2020-12-28 00:27:32 +01:00
|
|
|
NAME=seekinstr
|
|
|
|
FILE=bins//mach0/ired-arm64
|
2020-12-28 19:19:09 +01:00
|
|
|
ARGS=-e cfg.newshell=false
|
2020-12-28 00:27:32 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
# TODO: this test doesnt work on newshell
|
|
|
|
afr
|
|
|
|
?v $Fe
|
|
|
|
s $I1@$Fe
|
|
|
|
pi 1
|
|
|
|
?v $Fb
|
|
|
|
s $i1
|
|
|
|
pi 1
|
|
|
|
?v $Fb
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x1000058e4
|
|
|
|
b.lt 0x100005d34
|
|
|
|
0x100005864
|
|
|
|
ldr x21, [x20, 8]
|
|
|
|
0x1000058e4
|
|
|
|
EOF
|
|
|
|
RUN
|
|
|
|
|
2019-12-08 15:31:14 +01:00
|
|
|
NAME=seekop
|
2020-04-13 19:49:23 +02:00
|
|
|
FILE=bins//mach0/ired-arm64
|
2019-12-08 15:31:14 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
s
|
|
|
|
so+3
|
|
|
|
s
|
|
|
|
so-3
|
|
|
|
s
|
|
|
|
so+2
|
|
|
|
s
|
|
|
|
so-2
|
|
|
|
s
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x100005864
|
|
|
|
0x100005870
|
|
|
|
0x100005864
|
|
|
|
0x10000586c
|
|
|
|
0x100005864
|
|
|
|
EOF
|
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=s0x
|
|
|
|
FILE=-
|
|
|
|
CMDS=<<EOF
|
|
|
|
s0x33
|
|
|
|
s
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x33
|
|
|
|
EOF
|
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek far offset
|
|
|
|
FILE=-
|
|
|
|
CMDS=<<EOF
|
|
|
|
s 0x7fffff8000b54000 ; ?v $$
|
|
|
|
s 0x8fffff8000b54000 ; ?v $$
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x7fffff8000b54000
|
|
|
|
0x8fffff8000b54000
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek math (symbol addition)
|
2020-04-13 19:49:23 +02:00
|
|
|
FILE=bins/elf/analysis/hello-linux-x86_64
|
2019-12-08 15:31:14 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
s sym._start + 8
|
|
|
|
s
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x400418
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek opcodes
|
|
|
|
FILE=-
|
|
|
|
CMDS=<<EOF
|
|
|
|
e asm.arch=x86
|
|
|
|
e asm.bits=64
|
|
|
|
wx 4883c668
|
|
|
|
s 0; so ; ?v $$
|
|
|
|
s 0; so 1 ; ?v $$
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x4
|
|
|
|
0x4
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek line
|
2020-04-13 19:49:23 +02:00
|
|
|
FILE=bins/mach0/mac-ls
|
2019-12-08 15:31:14 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
sl 1; ?v $$
|
|
|
|
e lines.from=0x100002000
|
|
|
|
e lines.to=0x100004000
|
|
|
|
sl 9
|
|
|
|
sl
|
|
|
|
sl+1
|
|
|
|
sl
|
|
|
|
sl-2
|
|
|
|
sl
|
|
|
|
sl 999999999999
|
|
|
|
sl
|
|
|
|
sl 0
|
|
|
|
sl
|
|
|
|
sl 1; ?v $$
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x100001058
|
|
|
|
9
|
|
|
|
10
|
|
|
|
8
|
|
|
|
8
|
|
|
|
8
|
|
|
|
0x1000025a3
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek local flag
|
2020-04-13 19:49:23 +02:00
|
|
|
FILE=bins/elf/analysis/main
|
2019-12-08 15:31:14 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
af@main
|
|
|
|
f.foo@main+4
|
|
|
|
s main+.foo
|
|
|
|
s
|
|
|
|
s main+.foo
|
|
|
|
s
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x40050a
|
|
|
|
0x40050a
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=Redodups
|
|
|
|
FILE=malloc://512
|
|
|
|
CMDS=<<EOF
|
|
|
|
s $$
|
|
|
|
s $$
|
|
|
|
s $$
|
|
|
|
s $$
|
|
|
|
s*~?
