Remove 10 more globals from analysis and capstone ##globals

This commit is contained in:
pancake 2022-09-21 22:12:08 +02:00 committed by GitHub
parent 3ee7a15a44
commit be9a83871e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 103 additions and 103 deletions

View File

@ -88,6 +88,9 @@ R_API RAnal *r_anal_new(void) {
free (anal);
return NULL;
}
anal->cmpval = UT64_MAX;
anal->cache_addr = UT64_MAX;
anal->lea_jmptbl_ip = UT64_MAX;
anal->bb_tree = NULL;
anal->ht_addr_fun = ht_up_new0 ();
anal->ht_name_fun = ht_pp_new0 ();

View File

@ -48,32 +48,30 @@ R_API const char *r_anal_functiontype_tostring(int type) {
}
#if READ_AHEAD
static R_TH_LOCAL ut64 cache_addr = UT64_MAX;
// TODO: move into io :?
static int read_ahead(RAnal *anal, ut64 addr, ut8 *buf, int len) {
static R_TH_LOCAL ut8 cache[1024];
const int cache_len = sizeof (cache);
const int cache_len = sizeof (anal->cache);
if (len < 1) {
return 0;
}
if (len > cache_len) {
int a = anal->iob.read_at (anal->iob.io, addr, buf, len); // double read
memcpy (cache, buf, cache_len);
cache_addr = addr;
memcpy (anal->cache, buf, cache_len);
anal->cache_addr = addr;
return a;
}
ut64 addr_end = UT64_ADD_OVFCHK (addr, len)? UT64_MAX: addr + len;
ut64 cache_addr_end = UT64_ADD_OVFCHK (cache_addr, cache_len)? UT64_MAX: cache_addr + cache_len;
bool isCached = ((addr != UT64_MAX) && (addr >= cache_addr) && (addr_end < cache_addr_end));
ut64 cache_addr_end = UT64_ADD_OVFCHK (anal->cache_addr, cache_len)? UT64_MAX: anal->cache_addr + cache_len;
bool isCached = ((addr != UT64_MAX) && (addr >= anal->cache_addr) && (addr_end < cache_addr_end));
if (isCached) {
memcpy (buf, cache + (addr - cache_addr), len);
memcpy (buf, anal->cache + (addr - anal->cache_addr), len);
} else {
anal->iob.read_at (anal->iob.io, addr, cache, sizeof (cache));
memcpy (buf, cache, len);
cache_addr = addr;
anal->iob.read_at (anal->iob.io, addr, anal->cache, sizeof (anal->cache));
memcpy (buf, anal->cache, len);
anal->cache_addr = addr;
}
return len;
}
@ -83,9 +81,9 @@ static int read_ahead(RAnal *anal, ut64 addr, ut8 *buf, int len) {
}
#endif
R_API void r_anal_function_invalidate_read_ahead_cache(void) {
R_API void r_anal_function_invalidate_read_ahead_cache(RAnal *anal) {
#if READ_AHEAD
cache_addr = UT64_MAX;
anal->cache_addr = UT64_MAX;
#endif
}
@ -559,7 +557,6 @@ static int fcn_recurse(RAnal *anal, RAnalFunction *fcn, ut64 addr, ut64 len, int
int oplen, idx = 0;
size_t lea_cnt = 0;
size_t nop_prefix_cnt = 0;
