Release 4.0

* Corrected jumps and remove git messages
* Add ESIL for right shift and correct imm value
* Separate branch with immediate instructions

.gitignore

@@ -1,7 +1,20 @@
 ### C ###
 # Object files
 *.o
+*.so
+*.exe
+*.obj
+*.dll
+*.dylib
+*.
+*.gz
 
 # Make dependencies files
 # Conflicts with .d for dlang
 #*.d
+
+*.swp
+*.swo
+*.un~
+/Makefile
+/options.mk

.travis.yml

@@ -0,0 +1,118 @@
+dist:
+  - trusty
+sudo:
+  - false
+os:
+  - linux
+
+addons:
+  apt:
+    sources:
+      - ubuntu-toolchain-r-test
+    packages:
+      - gcc-7
+      - llvm-dev
+      - libatomic-ops-dev
+      - mono-xbuild
+      - curl
+      - make
+      - tcc
+      - libboost-dev
+      - libqt4-dev
+      - cmake
+      - cmake-data
+      - ninja-build
+      - libboost-dev
+      - libqt4-dev
+      - exuberant-ctags
+      - libelf-dev
+      - libgmp-dev
+      - zlib1g-dev
+      - swig
+env:
+  - TESTS="r2pm -i armthumb"
+  - TESTS="r2pm -i baleful"
+#  - TESTS="r2pm -i bcl" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+  - TESTS="r2pm -i blackfin"
+  - TESTS="r2pm -i blessr2"
+#  - TESTS="r2pm -i bpf" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+#  - TESTS="r2pm -i dlang" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+  - TESTS="r2pm -i dirtycow"
+  - TESTS="r2pm -i lang-duktape"
+  - TESTS="git clone git://git.code.sf.net/p/libdwarf/code libdwarf-code && cd libdwarf-code && ./configure && make && cd .. && r2pm -i dwarf-parser && cd radare2-regressions && ./r2r dwarf && cd .. && r2pm -u libdwarf && rm -rf libdwarf-code" #need to remove libdwarf? or travis destroys the vm so no issue in that?
+  - TESTS="r2pm -i r2frida"
+#  - TESTS="r2pm -i io-ewf" # https://github.com/travis-ci/apt-package-whitelist/issues/3205
+#  - TESTS="r2pm -i keystone-lib && r2pm -i keystone && cd radare2-regressions && make keystone && cd .." [BR] https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+  - TESTS="r2pm -i mc6809"
+  - TESTS="r2pm -i microblaze && cd radare2-regressions && make microblaze"
+  - TESTS="r2pm -i msil"
+  - TESTS="r2pm -i pcap"
+  - TESTS="r2pm -i ppcdisasm"
+  - TESTS="r2pm -i psosvm"
+  - TESTS="r2pm -i pyc"
+#  - TESTS="r2pm -i vala && r2pm -i valabind && r2pm -i r2api-python" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/387043680
+#  - TESTS="r2pm -i r2pipe-cs" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+#  - TESTS="r2pm -i r2pipe-go" [BR] https://travis-ci.org/radareorg/radare2-extras/builds/387043680
+  - TESTS="r2pm -i r2pipe-js"
+  - TESTS="r2pm -i r2pipe-py"
+  - TESTS="r2pm -i r2pipe-rb"
+#  - TESTS="r2pm -i r2pipe-vala" https://travis-ci.org/radareorg/radare2-extras/builds/157522362
+  - TESTS="r2pm -i radare2"
+#  - TESTS="r2pm -i r2snow" https://travis-ci.org/radareorg/radare2-extras/jobs/199500082
+#  - TESTS="r2pm -i radeco" [BR] https://travis-ci.org/radare/radare2-extras/builds/157522362
+  - TESTS="r2pm -i retdec"
+  - TESTS="r2pm -i swf && cd radare2-regressions && make swf && cd .."
+#  - TESTS="r2pm -i m68k-net && cd radare2-regressions && make m68k-extras && cd .." [BR] https://travis-ci.org/radare/radare2-extras/builds/387043680
+#  - TESTS="r2pm -i swig" Sorry. This package cannot be installed in your home.
+  - TESTS="r2pm -i syms2elf"
+#  - TESTS="r2pm -i tcc" [BR] https://travis-ci.org/radare/radare2-extras/builds/157522362
+  - TESTS="r2pm -i unicorn-lib && r2pm -i unicorn" # need to do this properly
+  - TESTS="r2pm -i vala"
+#  - TESTS="r2pm -i valabind" [BR] https://travis-ci.org/radare/radare2-extras/builds/387043680
+#  - TESTS="r2pm -i vapi" [BR] https://travis-ci.org/radare/radare2-extras/builds/387043680
+  - TESTS="r2pm -i vc4"
+  - TESTS="r2pm -i winapi"
+  - TESTS="r2pm -i www-enyo"
+#  - TESTS="r2pm -i www-m" [BR] https://travis-ci.org/radare/radare2-extras/builds/157522362
+  - TESTS="r2pm -i www-p"
+  - TESTS="r2pm -i www-t"
+  - TESTS="r2pm -i x86udis"
+  - TESTS="r2pm -i x86bea"
+  - TESTS="r2pm -i x86tab"
+  - TESTS="r2pm -i x86olly && cd radare2-regressions && make olly-extras && cd .."
+  - TESTS="r2pm -i z80-nc"
+  - TESTS="r2pm -i yara && r2pm -i yara-r2"
+  - TESTS="r2pm -i x86zyan"
+language:
+  - rust
+rust:
+  - stable
+cache:
+  - ccache
+  - apt
+
+before_script:
+  - export WORKING_DIR=${TRAVIS_BUILD_DIR}/..
+  - cd ${WORKING_DIR}
+  - rm -rf ~/.nvm && git clone https://github.com/creationix/nvm.git ~/.nvm && (cd ~/.nvm && git checkout `git describe --abbrev=0 --tags`) && source ~/.nvm/nvm.sh && nvm install 10
+  - git clone https://github.com/radareorg/radare2-regressions
+  - git clone https://github.com/radareorg/radare2 && cd radare2
+  - export CC=gcc-7
+  - ./configure --prefix=${WORKING_DIR}/install > /dev/null
+  - make -s -j2 > /dev/null
+  - make install > /dev/null
+  - cd ..
+  - export PATH=${WORKING_DIR}/install/bin:${PATH}
+  - export LD_LIBRARY_PATH=${WORKING_DIR}/install/lib:${LD_LIBRARY_PATH}
+  - export LIBR_INCLUDE=${WORKING_DIR}/radare2/libr/include
+  - export LIBR_UTIL=${WORKING_DIR}/radare2/libr/util
+  - export PKG_CONFIG_PATH=${WORKING_DIR}/radare2/pkgcfg
+  - export GOPATH=${WORKING_DIR}/
+  - r2pm init
+  - export R2PM_GITDIR=${WORKING_DIR}
+  - cd radare2-extras
+  - ./configure --prefix=${WORKING_DIR}/install
+  - cd ..
+
+script:
+  - eval $TESTS

Attic/r_db/Jamroot

@@ -0,0 +1,3 @@
+OBJS = db.c table.c ;
+
+lib r_db : $(OBJS) : <include>../include <library>../util <library>../../shlr/sdb ;

Attic/r_db/Makefile

@@ -0,0 +1,44 @@
+include ../config.mk
+
+NAME=r_db
+DEPS=r_util
+
+OBJS=db.o table.o
+
+SDBPATH=../../shlr/sdb/src/
+SDBLIB=${SDBPATH}/libsdb.a
+EXTRA_TARGETS+=${SDBLIB}
+
+SDB_OBJS=
+SDB_OBJS+=buffer.o
+SDB_OBJS+=cdb.o
+SDB_OBJS+=cdb_make.o
+SDB_OBJS+=ht.o
+SDB_OBJS+=json.o
+SDB_OBJS+=lock.o
+SDB_OBJS+=ls.o
+SDB_OBJS+=ns.o
+SDB_OBJS+=query.o
+SDB_OBJS+=sdb.o
+SDB_OBJS+=base64.o
+SDB_OBJS+=disk.o
+SDB_OBJS+=array.o
+SDB_OBJS+=fmt.o
+SDB_OBJS+=match.o
+SDB_OBJS+=num.o
+SDB_OBJS+=util.o
+SDB_OBJS+=journal.o
+
+SDBOBJS=$(addprefix ${SDBPATH},${SDB_OBJS})
+
+OBJS+=${SDBOBJS}
+
+CFLAGS+=-I${SDBPATH}/src
+pre: ${SDBLIB}
+	${MAKE} all
+
+include ../rules.mk
+
+${SDBLIB}:
+	${MAKE} -C ${SDBPATH}
+

Attic/r_db/README

@@ -0,0 +1,44 @@
++------+
+| r.db | Simple and performance-friendly relational database
++------+
+
+The database of r.db is based on index tables of key-size depth.
+The key is the index of the key-bucket array which opens the search
+space to a single key.
+
+Items are directly sorted
+
+  [255] key buckets
+    |
+    `-> [0..255]           -----.
+         |     \                |
+         |      \               |
+     [0..255]  [0..255]         |
+         |        |             |-- size of key (depth)
+     [0..255]    ...            |
+         |                      |
+     [0..255]              -----'
+
+OPERATIONS
+==========
+
+   ADD
+
+   DELETE
+
+     r_db_delete_by_key(db, K_ID, &tmp) # specify more than one key?
+
+   ITERATE
+   
+
++----------+
+| r.db.sql | The SQL frontend for r.db
++----------+
+
+ - Compiles simple SQL-like sentences into a set of r.db queries
+
+void **iter = r_db_sql_query("select * from flags");
+while(r_db_ptr(iter)) {
+	struct foo_t *foo = r_db_ptr(iter);
+	iter = r_db_ptr_next(iter);
+}

