Enable emulation in /as, it's fast enough and results are better ##search

* Use x16 on macOS and x8 on Linux
* Add test against glibc
This commit is contained in:
pancake 2022-07-19 21:12:38 +02:00
parent 19f8235062
commit c0d3c226f1
2 changed files with 500 additions and 21 deletions

View File

@ -10,7 +10,7 @@
static int cmd_search(void *data, const char *input);
#define USE_EMULATION 0
#define USE_EMULATION 1
#define AES_SEARCH_LENGTH 40
#define PRIVATE_KEY_SEARCH_LENGTH 11
@ -1891,22 +1891,31 @@ static void do_esil_search(RCore *core, struct search_parameters *param, const c
#define SUMARRAY(arr, size, res) do (res) += (arr)[--(size)]; while ((size))
#if USE_EMULATION
static const char *get_syscall_register(RCore *core) {
const char *a0 = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
if (!strcmp (core->anal->config->arch, "arm") && core->anal->config->bits == 64) {
const char *os = core->anal->config->os;
if (!strcmp (os, "linux")) {
a0 = "x8";
} else if (!strcmp (os, "macos")) {
a0 = "x16";
}
}
return a0;
}
// IMHO This code must be deleted
static int emulateSyscallPrelude(RCore *core, ut64 at, ut64 curpc) {
int i, inslen, bsize = R_MIN (64, core->blocksize);
ut8 *arr;
RAnalOp aop;
const int mininstrsz = r_anal_archinfo (core->anal, R_ANAL_ARCHINFO_MIN_OP_SIZE);
const int minopcode = R_MAX (1, mininstrsz);
const char *a0 = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
const char *a0 = get_syscall_register (core);
const char *pc = r_reg_get_name (core->dbg->reg, R_REG_NAME_PC);
RRegItem *r = r_reg_get (core->dbg->reg, pc, -1);
RRegItem *reg_a0 = r_reg_get (core->dbg->reg, a0, -1);
arr = malloc (bsize);
ut8 *arr = malloc (bsize);
if (!arr) {
eprintf ("Cannot allocate %d byte(s)\n", bsize);
free (arr);
return -1;
}
r_reg_set_value (core->dbg->reg, r, curpc);
@ -1925,10 +1934,10 @@ static int emulateSyscallPrelude(RCore *core, ut64 at, ut64 curpc) {
}
i += incr;
curpc += incr;
if (r_anal_op_nonlinear (aop.type)) { // skip the instr
if (r_anal_op_nonlinear (aop.type)) {
r_reg_set_value (core->dbg->reg, r, curpc + 1);
} else { // step instr
r_core_esil_step (core, UT64_MAX, NULL, NULL);
} else {
r_core_esil_step (core, UT64_MAX, NULL, NULL, false);
}
}
}
@ -1945,7 +1954,6 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
#if USE_EMULATION
ut64 curpc;
#endif
ut8 *buf;
int curpos, idx = 0, count = 0;
RAnalOp aop = {0};
int i, ret, bsize = R_MAX (64, core->blocksize);
@ -1968,7 +1976,7 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
r_anal_esil_free (esil);
return;
}
buf = malloc (bsize);
ut8 *buf = malloc (bsize);
if (!buf) {
eprintf ("Cannot allocate %d byte(s)\n", bsize);
r_anal_esil_free (esil);
@ -1976,18 +1984,12 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
return;
}
ut64 oldoff = core->offset;
#if !USE_EMULATION
int syscallNumber = 0;
#endif
r_cons_break_push (NULL, NULL);
// XXX: the syscall register depends on arcm
const char *a0 = r_reg_get_name (core->anal->reg, R_REG_NAME_SN);
if (!strcmp (core->anal->config->arch, "arm") && core->anal->config->bits == 64) {
const char *os = core->anal->config->os;
if (!strcmp (os, "linux")) {
a0 = "x8";
} else if (!strcmp (os, "macos")) {
a0 = "x16";
}
}
const char *a0 = get_syscall_register (core);
char *esp = r_str_newf ("%s,=", a0);
char *esp32 = NULL;
if (core->anal->config->bits == 64) {
@ -2023,6 +2025,7 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
ret = r_anal_op (core->anal, &aop, at, buf + i, bsize - i, R_ANAL_OP_MASK_ESIL);
curpos = idx++ % (MAXINSTR + 1);
previnstr[curpos] = ret; // This array holds prev n instr size + cur instr size
#if !USE_EMULATION
if (aop.type == R_ANAL_OP_TYPE_MOV) {
const char *es = R_STRBUF_SAFEGET (&aop.esil);
if (strstr (es, esp)) {
@ -2035,6 +2038,7 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
}
}
}
#endif
if ((aop.type == R_ANAL_OP_TYPE_SWI) && ret) { // && (aop.val > 10)) {
int scVector = -1; // int 0x80, svc 0x70, ...