static R_TH_LOCAL ut64 cmpval = UT64_MAX; // inherited across functions, otherwise it breaks :?
struct {
int cnt;
int idx;
@ -636,7 +633,6 @@ static int fcn_recurse(RAnal *anal, RAnalFunction *fcn, ut64 addr, ut64 len, int
gotoBeach (R_ANAL_RET_ERROR);
}
}
static R_TH_LOCAL ut64 lea_jmptbl_ip = UT64_MAX;
ut64 last_reg_mov_lea_val = UT64_MAX;
bool last_is_reg_mov_lea = false;
bool last_is_push = false;
@ -1034,7 +1030,7 @@ repeat:
? try_walkthrough_jmptbl (anal, fcn, bb, depth, addr, case_shift, jmptbl_addr, op->ptr, 4, table_size, default_case, 4)
: try_walkthrough_casetbl (anal, fcn, bb, depth, addr, case_shift, jmptbl_addr, casetbl_addr, op->ptr, 4, table_size, default_case, 4);
if (ret) {
lea_jmptbl_ip = addr;
anal->lea_jmptbl_ip = addr;
}
}
}
@ -1131,14 +1127,14 @@ repeat:
case R_ANAL_OP_TYPE_SUB:
if (op->val != UT64_MAX && op->val > 0) {
// if register is not stack
cmpval = op->val;
anal->cmpval = op->val;
}
break;
case R_ANAL_OP_TYPE_CMP: {
ut64 val = (is_x86 || is_v850)? op->val : op->ptr;
if (val) {
cmpval = val;
bb->cmpval = cmpval;
anal->cmpval = val;
bb->cmpval = anal->cmpval;
bb->cmpreg = op->reg;
r_anal_cond_free (bb->cond);
bb->cond = r_anal_cond_new_from_op (op);
@ -1165,9 +1161,9 @@ repeat:
if (anal->opt.jmptbl) {
if (op->ptr != UT64_MAX) {
ut64 table_size, default_case;
table_size = cmpval + 1;
table_size = anal->cmpval + 1;
default_case = op->fail; // is this really default case?
if (cmpval != UT64_MAX && default_case != UT64_MAX && (op->reg || op->ireg)) {
if (anal->cmpval != UT64_MAX && default_case != UT64_MAX && (op->reg || op->ireg)) {
// TODO -1
if (op->ireg) {
ret = try_walkthrough_jmptbl (anal, fcn, bb, depth, op->addr, 0, op->ptr, op->ptr, anal->config->bits >> 3, table_size, default_case, ret);
@ -1181,7 +1177,7 @@ repeat:
} else if (op->fail == op->ptr) {
op->fail = UT64_MAX;
}
cmpval = UT64_MAX;
anal->cmpval = UT64_MAX;
}
}
}
@ -1234,8 +1230,8 @@ repeat:
if (is_arm && last_is_mov_lr_pc) {
break;
} else if (is_v850 && anal->opt.jmptbl) {
int ptsz = cmpval? cmpval + 1: 4;
if ((int)cmpval > 0) {
int ptsz = (anal->cmpval && anal->cmpval != UT64_MAX)? anal->cmpval + 1: 4;
if ((int)anal->cmpval > 0) {
ret = try_walkthrough_jmptbl (anal, fcn, bb, depth, op->addr,
0, op->addr + 2, op->addr + 2, 2, ptsz, 0, ret);
}
@ -1251,7 +1247,7 @@ repeat:
gotoBeach (R_ANAL_RET_END);
}
// switch statement
if (anal->opt.jmptbl && lea_jmptbl_ip != op->addr) {
if (anal->opt.jmptbl && anal->lea_jmptbl_ip != op->addr) {
ut8 buf[32]; // 32 bytes is enough to hold any instruction.
