mirror of
https://github.com/radareorg/radare2.git
synced 2024-12-04 11:43:39 +00:00
578 lines
16 KiB
C
578 lines
16 KiB
C
/* radare - LGPL - Copyright 2009-2014 - pancake */
|
|
|
|
/* TODO: simplify using r_write */
|
|
static int cmd_write(void *data, const char *input) {
|
|
ut64 off;
|
|
ut8 *buf;
|
|
const char *arg;
|
|
int wseek, i, size, len = strlen (input);
|
|
char *tmp, *str, *ostr;
|
|
RCore *core = (RCore *)data;
|
|
#define WSEEK(x,y) if (wseek)r_core_seek_delta (x,y)
|
|
wseek = r_config_get_i (core->config, "cfg.wseek");
|
|
str = ostr = strdup (input+1);
|
|
|
|
switch (*input) {
|
|
case 'h':
|
|
{
|
|
char *p = strchr (input, ' ');
|
|
if (p) {
|
|
while (*p==' ') p++;
|
|
p = r_file_path (p);
|
|
if (p) {
|
|
r_cons_printf ("%s\n", p);
|
|
free (p);
|
|
}
|
|
}
|
|
}
|
|
break;
|
|
case 'p':
|
|
if (input[1]=='-' || (input[1]==' '&&input[2]=='-')) {
|
|
const char *tmpfile = ".tmp";
|
|
char *out = r_core_editor (core, NULL);
|
|
if (out) {
|
|
// XXX hacky .. patch should support str, not only file
|
|
r_file_dump (tmpfile, (ut8*)out, strlen (out));
|
|
r_core_patch (core, tmpfile);
|
|
r_file_rm (tmpfile);
|
|
}
|
|
} else
|
|
if (input[1]==' ' && input[2]) {
|
|
r_core_patch (core, input+2);
|
|
} else {
|
|
eprintf ("Usage: wp [-|r2patch-file]\n"
|
|
"TODO: rapatch format documentation here\n");
|
|
}
|
|
break;
|
|
case 'u':
|
|
// TODO: implement it in an API RCore.write_unified_hexpatch() is ETOOLONG
|
|
if (input[1]==' ') {
|
|
char *data = r_file_slurp (input+2, NULL);
|
|
if (data) {
|
|
char sign = ' ';
|
|
int line = 0, offs = 0, hexa = 0;
|
|
int newline = 1;
|
|
for (i=0; data[i]; i++) {
|
|
switch (data[i]) {
|
|
case '+':
|
|
if (newline)
|
|
sign = 1;
|
|
break;
|
|
case '-':
|
|
if (newline) {
|
|
sign = 0;
|
|
offs = i + ((data[i+1]==' ')?2:1);
|
|
}
|
|
break;
|
|
case ' ':
|
|
data[i] = 0;
|
|
if (sign) {
|
|
if (!line) line = i+1;
|
|
else
|
|
if (!hexa) hexa = i+1;
|
|
}
|
|
break;
|
|
case '\r':
|
|
break;
|
|
case '\n':
|
|
newline = 1;
|
|
if (sign == -1) {
|
|
offs = 0;
|
|
line = 0;
|
|
hexa = 0;
|
|
} else if (sign) {
|
|
if (offs && hexa) {
|
|
r_cons_printf ("wx %s @ %s\n", data+hexa, data+offs);
|
|
} else eprintf ("food\n");
|
|
offs = 0;
|
|
line = 0;
|
|
} else hexa = 0;
|
|
sign = -1;
|
|
continue;
|
|
}
|
|
newline = 0;
|
|
}
|
|
free (data);
|
|
}
|
|
} else {
|
|
eprintf ("|Usage: wu [unified-diff-patch] # see 'cu'\n");
|
|
}
|
|
break;
|
|
case 'r':
|
|
off = r_num_math (core->num, input+1);
|
|
len = (int)off;
|
|
if (len>0) {
|
|
buf = malloc (len);
|
|
if (buf != NULL) {
|
|
r_num_irand ();
|
|
for (i=0; i<len; i++)
|
|
buf[i] = r_num_rand (256);
|
|
r_core_write_at (core, core->offset, buf, len);
|
|
WSEEK (core, len);
|
|
free (buf);
|
|