int scNumber = 0; // r0/eax/...
@ -2071,7 +2075,9 @@ static void do_syscall_search(RCore *core, struct search_parameters *param) {
r_anal_op_fini (&aop);
break;
}
#if !USE_EMULATION
syscallNumber = 0;
#endif
}
int inc = (core->search->align > 0)? core->search->align - 1: ret - 1;
if (inc < 0) {
@ -2247,7 +2253,7 @@ static bool do_anal_search(RCore *core, struct search_parameters *param, const c
input++;
}
if (type == 's') {
eprintf ("Shouldn't reach\n");
R_LOG_ERROR ("Shouldn't be reached");
return true;
}
if (mode == 'j') {

View File

@ -1108,3 +1108,476 @@ EXPECT=<<EOF
0x00000000 1 Binary PLIST data stream
EOF
RUN
NAME=/as on glibc
FILE=bins/elf/glibc-2.34-39.el9.x86_64_libc.so.6
CMDS=/as
EXPECT=<<EOF
0x00029769 kill
0x00029799 sigaltstack
0x00029843 arch_prctl
0x000298af rt_sigprocmask
0x00029abf rt_sigprocmask
0x00029b32 arch_prctl
0x0003e8f9 uname
0x0003e929 alarm
0x0003e95a vfork
0x0003e9c9 getpid
0x0003e9d9 getppid
0x0003e9f9 geteuid
0x0003ea19 getegid
0x0003ea29 getgroups
0x0003ea59 getpgid
0x0003ea89 setpgid
0x0003eab9 getpgrp
0x0003eaf9 setsid
0x0003eb29 getresuid
0x0003eb59 getresgid
0x0003eb89 sched_setparam
0x0003ebb9 sched_getparam
0x0003ebe9 sched_setscheduler
0x0003ec19 sched_getscheduler
0x0003ec49 sched_yield
0x0003ec79 sched_get_priority_max
0x0003eca9 sched_get_priority_min
0x0003ecd9 umask
0x0003ece9 chmod
0x0003ed19 fchmod
0x0003ed49 mkdir
0x0003ed79 mkdirat
0x0003eda9 flock
0x0003edd9 dup
0x0003ee09 dup2
0x0003ee39 dup3
0x0003ee69 pipe
0x0003ee99 pipe2
0x0003eec9 chdir
0x0003eef9 fchdir
0x0003ef29 chown
0x0003ef59 fchown
0x0003ef89 lchown
0x0003efbc fchownat
0x0003efe9 link
0x0003f01c linkat
0x0003f049 symlink
0x0003f079 symlinkat
0x0003f0a9 readlink
0x0003f0dc readlinkat
0x0003f109 unlink
0x0003f139 unlinkat
0x0003f169 rmdir
0x0003f19c sendfile
0x0003f1c9 setpriority
0x0003f1f9 ioctl
0x0003f229 sethostname
0x0003f259 setdomainname
0x0003f289 acct
0x0003f2b9 chroot
0x0003f2e9 sync
0x0003f319 syncfs
0x0003f349 vhangup
0x0003f379 swapon
0x0003f3a9 swapoff
0x0003f419 munmap
0x0003f449 mprotect
0x0003f479 madvise
0x0003f4a9 mincore
0x0003f4dc remap_file_pages
0x0003f509 mlock
0x0003f539 munlock
0x0003f569 mlockall
0x0003f599 munlockall
0x0003f5cc fgetxattr
0x0003f5f9 flistxattr
0x0003f629 fremovexattr
0x0003f65c fsetxattr
0x0003f68c getxattr
0x0003f6b9 listxattr
0x0003f6ec lgetxattr
0x0003f719 llistxattr
0x0003f749 lremovexattr
0x0003f77c lsetxattr
0x0003f7a9 removexattr
0x0003f7dc setxattr
0x0003f809 ioperm
0x0003f839 iopl
0x0003f894 clone
0x0003f8ac exit