// op->ireg since rip relative addressing produces way too many false positives otherwise
// op->ireg is 0 for rip relative, "rax", etc otherwise
@ -1307,11 +1303,11 @@ repeat:
}
}
if (!try_get_jmptbl_info (anal, fcn, op->addr, bb, &table_size, &default_case, &case_shift)) {
table_size = cmpval + 1;
table_size = anal->cmpval + 1;
default_case = -1;
}
ret = try_walkthrough_jmptbl (anal, fcn, bb, depth - 1, op->addr, case_shift, jmptbl_base + movdisp, jmptbl_base, movscale, table_size, default_case, ret);
cmpval = UT64_MAX;
anal->cmpval = UT64_MAX;
#if 0
} else if (movdisp != UT64_MAX) {
ut64 table_size, default_case;
@ -1324,12 +1320,12 @@ repeat:
#endif
} else if (is_arm) {
if (op->ptrsize == 1) { // TBB
ut64 pred_cmpval = try_get_cmpval_from_parents(anal, fcn, bb, op->ireg);
ut64 pred_cmpval = try_get_cmpval_from_parents (anal, fcn, bb, op->ireg);
ut64 table_size = 0;
if (pred_cmpval != UT64_MAX) {
table_size += pred_cmpval;
} else {
table_size += cmpval;
table_size += anal->cmpval;
}
ret = try_walkthrough_jmptbl (anal, fcn, bb, depth - 1, op->addr, 0, op->addr + op->size,
op->addr + 4, 1, table_size, UT64_MAX, ret);
@ -1342,7 +1338,7 @@ repeat:
if (pred_cmpval != UT64_MAX) {
tablesize += pred_cmpval;
} else {
tablesize += cmpval;
tablesize += anal->cmpval;
}
ret = try_walkthrough_jmptbl (anal, fcn, bb, depth - 1, op->addr, 0, op->addr + op->size,
op->addr + 4, 2, tablesize, UT64_MAX, ret);
@ -1351,8 +1347,8 @@ repeat:
}
}
}
if (lea_jmptbl_ip == op->addr) {
lea_jmptbl_ip = UT64_MAX;
if (anal->lea_jmptbl_ip == op->addr) {
anal->lea_jmptbl_ip = UT64_MAX;
}
if (anal->opt.ijmp) {
r_anal_function_bb (anal, fcn, op->jump, depth - 1);
@ -1710,7 +1706,7 @@ R_API bool r_anal_function_add_bb(RAnal *a, RAnalFunction *fcn, ut64 addr, ut64
const bool is_x86 = a->cur->arch && !strcmp (a->cur->arch, "x86");
// TODO fix this x86-ism
if (is_x86) {
r_anal_function_invalidate_read_ahead_cache ();
r_anal_function_invalidate_read_ahead_cache (a);
fcn_recurse (a, fcn, addr, size, 1);
block = r_anal_get_block_at (a, addr);
if (block) {
@ -2280,7 +2276,7 @@ static void update_analysis(RAnal *anal, RList *fcns, HtUP *reachable) {
RAnalFunction *fcn;
bool old_jmpmid = anal->opt.jmpmid;
anal->opt.jmpmid = true;
r_anal_function_invalidate_read_ahead_cache ();
r_anal_function_invalidate_read_ahead_cache (anal);
r_list_foreach (fcns, it, fcn) {
// Recurse through blocks of function, mark reachable,
// analyze edges that don't have a block

