d8 i_do_hope_that_no_entity_knocks_over_my_beverage:
|
|
0x080483d8 50 push eax
|
|
0x080483d9 54 push esp
|
|
0x080483da 52 push edx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load with file using saved relative file path after project file and binary were moved together
|
|
FILE=--
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
cp bins/elf/crackme0x05 .tmp_load_move_both.bin
|
|
o .tmp_load_move_both.bin
|
|
f i_do_hope_that_no_entity_knocks_over_my_beverage @ 0x080483d8
|
|
Ps .tmp_load_move_both.rzdb
|
|
o--
|
|
mkdir -p .tmp_load_move_both
|
|
mv .tmp_load_move_both.rzdb .tmp_load_move_both/
|
|
mv .tmp_load_move_both.bin .tmp_load_move_both/
|
|
Po .tmp_load_move_both/.tmp_load_move_both.rzdb
|
|
pdq 3 @ 0x080483d8
|
|
o--
|
|
rm .tmp_load_move_both/.tmp_load_move_both.rzdb
|
|
rm .tmp_load_move_both/.tmp_load_move_both.bin
|
|
rm .tmp_load_move_both
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x080483d8 i_do_hope_that_no_entity_knocks_over_my_beverage:
|
|
0x080483d8 50 push eax
|
|
0x080483d9 54 push esp
|
|
0x080483da 52 push edx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load with file using saved relative file path after project file and binary were moved together with different relation
|
|
FILE=--
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
mkdir -p .tmp_load_move_both2/.tmp_load_move_both2
|
|
cp bins/elf/crackme0x05 .tmp_load_move_both2/somebin
|
|
o .tmp_load_move_both2/somebin
|
|
f i_do_hope_that_no_entity_knocks_over_my_beverage @ 0x080483d8
|
|
Ps .tmp_load_move_both2.rzdb
|
|
o--
|
|
mv .tmp_load_move_both2.rzdb .tmp_load_move_both2/
|
|
mv .tmp_load_move_both2/somebin .tmp_load_move_both2/.tmp_load_move_both2/somebin
|
|
Po .tmp_load_move_both2/.tmp_load_move_both2.rzdb
|
|
pdq 3 @ 0x080483d8
|
|
o--
|
|
rm .tmp_load_move_both2/.tmp_load_move_both2.rzdb
|
|
rm .tmp_load_move_both2/.tmp_load_move_both2/somebin
|
|
rm .tmp_load_move_both2/.tmp_load_move_both2
|
|
rm .tmp_load_move_both2
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x080483d8 i_do_hope_that_no_entity_knocks_over_my_beverage:
|
|
0x080483d8 50 push eax
|
|
0x080483d9 54 push esp
|
|
0x080483da 52 push edx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load with file using saved raw file path after everything has been messed up, but binary is in cwd
|
|
FILE=--
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
mkdir -p .tmp_load_move_bin
|
|
cp bins/elf/crackme0x05 .tmp_load_move_bin.bin
|
|
o .tmp_load_move_bin.bin
|
|
f i_do_hope_that_no_entity_knocks_over_my_beverage @ 0x080483d8
|
|
Ps .tmp_load_move_bin.rzdb
|
|
o--
|
|
mv .tmp_load_move_bin.bin .tmp_load_move_bin/.tmp_load_move_bin.bin
|
|
cd .tmp_load_move_bin
|
|
Po ../.tmp_load_move_bin.rzdb
|
|
pdq 3 @ 0x080483d8
|
|
o--
|
|
cd ..
