static int stack_clean (RCore *core, ut64 addr, RAnalFunction *fcn) {
int offset, ret;
char *tmp, *str, *sig;
RAnalOp *op = r_core_anal_op (core, addr);
if (!op) {
return 0;
}
str = strdup (r_strbuf_get (&op->esil));
if (!str) {
return 0;
}
tmp = strchr (str, ',');
if (!tmp) {
free (str);
return 0;
}
*tmp++ = 0;
offset = r_num_math (core->num, str);
const char *sp = r_reg_get_name (core->anal->reg, R_REG_NAME_SP);
sig = sdb_fmt (-1, "%s,+=", sp);
ret = 0;
if (!strncmp (tmp, sig, strlen (sig))) {
const char *esil = sdb_fmt (-1, "%d,%s,-=", offset, sp);
r_anal_esil_parse (core->anal->esil, esil);
r_anal_esil_dumpstack (core->anal->esil);
r_anal_esil_stack_free (core->anal->esil);
r_core_esil_step (core, UT64_MAX, NULL);
ret = op->size;
}
r_anal_op_free (op);
free (str);
return ret;
}
R_API void r_anal_type_match(RCore *core, RAnalFunction *fcn) {
bool esil_var[STATES_SIZE] = {false};
if (!core ) {
return;
}
if (!r_anal_emul_init (core, esil_var) || !fcn ) {
r_anal_emul_restore (core, esil_var);
return;
}
const char *pc = r_reg_get_name (core->anal->reg, R_REG_NAME_PC);
ut64 addr = fcn->addr;
r_reg_setv (core->dbg->reg, pc, fcn->addr);
r_debug_reg_sync (core->dbg, -1, true);
r_cons_break (NULL, NULL);
while (!r_cons_is_breaked ()) {
RAnalOp *op = r_core_anal_op (core, addr);
int loop_count = sdb_num_get ( core->anal->esil->db_trace, sdb_fmt (-1, "0x%"PFMT64x".count", addr), 0);
if (loop_count > LOOP_MAX) {
eprintf ("Unfortunately your evilly engineered %s function trapped my most innocent `aftm` in an infinite loop.\n", fcn->name);
eprintf ("I kept trace log for you to review and find out how bad things were going to happen by yourself.\n");
eprintf ("You can view this log by `ate`. Meanwhile, I will train on how to behave with such behaviour without bothering you.\n");
return;
}
sdb_num_set (core->anal->esil->db_trace, sdb_fmt (-1, "0x%"PFMT64x".count", addr), loop_count + 1, 0);
if (!op || op->type == R_ANAL_OP_TYPE_RET) {
r_anal_emul_restore (core, esil_var);
return;
}
if (op->type == R_ANAL_OP_TYPE_CALL) {
RAnalFunction *fcn_call = r_anal_get_fcn_in (core->anal, op->jump, -1);
//eprintf ("in the middle of %s\n", fcn_call->name);
if (fcn_call) {
type_match (core, addr, fcn_call->name);
} else {
eprintf ("Cannot find function at 0x%08"PFMT64x"\n", op->jump);
}
addr += op->size;
r_anal_op_free (op);
r_reg_setv (core->dbg->reg, pc, addr);
r_debug_reg_sync (core->dbg, -1, true);
r_anal_esil_set_pc (core->anal->esil, addr);
addr += stack_clean (core, addr, fcn);
r_reg_setv (core->dbg->reg, pc, addr);
r_debug_reg_sync (core->dbg, -1, true);
r_anal_esil_set_pc (core->anal->esil, addr);
continue;
} else {
r_core_esil_step (core, UT64_MAX, NULL);
r_anal_op_free (op);
}
r_core_cmd0 (core, ".ar*");
addr = r_reg_getv (core->anal->reg, pc);
}
r_cons_break_end ();
r_anal_emul_restore (core, esil_var);
}
R_API void r_core_print_func_args(RCore *core) {
RListIter *iter;
bool color = r_config_get_i (core->config, "scr.color");
if (!core->anal) {
return;
}
if (!core->anal->reg) {
return;
}
const char *pc = r_reg_get_name (core->anal->reg, R_REG_NAME_PC);
ut64 cur_addr = r_reg_getv (core->anal->reg, pc);
RAnalOp *op = r_core_anal_op (core, cur_addr, R_ANAL_OP_MASK_BASIC);
