Magic-Mirror/radare2
1
0
Fork 0
mirror of https://github.com/radareorg/radare2.git synced 2024-11-23 21:29:49 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Add anal.imports to analyze them early in aa ##analysis

Browse Source 
* better noreturn and type propagation
This commit is contained in:
pancake 2023-07-07 09:33:43 +02:00 committed by GitHub
parent 84f19e80ff
commit 35a668f2e3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 117 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
libr/core/canal.c
View File

@ -4222,6 +4222,7 @@ static void add_string_ref(RCore *core, ut64 xref_from, ut64 xref_to) {
free (str);
}
// R2R db/anal/mach0
static bool found_xref(RCore *core, ut64 at, ut64 xref_to, RAnalRefType type, PJ *pj, int rad, bool cfg_debug, bool cfg_anal_strings) {
// Validate the reference. If virtual addressing is enabled, we
// allow only references to virtual addresses in order to reduce
@ -4281,15 +4282,14 @@ R_API int r_core_anal_search_xrefs(RCore *core, ut64 from, ut64 to, PJ *pj, int
bool cfg_anal_strings = r_config_get_b (core->config, "anal.strings");
ut64 at;
int count = 0;
int bsz = 8096;
int bsz = 4 * 4096;
RAnalOp op = {0};
if (from == to) {
return -1;
}
if (from > to) {
eprintf ("Invalid range (0x%"PFMT64x
" >= 0x%"PFMT64x")\n", from, to);
R_LOG_ERROR ("Invalid range (0x%"PFMT64x " >= 0x%"PFMT64x")", from, to);
return -1;
}
@ -4331,6 +4331,7 @@ R_API int r_core_anal_search_xrefs(RCore *core, ut64 from, ut64 to, PJ *pj, int
if (!r_io_get_region_at (core->io, &region, at) || !(region.perm & R_PERM_X)) {
goto beach;
}
bool uninit = true;
while (at < to && !r_cons_is_breaked ()) {
int i = 0, ret = bsz;
if (!r_itv_contain (region.itv, at)) {
@ -4345,16 +4346,23 @@ R_API int r_core_anal_search_xrefs(RCore *core, ut64 from, ut64 to, PJ *pj, int
(void)r_io_read_at (core->io, at, buf, bsz);
memset (block, -1, bsz);
if (!memcmp (buf, block, bsz)) {
R_LOG_ERROR ("skipping uninitialized block ");
at += ret;
if (!uninit) {
R_LOG_ERROR ("skipping -1 uninitialized block 0x%08"PFMT64x, at);
}
uninit = true;
at += bsz;
continue;
}
memset (block, 0, bsz);
if (!memcmp (buf, block, bsz)) {
R_LOG_ERROR ("skipping uninitialized block");
at += ret;
if (!uninit) {
R_LOG_ERROR ("skipping 0 uninitialized block at 0x%08"PFMT64x, at);
}
uninit = true;
at += bsz;
continue;
}
uninit = false;
(void) r_anal_op (core->anal, &op, at, buf, bsz, R_ARCH_OP_MASK_BASIC | R_ARCH_OP_MASK_HINT);
while ((i + maxopsz) < bsz && !r_cons_is_breaked ()) {
r_anal_op_fini (&op);
@ -4435,7 +4443,7 @@ R_API int r_core_anal_search_xrefs(RCore *core, ut64 from, ut64 to, PJ *pj, int
if (i < 1) {
break;
}
at += i + 1;
at += i + 1; // XXX i think this causes code unalignment problems
}
beach:
r_cons_break_pop ();
@ -4479,6 +4487,12 @@ R_API int r_core_anal_all(RCore *core) {
const bool anal_vars = r_config_get_b (core->config, "anal.vars");
const bool anal_calls = r_config_get_b (core->config, "anal.calls");
// required for noreturn
if (r_config_get_b (core->config, "anal.imports")) {
R_LOG_INFO ("Analyze imports (af@@@@i)");
r_core_cmd0 (core, "af@@@i");
}
/* Analyze Functions */
/* Entries */
RFlagItem *item = r_flag_get (core->flags, "entry0");