View File

@ -2421,7 +2421,6 @@ static void arm32mathaddsub(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, in
static int analop_esil(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, csh *handle, cs_insn *insn, bool thumb) {
int i;
const char *postfix = NULL;
// char str[32][32];
RStringShort str[32] = {{0}};
int msr_flags;
int pcdelta = (thumb? 4: 8);
@ -4432,10 +4431,6 @@ static void op_fillval(RAnal *anal, RAnalOp *op, csh handle, cs_insn *insn, int
}
}
static R_TH_LOCAL csh cs_handle = 0;
static R_TH_LOCAL int omode = -1;
static R_TH_LOCAL int obits = 32;
static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAnalOpMask mask) {
cs_insn *insn = NULL;
int mode = (a->config->bits == 16)? CS_MODE_THUMB: CS_MODE_ARM;
@ -4453,30 +4448,30 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
strstr (a->config->features, "v8")) {
mode |= CS_MODE_V8;
}
if (mode != omode || a->config->bits != obits) {
if (cs_handle != 0) {
cs_close (&cs_handle);
cs_handle = 0;
if (mode != a->cs_omode || a->config->bits != a->cs_obits) {
if (a->cs_handle != 0) {
cs_close (&a->cs_handle);
a->cs_handle = 0;
}
omode = mode;
obits = a->config->bits;
a->cs_omode = mode;
a->cs_obits = a->config->bits;
}
op->size = (a->config->bits == 16)? 2: 4;
op->addr = addr;
if (cs_handle == 0) {
if (a->cs_handle == 0) {
ret = (a->config->bits == 64)?
cs_open (CS_ARCH_ARM64, mode, &cs_handle):
cs_open (CS_ARCH_ARM, mode, &cs_handle);
cs_option (cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
cs_open (CS_ARCH_ARM64, mode, &a->cs_handle):
cs_open (CS_ARCH_ARM, mode, &a->cs_handle);
cs_option (a->cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
if (ret != CS_ERR_OK) {
R_LOG_ERROR ("Capstone failed: cs_open(CS_ARCH_ARM%s, %x, ...): %s",
(a->config->bits == 64) ? "64" : "", mode, cs_strerror (ret));
cs_handle = 0;
a->cs_handle = 0;
return -1;
}
}
n = cs_disasm (cs_handle, (ut8*)buf, len, addr, 1, &insn);
n = cs_disasm (a->cs_handle, (ut8*)buf, len, addr, 1, &insn);
if (n > 0 && !(insn->mnemonic[0] == 'h' && insn->mnemonic[1] == 'i' &&
insn->mnemonic[2] == 'n' && insn->mnemonic[3] == 't')) {
if (mask & R_ANAL_OP_MASK_DISASM) {
@ -4491,25 +4486,25 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
op->size = insn->size;
op->id = insn->id;
if (a->config->bits == 64) {
anop64 (cs_handle, op, insn);
anop64 (a->cs_handle, op, insn);
if (mask & R_ANAL_OP_MASK_OPEX) {
opex64 (&op->opex, cs_handle, insn);
opex64 (&op->opex, a->cs_handle, insn);
}
if (mask & R_ANAL_OP_MASK_ESIL) {
analop64_esil (a, op, addr, buf, len, &cs_handle, insn);
analop64_esil (a, op, addr, buf, len, &a->cs_handle, insn);
}
} else {
anop32 (a, cs_handle, op, insn, thumb, (ut8*)buf, len);
anop32 (a, a->cs_handle, op, insn, thumb, (ut8*)buf, len);
if (mask & R_ANAL_OP_MASK_OPEX) {
opex (&op->opex, cs_handle, insn);
opex (&op->opex, a->cs_handle, insn);
}
if (mask & R_ANAL_OP_MASK_ESIL) {
analop_esil (a, op, addr, buf, len, &cs_handle, insn, thumb);
analop_esil (a, op, addr, buf, len, &a->cs_handle, insn, thumb);
}
}
set_opdir (op);
if (mask & R_ANAL_OP_MASK_VAL) {
op_fillval (a, op, cs_handle, insn, a->config->bits);
op_fillval (a, op, a->cs_handle, insn, a->config->bits);
}
cs_free (insn, n);
} else {
@ -4552,30 +4547,30 @@ static char *arm_mnemonics(RAnal *a, int id, bool json) {
strstr (a->config->features, "v8")) {
mode |= CS_MODE_V8;
}
if (mode != omode || a->config->bits != obits) {
if (cs_handle != 0) {
cs_close (&cs_handle);
cs_handle = 0;
if (mode != a->cs_omode || a->config->bits != a->cs_obits) {
if (a->cs_handle != 0) {
cs_close (&a->cs_handle);
a->cs_handle = 0;
}
omode = mode;
obits = a->config->bits;
a->cs_omode = mode;
a->cs_obits = a->config->bits;
}
if (cs_handle == 0) {
if (a->cs_handle == 0) {
int ret = (a->config->bits == 64)?
cs_open (CS_ARCH_ARM64, mode, &cs_handle):
cs_open (CS_ARCH_ARM, mode, &cs_handle);
cs_option (cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
cs_open (CS_ARCH_ARM64, mode, &a->cs_handle):
cs_open (CS_ARCH_ARM, mode, &a->cs_handle);
cs_option (a->cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
if (ret != CS_ERR_OK) {
R_LOG_ERROR ("Capstone failed: cs_open(CS_ARCH_ARM%s, %x, ...): %s",
(a->config->bits == 64) ? "64" : "", mode, cs_strerror (ret));
cs_handle = 0;
a->cs_handle = 0;
return NULL;
}
}
PJ *pj = NULL;
if (id != -1) {
const char *name = cs_insn_name (cs_handle, id);
const char *name = cs_insn_name (a->cs_handle, id);
if (name) {
if (json) {
pj = pj_new ();
@ -4599,7 +4594,7 @@ static char *arm_mnemonics(RAnal *a, int id, bool json) {
const int ins_ending = a->config->bits == 64 ? ARM64_INS_ENDING : ARM_INS_ENDING;
int i = 1;
for (; i < ins_ending; i++) {
const char *op = cs_insn_name (cs_handle, i);
const char *op = cs_insn_name (a->cs_handle, i);
if (!op) {
continue;
}