if (!op) {
return;
}
if (op->type == R_ANAL_OP_TYPE_CALL) {
RAnalFunction *fcn;
RAnalFuncArg *arg;
int i;
int nargs = 0;
bool onstack = false;
const char *fcn_name = NULL;
ut64 pcv = op->jump;
if (pcv == UT64_MAX) {
pcv = op->ptr;
}
fcn = r_anal_get_fcn_at (core->anal, pcv, 0);
if (fcn) {
fcn_name = fcn->name;
} else {
if (core->flags) {
RFlagItem *item = r_flag_get_i (core->flags, pcv);
if (item) {
fcn_name = item->name;
}
}
}
RList *list = r_core_get_func_args (core, fcn_name);
if (!r_list_empty (list)) {
int argcnt = 0;
r_list_foreach (list, iter, arg) {
if (arg->cc_source && !strncmp (arg->cc_source, "stack", 5)) {
onstack = true;
}
print_arg_str (argcnt, arg->name, color);
print_format_values (core, arg->fmt, onstack, arg->src, color);
argcnt++;
}
} else {
ut64 analyzeStackBased(RCore *core, Sdb *db, ut64 addr, RList *delayed_commands) {
#define addCall(x) sdb_array_add_num (db, "calls", x, 0);
#define addUcall(x) sdb_array_add_num (db, "ucalls", x, 0);
#define addUjmp(x) sdb_array_add_num (db, "ujmps", x, 0);
#define addCjmp(x) sdb_array_add_num (db, "cjmps", x, 0);
#define addRet(x) sdb_array_add_num (db, "rets", x, 0);
#define bbAddOpcode(x) sdb_array_insert_num (db, sdb_fmt ("bb.%"PFMT64x, addr+cur), -1, x, 0);
ut64 oaddr = addr;
ut64 *value = NULL;
RAnalOp *op;
int cur = 0;
bool block_end = false;
RStack *stack = r_stack_newf (10, free);
addTarget (core, stack, db, addr);
while (!r_stack_is_empty (stack)) {
block_end = false;
value = (ut64*) r_stack_pop (stack);
if (!value) {
eprintf ("Failed to pop next address from stack\n");
break;
}
addr = *value;
free (value);
cur = 0;
while (!block_end) {
op = r_core_anal_op (core, addr + cur, R_ANAL_OP_MASK_BASIC);
if (!op || !op->mnemonic) {
eprintf ("Cannot analyze opcode at %"PFMT64d"\n", addr+cur);
oaddr = UT64_MAX;
break;
}
if (op->mnemonic[0] == '?') {
eprintf ("Cannot analyze opcode at %"PFMT64d"\n", addr+cur);
oaddr = UT64_MAX;
break;
}
bbAddOpcode (addr+cur);
switch (op->type) {
case R_ANAL_OP_TYPE_NOP:
// skip nops
if (cur == 0) {
cur -= op->size;
addr += op->size;
oaddr += op->size;
}
break;
case R_ANAL_OP_TYPE_CALL:
/* A call instruction implies that the destination
* is a new function unless the address is inside
* the same range than the current function */
addCall (op->jump);
r_list_append (delayed_commands, r_str_newf ("axC %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
break;
case R_ANAL_OP_TYPE_UCALL:
case R_ANAL_OP_TYPE_ICALL:
case R_ANAL_OP_TYPE_RCALL:
case R_ANAL_OP_TYPE_IRCALL:
/* unknown calls depend on ESIL or DEBUG tracing
* information to know the destination, we can mark
* those 'calls' for later adding tracepoints in
* there to record all possible destinations */
addUcall (addr+cur);
if (op->ptr != UT64_MAX) {
r_list_append (delayed_commands, r_str_newf ("axC %"PFMT64d" %"PFMT64d, op->ptr, addr + cur));
}
break;
case R_ANAL_OP_TYPE_UJMP:
case R_ANAL_OP_TYPE_RJMP:
case R_ANAL_OP_TYPE_IJMP:
case R_ANAL_OP_TYPE_IRJMP:
/* an unknown jump use to go into computed destinations
* outside the current function, but it may result
* on an antidisasm trick */
addUjmp (addr + cur);
/* An unknown jump breaks the basic blocks */