Attic/r_db/TODO

@@ -0,0 +1,31 @@
+* Use r_mem_pool
+* Add support for one level RDB.. to 8x speed up
+* Serialize/Deserialize from disk
+* Return FALSE when adding two elements with the same
+  attributes (get before add) if the db is unique
+  // not necessary, we can just do this by manually checkingc
+* Benchmarking
+  - Compilation support for profiling memory usage
+  - Compare performance against sqlite
+* Import/export from/to SQL
+* SQL support
+
+CREATE TABLE flags (
+  name char(25) PRIMARY KEY,
+  offset ut64,
+);
+
+SELECT * FROM flags WHERE offset == 0x8048000;
+
+CREATE VIEW flagwindow AS SELECT * FROM flags WHERE offset>0 and offset<100
+
+DROP TABLE flags
+INSERT INTO flags (name, offset) VALUES ("patata", 33)
+
+UPDATE flags SET offset=33 WHERE offset==20
+
+STORE
+  - ut32
+  - ut64
+  - Endianness matterz
+  - RList *get_range (0, 4096)

Attic/r_db/db.c

@@ -0,0 +1,275 @@
+/* radare - LGPL - Copyright 2009-2013 - pancake */
+
+#include "r_db.h"
+
+R_LIB_VERSION (r_db);
+#if 0
+Configurable options:
+ - allow dupped nodes? (two times the same pointer?)
+#endif
+
+R_API RDatabase *r_db_new() {
+	RDatabase *db = R_NEW (RDatabase);
+	if (db) {
+		memset (&db->blocks, '\0', sizeof (db->blocks));
+		db->id_min = -1;
+		db->id_max = -1;
+	}
+	return db;
+}
+
+R_API RDatabaseBlock *r_db_block_new() {
+	RDatabaseBlock *ptr = R_NEW0 (RDatabaseBlock);
+	return ptr;
+}
+
+R_API int r_db_add_id(struct r_db_t *db, int key, int size) {
+	key &= 0xff;
+	if (db->blocks[key])
+		return false;
+	if (db->id_min==-1) {
+		db->id_min = key;
+		db->id_max = key;
+	} else if (db->id_max < key)
+		db->id_max = key;
+	if (key < db->id_min)
+		db->id_min = key;
+	db->blocks[key] = r_db_block_new ();
+	db->blocks_sz[key] = size;
+	return true;
+}
+
+static int _r_db_add_internal(struct r_db_t *db, int key, void *b) {
+	int i, idx, len, size;
+	struct r_db_block_t *block;
+	if (key<0 || key>255)
+		return false;
+	size = db->blocks_sz[key];
+	block = db->blocks[key];
+	if (block == NULL) {
+		block = r_db_block_new ();
+		if (!block) return false;
+		db->blocks[key] = block;
+	}
+	for (i=0;i<size;i++) {
+		idx = (((ut8 *)b)[key+i]) & 0xff;
+		if (block->childs[idx] == NULL)
+			block->childs[idx] = r_db_block_new();
+		block = block->childs[idx];
+	}
+	if (block) {
+		if (block->data == NULL) {
+			// TODO: use slices.. much faster alloc+free
+			block->data = malloc(sizeof(void *)*2);
+			block->data[0] = b;
+			block->data[1] = NULL;
+		} else {
+			for (len=0; block->data[len]; len++);
+			block->data = realloc (block->data, sizeof (void *)*(len+2));
+			block->data[len] = b;
+			block->data[len+1] = NULL;
+		}
+	}
+	return (block != NULL);
+}
+
+R_API int r_db_add(struct r_db_t *db, void *b) {
+	int i, ret = false;
+	for (i=db->id_min;i<=db->id_max;i++)
+		if (db->blocks[i])
+			ret += _r_db_add_internal (db, i, b);
+	return ret;
+}
+
+R_API int r_db_add_unique(struct r_db_t *db, void *b) {
+	int i, ret = true;
+	for(i=db->id_min;i<=db->id_max;i++) {
+		if (db->blocks[i] && r_db_get (db, i, b) != NULL) {
+			ret = false;
+			break;
+		}
+	}
+	if (ret) ret = r_db_add (db, b);
+	return ret;
+}
+
+R_API void **r_db_get(struct r_db_t *db, int key, const ut8 *b) {
+	RDatabaseBlock *block;
+	int i, size;
+	if (key == -1) {
+		key = db->id_min;
+#if 0
+UNNECESSARY LOOPZ
+		for (i=0;i<R_DB_KEYS;i++) {
+			if (db->blocks[i]) {
+				key = i;
+				break;
+			}
+		}
+		if (key == -1)
+			return NULL;
+#endif
+	}
+	size = db->blocks_sz[key];
+	block = db->blocks[key];
+	for (i=0; block && i<size; i++)
+		block = block->childs[b[key+i]];
+	if (block)
+		return block->data;
+	return NULL;
+}
+
+/* TODO: MOVE AS DEFINE IN r_db.h */
+R_API void **r_db_get_next(void **ptr) {
+	return ptr+1;
+}
+
+/* TODO: MOVE AS DEFINE IN r_db.h */
+R_API void *r_db_get_cur(void **ptr) {
+	return ptr[0];
+}
+
+static int _r_db_delete_internal(struct r_db_t *db, int key, const ut8 *b) {
+	RDatabaseBlock *block;
+	int i, j, size = db->blocks_sz[key];
+	block = db->blocks[key];
+
+	for (i=0;block&&i<size;i++)
+		block = block->childs[b[key+i]];
+
+	if (block && block->data) {
+		for (i=0;block->data[i]; i++) {
+			if (block->data[i] == b)
+				for (j=i;block->data[j]; j++)
+					block->data[j] = block->data[j+1];
+		}
+		if (block->data[0] == NULL) {
+			free (block->data);
+			block->data = NULL;
+		}
+		return true;
+	}
+	return false;
+}
+
+R_API int r_db_delete(struct r_db_t *db, const void *ptr) {
+	int i;
+	for (i=db->id_min; i<=db->id_max; i++)
+		if (db->blocks[i])
+			if (!_r_db_delete_internal (db, i, ptr))
+				eprintf ("failed to delete internal pointer\n");
+	/* TODO */
+	if (db->cb_free && ptr)
+		return db->cb_free (db, ptr, db->cb_user);
+	return (ptr != NULL);
+}
+
+static int r_db_iter_find_next(RDatabaseIter *it) {
+	// TODO
+	return false;
+}
+
+R_API RDatabaseIter *r_db_iter_new(RDatabase *db, int key) {
+	RDatabaseIter *iter = R_NEW0 (RDatabaseIter);
+	if (!iter) return NULL;
+	/* TODO: detect when keys are not valid and return NULL */
+	iter->db = db;
+	iter->key = key;
+	iter->size = db->blocks_sz[key];
+	memset (&iter->path, 0, sizeof (iter->path));
+	/* TODO: detect when no keys are found and return NULL */
+	iter->ptr = 0;
+	iter->cur = NULL;
+	r_db_iter_find_next (iter);
+	/* TODO: first iteration must be done here */
+	return iter;
+}
+
+R_API void *r_db_iter_cur(struct r_db_iter_t *iter) {
+	return iter->cur;
+#if 0
+	void *cur = NULL;
+	int i, depth = 0;
+	struct r_db_t *db = iter->db;
+	struct r_db_block_t *b = db->blocks[iter->key];
+	if (iter->ptr == 0) {
+		/* first iteration */
+	} else {
+		for(i=0;i<iter->size;i++) {
+			b = &b[iter->path[i]];
+			if (b == NULL) {
+				fprintf(stderr, "r_db: Internal data corruption\n");
+				return NULL;
+			}
+		}
+		/* TODO: check if null to find next node */
+		return b->data[iter->ptr];
+	}
+
+	for(i=0;i<255;i++) {
+		if (b->childs[i]) {
+			/* walk childs until reaching the leafs */
+			b = b->childs[i];
+			i=0;
+			depth++;
+			if (depth == iter->size) {
+				break;
+			}
+			continue;
+		}
+	}
+	//iter->db
+	return cur;
+#endif
+}
+
+// NOTE: required for vala/swig
+R_API void *r_db_iterator(RDatabase *db) {
+	return r_db_iter_new (db, db->id_min);
+}
+
+/* returns 1 if there is a next element */
+R_API int r_db_iter_next(RDatabaseIter *iter) {
+	//RDatabaseBlock *b, *block;
+	int i;//, j;
+// TODO: must be implemented for Vala/Swig
+	// if (something) return 1;
+	// depth = iter->size
+	//
+	for (i=iter->ptr; i<iter->size; i++) {
+		//block = block->childs[b[key+i]];
+	}
+	iter->ptr = i; // update pointer
+	iter->cur = NULL;
+	return 0;
+}
+
+/* return current iter data and go to next iterable element */
+R_API void *r_db_iter_get(RDatabaseIter *iter) {
+	void *data = iter->cur;
+
+// TODO: must be implemented for Vala/Swig
+	return data;
+}
+
+R_API void *r_db_iter_prev(struct r_db_iter_t *iter) {
+	/* TODO */
+	return NULL;
+}
+
+R_API struct r_db_iter_t *r_db_iter_free(struct r_db_iter_t *iter) {
+	free (iter);
+	return NULL;
+}
+
+R_API int r_db_free(struct r_db_t *db) {
+	/* TODO : using the iterator logic */
+	// TODO: use r_pool_mem here!
+#if 0
+	r_db_iter_t *iter = r_db_iter(db, -1);
+	if (db->cb_free) {
+		r_db_delete(db); // XXX
+	}
+#endif
+	return 0;
+}