1
libr/core/cconfig.c
View File

@ -3466,6 +3466,7 @@ R_API int r_core_config_init(RCore *core) {
SETICB ("anal.graph_depth", 256, &cb_analgraphdepth, "max depth for path search");
SETICB ("anal.sleep", 0, &cb_analsleep, "sleep N usecs every so often during analysis. Avoid 100% CPU usage");
SETCB ("anal.ignbithints", "false", &cb_anal_ignbithints, "ignore the ahb hints (only obey asm.bits)");
SETBPREF ("anal.imports", "true", "run af@@@i in aa for better noreturn propagation");
SETBPREF ("anal.calls", "false", "make basic af analysis walk into calls");
SETBPREF ("anal.autoname", "false", "speculatively set a name for the functions, may result in some false positives");
SETBPREF ("anal.hasnext", "false", "continue analysis after each function");

12
test/db/cmd/cmd_afn
View File

@ -61,29 +61,29 @@ EXPECT=<<EOF
mymain
The main flag shouldnt be renamed, it comes from bin:
0x080483f4 33 fcn.080483f4
0x08048540 92 mymain
0x08048540 85 mymain
--
0x080483f4 33 fcn.080483f4
0x08048540 92 main
0x08048540 92 sym.main
0x08048540 92 mymain
0x08048540 85 mymain
myfunc
Here the flag is owned by the fcn and should be renamed:
0x080483f4 33 myfunc
0x08048540 92 mymain
0x08048540 85 mymain
--
0x080483f4 33 myfunc
0x08048540 92 main
0x08048540 92 sym.main
0x08048540 92 mymain
0x08048540 85 mymain
Non-existing flags should be created
0x080483f4 33 createdflag
0x08048540 92 mymain
0x08048540 85 mymain
--
0x080483f4 33 createdflag
0x08048540 92 main
0x08048540 92 sym.main
0x08048540 92 mymain
0x08048540 85 mymain
EOF
RUN

1
test/db/cmd/cmd_k
View File

@ -62,6 +62,7 @@ EXPECT=<<EOF
"acoshf=func",
"acoshl=func",
"acosl=func",
"addr.8048360.noreturn=true",
"arc4random=func",
"asctime=func",
"asin=func",

4
test/db/cmd/cmd_pd
View File

@ -2204,7 +2204,7 @@ aaa
pdf @ 0x08048484~:1
EOF
EXPECT=<<EOF
66: sym.parell (char *s);
66: sym.parell (char *s); // noreturn
EOF
RUN
@ -2218,7 +2218,7 @@ aaa
pdf @ 0x08048484~:1
EOF
EXPECT=<<EOF
66: parell (char *s);
66: parell (char *s); // noreturn
EOF
RUN

4
test/db/cmd/cmd_pipe
View File

@ -27,14 +27,14 @@ EOF
EXPECT=<<EOF
Function names:
entry0
sym.imp._Exit
entry0
Disassembly of entry0:
;-- section..text:
;-- .text:
;-- _start():
/ 16: entry0 ();
/ 16: entry0 (); // noreturn
| 0x08049020 55 push ebp ; [10] -r-x section size 16 named .text
| 0x08049021 89e5 mov ebp, esp
| 0x08049023 83ec08 sub esp, 8