0x0003f8c9 setfsuid
0x0003f8f9 setfsgid
0x0003f929 eventfd2
0x0003f95c prlimit64
0x0003f989 personality
0x0003f9cb clone3
0x0003f9e8 exit
0x0003fa09 arch_prctl
0x0003fa39 modify_ldt
0x0003fa69 clock_gettime
0x0003fa7c fanotify_mark
0x0003faa9 capget
0x0003fad9 capset
0x0003fb09 create_module
0x0003fb39 delete_module
0x0003fb69 epoll_create
0x0003fb99 epoll_create1
0x0003fbcc epoll_ctl
0x0003fbf9 get_kernel_syms
0x0003fc2c init_module
0x0003fc59 inotify_add_watch
0x0003fc89 inotify_init
0x0003fcb9 inotify_init1
0x0003fce9 inotify_rm_watch
0x0003fd19 syslog
0x0003fd4c mount
0x0003fd7c mremap
0x0003fda9 nfsservctl
0x0003fdd9 pivot_root
0x0003fe0c query_module
0x0003fe3c quotactl
0x0003fe69 sysinfo
0x0003fe99 unshare
0x0003fec9 uselib
0x0003fef9 timerfd_create
0x0003ff29 fanotify_init
0x0003ff5c name_to_handle_at
0x0003ff89 setns
0x0003ffb9 memfd_create
0x0003ffe9 pkey_alloc
0x00040019 pkey_free
0x00040049 gettid
0x00040059 tgkill
0x00040089 close_range
0x000400b9 bind
0x000400e9 getpeername
0x00040119 getsockname
0x00040149 listen
0x00040179 shutdown
0x000401a9 socket
0x000401dc socketpair
0x0004030d sigaltstack
0x00040464 exit
0x000553f1 rt_sigaction
0x0005555e rt_sigpending
0x000555aa rt_sigsuspend
0x000555d8 rt_sigsuspend
0x00055fd6 rt_sigtimedwait
0x00056129 rt_sigqueueinfo
0x00059005 getrandom
0x0005903d getrandom
0x00061f39 kill
0x00070b89 rename
0x00070bbc renameat
0x00070c01 renameat2
0x00095a3e writev
0x0009c8a7 futex
0x0009c928 futex
0x0009ca89 futex
0x0009caee futex
0x0009cff8 futex
0x0009d0e8 futex
0x0009d1c4 futex
0x0009d208 futex
0x0009d35a tgkill
0x0009d3c2 tgkill
0x0009df7b read
0x0009e0d2 futex
0x0009e19a futex
0x0009e59e futex
0x0009e616 futex
0x0009e63e futex
0x0009e6bb read
0x0009e9e3 futex
0x0009ea6c futex
0x0009eaeb read
0x0009ec3c read
0x0009ec91 futex
0x0009ece4 futex
0x0009ed46 futex
0x0009eefd futex
0x0009f098 futex
0x0009f391 futex
0x0009f783 futex
0x0009f9fe sched_setaffinity
0x0009fa4f sched_setscheduler
0x0009fb94 rseq
0x0009fc34 rt_sigprocmask
0x0009fcc8 rt_sigprocmask
0x0009fd7c exit
0x0009fddd futex
0x0009fe7e read
0x000a0421 rt_sigprocmask
0x000a0586 rt_sigprocmask
0x000a08a7 rt_sigprocmask
0x000a091c sched_getscheduler
0x000a0949 sched_getparam
0x000a0f7e sched_getaffinity
0x000a0fca sched_getaffinity
0x000a1a5e rt_sigprocmask
0x000a1aa7 tgkill
0x000a1ac5 gettid
0x000a1ada tgkill
0x000a1d2f futex
0x000a1e63 read
0x000a2031 read
0x000a2191 futex
0x000a28a5 futex
0x000a2aac futex
0x000a2be3 read
0x000a2dad read
0x000a3459 read
0x000a34d3 futex
0x000a37d9 futex
