dnrops
/
radare2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

* r_anal 

- Redefined r_anal_aop
  - Fixed x86 plugin
* r_core
  - Added ao command (test)
* Fixed r_search Makefile
This commit is contained in:
Nibble 2009-02-16 02:12:02 +01:00
parent 26b5e48ede
commit f2a93116c9
6 changed files with 57 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libr/anal/anal.c
View File

@ -48,10 +48,10 @@ int r_anal_set(struct r_anal_t *anal, const char *name)
return R_FALSE;
}
int r_anal_aop(struct r_anal_t *anal)
int r_anal_aop(struct r_anal_t *anal, struct r_asm_t *data, struct r_anal_aop_t *aop)
{
if (anal->cur && anal->cur->aop)
return anal->cur->aop(anal->user);
return anal->cur->aop(data, aop);
return R_FALSE;
}

3
libr/anal/p/anal_dummy.c
View File

@ -2,9 +2,10 @@
#include <r_types.h>
#include <r_lib.h>
#include <r_asm.h>
#include <r_anal.h>
static int aop(void *user)
static int aop(struct r_asm_t *data, struct r_anal_aop_t *aop)
{
printf("Dummy analysis plugin");

44
libr/anal/p/anal_x86.c
View File

@ -23,11 +23,9 @@
// NOTE: buf should be at least 16 bytes!
// XXX addr should be off_t for 64 love
static int aop(void *user)
static int aop(struct r_asm_t *data, struct r_anal_aop_t *aop)
{
struct r_asm_t *a = (struct r_asm_t*)user;
struct r_anal_aop_t *aop = a->aux;
u8 *buf = a->buf;
u8 *buf = data->buf;
memset(aop, '\0', sizeof(struct r_anal_aop_t));
aop->type = R_ANAL_AOP_TYPE_UNK;
@ -124,8 +122,8 @@ static int aop(void *user)
} else
if (buf[1]>=0x80 && buf[1]<=0x8f) {
aop->type = R_ANAL_AOP_TYPE_CJMP;
aop->jump = a->pc+6+buf[2]+(buf[3]<<8)+(buf[4]<<16)+(buf[5]<<24);//((unsigned long)((buf+2))+6);
aop->fail = a->pc+6;
aop->jump = data->pc+6+buf[2]+(buf[3]<<8)+(buf[4]<<16)+(buf[5]<<24);//((unsigned long)((buf+2))+6);
aop->fail = data->pc+6;
aop->length = 6;
//aop->eob = 1;
}
@ -143,24 +141,24 @@ static int aop(void *user)
case 0xe8: // call
aop->type = R_ANAL_AOP_TYPE_CALL;
aop->length = 5;
//aop->jump = a->pc+*ptr+5; //(unsigned long)((buf+1)+5);
aop->jump = a->pc+5+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);//((unsigned long)((buf+2))+6);
aop->fail = a->pc+5;
//printf("a->pc: %08llx\n call %08llx \n ret %08llx\n", a->pc, aop->jump, aop->fail);
//aop->jump = data->pc+*ptr+5; //(unsigned long)((buf+1)+5);
aop->jump = data->pc+5+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);//((unsigned long)((buf+2))+6);
aop->fail = data->pc+5;
//printf("data->pc: %08llx\n call %08llx \n ret %08llx\n", data->pc, aop->jump, aop->fail);
// aop->eob = 1;
break;
case 0xe9: // jmp
aop->type = R_ANAL_AOP_TYPE_JMP;
aop->length = 5;
//aop->jump = (unsigned long)((buf+1)+5);
aop->jump = a->pc+5+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);//((unsigned long)((buf+2))+6);
aop->jump = data->pc+5+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);//((unsigned long)((buf+2))+6);
aop->fail = 0L;
aop->eob = 1;
break;
case 0xeb: // short jmp
aop->type = R_ANAL_AOP_TYPE_JMP;
aop->length = 2;
aop->jump = a->pc+((unsigned long)((char)buf[1])+2);
aop->jump = data->pc+((unsigned long)((char)buf[1])+2);
aop->fail = 0L;
aop->eob = 1;
break;
@ -191,7 +189,7 @@ static int aop(void *user)
aop->length = 2;
aop->eob = 1;
//aop->jump = vm_arch_x86_regs[VM_X86_EAX+buf[1]-0xd0];
aop->fail = a->pc+2;
aop->fail = data->pc+2;
} else
if (buf[1]>=0xe0 && buf[1]<=0xe7) {
aop->type = R_ANAL_AOP_TYPE_UJMP;
@ -320,34 +318,34 @@ static int aop(void *user)
case 0xa1: // mov eax, [addr]
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_EAX] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_EAX] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//radare_read_at((u64)vm_arch_x86_regs[VM_X86_EAX], (unsigned char *)&(vm_arch_x86_regs[VM_X86_EAX]), 4);
break;
// roll to a switch range case
case 0xb8: // mov eax, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_EAX] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_EAX] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
case 0xb9: // mov ecx, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_ECX] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_ECX] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
case 0xba: // mov edx, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_EDX] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_EDX] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
case 0xbb: // mov ebx, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_EBX] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_EBX] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
case 0xbc: // mov esp, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_ESP] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_ESP] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
case 0xbd: // mov esp, <inmedate>
aop->type = R_ANAL_AOP_TYPE_MOV;
//vm_arch_x86_regs[VM_X86_EBP] = a->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
//vm_arch_x86_regs[VM_X86_EBP] = data->pc+buf[1]+(buf[2]<<8)+(buf[3]<<16)+(buf[4]<<24);
break;
#if 0
case0xF
@ -384,8 +382,8 @@ static int aop(void *user)
aop->type = R_ANAL_AOP_TYPE_CJMP;
aop->length = 2;
// aop->jump = (unsigned long)((buf+2)+6);
aop->jump = a->pc+bo+2; //(unsigned long)((buf+1)+5);
aop->fail = a->pc+2;
aop->jump = data->pc+bo+2; //(unsigned long)((buf+1)+5);
aop->fail = data->pc+2;
aop->eob = 1;
return 2;
}
@ -394,7 +392,7 @@ static int aop(void *user)
//aop->type = R_ANAL_AOP_TYPE_UNK;
}
aop->length = a->inst_len;
aop->length = data->inst_len;
if (!(aop->jump>>33))
aop->jump &= 0xFFFFFFFF; // XXX may break on 64 bits here