Attic/r_db/r.mk

@@ -0,0 +1,5 @@
+ifeq ($(WITHNONPIC),1)
+LDFLAGS+=$(LIBR)/db/sdb/src/libsdb.a
+else
+LDFLAGS+=-L$(LIBR)/db -lr_db
+endif

Attic/r_db/t/Makefile

@@ -0,0 +1,6 @@
+BINDEPS=r_db r_util
+BIN=test
+OBJ=test.o
+
+include ../../rules.mk
+include ../r.mk

Attic/r_db/t/test.c

@@ -0,0 +1,109 @@
+/* radare - LGPL - Copyright 2009-2010 pancake<nopcode.org> */
+
+
+#include "r_db.h"
+void test_pair ();
+void test_db();
+
+struct item_t {
+	char city[10];
+	int people;
+	int id;
+};
+
+#define K_ID R_DB_INDEXOF(struct item_t, id)
+#define K_CITY R_DB_INDEXOF(struct item_t, city)
+
+int main(int argc, char **argv) {
+	test_pair ();
+	test_db ();
+	return 0;
+}
+
+void test_pair () {
+	char *s;
+	RPair *p = r_pair_new ();
+	r_pair_set_sync_dir (p, "sdb-db-test");
+
+	r_pair_set (p, "root", "clown");
+	r_pair_set (p, ".branch", "clown");
+	r_pair_set (p, "user.name", "pancake");
+	r_pair_set (p, "user.pass", "password");
+
+	s = r_pair_get (p, "user.name");
+	printf ("user.name=%s\n", s);
+
+	{
+	RPairItem *o;
+	RListIter *iter;
+	RList *list = r_pair_list (p, "user");
+	printf ("DUMP:\n");
+	r_list_foreach (list, iter, o) {
+		printf ("   %s = %s\n", o->k, o->v);
+	}
+	r_list_purge (list);
+	}
+	r_pair_sync (p);
+}
+
+void test_db() {
+	RDatabase *db = r_db_new ();
+	void **siter;
+	struct item_t *it, tmp;
+
+	r_db_add_id (db, K_CITY, 10);
+	r_db_add_id (db, (int)(K_ID), sizeof (int));
+
+	it = (struct item_t *)malloc(sizeof(struct item_t));
+	strcpy(it->city, "bcn");
+	it->people = 1024;
+	it->id = 33;
+	r_db_add (db, it);
+	r_db_add (db, it);
+	//printf("(ORIG) %p\n", it);
+
+	tmp.id = 33;
+	siter = r_db_get (db, K_ID, (void *)&tmp);
+	for(; siter && *siter; siter=r_db_get_next (siter)) {
+		struct item_t *foo = (struct item_t *)r_db_get_cur (siter);
+//	printf("(GET) %p\n", foo);
+		printf ("city: %s, people: %d, id: %d\n",
+			foo->city, foo->people, foo->id);
+	}
+
+	/* delete */
+	r_db_delete(db, it);
+	printf("--> delete 1 item\n");
+
+	/* list */
+	tmp.id = 33;
+	siter = r_db_get(db, K_ID, (void *)&tmp);
+	for(; siter && siter[0]; siter=r_db_get_next(siter)) {
+		struct item_t *foo = (struct item_t *)r_db_get_cur(siter);
+	//	printf("(GET) %p\n", foo);
+		printf("city: %s, people: %d, id: %d\n",
+			foo->city, foo->people, foo->id);
+	}
+
+#if 0
+  |---| key
+|--.--.--.--.--|
+|--.--.--.--.--|
+#endif
+	printf("--> iterate over full list\n");
+	{
+		struct r_db_iter_t *iter;
+
+		iter = r_db_iter_new(db, K_ID); // iter = db.iterator(K_ID);
+		//while (r_db_iter_cur(iter)) {   // while(iter.exists()) {
+		while (iter->cur) {   // while(iter.exists()) {
+			struct item_t *foo = (struct item_t *)iter->cur; //r_db_iter_cur(siter);
+			printf("city: %s, people: %d, id: %d\n",
+				foo->city, foo->people, foo->id);
+			r_db_iter_next(iter);
+		}
+	}
+
+	printf("--> free db\n");
+	r_db_free(db);
+}

Attic/r_db/table.c

@@ -0,0 +1,70 @@
+/* radare - LGPL - Copyright 2009-2016 - pancake */
+
+#include "r_db.h"
+#include "r_util.h"
+
+struct r_db_table_t *r_db_table_new(const char *name, const char *fmt, const char *fields) {
+	int i;
+	int offset = 0;
+	struct r_db_table_t *table = R_NEW0 (RDatabaseTable);
+	if (!table) return NULL;
+	table->args = strdup (fields);
+	if (!table->args) goto beach;
+
+	table->nelems = r_str_word_set0 (table->args);
+	if (table->nelems != strlen (fmt)) {
+		eprintf ("r_db_table_new: Invalid arguments\n");
+		goto beach;
+	} else {
+		table->fmt = strdup (fmt);
+		if (!table->fmt) goto beach;
+		table->name = strdup (name);
+		if (!table->name) goto beach;
+		table->offset = (int*)calloc (1, sizeof (int)*table->nelems);
+		if (!table->offset) goto beach;
+		for (i=0; i<table->nelems; i++) {
+			table->offset[i] = offset;
+			offset += 4;
+		}
+	}
+	return table;
+
+beach:
+	r_db_table_free (table);
+	return NULL;
+}
+
+/* Get offset of given named field inside the table */
+int r_db_table_key(struct r_db_table_t *table, const char *name) {
+	const char *word;
+	int i;
+	for (i = 0; i < table->nelems; i++) {
+		word = r_str_word_get0 (table->args, i);
+		if (!strcmp (name, word))
+			break;
+	}
+	return table->offset[i];
+}
+
+/* Get offset of the N field in the table */
+int r_db_table_key_i(struct r_db_table_t *table, int elem) {
+	return (elem>=0 && table->nelems<elem)
+		? table->offset[elem]
+		: -1;
+}
+
+/* Get name of the N field in the table */
+const char *r_db_table_field_i(struct r_db_table_t *table, int elem) {
+	return (elem >= 0 && table->nelems < elem)
+		? r_str_word_get0 (table->args, elem)
+		: NULL;
+}
+
+void *r_db_table_free(struct r_db_table_t *table) {
+	free (table->name);
+	free (table->fmt);
+	free (table->args);
+	free (table->offset);
+	free (table);
+	return NULL;
+}

Makefile.acr

@@ -1,14 +1,12 @@
-VERSION=@VERSION@
-HAVE_LIB_YARA=@HAVE_LIB_YARA@
-PREFIX=@PREFIX@
+include options.mk
+
 DESTDIR?=
 TAR=tar -cvf
 CZ=xz -f
 
 DIRS=
 ifeq ($(HAVE_LIB_YARA),1)
-DIRS+=yara/yara2
-DIRS+=yara/yara3
+DIRS+=yara/yara
 DIRS+=libr/asm/p
 DIRS+=libr/anal/p
 endif
@@ -18,13 +16,16 @@ help:
 	@echo "  all                - build everything"
 	@echo "  baleful            - build baleful r2 plugin"
 	@echo "  asm                - build armthumb, ppc, psosvm, x86bea, m68k plugins"
+	@echo "  io                 - build io plugins"
 	@echo "  anal               - build analysis plugins (RAnal)"
+	@echo "  bin                - build binary plugins (RBin)"
 	@echo "  debug              - build debugger plugins (RDebug)"
-	@echo "  dlang              - support DLang demangler (RBin)"
-	@echo "  yara{2,3}          - build yara2 or yara3 r2 plugin"
+	@echo "  yara               - build yara3 r2 plugin"
 	@echo "  (target)-install   - install given plugin"
 	@echo "  (target)-clean     - clean given plugin"
-	@echo "  install-yara{2,3}  - install Yara 2 or 3 from Git"
+
+
+#	@echo "  install-yara{2,3}  - install Yara 2 or 3 from Git"
 