0x000a3e98 futex
0x000a41c5 futex
0x000a4771 futex
0x000a4ad4 futex
0x000a4b04 futex
0x000a4fee futex
0x000a503c futex
0x000a55a7 futex
0x000a55ce futex
0x000a565e futex
0x000a5de5 futex
0x000a5e0c futex
0x000a5e96 futex
0x000a607d futex
0x000a60d2 futex
0x000a61c0 futex
0x000a6431 futex
0x000a6458 futex
0x000a64e5 futex
0x000a65ef sched_setaffinity
0x000a6d89 rt_sigprocmask
0x000a6ebe rt_tgsigqueueinfo
0x000a75d3 futex
0x000a85f9 sched_yield
0x000a9b1d rt_sigprocmask
0x000a9b4d rt_sigprocmask
0x000a9d26 rt_sigprocmask
0x000aa000 rt_sigqueueinfo
0x000aabe9 close
0x000aaf29 mq_notify
0x000aaffe mq_notify
0x000ab0eb mq_open
0x000ab1b9 mq_getsetattr
0x000ab1f8 mq_timedreceive
0x000ab249 mq_timedreceive
0x000ab2b8 mq_timedsend
0x000ab372 mq_unlink
0x000ab429 timer_create
0x000ab56f timer_create
0x000ab6bc timer_delete
0x000ab7da timer_getoverrun
0x000ab83a timer_gettime
0x000ab89d timer_settime
0x000ab9e6 rt_sigprocmask
0x00108519 time
0x0010862e gettimeofday
0x001087de settimeofday
0x0010af19 getitimer
0x0010af49 setitimer
0x001135c7 clock_getres
0x0011364a clock_getres
0x00113695 clock_gettime
0x00113703 clock_settime
0x00113768 clock_nanosleep
0x001137a3 clock_nanosleep
0x00115437 setgroups
0x00118049 times
0x001180f8 wait4
0x0011813d wait4
0x001181ab waitid
0x001181f7 waitid
0x001182d5 pause
0x001182f0 pause
0x00118835 clone
0x0011886e set_robust_list
0x001188b2 exit
0x001188bf exit_group
0x00118f76 execveat
0x00119a37 setuid
0x00119ac7 setgid
0x00119c57 setresuid
0x00119cf7 setresgid
0x00134209 sched_rr_get_interval
0x00134248 sched_getaffinity
0x001342b4 sched_getaffinity
0x00134319 sched_setaffinity
0x00134351 sched_setaffinity
0x0013c848 pread64
0x0013c88d pread64
0x0013c8f8 pwrite64
0x0013c93d pwrite64
0x0013d0b6 rt_sigprocmask
0x0013d147 rt_sigprocmask
0x0013d56f close_range
0x0013d5ab setresuid
0x0013d6b6 setresgid
0x0013d900 madvise
0x0013dbac execveat
0x0013dc7c getcpu
0x0013de5c newfstatat
0x0013e14c statx
0x0013e1d3 mknodat
0x0013e219 statfs
0x0013e249 fstatfs
0x0013e465 fchmodat
0x0013e579 openat
0x0013e5f2 openat
0x0013e6f4 openat
0x0013e781 openat
0x0013e85a read
0x0013e8c5 write
0x0013e8fd write
0x0013e959 lseek
0x0013e989 access
0x0013eb32 faccessat2
0x0013ec70 faccessat
0x0013eda9 fcntl
0x0013edf5 fcntl
0x0013ef75 close
0x0013ef99 close
0x0013f005 creat
0x0013f031 creat
0x0013f119 getcwd
0x00142645 poll
0x0014267d poll
0x0014271d ppoll
0x0014277c ppoll
0x001427ec fadvise64
0x001429e4 fallocate
0x00142bf4 fallocate
0x00142c38 copy_file_range
0x00142c93 copy_file_range