View File

@ -108,8 +108,8 @@ static void hidden_op(cs_insn *insn, cs_x86 *x, int mode) {
}
}
static void opex(RStrBuf *buf, cs_insn *insn, int mode) {
csh handle = cs_handle;
static void opex(RAnal *anal, RStrBuf *buf, cs_insn *insn, int mode) {
csh handle = anal->cs_handle;
int i;
PJ *pj = pj_new ();
@ -132,7 +132,7 @@ static void opex(RStrBuf *buf, cs_insn *insn, int mode) {
switch (op->type) {
case X86_OP_REG:
pj_ks (pj, "type", "reg");
pj_ks (pj, "value", cs_reg_name (handle, op->reg));
pj_ks (pj, "value", r_str_get (cs_reg_name (handle, op->reg)));
break;
case X86_OP_IMM:
pj_ks (pj, "type", "imm");
@ -141,13 +141,13 @@ static void opex(RStrBuf *buf, cs_insn *insn, int mode) {
case X86_OP_MEM:
pj_ks (pj, "type", "mem");
if (op->mem.segment != X86_REG_INVALID) {
pj_ks (pj, "segment", cs_reg_name (handle, op->mem.segment));
pj_ks (pj, "segment", r_str_get (cs_reg_name (handle, op->mem.segment)));
}
if (op->mem.base != X86_REG_INVALID) {
pj_ks (pj, "base", cs_reg_name (handle, op->mem.base));
pj_ks (pj, "base", r_str_get (cs_reg_name (handle, op->mem.base)));
}
if (op->mem.index != X86_REG_INVALID) {
pj_ks (pj, "index", cs_reg_name (handle, op->mem.index));
pj_ks (pj, "index", r_str_get (cs_reg_name (handle, op->mem.index)));
}
pj_ki (pj, "scale", op->mem.scale);
pj_kN (pj, "disp", op->mem.disp);
@ -173,10 +173,10 @@ static void opex(RStrBuf *buf, cs_insn *insn, int mode) {
}
if (x->sib_index != X86_REG_INVALID) {
pj_ki (pj, "sib_scale", x->sib_scale);
pj_ks (pj, "sib_index", cs_reg_name (handle, x->sib_index));
pj_ks (pj, "sib_index", r_str_get (cs_reg_name (handle, x->sib_index)));
}
if (x->sib_base != X86_REG_INVALID) {
pj_ks (pj, "sib_base", cs_reg_name (handle, x->sib_base));
pj_ks (pj, "sib_base", r_str_get (cs_reg_name (handle, x->sib_base)));
}
pj_end (pj);
@ -3607,7 +3607,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
if (handle == 0) {
return -1;
}
int mode = cs_omode;
int mode = a->cs_omode;
cs_insn *insn = NULL;
int n;
@ -3683,7 +3683,7 @@ static int analop(RAnal *a, RAnalOp *op, ut64 addr, const ut8 *buf, int len, RAn
anop_esil (a, op, addr, buf, len, &handle, insn);
}
if (mask & R_ANAL_OP_MASK_OPEX) {
opex (&op->opex, insn, mode);
opex (a, &op->opex, insn, mode);
}
if (mask & R_ANAL_OP_MASK_VAL) {
op_fillval (a, op, &handle, insn, mode);