|
|
rm .tmp_load_move_bin/.tmp_load_move_bin.bin
|
|
rm .tmp_load_move_bin
|
|
rm .tmp_load_move_bin.rzdb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x080483d8 i_do_hope_that_no_entity_knocks_over_my_beverage:
|
|
0x080483d8 50 push eax
|
|
0x080483d9 54 push esp
|
|
0x080483da 52 push edx
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load without file
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
f a_nice_refreshing_un-moisten @ 0x080483d8
|
|
Ps .tmp_load_without_file.rzdb
|
|
ol
|
|
?e --
|
|
o--
|
|
ol
|
|
pdq 3 @ 0x080483d8
|
|
?e --
|
|
Poo .tmp_load_without_file.rzdb
|
|
rm .tmp_load_without_file.rzdb
|
|
ol
|
|
?e --
|
|
pdq 3 @ 0x080483d8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
3 * r-x 0x00001de8 bins/elf/crackme0x05
|
|
4 - r-x 0x0000001c vfile://0/reloc-targets
|
|
5 - rw- 0x00000004 null://4
|
|
--
|
|
0x080483d8 ff invalid
|
|
0x080483d9 ff invalid
|
|
0x080483da ff invalid
|
|
--
|
|
--
|
|
0x080483d8 a_nice_refreshing_un_moisten:
|
|
0x080483d8 ff invalid
|
|
0x080483d9 ff invalid
|
|
0x080483da ff invalid
|
|
EOF
|
|
RUN
|
|
|
|
NAME=load on top of file
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
f a_nice_refreshing_un-moisten @ 0x080483d8
|
|
Ps .tmp_load_on_top_of_file.rzdb
|
|
ol
|
|
?e --
|
|
o--
|
|
ol
|
|
pdq 3 @ 0x080483d8
|
|
?e --
|
|
o bins/elf/crackme0x00b
|
|
Poo .tmp_load_on_top_of_file.rzdb
|
|
rm .tmp_load_on_top_of_file.rzdb
|
|
?e --
|
|
pdq 3 @ 0x080483d8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
3 * r-x 0x00001de8 bins/elf/crackme0x05
|
|
4 - r-x 0x0000001c vfile://0/reloc-targets
|
|
5 - rw- 0x00000004 null://4
|
|
--
|
|
0x080483d8 ff invalid
|
|
0x080483d9 ff invalid
|
|
0x080483da ff invalid
|
|
--
|
|
--
|
|
0x080483d8 a_nice_refreshing_un_moisten:
|
|
0x080483d8 0000 add byte [eax], al
|
|
0x080483da 00e9 add cl, ch
|
|
0x080483dc 90 nop
|
|
EOF
|
|
RUN
|
|
|
|
NAME=flags
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
fr sym.main sym.renamedmain
|
|
fl~?
|
|
fl~main
|
|
Ps .tmp_flags.rzdb
|
|
?e --
|
|
o--
|
|
fl
|
|
?e --
|
|
Poo .tmp_flags.rzdb
|
|
rm .tmp_flags.rzdb
|
|
fl~?
|
|
fl~main
|
|
EOF
|
|
EXPECT=<<EOF
|
|
111
|
|
0x08048364 16 sym.imp.__libc_start_main
|
|
0x08048540 256 main
|
|
0x08048540 92 sym.renamedmain
|
|
0x0804a000 4 reloc.__libc_start_main
|
|
--
|
|
--
|
|
111
|
|
0x08048364 16 sym.imp.__libc_start_main
|
|
0x08048540 92 sym.renamedmain
|
|
0x08048540 256 main
|
|
0x0804a000 4 reloc.__libc_start_main
|
|
EOF
|
|
RUN
|
|
|
|
NAME=config
|
|
FILE==
|
|
CMDS=<<EOF
|
|
e asm.describe=1
|
|
e asm.describe
|
|
e asm.indentspace=8
|
|
e asm.indentspace
|
|
e analysis.fcnprefix=myfunctions
|
|
e analysis.fcnprefix
|
|
Ps .tmp_config.rzdb
|
|
?e --
|
|
e asm.describe=0
|
|
e asm.describe
|
|
e asm.indentspace=0
|
|
e asm.indentspace
|
|
e analysis.fcnprefix=fcn
|
|
e analysis.fcnprefix
|
|
?e --
|
|
Poo .tmp_config.rzdb
|
|
rm .tmp_config.rzdb
|
|
e asm.describe
|
|
e asm.indentspace
|
|
e analysis.fcnprefix
|
|
EOF
|
|
EXPECT=<<EOF
|
|
true
|
|
8
|
|
myfunctions