0x00142cfc utimensat
0x00142d41 utimensat
0x00143178 sync_file_range
0x001431be sync_file_range
0x00143228 fallocate
0x0014326d fallocate
0x001432c9 close
0x00143333 fcntl
0x00143367 fcntl
0x001433c2 fcntl
0x001433f5 fcntl
0x0014347a openat
0x00143518 openat
0x00143586 read
0x001435f9 write
0x001438e8 read
0x00143a2f ioctl
0x00143a63 ioctl
0x00143c52 prlimit64
0x00143c93 prlimit64
0x00143cc9 getrusage
0x00143ff9 getpriority
0x001440a9 brk
0x001441c5 readv
0x001441fb readv
0x00144265 writev
0x0014429b writev
0x0014430b preadv
0x00144356 preadv
0x001443cb pwritev
0x00144416 pwritev
0x001444aa preadv2
0x00144536 preadv2
0x0014460a pwritev2
0x00144696 pwritev2
0x00144757 setreuid
0x001447e7 setregid
0x0014488e setresuid
0x0014494e setresgid
0x00144d47 pselect6
0x00144ddb pselect6
0x00144ee2 pselect6
0x00144f50 pselect6
0x00144fc5 fsync
0x00144fe9 fsync
0x00145055 fdatasync
0x00145079 fdatasync
0x001450e5 reboot
0x0014564c ptrace
0x00146419 truncate
0x00146449 ftruncate
0x00147cf5 mmap
0x00147d55 msync
0x00147d8d msync
0x0014a1a0 ustat
0x0014a5f6 sched_getaffinity
0x0014e599 umount2
0x0014e5c9 readahead
0x0014e62e epoll_pwait
0x0014e686 epoll_pwait
0x0014e6f1 signalfd4
0x0014e798 epoll_wait
0x0014e7dc epoll_wait
0x0014e848 tee
0x0014e88c tee
0x0014e8f8 vmsplice
0x0014e93c vmsplice
0x0014e9a8 splice
0x0014ea03 splice
0x0014ea75 open_by_handle_at
0x0014eaa9 open_by_handle_at
0x0014eb0d mlock2
0x0014eb3d mlock
0x0014eba1 pkey_mprotect
0x0014ec79 timerfd_gettime
0x0014ecac timerfd_settime
0x0014ed2f prctl
0x0014ed7c process_vm_readv
0x0014edf9 clock_adjtime
0x0014ee38 stat
0x0014ee97 fstat
0x0014eef8 lstat
0x0014ef5d newfstatat
0x0014f295 accept
0x0014f2cd accept
0x0014f335 connect
0x0014f369 connect
0x0014f3cc getsockopt
0x0014f41e recvfrom
0x0014f46c recvfrom
0x0014f4d8 recvfrom
0x0014f532 recvfrom
0x0014f5ab recvmsg
0x0014f5ed recvmsg
0x0014f65e sendto
0x0014f6ac sendto
0x0014f715 sendmsg
0x0014f74b sendmsg
0x0014f7b8 sendto
0x0014f814 sendto
0x0014f87c setsockopt
0x0014fa08 accept4
0x0014fa4e accept4
0x0014fab8 recvmmsg
0x0014fb06 recvmmsg
0x0014fb78 sendmmsg
0x0014fbbc sendmmsg
0x0014fdd8 msgsnd
0x0014fe1e msgsnd
0x0014fe88 msgrcv
0x0014fed9 msgrcv
0x0014ff39 msgget
0x0014ff79 msgctl
0x0014ffd9 semget
0x0015008d semctl
0x001500cc semtimedop
0x00150109 shmat
0x00150139 shmdt
0x0015016c shmget
0x001501bf shmctl
0x00150437 writev
0x00150477 writev
0x001506b1 writev
0x0015c14b read
0x001676bb close
0x00167777 close
0x0016794d close
0x0016dd66 writev
0x00176910 rt_sigqueueinfo
0x00196a7f futex
EOF
RUN