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
1
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek backwards
|
|
|
|
FILE=malloc://0x4000
|
|
|
|
CMDS=<<EOF
|
|
|
|
s 0
|
|
|
|
b 64
|
|
|
|
wb 38
|
|
|
|
s 64
|
|
|
|
wb deadbeef
|
|
|
|
s-32
|
|
|
|
px
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
- offset - 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
|
|
|
|
0x00000020 3838 3838 3838 3838 3838 3838 3838 3838 8888888888888888
|
|
|
|
0x00000030 3838 3838 3838 3838 3838 3838 3838 3838 8888888888888888
|
|
|
|
0x00000040 dead beef dead beef dead beef dead beef ................
|
|
|
|
0x00000050 dead beef dead beef dead beef dead beef ................
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek silent
|
|
|
|
FILE=-
|
|
|
|
CMDS=<<EOF
|
|
|
|
s 0x100
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
?e
|
|
|
|
s 0x200
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
?e
|
|
|
|
ss 0x300
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x100
|
|
|
|
f undo_0 @ 0x0
|
|
|
|
|
|
|
|
0x200
|
|
|
|
f undo_1 @ 0x0
|
|
|
|
f undo_0 @ 0x100
|
|
|
|
|
|
|
|
0x300
|
|
|
|
f undo_1 @ 0x0
|
|
|
|
f undo_0 @ 0x100
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=seek silent to register
|
|
|
|
FILE=-
|
2019-12-08 15:31:14 +01:00
|
|
|
CMDS=<<EOF
|
|
|
|
e asm.arch=x86
|
|
|
|
e asm.bits=32
|
|
|
|
dr eax=0x200
|
|
|
|
dr ebx=0x300
|
|
|
|
s 0x100
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
?e
|
|
|
|
sr eax
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
?e
|
|
|
|
ssr ebx
|
|
|
|
s
|
|
|
|
s*
|
|
|
|
EOF
|
2020-04-05 20:56:06 +08:00
|
|
|
EXPECT=<<EOF
|
|
|
|
0x100
|
|
|
|
f undo_0 @ 0x0
|
|
|
|
|
|
|
|
0x200
|
|
|
|
f undo_1 @ 0x0
|
|
|
|
f undo_0 @ 0x100
|
|
|
|
|
|
|
|
0x300
|
|
|
|
f undo_1 @ 0x0
|
|
|
|
f undo_0 @ 0x100
|
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
|
|
|
|
|
|
|
NAME=so -N, pd -N
|
2020-04-13 19:49:23 +02:00
|
|
|
FILE=bins/pe/cmd_adf_sample0.exe
|
2020-01-17 21:58:18 +08:00
|
|
|
CMDS=<<EOF
|
Change macro syntax to use `;` instead of `,`
This change is to ease the switch to the new parser and make the syntax
more consistent and easy. As things were before this patch, ',' could be
part of an argument of a command, but at the same time it was used as a
separator when defining a new macro. This difference in how `,` is
interpreter, makes parsing commands harder, as grep specifiers,
arguments, etc. should be parsed differently based on whether they are
inside a macro body or not.
By switching to using `;` as separator in the macro body, arguments,
grep specifiers, etc. can be parsed as they would be outside of a macro
body, making the new parser more consistent and easier.