block_end = true; // XXX more investigation here
break;
case R_ANAL_OP_TYPE_TRAP:
if (cur == 0) {
// skip leading int3
cur -= op->size;
addr += op->size;
oaddr += op->size;
} else {
block_end = true;
}
break;
case R_ANAL_OP_TYPE_RET:
addRet (addr + cur);
bbAdd (db, addr, addr + cur + op->size, UT64_MAX, UT64_MAX);
block_end = true;
break;
case R_ANAL_OP_TYPE_CJMP:
addCjmp (addr+cur);
bbAdd (db, addr, addr + cur + op->size, op->jump, addr + cur + op->size);
addTarget (core, stack, db, op->jump);
addTarget (core, stack, db, addr + cur + op->size);
block_end = true;
r_list_append (delayed_commands, r_str_newf ("axc %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
break;
case R_ANAL_OP_TYPE_JMP:
addUjmp (addr+cur);
bbAdd (db, addr, addr + cur + op->size, op->jump, UT64_MAX);
addTarget (core, stack, db, op->jump);
block_end = true;
r_list_append (delayed_commands, r_str_newf ("axc %"PFMT64d" %"PFMT64d, op->jump, addr + cur));
break;
case R_ANAL_OP_TYPE_UNK:
case R_ANAL_OP_TYPE_ILL:
eprintf ("a2f: Invalid instruction\n");
block_end = true;
break;
default:
if (op->ptr != UT64_MAX) {
r_list_append (delayed_commands, r_str_newf ("axd %"PFMT64d" %"PFMT64d, op->ptr, addr + cur));
}
break;
}
cur += op->size;
r_anal_op_free (op);
op = NULL;
}
}
r_stack_free (stack);
return oaddr;
}
R_API int r_core_visual_cmd(RCore *core, int ch) {
RAsmOp op;
ut64 offset = core->offset;
char buf[4096];
int i, ret, offscreen, cols = core->print->cols, delta = 0;
ch = r_cons_arrow_to_hjkl (ch);
ch = visual_nkey (core, ch);
if (ch<2) return 1;
// do we need hotkeys for data references? not only calls?
if (ch>='0'&& ch<='9') {
ut64 off = core->asmqjmps[ch-'0'];
if (off != UT64_MAX) {
int delta = R_ABS ((st64)off-(st64)offset);
r_io_sundo_push (core->io, offset);
if (curset && delta<100) {
cursor = delta;
} else {
r_core_visual_seek_animation (core, off);
//r_core_seek (core, off, 1);
}
r_core_block_read (core, 1);
}
} else
switch (ch) {
case 0x0d:
{
r_cons_enable_mouse (R_TRUE);
RAnalOp *op = r_core_anal_op (core, core->offset+cursor);
if (op) {
if (op->type == R_ANAL_OP_TYPE_JMP ||
op->type == R_ANAL_OP_TYPE_CJMP ||
op->type == R_ANAL_OP_TYPE_CALL) {
r_io_sundo_push (core->io, offset);
r_core_visual_seek_animation(core, op->jump);
}
}
r_anal_op_free (op);
}
break;
case 90: // shift+tab
if (!strcmp (printfmt[0], "x"))
printfmt[0] = "pxa";
else printfmt[0] = "x";
break;
case 9: // tab
{ // XXX: unify diff mode detection
ut64 f = r_config_get_i (core->config, "diff.from");
ut64 t = r_config_get_i (core->config, "diff.to");
if (f == t && f == 0) {
core->print->col = core->print->col==1? 2: 1;
} else {
ut64 delta = offset - f;
r_core_seek (core, t+delta, 1);
r_config_set_i (core->config, "diff.from", t);
r_config_set_i (core->config, "diff.to", f);
}
}
break;
case 'a':
if (core->file && !(core->file->rwx & 2)) {
r_cons_printf ("\nFile has been opened in read-only mode. Use -w flag\n");
r_cons_any_key ();
return R_TRUE;
}
r_cons_printf ("Enter assembler opcodes separated with ';':\n");
showcursor (core, R_TRUE);
r_cons_flush ();
r_cons_set_raw (R_FALSE);
strcpy (buf, "wa ");
r_line_set_prompt (":> ");
if (r_cons_fgets (buf+3, 1000, 0, NULL) <0) buf[0]='\0';
if (*buf) {