} else eprintf ("Cannot allocate %d bytes\n", len);
|
|
}
|
|
break;
|
|
case 'A':
|
|
switch (input[1]) {
|
|
case ' ':
|
|
if (input[2] && input[3]==' ') {
|
|
r_asm_set_pc (core->assembler, core->offset);
|
|
eprintf ("modify (%c)=%s\n", input[2], input+4);
|
|
len = r_asm_modify (core->assembler, core->block, input[2],
|
|
r_num_math (core->num, input+4));
|
|
eprintf ("len=%d\n", len);
|
|
if (len>0) {
|
|
r_core_write_at (core, core->offset, core->block, len);
|
|
WSEEK (core, len);
|
|
} else eprintf ("r_asm_modify = %d\n", len);
|
|
} else eprintf ("Usage: wA [type] [value]\n");
|
|
break;
|
|
case '?':
|
|
default:
|
|
r_cons_printf ("|Usage: wA [type] [value]\n"
|
|
"|Types:\n"
|
|
"| r raw write value\n"
|
|
"| v set value (taking care of current address)\n"
|
|
"| d destination register\n"
|
|
"| 0 1st src register\n"
|
|
"| 1 2nd src register\n"
|
|
"|Example: wA r 0 # e800000000\n");
|
|
break;
|
|
}
|
|
break;
|
|
case 'c':
|
|
switch (input[1]) {
|
|
case 'i':
|
|
r_io_cache_commit (core->io);
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case 'r':
|
|
r_io_cache_reset (core->io, R_TRUE);
|
|
/* Before loading the core block we have to make sure that if
|
|
* the cache wrote past the original EOF these changes are no
|
|
* longer displayed. */
|
|
memset (core->block, 0xff, core->blocksize);
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case '-':
|
|
if (input[2]=='*') {
|
|
r_io_cache_reset (core->io, R_TRUE);
|
|
} else if (input[2]==' ') {
|
|
char *p = strchr (input+3, ' ');
|
|
ut64 to, from = core->offset;
|
|
if (p) {
|
|
*p = 0;
|
|
from = r_num_math (core->num, input+3);
|
|
to = r_num_math (core->num, input+3);
|
|
if (to<from) {
|
|
eprintf ("Invalid range (from>to)\n");
|
|
return 0;
|
|
}
|
|
} else {
|
|
from = r_num_math (core->num, input+3);
|
|
to = from + core->blocksize;
|
|
}
|
|
r_io_cache_invalidate (core->io, from, to);
|
|
} else {
|
|
eprintf ("Invalidate write cache at 0x%08"PFMT64x"\n", core->offset);
|
|
r_io_cache_invalidate (core->io, core->offset, core->offset+core->blocksize);
|
|
}
|
|
/* See 'r' above. */
|
|
memset (core->block, 0xff, core->blocksize);
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case '?':
|
|
r_cons_printf (
|
|
"|Usage: wc[ir*?]\n"
|
|
"| wc list all write changes\n"
|
|
"| wc- [a] [b] remove write op at curseek or given addr\n"
|
|
"| wc* \"\" in radare commands\n"
|
|
"| wcr reset all write changes in cache\n"
|
|
"| wci commit write cache\n"
|
|
"|NOTE: Requires 'e io.cache=true'\n");
|
|
break;
|
|
case '*':
|
|
r_io_cache_list (core->io, R_TRUE);
|
|
break;
|
|
case '\0':
|
|
if (!r_config_get_i (core->config, "io.cache"))
|
|
eprintf ("[warning] e io.cache must be true\n");
|
|
r_io_cache_list (core->io, R_FALSE);
|
|
break;
|
|
}
|
|
break;
|
|