2020-03-10 15:47:13 +01:00
|
|
|
"(test_so_pd addr; ?e; ?e --- From $0 ---; ?e; ?e -- 1 --; s $0; pd -1; so -1; s; pd 1; ?e; ?e -- 2 --; s $0; pd -2; so -2; s; pd 2)"
|
2019-12-08 15:31:14 +01:00
|
|
|
.(test_so_pd 0x0) # Special case
|
|
|
|
.(test_so_pd 0x401000)
|
|
|
|
s 0x560e67
|
|
|
|
af
|
|
|
|
.(test_so_pd 0x560e7d)
|
|
|
|
.(test_so_pd 0x560e7c)
|
|
|
|
.(test_so_pd 0x560e7a)
|
|
|
|
.(test_so_pd 0x560e79)
|
|
|
|
.(test_so_pd 0x560e97)
|
|
|
|
.(test_so_pd 0x560e96)
|
2020-01-17 21:58:18 +08:00
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
|
|
|
|
--- From 0x0 ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00000000 ff invalid
|
|
|
|
0x0
|
|
|
|
0x00000000 ff invalid
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00000000 ff invalid
|
|
|
|
0x00000001 ff invalid
|
|
|
|
0x0
|
|
|
|
0x00000000 ff invalid
|
|
|
|
0x00000001 ff invalid
|
|
|
|
|
|
|
|
--- From 0x401000 ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00400fff ~ ffcc dec esp
|
|
|
|
0x400fff
|
|
|
|
0x00400fff ~ ffcc dec esp
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00400ffe ff invalid
|
|
|
|
0x00400fff ~ ffcc dec esp
|
|
|
|
0x400ffe
|
|
|
|
0x00400ffe ff invalid
|
|
|
|
0x00400fff ~ ffcc dec esp
|
|
|
|
|
|
|
|
--- From 0x560e7d ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
0x560e7a
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
0x560e78
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
|
|
|
|
--- From 0x560e7c ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
0x560e7a
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
0x560e78
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x00560e7a ~ 0085965e5052 add byte [ebp + 0x52505e96], al
|
|
|
|
|
|
|
|
--- From 0x560e7a ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x560e78
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e76 3bd4 cmp edx, esp
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x560e76
|
|
|
|
0x00560e76 3bd4 cmp edx, esp
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
|
|
|
|
--- From 0x560e79 ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x560e78
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e76 3bd4 cmp edx, esp
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
0x560e76
|
|
|
|
0x00560e76 3bd4 cmp edx, esp
|
|
|
|
0x00560e78 d41b aam 0x1b
|
|
|
|
|
|
|
|
--- From 0x560e97 ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
| ; CODE XREF from fcn.00560e67 @ 0x560e80
|
|
|
|
| 0x00560e96 0f31 rdtsc
|
|
|
|
0x560e96
|
|
|
|
| ; CODE XREF from fcn.00560e67 @ 0x560e80
|
|
|
|
| 0x00560e96 0f31 rdtsc
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
|
|
|
| ; CODE XREF from fcn.00560e67 @ 0x560e80
|
|
|
|
| 0x00560e96 0f31 rdtsc
|
|
|
|
0x560e95
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
|
|
|
| ; CODE XREF from fcn.00560e67 @ 0x560e80
|
|
|
|
| 0x00560e96 0f31 rdtsc
|
|
|
|
|
|
|
|
--- From 0x560e96 ---
|
|
|
|
|
|
|
|
-- 1 --
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
|
|
|
0x560e95
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
|
|
|
|
|
|
|
-- 2 --
|
|
|
|
0x00560e94 9e sahf
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
|
|
|
0x560e94
|
|
|
|
0x00560e94 9e sahf
|
|
|
|
0x00560e95 ~ ba0f31e914 mov edx, 0x14e9310f
|
2020-01-17 21:58:18 +08:00
|
|
|
EOF
|
2019-12-08 15:31:14 +01:00
|
|
|
RUN
|
2020-04-24 11:23:55 +02:00
|
|
|
|
|
|
|
NAME=relative tmp seek
|
|
|
|
FILE=-
|
|
|
|
CMDS=<<EOF
|
|
|
|
s 0x10
|
|
|
|
?v $$ @ +0x10
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x20
|
|
|
|
EOF
|
|
|
|
RUN
|
2020-07-21 04:16:28 -04:00
|
|
|
|
|
|
|
NAME=seek to bb start (sb)
|
|
|
|
FILE=bins/elf/vim
|
|
|
|
CMDS=<<EOF
|
|
|
|
s 0x543a0
|
|
|
|
af
|
|
|
|
s+3
|
|
|
|
sb
|
|
|
|
?v $$
|
|
|
|
EOF
|
|
|
|
EXPECT=<<EOF
|
|
|
|
0x543a0
|
|
|
|
EOF
|
|
|
|
RUN
|