if (curset) r_core_seek (core, core->offset + cursor, 0);
r_core_cmd (core, buf, R_TRUE);
if (curset) r_core_seek (core, core->offset - cursor, 1);
}
showcursor (core, R_FALSE);
r_cons_set_raw (R_TRUE);
break;
case '!':
r_cons_2048();
break;
case 'o':
visual_offset (core);
break;
case 'A':
{ int oc = curset;
ut64 off = curset? core->offset+cursor : core->offset;
curset = 0;
r_core_visual_asm (core, off);
curset = oc;
}
break;
case 'c':
setcursor (core, curset?0:1);
break;
case 'C':
color = color? 0: 1;
r_config_set_i (core->config, "scr.color", color);
break;
case 'd':
r_core_visual_define (core);
break;
case 'D':
setdiff (core);
break;
case 'f':
{
int range, min, max;
char name[256], *n;
r_line_set_prompt ("flag name: ");
showcursor (core, R_TRUE);
if (r_cons_fgets (name, sizeof (name), 0, NULL) >=0 && *name) {
n = r_str_chop (name);
if (*name=='-') {
if (*n) r_flag_unset (core->flags, n+1, NULL);
} else {
if (ocursor != -1) {
min = R_MIN (cursor, ocursor);
max = R_MAX (cursor, ocursor);
} else {
min = max = cursor;
}
range = max-min+1;
if (range<1) range = 1;
if (*n) r_flag_set (core->flags, n,
core->offset + min, range, 1);
}
}
}
showcursor (core, R_FALSE);
break;
case 'F':
r_flag_unset_i (core->flags, core->offset + cursor, NULL);
break;
case 'n':
r_core_seek_next (core, r_config_get (core->config, "scr.nkey"));
break;
case 'N':
r_core_seek_previous (core, r_config_get (core->config, "scr.nkey"));
break;
case 'i':
case 'I':
if (core->file && !(core->file->rwx & 2)) {
r_cons_printf ("\nFile has been opened in read-only mode. Use -w flag\n");
r_cons_any_key ();
return R_TRUE;
}
showcursor (core, R_TRUE);
r_cons_flush ();
r_cons_set_raw (0);
if (ch=='I') {
strcpy (buf, "wow ");
r_line_set_prompt ("insert hexpair block: ");
if (r_cons_fgets (buf+4, sizeof (buf)-5, 0, NULL) <0)
buf[0]='\0';
char *p = strdup (buf);
int cur = core->print->cur;
if (cur>=core->blocksize)
cur = core->print->cur-1;
snprintf (buf, sizeof (buf), "%s @ $$0!%i", p,
core->blocksize-cursor);
r_core_cmd (core, buf, 0);
free (p);
break;
}
delta = (ocursor!=-1)? R_MIN (cursor, ocursor): cursor;
if (core->print->col==2) {
strcpy (buf, "\"w ");
r_line_set_prompt ("insert string: ");
if (r_cons_fgets (buf+3, sizeof (buf)-4, 0, NULL) <0)
buf[0]='\0';
strcat (buf, "\"");
} else {
r_line_set_prompt ("insert hex: ");
if (ocursor != -1) {
int bs = R_ABS (cursor-ocursor)+1;
core->blocksize = bs;
strcpy (buf, "wow ");
} else {
strcpy (buf, "wx ");
}
if (r_cons_fgets (buf+strlen (buf), sizeof (buf)-strlen (buf), 0, NULL) <0)
buf[0]='\0';
}
if (curset) r_core_seek (core, core->offset + delta, 0);
r_core_cmd (core, buf, 1);
if (curset) r_core_seek (core, offset, 1);
r_cons_set_raw (1);
showcursor (core, R_FALSE);
break;
case 'R':
r_core_cmd0 (core, "ecr");
break;
case 'e':
r_core_visual_config (core);
break;
case 'E':
r_core_visual_colors (core);
break;
case 'M':
r_core_visual_mounts (core);
break;
case 't':
r_core_visual_trackflags (core);
break;
case 'x':
{
int count = 0;
RList *xrefs = NULL;
RAnalRef *refi;
RListIter *iter;
RAnalFunction *fun;
if ((xrefs = r_anal_xref_get (core->anal, core->offset))) {
r_cons_gotoxy (1, 1);
r_cons_printf ("[GOTO XREF]> \n");
if (r_list_empty (xrefs)) {