 baleful:
 	$(MAKE) -C baleful
@@ -32,33 +33,35 @@ debug unicorn:
 	$(MAKE) -C libr/debug/p
 anal:
 	$(MAKE) -C libr/anal/p
+anal-install:
+	$(MAKE) -C libr/anal/p install DESTDIR=$(DESTDIR)
 asm:
 	$(MAKE) -C libr/asm/p
 asm-install:
 	$(MAKE) -C libr/asm/p install DESTDIR=$(DESTDIR)
 asm-clean:
 	$(MAKE) -C libr/asm/p clean
-dlang:
+bin:
 	$(MAKE) -C libr/bin/p
-dlang-install:
+bin-install:
 	$(MAKE) -C libr/bin/p install DESTDIR=$(DESTDIR)
-yara2 yara3:
+io:
+	$(MAKE) -C libr/io/p
+io-install:
+	$(MAKE) -C libr/io/p install DESTDIR=$(DESTDIR)
+yara:
 	cd yara/$@ ; ./configure --prefix=$(PREFIX)
 	$(MAKE) -C yara/$@
-yara2-clean:
-	$(MAKE) -C yara/yara2 clean
-yara3-clean:
-	$(MAKE) -C yara/yara3 clean
+yara-clean:
+	$(MAKE) -C yara/yara clean
 baleful-install:
 	$(MAKE) -C baleful install DESTDIR=$(DESTDIR)
 debug-install unicorn-install:
 	$(MAKE) -C libr/debug/p install DESTDIR=$(DESTDIR)
 debug-uninstall unicorn-uninstall:
 	$(MAKE) -C libr/debug/p uninstall DESTDIR=$(DESTDIR)
-yara2-install:
-	$(MAKE) -C yara/yara2 install DESTDIR=$(DESTDIR)
 yara3-install:
-	$(MAKE) -C yara/yara3 install DESTDIR=$(DESTDIR)
+	$(MAKE) -C yara/yara install DESTDIR=$(DESTDIR)
 
 all:
 	for a in $(DIRS) ; do \

README.md

@@ -1,4 +1,4 @@
-radare2-extras
+radare2-extras [![Build Status](https://travis-ci.org/radareorg/radare2-extras.svg?branch=master)](https://travis-ci.org/radareorg/radare2-extras)
 ==============
 This repository contains extra plugins for radare2.
 
@@ -29,89 +29,8 @@ keep it usable for 99% of users.
 
 Building
 ========
-To build radare2-extras, just follow the common gnu-configure steps:
 
-	./configure --prefix=/usr
-	make baleful
-	make baleful-install
+The recommended way to build and install those plugins for users
+is to use r2pm. See the radare2-pm repository for details:
 
-To install yara3 and the r2 plugin:
-
-	./configure --prefix=/usr
-	make install-yara3
-	make yara3
-	make yara3-install
-
-Note the `symstall` instead of `install` will symlink the plugins
-instead of copying them. This way you can just avoid installing
-every time you build. This installation method is prefered for
-developers.
-
-Each module may have it's own configure script, this way
-packagers can create plugin-specific packages like this:
-
-	radare2-extras-yara -> yara plugin
-
-Directories
-===========
-
-* yara/yara2 yara/yara3
-
-	yara2/3 command. Depends on libyara
-
-* libr/asm/p
-
-	Contains assembler/disassembler plugins:
-
-	* m68k
-	* armthumb
-	* psosvm
-	* ppc
-
-* libr/bin/p
-
-	Bin-related plugins:
-
-	* dlang demangler
-
-* libr/anal/p
-
-	Contains code analysis plugins
-
-* libr/vm
-
-	Contains the initial implementation of ESIL. It is kept
-	for historical reasons, but will be removed soon or late.
-
-* libr/cmd
-
-	very work-in-progress core cmd plugins
-	for historical reasons, but will be removed soon or late.
-
-RFC
-===
-	
-In addition we should add sys/*.sh files to fetch and build the
-plugins and dependencies if needed (yara.sh) to allow git users
-to get the proper version installed without depending on the
-pkgsystem.
-
-We could still provide one-liners to help them. We should keep
-different versioning numbers for each plugin..
-
-	radare2-extras-yara3-0.9.9-0.1
-	[pkgname] [modname] [r2version] [modversion]
-
-* Do we need a radare2-extra-regressions then?
-
-I would just add the tests inside the radare2-extras/libr/core/p/yara/t/
-for example.. and just make those tests run from inside that
-repo, no need to add more repos because those plugins would be
-pretty contained.
-
-* What about checking all the tests right away?
-
-Also maybe the plugins depend on some r2 behavior, that has
-been broken, and we need to test for that jenkins should run
-those tests don't know much about jenkins, so i won't say much.
-just hoping it covers all our bases.
+	https://github.com/radareorg/radare2-pm

agc/Makefile

@@ -0,0 +1,31 @@
+include ../options.mk
+
+CFLAGS+=$(R2_CFLAGS) -Wall -shared -fPIC $(LDFLAGS_LIB) -DLIL_ENDIAN=1
+LDLAGS+=$(R2_LDFLAGS)
+
+LDFLAGS+=$(LINK) -lr_util
+DESTDIR?=
+
+CURDIR=
+
+TARGET_ASM=asm_agc.$(LIBEXT)
+TARGET_ANAL=anal_agc.$(LIBEXT)
+
+OBJ_ASM=asm.o asm_main.o
+
+OBJ_ANAL=asm.o anal.o anal_main.o
+
+ALL_TARGETS= $(TARGET_ASM) $(TARGET_ANAL)
+
+all: $(ALL_TARGETS)
+
+$(TARGET_ASM): $(OBJ_ASM)
+	$(CC) $(call libname,asm_agc) $(LDFLAGS) \
+		$(CFLAGS) -o $(TARGET_ASM) $(OBJ_ASM)
+
+$(TARGET_ANAL): $(OBJ_ANAL)
+	$(CC) $(call libname,anal_agc) $(LDFLAGS) \
+		$(CFLAGS) -o $(TARGET_ANAL) $(OBJ_ANAL)
+
+clean:
+	rm -f *.{o,so}