case ' ':
|
|
/* write string */
|
|
len = r_str_unescape (str);
|
|
r_core_write_at (core, core->offset, (const ut8*)str, len);
|
|
#if 0
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_write_at (core->io, core->offset, (const ut8*)str, len);
|
|
#endif
|
|
WSEEK (core, len);
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case 't':
|
|
if (*str != ' ') {
|
|
eprintf ("Usage: wt file [size]\n");
|
|
} else {
|
|
tmp = strchr (str+1, ' ');
|
|
if (tmp) {
|
|
st64 sz = (st64) r_num_math (core->num, tmp+1);
|
|
*tmp = 0;
|
|
if (sz<1) eprintf ("Invalid length\n");
|
|
else r_core_dump (core, str+1, core->offset, (ut64)sz);
|
|
} else r_file_dump (str+1, core->block, core->blocksize);
|
|
}
|
|
break;
|
|
case 'T':
|
|
eprintf ("TODO: wT // why?\n");
|
|
break;
|
|
case 'f':
|
|
arg = (const char *)(input+((input[1]==' ')?2:1));
|
|
if (!strcmp (arg, "-")) {
|
|
char *out = r_core_editor (core, NULL);
|
|
if (out) {
|
|
r_io_write_at (core->io, core->offset,
|
|
(ut8*)out, strlen (out));
|
|
free (out);
|
|
}
|
|
} else
|
|
if ((buf = (ut8*) r_file_slurp (arg, &size))) {
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_write_at (core->io, core->offset, buf, size);
|
|
WSEEK (core, size);
|
|
free (buf);
|
|
r_core_block_read (core, 0);
|
|
} else eprintf ("Cannot open file '%s'\n", arg);
|
|
break;
|
|
case 'F':
|
|
arg = (const char *)(input+((input[1]==' ')?2:1));
|
|
if (!strcmp (arg, "-")) {
|
|
int len;
|
|
ut8 *out;
|
|
char *in = r_core_editor (core, NULL);
|
|
if (in) {
|
|
out = (ut8 *)strdup (in);
|
|
if (out) {
|
|
len = r_hex_str2bin (in, out);
|
|
if (len>0)
|
|
r_io_write_at (core->io, core->offset, out, len);
|
|
free (out);
|
|
}
|
|
free (in);
|
|
}
|
|
} else
|
|
if ((buf = r_file_slurp_hexpairs (arg, &size))) {
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_write_at (core->io, core->offset, buf, size);
|
|
WSEEK (core, size);
|
|
free (buf);
|
|
r_core_block_read (core, 0);
|
|
} else eprintf ("Cannot open file '%s'\n", arg);
|
|
break;
|
|
case 'w':
|
|
str++;
|
|
len = (len-1)<<1;
|
|
if (len>0) tmp = malloc (len+1);
|
|
else tmp = NULL;
|
|
if (tmp) {
|
|
for (i=0; i<len; i++) {
|
|
if (i%2) tmp[i] = 0;
|
|
else tmp[i] = str[i>>1];
|
|
}
|
|
str = tmp;
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_write_at (core->io, core->offset, (const ut8*)str, len);
|
|
WSEEK (core, len);
|
|
r_core_block_read (core, 0);
|
|
free (tmp);
|
|
} else eprintf ("Cannot malloc %d\n", len);
|
|
break;
|
|
case 'x':
|
|
{
|
|
int b, len = strlen (input);
|
|
ut8 *buf = malloc (len+1);
|
|
len = r_hex_str2bin (input+1, buf);
|
|
if (len != 0) {
|
|
if (len<0) len = -len+1;
|
|
if (len<core->blocksize) {
|
|
b = core->block[len]&0xf;
|
|
b |= (buf[len]&0xf0);
|
|
} else b = buf[len];
|
|
buf[len] = b;