61
test/db/cmd/noreturn
View File

@ -125,9 +125,68 @@ call fcn.00000010
EOF
RUN
NAME=noreturn propagation
NAME=noreturn propagation with anal.imports
FILE=bins/elf/noreturn
CMDS=<<EOF
e anal.imports=true
aa
?e -- before --
afb@sym.might_not_return
tn 0x00001050 # TODO: this should be done automatically
aanr
?e -- after --
afb@sym.might_not_return
EOF
EXPECT=<<EOF
-- before --
0x00001167 0x00001172 00:0000 11 j 0x00001172
0x00001172 0x00001177 00:0000 5 j 0x00001250
0x00001177 0x00001181 00:0000 10 j 0x0000124b f 0x00001181
0x00001181 0x0000118b 00:0000 10
0x0000124b 0x00001250 00:0000 5 j 0x00001250
0x00001250 0x0000125a 00:0000 10 j 0x00001177 f 0x0000125a
0x0000125a 0x00001260 00:0000 6 j 0x000012d1 f 0x00001260
0x00001260 0x00001266 00:0000 6 j 0x000012da f 0x00001266
0x00001266 0x0000126c 00:0000 6 j 0x000012da f 0x0000126c
0x0000126c 0x00001272 00:0000 6 j 0x000012da f 0x00001272
0x00001272 0x0000127d 00:0000 11 j 0x000012da f 0x0000127d
0x0000127d 0x0000129f 00:0000 34 s 0x0000129f s 0x000012a6 s 0x000012bc s 0x000012c3 s 0x000012ca
0x0000129f 0x000012a6 00:0000 7 j 0x000012df
0x000012a6 0x000012b0 00:0000 10
0x000012bc 0x000012c3 00:0000 7 j 0x000012df
0x000012c3 0x000012ca 00:0000 7 j 0x000012df
0x000012ca 0x000012d1 00:0000 7 j 0x000012df
0x000012d1 0x000012da 00:0000 9 j 0x00001172
0x000012da 0x000012df 00:0000 5 j 0x000012df
0x000012df 0x000012e1 00:0000 2
-- after --
0x00001167 0x00001172 00:0000 11 j 0x00001172
0x00001172 0x00001177 00:0000 5 j 0x00001250
0x00001177 0x00001181 00:0000 10 j 0x0000124b f 0x00001181
0x00001181 0x0000118b 00:0000 10
0x0000124b 0x00001250 00:0000 5 j 0x00001250
0x00001250 0x0000125a 00:0000 10 j 0x00001177 f 0x0000125a
0x0000125a 0x00001260 00:0000 6 j 0x000012d1 f 0x00001260
0x00001260 0x00001266 00:0000 6 j 0x000012da f 0x00001266
0x00001266 0x0000126c 00:0000 6 j 0x000012da f 0x0000126c
0x0000126c 0x00001272 00:0000 6 j 0x000012da f 0x00001272
0x00001272 0x0000127d 00:0000 11 j 0x000012da f 0x0000127d
0x0000127d 0x0000129f 00:0000 34 s 0x0000129f s 0x000012a6 s 0x000012bc s 0x000012c3 s 0x000012ca
0x0000129f 0x000012a6 00:0000 7 j 0x000012df
0x000012a6 0x000012b0 00:0000 10
0x000012bc 0x000012c3 00:0000 7 j 0x000012df
0x000012c3 0x000012ca 00:0000 7 j 0x000012df
0x000012ca 0x000012d1 00:0000 7 j 0x000012df
0x000012d1 0x000012da 00:0000 9 j 0x00001172
0x000012da 0x000012df 00:0000 5 j 0x000012df
0x000012df 0x000012e1 00:0000 2
EOF
RUN
NAME=noreturn propagation without anal.imports
FILE=bins/elf/noreturn
CMDS=<<EOF
e anal.imports=false
aa
?e -- before --
afb@sym.might_not_return

3
test/db/cmd/slow
View File

@ -131197,10 +131197,13 @@ EXPECT=<<EOF
EOF
EXPECT_ERR=<<EOF
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@@i)
                               INFO: Analyze all functions arguments/locals (afva@@@F)
 INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@@i)
INFO: Analyze all functions arguments/locals (afva@@@F)
 INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze imports (af@@@@i)
                               INFO: Analyze all functions arguments/locals (afva@@@F)
 ERROR: Cannot find basic block
                                                                                       ERROR: Cannot find basic block