agc/anal.c

@@ -0,0 +1,255 @@
+/* radare2 - BSD - Copyright 2016 - ibabushkin */
+
+#include <stdio.h>
+#include <r_anal.h>
+#include "anal.h"
+#include "asm.h"
+
+static ut64 get_type(agc_insn_type type) {
+	switch (type) {
+	// arithmetic instructions
+	case AGC_INSN_DDOUBL: // double `A`, `L` register pair
+	case AGC_INSN_DOUBLE: // double `A` register
+	case AGC_INSN_INDEX: // add value to next instruction
+	case AGC_INSN_DAS: // add `A`, `L` register pair to memory
+	case AGC_INSN_INCR: // increment
+	case AGC_INSN_ADS: // add `A` register to memory
+	case AGC_INSN_AD: // add memory to the `A` register
+	case AGC_INSN_AUG: // "augment" a value
+	case AGC_INSN_DIM: // "diminish" a value
+		return R_ANAL_OP_TYPE_ADD;
+	case AGC_INSN_MSU: // special kind of difference
+	case AGC_INSN_SU: // subtract memory from `A` register
+		return R_ANAL_OP_TYPE_SUB;
+	case AGC_INSN_SQUARE: // square the `A` register
+	case AGC_INSN_MP: // multiply with `A` register
+		return R_ANAL_OP_TYPE_MUL;
+	case AGC_INSN_DV: // divide `A`, `L` by memory location, write back
+					  // results (quotient and remainder)
+		return R_ANAL_OP_TYPE_DIV;
+	// bitwise logic
+	case AGC_INSN_COM: // complement `A` register
+	case AGC_INSN_CS: // move complement into `A` register
+	case AGC_INSN_DCOM: // complement `A`, `L` register pair
+	case AGC_INSN_DCS: // move complement into `A`, `L` register pair
+		return R_ANAL_OP_TYPE_CPL;
+	case AGC_INSN_MASK: // logically and a value in memory
+		return R_ANAL_OP_TYPE_AND;
+	// control flow and interrupts
+	case AGC_INSN_TCF: // jump to fixed memory
+		return R_ANAL_OP_TYPE_JMP;
+	case AGC_INSN_OVSK: // skip next instruction on overflow
+	case AGC_INSN_CCS: // conditional jump to erasable memory
+	case AGC_INSN_BZF: // branch to fixed memory if `A` = 0
+	case AGC_INSN_BZMF: // branch to fixed memory if `A` <= 0
+		return R_ANAL_OP_TYPE_CJMP;
+	case AGC_INSN_TCAA: // jump to address in `A`
+	case AGC_INSN_XLQ: // jump to `A`
+	case AGC_INSN_XXALQ: // jump to `A` with extracode
+		return R_ANAL_OP_TYPE_UCJMP;
+	case AGC_INSN_TC: // call subroutine
+		return R_ANAL_OP_TYPE_CALL;
+	case AGC_INSN_RETURN: // return from subroutine
+		return R_ANAL_OP_TYPE_RET;
+	case AGC_INSN_INHINT: // diable interrupts
+	case AGC_INSN_RELINT: // enable interrupts
+	case AGC_INSN_RESUME: // resume after an ISR
+	case AGC_INSN_EXTEND: // extend next instruction
+						  // (not directly interrupt-related)
+		return R_ANAL_OP_TYPE_SWI;
+	// moving memory
+	case AGC_INSN_TS: // transfer to storage and manipulate `A`
+		return R_ANAL_OP_TYPE_CMOV; // TODO: maybe make it STORE?
+	case AGC_INSN_CA: // move memory into the `A` register
+	case AGC_INSN_DCA: // move memory into `A`, `L` register pair
+		return R_ANAL_OP_TYPE_LOAD;
+	case AGC_INSN_DTCB: // memory adressing change using a register swap
+	case AGC_INSN_DTCF: // similar to the above
+	case AGC_INSN_ZL: // clear `L` register
+	case AGC_INSN_ZQ: // clear `Q` register
+	case AGC_INSN_LXCH: // exchange with `L` register
+	case AGC_INSN_DXCH: // exchange with `A`, `L` register pair
+	case AGC_INSN_XCH: // exchange with `A` register
+	case AGC_INSN_QXCH: // exchange with `Q` register
+		return R_ANAL_OP_TYPE_XCHG;
+	// special instructions and I/O
+	case AGC_INSN_NOOP: // do nothing
+		return R_ANAL_OP_TYPE_NOP;
+	case AGC_INSN_READ: // read IO channel into `A`
+	case AGC_INSN_WRITE: // write contents of `A` into IO channel
+	case AGC_INSN_RAND: // read IO channel into `A`, with and
+	case AGC_INSN_WAND: // write contents of `A` into IO channel, with and
+	case AGC_INSN_ROR: // read IO channel into `A`, with or
+	case AGC_INSN_WOR: // write contents of `A` into IO channel, with or
+	case AGC_INSN_RXOR: // read IO channel into `A`, with xor
+		return R_ANAL_OP_TYPE_IO;
+	case AGC_INSN_EDRUPT: // we don't know what it does
+	default:
+		return R_ANAL_OP_TYPE_UNK;
+	}
+}
+
+static int set_reg_profile(RAnal *anal) {
+	const char *p = \
+		"=PC	Z\n"
+		"=SP	Q\n"
+		"gpr	A	.16	0	0\n" // TODO: model overflow bit
+		"gpr	L	.16	2	0\n" // TODO: model overflow bit
+		"gpr	Q	.16	4	0\n" // TODO: model overflow bit
+		"seg	EB	.15	6	0\n" // TODO: model mirroring
+		"seg	FB	.15	8	0\n" // TODO: model mirroring
+		"gpr	Z	.12	10	0\n" // ...
+		"seg	BB	.15	12	0\n" // TODO: model mirroring
+		// TODO: model 7th 0-register?
+		"gpr	ARUPT	.15	14	0\n"
+		"gpr	LRUPT	.15	16	0\n"
+		"gpr	QRUPT	.15	18	0\n"
+		"gpr	ZRUPT	.15	20	0\n"
+		"gpr	BBRUPT	.15	22	0\n"
+		"gpr	BRUPT	.15	24	0\n"
+		// TODO: model editing registers
+		// TODO: model timer and counter registers?
+	;
+	return r_reg_set_profile_string (anal->reg, p);
+}
+
+static bool get_esil(RAnalOp *op, const agc_insn_t *insn) {
+	// TODO: account for weird addressing scheme!
+	r_strbuf_init (&op->esil);
+	r_strbuf_set  (&op->esil, "");
+
+	// TODO: implement flag behaviours!
+	switch (insn->type) {
+	case AGC_INSN_COM:
+		r_strbuf_set (&op->esil, "A,!=");
+		break;
+	case AGC_INSN_DDOUBL:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_DOUBLE:
+		r_strbuf_set (&op->esil, "2,A,*=");
+		break;
+	case AGC_INSN_DTCB:
+	case AGC_INSN_DTCF:
+	case AGC_INSN_EXTEND:
+	case AGC_INSN_INHINT:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_NOOP:
+		r_strbuf_set (&op->esil, ",");
+		break;
+	case AGC_INSN_OVSK:
+		r_strbuf_set (&op->esil, "a_overflow,?{,2,Z,+=,}"); // FIXME
+		break;
+	case AGC_INSN_RELINT:
+	case AGC_INSN_RESUME: // TODO: handle extracode
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_RETURN:
+		r_strbuf_set (&op->esil, "Q,Z,=,00003,Q,=");
+		break;
+	case AGC_INSN_TCAA:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_XLQ:
+		r_strbuf_set (&op->esil, "2,$$,+,Q,=,1,Z,=");
+		break;
+	case AGC_INSN_XXALQ:
+		r_strbuf_set (&op->esil, "2,$$,+,Q,=,0,Z,=");
+		break;
+	case AGC_INSN_ZL:
+		r_strbuf_set (&op->esil, "0,L,=");
+		break;
+	case AGC_INSN_TC:
+		r_strbuf_setf (&op->esil, "2,$$,+,Q,=,%04o,Z,=", insn->operand);
+		break;
+	case AGC_INSN_CCS:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_TCF:
+		r_strbuf_setf (&op->esil, "%04o,Z,=", insn->operand);
+		break;
+	case AGC_INSN_DAS:
+	case AGC_INSN_LXCH:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_INCR:
+		r_strbuf_setf (&op->esil,
+				"%04o,[],++,%04o,=[]", insn->operand, insn->operand);
+		break;
+	case AGC_INSN_ADS:
+		r_strbuf_setf (&op->esil,
+				"%04o,[],A,+,A,%04o,[]=", insn->operand, insn->operand);
+		break;
+	case AGC_INSN_CA:
+		r_strbuf_setf (&op->esil, "%04o,[],A,=", insn->operand);
+		break;
+	case AGC_INSN_CS:
+		r_strbuf_setf (&op->esil, "%04o,[],!,A,=", insn->operand);
+		break;
+	case AGC_INSN_INDEX: // TODO: handle extracode
+	case AGC_INSN_DXCH:
+	case AGC_INSN_TS:
+	case AGC_INSN_XCH:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_AD:
+		r_strbuf_setf (&op->esil, "%04o,[],A,+=", insn->operand);
+		break;
+	case AGC_INSN_MASK:
+		r_strbuf_setf (&op->esil, "%04o,[],A,&=", insn->operand);
+		break;
+	case AGC_INSN_DCOM: // TODO: handle extracode flag from here on
+		r_strbuf_set (&op->esil, "A,!=,L,!=");
+		break;
+	case AGC_INSN_SQUARE:
+		r_strbuf_set (&op->esil, "A,A,*=");
+		break;
+	case AGC_INSN_ZQ:
+		r_strbuf_set (&op->esil, "0,A,=");
+	case AGC_INSN_READ:
+	case AGC_INSN_WRITE:
+	case AGC_INSN_RAND:
+	case AGC_INSN_WAND:
+	case AGC_INSN_ROR:
+	case AGC_INSN_WOR:
+	case AGC_INSN_RXOR:
+	case AGC_INSN_EDRUPT:
+	case AGC_INSN_DV:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_BZF:
+		r_strbuf_setf (&op->esil, "0,A,==,?,{,%04o,Z,=,}", insn->operand);
+		break;
+	case AGC_INSN_MSU:
+	case AGC_INSN_QXCH:
+	case AGC_INSN_AUG:
+	case AGC_INSN_DIM:
+	case AGC_INSN_DCA:
+	case AGC_INSN_DCS:
+		// TODO: find a way to implement
+		break;
+	case AGC_INSN_SU:
+		r_strbuf_setf (&op->esil, "%04o,A,-=", insn->operand);
+		break;
+	case AGC_INSN_BZMF:
+		r_strbuf_setf (&op->esil, "0,A,<=,?,{,%04o,Z,=,}", insn->operand);
+		break;
+	case AGC_INSN_MP:
+		r_strbuf_setf (&op->esil, "%04o,A,*=", insn->operand);
+		break;
+
+	default:
+		return false;
+	}
+	return true;
+}
+
+void analyze_agc_insn(RAnalOp *op, ut64 address, ut16 value, bool shift) {
+
+	agc_insn_t insn = {0};
+	disasm_agc_insn (&insn, address, value, shift);
+
+	op->size = 2;
+	op->type = get_type (insn.type);
+}

agc/anal.h

@@ -0,0 +1,11 @@
+#ifndef AGC_ANAL_H
+#define AGC_ANAL_H
+
+#define SWITCH_MASK 070000
+#define LOWER_WIDE 07777
+#define LOWER 01777
+#define HIGHER 06000
+
+void analyze_agc_insn(RAnalOp *op, ut64 address, ut16 value, bool shift);
+
+#endif

agc/anal_main.c

@@ -0,0 +1,33 @@
+/* radare2 - BSD - Copyright 2016 - ibabushkin */
+
+#include <r_types.h>
+#include <r_lib.h>
+#include <r_util.h>
+#include <r_anal.h>
+#include "anal.h"
+
+static int agc_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) {
+	// early exit on illegal inputs
+	if (!data || len != 2) {
+		return -1;
+	}
+	analyze_agc_insn (op, addr, ((const ut16 *)data)[0], false);
+	return op->size;
+}
+
+RAnalPlugin r_anal_plugin_agc = {
+	.name = "agc",
+	.arch = "agc",
+	.bits = 16,
+	.license = "BSD",
+	.desc = "AGC (Apollo Guidance Computer) code analysis plugin",
+	.op = &agc_op,
+};
+
+#ifndef CORELIB
+RLibStruct radare_plugin = {
+	.type = R_LIB_TYPE_ANAL,
+	.data = &r_anal_plugin_agc,
+	.version = R2_VERSION
+};
+#endif