|
|
r_core_write_at (core, core->offset, buf, len);
|
|
WSEEK (core, len);
|
|
r_core_block_read (core, 0);
|
|
} else eprintf ("Error: invalid hexpair string\n");
|
|
free (buf);
|
|
}
|
|
break;
|
|
case 'a':
|
|
switch (input[1]) {
|
|
case 'o':
|
|
if (input[2] == ' ')
|
|
r_core_hack (core, input+3);
|
|
else r_core_hack_help (core);
|
|
break;
|
|
case ' ':
|
|
case '*':
|
|
{ const char *file = input[1]=='*'? input+2: input+1;
|
|
RAsmCode *acode;
|
|
r_asm_set_pc (core->assembler, core->offset);
|
|
acode = r_asm_massemble (core->assembler, file);
|
|
if (acode) {
|
|
if (input[1]=='*') {
|
|
r_cons_printf ("wx %s\n", acode->buf_hex);
|
|
} else {
|
|
if (r_config_get_i (core->config, "scr.prompt"))
|
|
eprintf ("Written %d bytes (%s) = wx %s\n", acode->len, input+2, acode->buf_hex);
|
|
r_core_write_at (core, core->offset, acode->buf, acode->len);
|
|
WSEEK (core, acode->len);
|
|
r_core_block_read (core, 0);
|
|
}
|
|
r_asm_code_free (acode);
|
|
}
|
|
} break;
|
|
case 'f':
|
|
if ((input[2]==' '||input[2]=='*')) {
|
|
const char *file = input[2]=='*'? input+4: input+3;
|
|
RAsmCode *acode;
|
|
r_asm_set_pc (core->assembler, core->offset);
|
|
acode = r_asm_assemble_file (core->assembler, file);
|
|
if (acode) {
|
|
if (input[2]=='*') {
|
|
r_cons_printf ("wx %s\n", acode->buf_hex);
|
|
} else {
|
|
if (r_config_get_i (core->config, "scr.prompt"))
|
|
eprintf ("Written %d bytes (%s)=wx %s\n", acode->len, input+1, acode->buf_hex);
|
|
r_core_write_at (core, core->offset, acode->buf, acode->len);
|
|
WSEEK (core, acode->len);
|
|
r_core_block_read (core, 0);
|
|
}
|
|
r_asm_code_free (acode);
|
|
} else eprintf ("Cannot assemble file\n");
|
|
} else eprintf ("Wrong argument\n");
|
|
break;
|
|
default:
|
|
r_cons_printf ("|Usage: wa[of*] [arg]\n"
|
|
"| wa nop : write nopcode using asm.arch and asm.bits\n"
|
|
"| wa* mov eax, 33 : show 'wx' op with hexpair bytes of sassembled opcode\n"
|
|
"| \"wa nop;nop\" : assemble more than one instruction (note the quotes)\n"
|
|
"| waf foo.asm : assemble file and write bytes\n"
|
|
"| wao nop : convert current opcode into nops\n"
|
|
"| wao? : show help for assembler operation on current opcode (hack)\n");
|
|
break;
|
|
}
|
|
break;
|
|
case 'b':
|
|
{
|
|
int len = strlen (input);
|
|
ut8 *buf = malloc (len+1);
|
|
if (buf) {
|
|
len = r_hex_str2bin (input+1, buf);
|
|
if (len > 0) {
|
|
r_mem_copyloop (core->block, buf, core->blocksize, len);
|
|
r_core_write_at (core, core->offset, core->block, core->blocksize);
|
|
WSEEK (core, core->blocksize);
|
|
r_core_block_read (core, 0);
|
|
} else eprintf ("Wrong argument\n");
|
|
} else eprintf ("Cannot malloc %d\n", len+1);
|
|
}
|
|
break;
|
|
case 'm':
|
|
size = r_hex_str2bin (input+1, (ut8*)str);
|
|
switch (input[1]) {
|
|