16
test/db/formats/elf/helloworld-gcc-elf
View File

@ -17,10 +17,16 @@ aaa
pid 1@@f
EOF
EXPECT=<<EOF
0x000003fc r15:
0x000003fc 4ff0000b mov.w fp, 0
0x000003c0 sym.imp.__cxa_finalize:
0x000003c0 00c68fe2 add ip, pc, 0, 12
0x000003cc sym.imp.puts:
0x000003cc 00c68fe2 add ip, pc, 0, 12
0x000003d8 sym.imp.__libc_start_main:
0x000003d8 00c68fe2 add ip, pc, 0, 12
0x000003f0 sym.imp.abort:
0x000003f0 00c68fe2 add ip, pc, 0, 12
0x000003fc r15:
0x000003fc 4ff0000b mov.w fp, 0
0x00000444 sym.call_weak_fn:
0x00000444 14309fe5 ldr r3, [pc, 0x14]
0x00000468 sym.deregister_tm_clones:
@ -29,8 +35,6 @@ EXPECT=<<EOF
0x00000494 0848 ldr r0, [pc, 0x20]
0x000004c8 sym.__do_global_dtors_aux:
0x000004c8 08b5 push {r3, lr}
0x000003c0 sym.imp.__cxa_finalize:
0x000003c0 00c68fe2 add ip, pc, 0, 12
0x00000508 sym.frame_dummy:
0x00000508 c4e7 b sym.register_tm_clones
0x00000564 sym.__libc_csu_fini:
@ -41,12 +45,8 @@ EXPECT=<<EOF
0x00000524 2de9f843 push.w {r3, r4, r5, r6, r7, r8, sb, lr}
0x0000050c sym.main:
0x0000050c 80b5 push {r7, lr}
0x000003cc sym.imp.puts:
0x000003cc 00c68fe2 add ip, pc, 0, 12
0x000003a0 sym._init:
0x000003a0 08402de9 push {r3, lr}
0x000003f0 sym.imp.abort:
0x000003f0 00c68fe2 add ip, pc, 0, 12
0x000003ac sym..plt:
0x000003ac 04e02de5 str lr, [sp, -4]!
EOF

15
test/db/formats/elf/vax
View File

@ -6,7 +6,16 @@ s+2
pdf
EOF
EXPECT=<<EOF
/ 72: fcn.00010b2e ();
;-- section..text:
;-- .text:
;-- __start:
;-- _start:
;-- r15:
;-- pc:
; NULL XREF from aav.0x00010001 @ +0x17(r)
/ 74: entry0 ();
| 0x00010b2c 01 nop ; [11] -r-x section size 31963 named .text
| 0x00010b2d 01 nop
| 0x00010b2e dd59 pushl r9
| 0x00010b30 dd57 pushl r7
| 0x00010b32 fb02ef3d0000. calls $0x2, sym.___start
@ -21,12 +30,12 @@ EXPECT=<<EOF
| | 0x00010b5c c25057 subl2 r0, r7
| | 0x00010b5f ca0357 bicl2 $0x3, r7
| | 0x00010b62 9e47ef539501. movab loc.__CTOR_LIST_END__[r7], r7
| | ; CODE XREF from fcn.00010b2e @ 0x10b73(x)
| | ; CODE XREF from entry0 @ 0x10b73(x)
| .--> 0x00010b6a d08650 movl (r6)+, r0
| :| 0x00010b6d fb0060 calls $0x0, (r0)
| :| 0x00010b70 d15657 cmpl r6, r7
| `==< 0x00010b73 12f5 bneq 0x00010b6a
| | ; CODE XREF from fcn.00010b2e @ 0x10b50(x)
| | ; CODE XREF from entry0 @ 0x10b50(x)
\ `-> 0x00010b75 04 ret
EOF
RUN