agc/asm.c

@@ -0,0 +1,398 @@
+/*
+  Copyright 2003-2006 Ronald S. Burkey <[email protected]>,
+			2008 Onno Hommes
+			2016 Inokentiy Babushkin
+
+  This file is based on the implmentation found in yaAGC, but modified for new
+  purposes.
+
+  This file is part of yaAGC / radare2-extras.
+  yaAGC is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+  yaAGC is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	See the
+  GNU General Public License for more details.
+  You should have received a copy of the GNU General Public License
+  along with yaAGC; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA	02111-1307	USA
+
+  Filename:  asm_agc.c
+  Purpose:	 Source file for AGC Disassembler integrated in radare2.
+  Contact:	 Inokentiy Babushkin
+  Reference: http://www.ibiblio.org/apollo
+  Mods:		 08/31/08 OH. Began.
+			 07/12/16 IB. Began refactoring to include in radare2-extras.
+			 07/17/16 IB. Annotated disassembler source and added symbolic
+						  constants.
+*/
+
+#include <stdbool.h>
+#include "asm.h"
+
+const char *agc_mnemonics[59] = {
+	// 3-bit opcode, no operand
+	"com", "ddoubl", "double", "dtcb", "dtcf", "extend", "inhint", "noop",
+	"ovsk", "relint", "resume", "return", "tcaa", "xlq", "xxalq", "zl",
+	// 3-bit opcode, w/ operand
+	"tc %04o", "ccs %04o", "tcf %04o", "das %04o", "lxch %04o",
+	"incr %04o", "ads %04o", "ca %04o", "cs %04o", "index %04o",
+	"dxch %04o", "ts %04o", "xch %04o", "ad %04o", "mask %04o",
+	// 4-bit opcode, no operand
+	"dcom", "resume", "square", "zq",
+	// 4-bit opcode, w/ small operand
+	"read %03o", "write %03o", "rand %03o", "wand %03o", "ror %03o",
+	"wor %03o", "rxor %03o", "edrupt %03o",
+	// 4-bit opcode, w/ normal operand
+	"dv %04o", "bzf %04o", "msu %04o", "qxch %04o", "aug %04o",
+	"dim %04o", "dca %04o", "dcs %04o", "index %04o", "su %04o",
+	"bzmf %04o", "mp %04o"
+};
+
+// decode a 3-bit opcode
+static void decode_no_extra_opcode_bit(
+		agc_insn_t *insn, ut16 value, ut16 nop_value) {
+	// first, special cases that have their own mnemonics
+	if (value == 040000) { // i = 100, o = 0
+		// complement the A register (address 0)
+		insn->type = AGC_INSN_COM;
+	} else if (value == 020001) { // i = 010, o = 0, 1
+		// add the A, L register pair to itself (addresses 0 and 1)
+		insn->type = AGC_INSN_DDOUBL;
+	} else if (value == 060000) { // i = 110, o = 0
+		// add the A register to itself (address 0o)
+		insn->type = AGC_INSN_DOUBLE;
+	} else if (value == 052006) {
+		// change adressing, see manual
+		insn->type = AGC_INSN_DTCB;
+	} else if (value == 052005) {
+		// change adressing, see manual
+		insn->type = AGC_INSN_DTCF;
+	} else if (value == 6) {
+		// set extracode flag for next instruction, and the instruction
+		// after that, if it is an index.
+		insn->type = AGC_INSN_EXTEND;
+	} else if (value == 4) {
+		// disable interrupts
+		insn->type = AGC_INSN_INHINT;
+	} else if (value == nop_value && value != 010000) {
+		// do nothing
+		insn->type = AGC_INSN_NOOP;
+	} else if (value == 054000) {
+		// skip the next instruction if A is overflown
+		insn->type = AGC_INSN_OVSK;
+	} else if (value == 3) {
+		// enable interrupts after an inhint
+		insn->type = AGC_INSN_RELINT;
+	} else if (value == 050017) {
+		// resume program from an ISR
+		insn->type = AGC_INSN_RESUME;
+	} else if (value == 2) {
+		// return from subroutine, which is to say, move the Q register
+		// into the Z register.
+		insn->type = AGC_INSN_RETURN;
+	} else if (value == 054005) { // essentially a `TS Z`
+		// jump to the address stored in the A register
+		insn->type = AGC_INSN_TCAA;
+	} else if (value == 1) { // essentially a `TC L`
+		// convoluted control flow primitive from hell, see manual: load an
+		// instruction in the `A` register, and a return instruction into
+		// the `L` register, call `XLQ` and you will execute the contents
+		// of `A` and return.
+		insn->type = AGC_INSN_XLQ;
+	} else if (value == 0) { // essentially `TC A`
+		// similar to the above, but with extracode: load an `EXTEND`
+		// instruction into the `A` register, an extracode instruction into
+		// the `L` register, a return instruction into the `Q` register and
+		// call `XXALQ`. This results in the execution of the given
+		// extracode instruction.
+		insn->type = AGC_INSN_XXALQ;
+	} else if (value == 022007) { // essentially `LXCH 7`
+		// zero the `L` register, by exchanging it's content with the 7th
+		// register, which is hardwired to zero.
+		insn->type = AGC_INSN_ZL;
+	} else {
+		switch (value & SWITCH_MASK) {
+		// from now on, we have instructions with operands, so switch based
+		// on the first three bits.
+		case 000000: // i = 000, o = address of subroutine
+			// call a subroutine (this can't be nested, because it stores
+			// the current contents of the `Z` register in the `Q`
+			// register).
+			insn->type = AGC_INSN_TC;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		case 010000: // i = 001
+			// one of the many space-saving tricks employed
+			if (value & HIGHER) {
+				// jump to a memory location
+				// (12 bit address in fixed memory)
+				insn->type = AGC_INSN_TCF;
+				insn->operand = value & LOWER_WIDE;
+			} else {
+				// weird compare and jump (10 bit address in erasable
+				// memory)
+				insn->type = AGC_INSN_CCS;
+				insn->operand = value & LOWER;
+			}
+			break;
+		case 020000: // i = 010
+			switch (value & HIGHER) { // lower bits...
+			case 00000:
+				// add the `A`, `L` register pair to a memory location
+				insn->type = AGC_INSN_DAS;
+				insn->operand = (value - 1) & LOWER;
+				break;
+			case 02000:
+				// exchange the `L` register and a memory location
+				insn->type = AGC_INSN_LXCH;
+				insn->operand = value & LOWER;
+				break;
+			case 04000:
+				// increment a memory location
+				insn->type = AGC_INSN_INCR;
+				insn->operand = value & LOWER;
+				break;
+			case 06000:
+				// add the `A` register to a memory location
+				insn->type = AGC_INSN_ADS;
+				insn->operand = value & LOWER;
+				break;
+			}
+			break;
+		case 030000: // i = 011
+			// move a memory location's contents into the `A` register
+			insn->type = AGC_INSN_CA;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		case 040000: // i = 100
+			// move a memory location's complement into the `A` register
+			insn->type = AGC_INSN_CS;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		case 050000: // i = 101
+			switch (value & HIGHER) { // lower bits again...
+			case 00000:
+				// adds the contents of a memory location to the next
+				// instruction before it is executed, without altering
+				// memory
+				insn->type = AGC_INSN_INDEX;
+				insn->operand = value & LOWER;
+				break;
+			case 02000:
+				// exchange double precision int with `A`, `L` register
+				// pair
+				insn->type = AGC_INSN_DXCH;
+				insn->operand = (value - 1) & LOWER;
+				break;
+			case 04000:
+				// copy the contents of the `A` register to memory,
+				// with extra magic when overflow occured.
+				insn->type = AGC_INSN_TS;
+				insn->operand = value & LOWER;
+				break;
+			case 06000:
+				// exchange an erasable memory location with the `A`
+				// register
+				insn->type = AGC_INSN_XCH;
+				insn->operand = value & LOWER;
+				break;
+			}
+			break;
+		case 060000: // i = 110
+			// add a memory location to the `A` register
+			insn->type = AGC_INSN_AD;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		case 070000: // i = 111
+			// logical and between the `A` register and a memory location
+			insn->type = AGC_INSN_MASK;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		}
+	}
+}
+
+static void decode_extra_opcode_bit(agc_insn_t *insn, ut16 value) {
+	if (value == 040001) { // basically a `DCS A`
+		// bitwise complement of the register pair `A`, `L`
+		insn->type = AGC_INSN_DCOM;
+	} else if (value == 050017) {
+		// FIXME: wtf is this here? see manual...
+		// resume program from an ISR
+		insn->type = AGC_INSN_RESUME;
+	} else if (value == 070000) { // essentially `MP A`
+		// square the contents of register `A`
+		insn->type = AGC_INSN_SQUARE;
+	} else if (value == 022007) { // essentially `QXCH 7`
+		// zero the `Q` register, by exchanging it's content with the 7th
+		// register, which is hardwired to zero.
+		insn->type = AGC_INSN_ZQ;
+	} else {
+		switch (value & SWITCH_MASK) {
+		case 000000: // i = 000
+			insn->operand = value & 0777;
+			switch (value & 07000) { // lower bits
+			case 00000:
+				// read a 9 bit IO channel into register `A`
+				insn->type = AGC_INSN_READ;
+				break;
+			case 01000:
+				// write register `A` into a 9 bit IO channel
+				insn->type = AGC_INSN_WRITE;
+				break;
+			case 02000:
+				// read and bitwise and
+				insn->type = AGC_INSN_RAND;
+				break;
+			case 03000:
+				// read and bitwise and with writeback
+				insn->type = AGC_INSN_WAND;
+				break;
+			case 04000:
+				// read and bitwise or
+				insn->type = AGC_INSN_ROR;
+				break;
+			case 05000:
+				// read and bitwise or with writeback
+				insn->type = AGC_INSN_WOR;
+				break;
+			case 06000:
+				// read and xor
+				insn->type = AGC_INSN_RXOR;
+				break;
+			case 07000:
+				// noone knows o__O
+				insn->type = AGC_INSN_EDRUPT;
+				break;
+			}
+			break;
+		case 010000: // i = 001
+			if (value & HIGHER) {
+				// branch to a fixed memory location if `A` equals 0
+				insn->type = AGC_INSN_BZF;
+				insn->operand = value & LOWER_WIDE;
+			} else{ 
+				// divide register pair `A`, `L` by a memory location,
+				// putting the quotient/remainder in `A`, `L`, respectively
+				insn->type = AGC_INSN_DV;
+				insn->operand = value & LOWER;
+			}
+			break;
+		case 020000: // i = 010
+			insn->operand = value & LOWER;
+			switch (value & HIGHER) {
+			case 00000:
+				// 1's complement difference between two 2's complement
+				// values of which the first is the register `A`
+				insn->type = AGC_INSN_MSU;
+				break;
+			case 02000:
+				// exchange `Q` register with memory location
+				insn->type = AGC_INSN_QXCH;
+				break;
+			case 04000:
+				// increment positive and decrement negative values at
+				// a memory location, using 1's complement
+				insn->type = AGC_INSN_AUG;
+				break;
+			case 06000:
+				// other way 'round
+				insn->type = AGC_INSN_DIM;
+				break;
+			}
+			break;
+		case 030000: // i = 011
+			// move a pair of registers into `A` and `L`
+			insn->type = AGC_INSN_DCA;
+			insn->operand = (value - 1) & LOWER_WIDE;
+			break;
+		case 040000: // i = 100
+			// move the complement of a pair of registers into `A` and `L`
+			insn->type = AGC_INSN_DCS;
+			insn->operand = (value - 1) & LOWER_WIDE;
+			break;
+		case 050000: // i = 101
+			// see above
+			insn->type = AGC_INSN_INDEX;
+			insn->operand = (value - 1) & LOWER_WIDE;
+			// reset bit
+			break;
+		case 060000: // i = 110
+			if (value & HIGHER) {
+				// branch to a fixed memory location if `A` is equal or
+				// less than 0
+				insn->type = AGC_INSN_BZMF;
+				insn->operand = value & LOWER_WIDE;
+			} else {
+				// subtract a memory location from the `A` register
+				insn->type = AGC_INSN_SU;
+				insn->operand = value & LOWER;
+			}
+			break;
+		case 070000: // i = 111
+			// multiply two single precision values to form a double
+			// precision value, of which one is the accumulator.
+			insn->type = AGC_INSN_MP;
+			insn->operand = value & LOWER_WIDE;
+			break;
+		}
+	}
+}
+
+void disasm_agc_insn(agc_insn_t *insn, unsigned int address, ut16 value, bool shift) {
+	// See http://www.ibiblio.org/apollo/assembly_language_manual.html
+	// for instruction set documentation and other valuable info.
+
+	// extracode flag saved between invocations
+	static bool extra_opcode_bit = false;
+
+	// distinguish between RW and RO memory
+	bool erasable = false;
+	if (address < 02000) {
+		erasable = true;
+	}
+
+	// shift data one bit to the right if we work with memory as it was stored
+	// on the original AGC hardware.
+	if (shift) {
+		value <<= 1;
+	}
+
+	if (extra_opcode_bit) {
+		// the previous instruction was an `EXTEND`. This means we will
+		// interpret not three, but four leading bits of our intruction as an
+		// opcode. This was added to the second-generation AGC, after it became
+		// clear that three bits for an opcode are not enough.
+		extra_opcode_bit = false;
+		decode_extra_opcode_bit (insn, value);
+		if (insn->type == AGC_INSN_EXTEND) {
+			extra_opcode_bit = true;
+		}
+	} else {
+		// simple instructions below - encoded as follows: x iii ooo ooo ooo
+		// where x is the odd-parity bit, which is used only by the hardware
+		// itself to determine error conditions. However, yaYUL doesn't emulate
+		// it, so things are shifted one bit to the left. This behaviour is
+		// configurable, just in case.
+
+		// NOOP's are special:
+		// they are encoded as 10000 + current adress in fixed memory...
+		// (which is a jump to the next instruction)
+		// ...and as a constant value in erasable memory, because the jump
+		// method isn't applicable. Note that this way of encoding it means
+		// loading the accumulator (A) with itself.
+		ut16 nop_value = 010000;
+		if (erasable) {
+			nop_value = 030000;
+		} else if (value == address + 1) {
+			nop_value = value;
+		}
+		decode_no_extra_opcode_bit (insn, value, nop_value);
+		if (insn->type == AGC_INSN_EXTEND) {
+			extra_opcode_bit = true;
+		}
+	}
+}