20
libr/core/cmd.c
View File

@ -347,6 +347,26 @@ static int cmd_anal(void *data, const char *input)
r_anal_list(&core->anal);
break;
case 'o':
{
/* XXX hardcoded */
int ret, idx;
u8 *buf = core->block;
struct r_asm_t a;// TODO: move to core.h
struct r_anal_aop_t aop;
r_asm_init(&a);
r_asm_set_pc(&a, core->seek);
r_anal_set(&core->anal, "anal_x86");
for(idx=ret=0; idx < len; idx+=ret) {
r_asm_set_pc(&a, a.pc + ret);
ret = r_asm_disasm(&a, buf+idx, len-idx);
r_cons_printf("0x%08llx %14s %s\n",
core->seek+idx, a.buf_hex, a.buf_asm);
r_anal_aop(&core->anal, &a, &aop);
r_cons_printf("JUMP: 0x%08llx\n",
aop.jump);
}
}
break;
default:
fprintf(stderr, "Usage: a[o] [len]\n"

21
libr/include/r_anal.h
View File

@ -4,6 +4,7 @@
#define _INCLUDE_R_ANAL_H_
#include "r_types.h"
#include "r_asm.h"
#include "list.h"
enum {
@ -89,15 +90,6 @@ struct r_anal_t {
struct list_head anals;
};
struct r_anal_handle_t {
char *name;
char *desc;
int (*init)(void *user);
int (*fini)(void *user);
int (*aop)(void *user);
struct list_head list;
};
struct r_anal_aop_t {
int type; /* type of opcode */
int stackop; /* operation on stack? */
@ -111,13 +103,22 @@ struct r_anal_aop_t {
u64 i_dst,i_src1,i_src2; /* inmediate arguments */
};
struct r_anal_handle_t {
char *name;
char *desc;
int (*init)(void *user);
int (*fini)(void *user);
int (*aop)(struct r_asm_t *data, struct r_anal_aop_t *aop);
struct list_head list;
};
/* anal.c */
int r_anal_init(struct r_anal_t *anal);
void r_anal_set_user_ptr(struct r_anal_t *anal, void *user);
int r_anal_add(struct r_anal_t *anal, struct r_anal_handle_t *foo);
int r_anal_list(struct r_anal_t *anal);
int r_anal_set(struct r_anal_t *anal, const char *name);
int r_anal_aop(struct r_anal_t *anal);
int r_anal_aop(struct r_anal_t *anal, struct r_asm_t *data, struct r_anal_aop_t *aop);
int r_anal_set_bits(struct r_anal_t *anal, int bits);
int r_anal_set_big_endian(struct r_anal_t *anal, int boolean);

2
libr/search/t/Makefile
View File

@ -14,5 +14,5 @@ test-str:
${CC} -g -I ../../include test-str.c ${LDFLAGS} -o test-str
clean:
rm -f test test.o test-str test-str.o
rm -f test test.o test-str test-str.o test-regexp