|
|
--
|
|
false
|
|
0
|
|
fcn
|
|
--
|
|
true
|
|
8
|
|
myfunctions
|
|
EOF
|
|
RUN
|
|
|
|
NAME=seek
|
|
FILE==
|
|
CMDS=<<EOF
|
|
s 0x1337
|
|
s
|
|
Ps .tmp_seek.rzdb
|
|
o--
|
|
s 0
|
|
Poo .tmp_seek.rzdb
|
|
rm .tmp_seek.rzdb
|
|
s
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x1337
|
|
0x1337
|
|
EOF
|
|
RUN
|
|
|
|
NAME=analysis
|
|
FILE==
|
|
CMDS=<<EOF
|
|
af+ windowpane @ 0x100
|
|
afb+ windowpane 0x100 0x30
|
|
afl
|
|
Ps .tmp_analysis.rzdb
|
|
?e --
|
|
o--
|
|
afl
|
|
?e --
|
|
Poo .tmp_analysis.rzdb
|
|
rm .tmp_analysis.rzdb
|
|
afl
|
|
EOF
|
|
EXPECT=<<EOF
|
|
0x00000100 1 48 windowpane
|
|
--
|
|
--
|
|
0x00000100 1 48 windowpane
|
|
EOF
|
|
RUN
|
|
|
|
NAME=remember saved project file during session
|
|
FILE=bins/elf/crackme0x05
|
|
CMDS=<<EOF
|
|
e asm.bytes=true
|
|
Ps .tmp_remember.rzdb
|
|
e prj.file
|
|
f cashews @ 0x080483d8
|
|
Ps
|
|
o--
|
|
e prj.file=
|
|
e prj.file
|
|
Po .tmp_remember.rzdb
|
|
e prj.file
|
|
rm .tmp_remember.rzdb
|
|
pdq 1 @ 0x080483d8
|
|
EOF
|
|
EXPECT=<<EOF
|
|
.tmp_remember.rzdb
|
|
|
|
.tmp_remember.rzdb
|
|
0x080483d8 cashews:
|
|
0x080483d8 50 push eax
|
|
EOF
|
|
RUN
|
|
|
|
NAME=raw file permissions after reload
|
|
FILE=bins/other/0x3
|
|
CMDS=<<EOF
|
|
oml
|
|
Ps .tmp_perms.rzdb
|
|
o--
|
|
?e --
|
|
oml
|
|
?e --
|
|
Po .tmp_perms.rzdb
|
|
oml
|
|
rm .tmp_perms.rzdb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
1 fd: 3 +0x00000000 0x00000000 * 0x00000002 r-x
|
|
--
|
|
--
|
|
1 fd: 3 +0x00000000 0x00000000 * 0x00000002 r-x
|
|
EOF
|
|
RUN
|
|
|
|
NAME=migrate info
|
|
FILE=--
|
|
CMDS=<<EOF
|
|
Po prj/v1-noreturn.rzdb
|
|
EOF
|
|
EXPECT=<<EOF
|
|
Detailed project load info:
|
|
project migrated from version 1 to 2.
|
|
project migrated from version 2 to 3.
|
|
project migrated from version 3 to 4.
|
|
project migrated from version 4 to 5.
|
|
project migrated from version 5 to 6.
|
|
project migrated from version 6 to 7.
|
|
project migrated from version 7 to 8.
|
|
project migrated from version 8 to 9.
|
|
project migrated from version 9 to 10.
|
|
project migrated from version 10 to 11.
|
|
EOF
|
|
RUN
|
|
|
|
NAME=longkeys (> 256)
|
|
FILE=bins/elf/crackme0x00b
|
|
CMDS=<<EOF
|
|
s 0x08048464
|
|
af Loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongname
|
|
ac Claaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss
|
|
acm Claaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeethod 0x100
|
|
Ps .tmp_longkeys.rzdb
|
|
?e --
|
|
o--
|
|
ol
|
|
?e --
|
|
Po .tmp_longkeys.rzdb
|
|
rm .tmp_longkeys.rzdb
|
|
?e --
|
|
afl
|
|
acll
|
|
EOF
|
|
EXPECT=<<EOF
|
|
--
|
|
--
|
|
--
|
|
0x08048464 1 1 Loooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooongname
|
|
[Claaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaasssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss]
|
|
nth name addr vt_offset type
|
|
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
|
1 Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeethod 0x100 -1 DEFAULT
|
|
|
|
EOF
|
|
EXPECT_ERR=<<EOF
|
|
EOF
|
|
RUN
|