agc/asm.h

@@ -0,0 +1,87 @@
+#ifndef AGC_ASM_H
+#define AGC_ASM_H
+
+#include <r_types.h>
+
+#define SWITCH_MASK 070000
+#define LOWER_WIDE 07777
+#define LOWER 01777
+#define HIGHER 06000
+
+typedef enum agc_insn_type {
+	AGC_INSN_COM,
+	AGC_INSN_DDOUBL,
+	AGC_INSN_DOUBLE,
+	AGC_INSN_DTCB,
+	AGC_INSN_DTCF,
+	AGC_INSN_EXTEND,
+	AGC_INSN_INHINT,
+	AGC_INSN_NOOP,
+	AGC_INSN_OVSK,
+	AGC_INSN_RELINT,
+	AGC_INSN_RESUME,
+	AGC_INSN_RETURN,
+	AGC_INSN_TCAA,
+	AGC_INSN_XLQ,
+	AGC_INSN_XXALQ,
+	AGC_INSN_ZL,
+	AGC_INSN_TC,
+	AGC_INSN_CCS,
+	AGC_INSN_TCF,
+	AGC_INSN_DAS,
+	AGC_INSN_LXCH,
+	AGC_INSN_INCR,
+	AGC_INSN_ADS,
+	AGC_INSN_CA,
+	AGC_INSN_CS,
+	AGC_INSN_INDEX,
+	AGC_INSN_DXCH,
+	AGC_INSN_TS,
+	AGC_INSN_XCH,
+	AGC_INSN_AD,
+	AGC_INSN_MASK,
+	AGC_INSN_DCOM,
+	// a dirty hack so we can use the enum as indices of our lookup table.
+	// this is due to the fact that the resume instruction is for some reason
+	// present in both the 3-bit-opcode and 4-bit-opcode subsets of the
+	// instruction set.
+	AGC_INSN_RESUME2,
+	AGC_INSN_SQUARE,
+	AGC_INSN_ZQ,
+	AGC_INSN_READ,
+	AGC_INSN_WRITE,
+	AGC_INSN_RAND,
+	AGC_INSN_WAND,
+	AGC_INSN_ROR,
+	AGC_INSN_WOR,
+	AGC_INSN_RXOR,
+	AGC_INSN_EDRUPT,
+	AGC_INSN_DV,
+	AGC_INSN_BZF,
+	AGC_INSN_MSU,
+	AGC_INSN_QXCH,
+	AGC_INSN_AUG,
+	AGC_INSN_DIM,
+	AGC_INSN_DCA,
+	AGC_INSN_DCS,
+	// same hack as above
+	AGC_INSN_INDEX2,
+	AGC_INSN_SU,
+	AGC_INSN_BZMF,
+	AGC_INSN_MP
+} agc_insn_type;
+
+// mnemonic lookup table
+const char *agc_mnemonics[59];
+
+// instruction representation
+typedef struct agc_insn_t {
+	agc_insn_type type;
+	ut16 operand;
+} agc_insn_t;
+
+// actual disassembly logic
+void disasm_agc_insn(
+		agc_insn_t *op, unsigned int address, ut16 value, bool shift);
+
+#endif

agc/asm_main.c

@@ -0,0 +1,44 @@
+/* radare2 - GPL3 - Copyright 2016 - ibabushkin */
+
+#include <stdbool.h>
+#include <r_lib.h>
+#include <r_asm.h>
+#include "asm.h"
+
+static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
+    // default values
+    op->buf_asm[0] = 0;
+    op->size = 2;
+
+    agc_insn_t insn = {0};
+    disasm_agc_insn (&insn, a->pc, ((const ut16 *)buf)[0], false);
+
+    // we sometimes pass more arguments than the format string takes, but who
+    // cares?
+    snprintf (op->buf_asm, R_ASM_BUFSIZE, agc_mnemonics[insn.type], insn.operand);
+
+    return op->size;
+}
+
+static int assemble(RAsm *a, RAsmOp *op, const char *buf) {
+	// TODO
+	return 0;
+}
+
+RAsmPlugin r_asm_plugin_agc = {
+	.name = "agc",
+	.arch = "agc",
+	.bits = 16,
+	.license = "GPL3",
+	.desc = "AGC (Apollo Guidance Computer) disassembly plugin",
+	.disassemble = &disassemble,
+	.assemble = &assemble
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_agc,
+	.version = R2_VERSION
+};
+#endif