r_cons_printf ("\tNo XREF found at 0x%"PFMT64x"\n", core->offset);
r_cons_any_key ();
r_cons_clear00 ();
} else {
r_list_foreach (xrefs, iter, refi) {
fun = r_anal_fcn_find (core->anal, refi->addr, R_ANAL_FCN_TYPE_NULL);
r_cons_printf (" [%i] 0x%08"PFMT64x" %s XREF 0x%08"PFMT64x" (%s) \n", count,
refi->at,
refi->type==R_ANAL_REF_TYPE_CODE?"CODE (JMP)":
refi->type==R_ANAL_REF_TYPE_CALL?"CODE (CALL)":"DATA", refi->addr,
fun?fun->name:"unk");
if (++count > 9) break;
}
}
} else xrefs = NULL;
ut64 analyzeIterative (RCore *core, Sdb *db, ut64 addr) {
#define addCall(x) sdb_array_add_num (db, "calls", x, 0);
#define addUcall(x) sdb_array_add_num (db, "ucalls", x, 0);
#define addUjmp(x) sdb_array_add_num (db, "ujmps", x, 0);
#define addCjmp(x) sdb_array_add_num (db, "cjmps", x, 0);
#define addRet(x) sdb_array_add_num (db, "rets", x, 0);
#define bbAddOpcode(x) sdb_array_insert_num (db, sdb_fmt (0, "bb.%"PFMT64x, bb_begin), -1, x, 0);
/* this loop creates basic blocks */
ut64 oaddr = addr;
RAnalOp *op;
int cur = 0;
int fcn_size = 0;
ut64 bb_end = addr;
ut64 bb_begin = addr;
eprintf ("-> 0x%08"PFMT64x"\n", addr);
for (;;) {
op = r_core_anal_op (core, addr + cur);
if (!op || !op->mnemonic) {
eprintf ("Cannot analyze opcode at %"PFMT64d"\n", addr+cur);
break;
}
eprintf ("0x%08"PFMT64x" %s\n", addr + cur, op->mnemonic);
if (op->mnemonic[0] == '?') {
eprintf ("Cannot analyze opcode at %"PFMT64d"\n", addr+cur);
break;
}
bb_end += op->size;
fcn_size += op->size;
bbAddOpcode (addr+cur);
switch (op->type) {
case R_ANAL_OP_TYPE_NOP:
/* If placed at the beginning..just skip them */
if (cur == 0) {
eprintf ("NOPSKIP %d\n", op->size);
oaddr += op->size;
bb_begin = addr = oaddr;
fcn_size -= op->size;
cur -= op->size;
}
break;
case R_ANAL_OP_TYPE_CALL:
/* A call instruction implies that the destination
* is a new function unless the address is inside
* the same range than the current function */
addCall (op->jump);
// add call reference
break;
case R_ANAL_OP_TYPE_UCALL:
/* unknown calls depend on ESIL or DEBUG tracing
* information to know the destination, we can mark
* those 'calls' for later adding tracepoints in
* there to record all possible destinations */
addUcall (addr+cur);
break;
case R_ANAL_OP_TYPE_UJMP:
/* an unknown jump use to go into computed destinations
* outside the current function, but it may result
* on an antidisasm trick */
addUjmp (addr+cur);
/* An unknown jump breaks the basic blocks */
goto endOfFunction;
case R_ANAL_OP_TYPE_TRAP:
addRet (addr + cur);
goto endOfFunction;
case R_ANAL_OP_TYPE_RET:
addRet (addr + cur);
goto endOfFunction;
case R_ANAL_OP_TYPE_CJMP:
/* jumps use to go into the same function, so we*/
addCjmp (op->jump);
bbAdd (db, bb_begin, bb_end, op->jump, bb_end);
bb_begin = bb_end;
break;
case R_ANAL_OP_TYPE_JMP:
/* jumps usually go to the same function, but they
* can be used */
goto endOfFunction;
case R_ANAL_OP_TYPE_UNK:
eprintf ("Unknown instruction at 0x%08"PFMT64x"\n", addr+cur);
goto endOfFunction;
case R_ANAL_OP_TYPE_ILL:
eprintf ("HLT\n");
goto endOfFunction;
}
cur += op->size;
r_anal_op_free (op);
op = NULL;
}
endOfFunction:
r_anal_op_free (op);
bbAdd (db, bb_begin, bb_end, UT64_MAX, UT64_MAX);
return oaddr;
}