case '\0':
|
|
eprintf ("Current write mask: TODO\n");
|
|
// TODO
|
|
break;
|
|
case '?':
|
|
break;
|
|
case '-':
|
|
r_io_set_write_mask (core->io, 0, 0);
|
|
eprintf ("Write mask disabled\n");
|
|
break;
|
|
case ' ':
|
|
if (size>0) {
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_set_write_mask (core->io, (const ut8*)str, size);
|
|
WSEEK (core, size);
|
|
eprintf ("Write mask set to '");
|
|
for (i=0; i<size; i++)
|
|
eprintf ("%02x", str[i]);
|
|
eprintf ("'\n");
|
|
} else eprintf ("Invalid string\n");
|
|
break;
|
|
}
|
|
break;
|
|
case 'v':
|
|
{
|
|
int type = 0;
|
|
ut8 addr1;
|
|
ut16 addr2;
|
|
ut32 addr4, addr4_;
|
|
ut64 addr8;
|
|
|
|
switch (input[1]) {
|
|
case '?':
|
|
r_cons_printf ("|Usage: wv[size] [value] # write value of given size\n"
|
|
"| wv1 234 # write one byte with this value\n"
|
|
"| wv 0x834002 # write dword with this value\n"
|
|
"|Supported sizes are: 1, 2, 4, 8\n");
|
|
return 0;
|
|
case '1': type = 1; break;
|
|
case '2': type = 2; break;
|
|
case '4': type = 4; break;
|
|
case '8': type = 8; break;
|
|
}
|
|
off = r_num_math (core->num, input+2);
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_seek (core->io, core->offset, R_IO_SEEK_SET);
|
|
if (type == 0)
|
|
type = (off&UT64_32U)? 8: 4;
|
|
switch (type) {
|
|
case 1:
|
|
addr1 = (ut8)off;
|
|
r_io_write (core->io, (const ut8 *)&addr1, 1);
|
|
WSEEK (core, 1);
|
|
break;
|
|
case 2:
|
|
addr2 = (ut16)off;
|
|
r_io_write (core->io, (const ut8 *)&addr2, 2);
|
|
WSEEK (core, 2);
|
|
break;
|
|
case 4:
|
|
addr4_ = (ut32)off;
|
|
//drop_endian((ut8*)&addr4_, (ut8*)&addr4, 4); /* addr4_ = addr4 */
|
|
//endian_memcpy((ut8*)&addr4, (ut8*)&addr4_, 4); /* addr4 = addr4_ */
|
|
memcpy ((ut8*)&addr4, (ut8*)&addr4_, 4); // XXX needs endian here too
|
|
r_io_write (core->io, (const ut8 *)&addr4, 4);
|
|
WSEEK (core, 4);
|
|
break;
|
|
case 8:
|
|
/* 8 byte addr */
|
|
memcpy ((ut8*)&addr8, (ut8*)&off, 8); // XXX needs endian here
|
|
// endian_memcpy((ut8*)&addr8, (ut8*)&off, 8);
|
|
r_io_write (core->io, (const ut8 *)&addr8, 8);
|
|
WSEEK (core, 8);
|
|
break;
|
|
}
|
|
r_core_block_read (core, 0);
|
|
}
|
|
break;
|
|
case 'o':
|
|
switch (input[1]) {
|
|
case 'a':
|
|
case 's':
|
|
case 'e':
|
|
case 'A':
|
|
case 'x':
|
|
case 'r':
|
|
case 'l':
|
|
case 'm':
|
|
case 'd':
|
|
case 'o':
|
|
case 'w':
|
|
if (input[2]!=' ') {
|
|
if (input[1]=='e') r_cons_printf (
|
|
"Usage: 'woe from-to step'\n");
|
|
else r_cons_printf (
|
|
"Usage: 'wo%c 00 11 22'\n", input[1]);
|
|
return 0;
|
|
}
|
|
case '2':
|
|
case '4':
|
|
r_core_write_op (core, input+3, input[1]);
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case 'R':
|
|
r_core_cmd0 (core, "wr $b");
|
|
break;
|
|
case 'n':
|
|
r_core_write_op (core, "ff", 'x');
|
|