View File

@ -14,51 +14,48 @@
#define CSINC_ARCH CSINC_ARCH_(CSINC)
#define CSINC_ARCH_(y) TOKEN_PASTE(CS_ARCH_, y)
static R_TH_LOCAL int cs_obits = 32;
static R_TH_LOCAL int cs_omode = 0;
static R_TH_LOCAL csh cs_handle = 0;
static csh init_capstone (RAnal *a) {
int mode = (CSINC_MODE);
if (mode != cs_omode || a->config->bits != cs_obits) {
if (cs_handle != 0) {
cs_close (&cs_handle);
cs_handle = 0; // unnecessary
if (mode != a->cs_omode || a->config->bits != a->cs_obits) {
if (a->cs_handle != 0) {
cs_close (&a->cs_handle);
a->cs_handle = 0; // unnecessary
}
cs_omode = mode;
cs_obits = a->config->bits;
a->cs_omode = mode;
a->cs_obits = a->config->bits;
}
if (cs_handle == 0) {
int ret = cs_open (CSINC_ARCH, mode, &cs_handle);
if (a->cs_handle == 0) {
int ret = cs_open (CSINC_ARCH, mode, &a->cs_handle);
if (ret != CS_ERR_OK) {
R_LOG_ERROR ("Capstone failed: cs_open(%#x, %#x): %s", CSINC_ARCH, mode, cs_strerror (ret));
cs_handle = 0;
a->cs_handle = 0;
} else {
cs_option (cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
cs_option (a->cs_handle, CS_OPT_DETAIL, CS_OPT_ON);
#if CS_API_MAJOR >= 4
cs_option (cs_handle, CS_OPT_UNSIGNED, CS_OPT_ON);
cs_option (a->cs_handle, CS_OPT_UNSIGNED, CS_OPT_ON);
#endif
}
}
if (cs_handle) {
if (a->cs_handle) {
if (a->config->syntax == R_ARCH_SYNTAX_ATT) {
cs_option (cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT);
cs_option (a->cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_ATT);
#if CS_API_MAJOR >= 4
} else if (a->config->syntax == R_ARCH_SYNTAX_MASM) {
cs_option (cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_MASM);
cs_option (a->cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_MASM);
#endif
} else {
cs_option (cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_INTEL);
cs_option (a->cs_handle, CS_OPT_SYNTAX, CS_OPT_SYNTAX_INTEL);
}
}
return cs_handle;
return a->cs_handle;
}
static char *cs_mnemonics(RAnal *a, int id, bool json) {
int i;
csh cs_handle = init_capstone (a);
if (cs_handle == 0) {
a->cs_handle = cs_handle;
return NULL;
}

View File

@ -772,7 +772,7 @@ static bool __core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int de
if (!fcn->name) {
fcn->name = r_str_newf ("%s.%08"PFMT64x, fcnpfx, at);
}
r_anal_function_invalidate_read_ahead_cache ();
r_anal_function_invalidate_read_ahead_cache (core->anal);
do {
RFlagItem *f;
ut64 delta = r_anal_function_linear_size (fcn);

View File

@ -667,6 +667,15 @@ typedef struct r_anal_t {
RStrConstPool constpool;
RList *leaddrs;
char *pincmd;
/* private */
ut8 cache[1024];
ut64 cache_addr;
ut64 cmpval;
ut64 lea_jmptbl_ip;
int cs_obits;
int cs_omode;
size_t cs_handle;
/* end private */
R_DIRTY_VAR;
} RAnal;
@ -1683,7 +1692,7 @@ R_API bool r_anal_function_add_bb(RAnal *anal, RAnalFunction *fcn,
ut64 addr, ut64 size,
ut64 jump, ut64 fail, R_BORROW RAnalDiff *diff);
R_API bool r_anal_check_fcn(RAnal *anal, ut8 *buf, ut16 bufsz, ut64 addr, ut64 low, ut64 high);
R_API void r_anal_function_invalidate_read_ahead_cache(void);
R_API void r_anal_function_invalidate_read_ahead_cache(RAnal *anal);
R_API void r_anal_function_check_bp_use(RAnalFunction *fcn);
R_API void r_anal_update_analysis_range(RAnal *anal, ut64 addr, int size);