r_core_block_read (core, 0);
|
|
break;
|
|
case '\0':
|
|
case '?':
|
|
default:
|
|
r_cons_printf (
|
|
"|Usage: wo[asmdxoArl24] [hexpairs] @ addr[:bsize]\n"
|
|
"|Example:\n"
|
|
"| wox 0x90 ; xor cur block with 0x90\n"
|
|
"| wox 90 ; xor cur block with 0x90\n"
|
|
"| wox 0x0203 ; xor cur block with 0203\n"
|
|
"| woa 02 03 ; add [0203][0203][...] to curblk\n"
|
|
"| woe 02 03 \n"
|
|
"|Supported operations:\n"
|
|
"| wow == write looped value (alias for 'wb')\n"
|
|
"| woa += addition\n"
|
|
"| wos -= substraction\n"
|
|
"| wom *= multiply\n"
|
|
"| wod /= divide\n"
|
|
"| wox ^= xor\n"
|
|
"| woo |= or\n"
|
|
"| woA &= and\n"
|
|
"| woR random bytes (alias for 'wr $b'\n"
|
|
"| wor >>= shift right\n"
|
|
"| wol <<= shift left\n"
|
|
"| wo2 2= 2 byte endian swap\n"
|
|
"| wo4 4= 4 byte endian swap\n"
|
|
);
|
|
break;
|
|
}
|
|
break;
|
|
case 's':
|
|
{
|
|
ut8 ulen;
|
|
len = r_str_escape (str+1);
|
|
if (len>255) {
|
|
eprintf ("Too large\n");
|
|
} else {
|
|
ulen = (ut8)len;
|
|
r_core_write_at (core, core->offset, &ulen, 1);
|
|
r_core_write_at (core, core->offset+1, (const ut8*)str+1, len);
|
|
WSEEK (core, len);
|
|
r_core_block_read (core, 0);
|
|
}
|
|
}
|
|
break;
|
|
default:
|
|
case '?':
|
|
if (core->oobi) {
|
|
eprintf ("Writing oobi buffer!\n");
|
|
r_io_set_fd (core->io, core->file->fd);
|
|
r_io_write (core->io, core->oobi, core->oobi_len);
|
|
WSEEK (core, core->oobi_len);
|
|
r_core_block_read (core, 0);
|
|
} else r_cons_printf (
|
|
"|Usage: w[x] [str] [<file] [<<EOF] [@addr]\n"
|
|
"| w foobar write string 'foobar'\n"
|
|
"| wh r2 whereis/which shell command\n"
|
|
"| wr 10 write 10 random bytes\n"
|
|
"| ww foobar write wide string 'f\\x00o\\x00o\\x00b\\x00a\\x00r\\x00'\n"
|
|
"| wa push ebp write opcode, separated by ';' (use '\"' around the command)\n"
|
|
"| waf file assemble file and write bytes\n"
|
|
"| wA r 0 alter/modify opcode at current seek (see wA?)\n"
|
|
"| wb 010203 fill current block with cyclic hexpairs\n"
|
|
"| wc[ir*?] write cache undo/commit/reset/list (io.cache)\n"
|
|
"| wx 9090 write two intel nops\n"
|
|
"| wv eip+34 write 32-64 bit value\n"
|
|
"| wo? hex write in block with operation. 'wo?' fmi\n"
|
|
"| wm f0ff set binary mask hexpair to be used as cyclic write mask\n"
|
|
"| ws pstring write 1 byte for length and then the string\n"
|
|
"| wf -|file write contents of file at current offset\n"
|
|
"| wF -|file write contents of hexpairs file here\n"
|
|
"| wp -|file apply radare patch file. See wp? fmi\n"
|
|
"| wt file [sz] write to file (from current seek, blocksize or sz bytes)\n"
|
|
);
|
|
//TODO: add support for offset+seek
|
|
// " wf file o s ; write contents of file from optional offset 'o' and size 's'.\n"
|
|
break;
|
|
}
|
|
free (ostr);
|
|
return 0;
|
|
}
|
|
|