agc/d/Makefile

@@ -0,0 +1,33 @@
+# TODO: fix makefile to work with radare2-extras
+FILES=agc
+F_SDB=$(addsuffix .sdb,${FILES})
+SDB=../../../shlr/sdb/sdb
+include ../../../config-user.mk
+
+all: ${F_SDB}
+
+%.sdb:%
+	${SDB} $<.sdb = < $<
+	test -f $<.sdb
+
+clean:
+	rm -f *.sdb
+
+.PHONY: all clean install install-symlink symstall uninstall
+
+# XXX rmdblslash not defined, but doesnt warns about it
+OPDIR=${DESTDIR}${LIBDIR}/radare2/${VERSION}/opcodes
+
+install: ${F_SDB}
+	-rm -rf "${OPDIR}"
+	mkdir -p "${OPDIR}"
+	cp -f *.sdb "${OPDIR}"
+
+#that sed is a workaround for mingw's pwd
+CWD=$(shell pwd)
+symstall install-symlink: ${F_SDB}
+	mkdir -p "${OPDIR}"
+	for FILE in *.sdb ; do ln -fs "${CWD}/$$FILE" "${OPDIR}/$$FILE" ; done
+
+uninstall:
+	rm -rf "${DESTDIR}${LIBDIR}/radare2/opcodes"

agc/d/agc

@@ -0,0 +1,54 @@
+com=complement the `A` register (address 0)
+ddoubl=add the A, `L` register pair to itself (addresses 0 and 1)
+double=add the `A` register to itself (address 0o)
+dtcb=change adressing, see manual
+dtcf=change adressing, see manual
+extend=set extracode flag for next instruction, and the instruction after that, if it is an index.
+inhint=disable interrupts
+noop=no operation, but note that this is encoded in a context-sensitive fashion
+ovsk=skip the next instruction if `A` is overflown
+relint=enable interrupts after an inhint
+resume=resume program from an ISR
+return=return from subroutine, which is to say, move the `Q` register into the `Z` register
+tcaa=jump to the address stored in the `A` register
+xlq=execute the content of the `A` register, assuming there is a `return` instruction in `L`
+xxalq=execute the content of the `L` register as an extracode instruction, assuming there is an `extend` instruction in the `A` register and a `return` instruction in `Q`
+zl=zero the `L` register
+tc=call a subroutine, can't be nested
+ccs=weird compare and jump (10 bit address in erasable memory)
+tcf=jump to a memory location (12 bit address in fixed memory)
+das=add the `A`, `L` register pair to a memory location
+lxch=exchange the `L` register and a memory location
+incr=increment a memory location
+ads=add the `A` register to a memory location
+ca=move a memory location's contents into the `A` register
+cs=move a memory location's complement into the `A` register
+index=add a memory location to the next instruction before it is executed, without altering memory
+dxch=exchange double precision int with `A`, `L` register pair
+ts=copy the contents of the `A` register to memory, with extra magic when overflow occured.
+xch=exchange an erasable memory location with the `A` register
+ad=add a memory location to the `A` register
+mask=logical and between the `A` register and a memory location
+dcom=bitwise complement of the register pair `A`, `L`
+resume=resume program from an ISR
+square=square the contents of register `A`
+zq=zero the `Q` register
+read=read a 9 bit IO channel into register `A`
+write=write register `A` into a 9 bit IO channel
+rand=read and bitwise and
+wand=read and bitwise and with writeback
+ror=read and bitwise or
+wor=read and bitwise or with writeback
+rxor=read and xor
+edrupt=noone knows o__O
+dv=divide register pair `A`, `L` by a memory location (double precision), putting the quotient/remainder in `A`, `L`, respectively
+bzf=branch to a fixed memory location if `A` equals 0
+msu=1's complement difference between two 2's complement values, of which the first is the register `A`
+qxch=exchange `Q` register with memory location
+aug=increment positive and decrement negative values at a memory location, using 1's complement
+dim=other way 'round compared to `aug`
+dca=move a pair of registers into `A` and `L`
+dcs=move the complement of a pair of registers into `A` and `L`
+su=subtract a memory location from the `A` register
+bzmf=branch to a fixed memory location if `A` is equal or less than 0
+mp=multiply two single precision values to form a double precision value, of which one is the accumulator.

baleful/Makefile

@@ -3,20 +3,22 @@ include ../options.mk
 R2_CFLAGS+=-fPIC
 R2_LDFLAGS+=-shared
 
-all: asm/asm_baleful.$(EXT_SO) anal/anal_baleful.$(EXT_SO)
+all: asm/asm_baleful.$(LIBEXT) anal/anal_baleful.$(LIBEXT)
 
-asm/asm_baleful.$(EXT_SO):
-	$(CC) $(R2_CFLAGS) $(R2_LDFLAGS) -o asm/asm_baleful.$(EXT_SO) asm/asm_baleful.c
+asm/asm_baleful.$(LIBEXT):
+	$(CC) $(CFLAGS) $(LDFLAGS) $(R2_CFLAGS) $(R2_LDFLAGS) -o asm/asm_baleful.$(LIBEXT) asm/asm_baleful.c
 
-anal/anal_baleful.$(EXT_SO):
-	$(CC) $(R2_CFLAGS) $(R2_LDFLAGS) -o anal/anal_baleful.$(EXT_SO) anal/anal_baleful.c
+anal/anal_baleful.$(LIBEXT):
+	$(CC) $(CFLAGS) $(LDFLAGS) $(R2_CFLAGS) $(R2_LDFLAGS) -o anal/anal_baleful.$(LIBEXT) anal/anal_baleful.c
+
+w32:
+	$(MAKE) CC=i586-mingw32-gcc LDFLAGS=-L/tmp/radare2-w32-0.10.5 LIBEXT=dll
 
 clean:
-	rm -f */*.$(EXT_SO)
+	rm -f */*.$(LIBEXT) */*.dll */*.so */*.dylib
 
 install:
-	cp -f asm/asm_baleful.$(EXT_SO) anal/anal_baleful.$(EXT_SO) \
-		~/.config/radare2/plugins
+	cp -f asm/asm_baleful.$(LIBEXT) anal/anal_baleful.$(LIBEXT) $(R2PM_PLUGDIR)
 
 uninstall:
-	rm -f ~/.config/radare2/plugins/*baleful*
+	rm -f ${R2PM_PLUGDIR}/*baleful*

baleful/anal/anal_baleful.c

@@ -1,4 +1,4 @@
-/* radare2 - LGPL - Copyright 2011-2014 - pancake */
+/* radare2 - LGPL - Copyright 2011-2016 - SkUaTeR */
 
 #include <string.h>
 #include <r_types.h>
@@ -7,9 +7,10 @@
 #include <r_anal.h>
 #include <stdio.h>
 #include <fcntl.h>
+
 static int ptsHandle=0;
 
-int reg_read(RAnalEsil *esil, const char *regname, ut64 *num) {
+static int reg_read(RAnalEsil *esil, const char *regname, ut64 *num) {
 	RRegItem *reg = r_reg_get (esil->anal->reg, regname, -1);
 	if (reg) {
 		if (num)
@@ -18,7 +19,8 @@ int reg_read(RAnalEsil *esil, const char *regname, ut64 *num) {
 	}
 	return 0;
 }
-int reg_write(RAnalEsil *esil, const char *regname, ut64 num) {
+
+static int reg_write(RAnalEsil *esil, const char *regname, ut64 num) {
 	RRegItem *reg = r_reg_get (esil->anal->reg, regname, -1);
 	if (reg) {
 		if (num)
@@ -122,8 +124,8 @@ if (valor==0){
 return 1;
 }
 */
-int getp(const ut8 *buf, const ut8 *p0, const ut8 *p1, const ut8 *p2, const ut8 *p3, int type) {
-	const ut8 * c;
+static int getp(const ut8 *buf, const ut8 *p0, const ut8 *p1, const ut8 *p2, const ut8 *p3, int type) {
+	const ut8 * c = buf + 1;
 	const ut8  *r0;
 	const ut8  *r1;
 	const ut8  *r2;
@@ -132,157 +134,155 @@ int getp(const ut8 *buf, const ut8 *p0, const ut8 *p1, const ut8 *p2, const ut8
 	const ut32 *imm1;
 	int size=0;
 
-	c   = buf+1;
-	switch(type) {
-		case 0: // 8 8 11 5 ESIL
-			r0  = buf + 2;
-			sprintf((char *)p0,"r_%02x",*r0);
-			switch(*c) {
-				case 1:
-					r1  = buf + 3;
-					imm = (ut32 *)(buf + 4);
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"0x%04x",*imm);
-					size=8;
-					break;
-				case 2:
-					imm  = (ut32 *)(buf + 3);
-					r1   = buf + 4;
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"r_%02x",*r1);
-					size=8;
-					break;
-				case 4:
-					imm  = (ut32 *)(buf + 3);
-					imm1 = (ut32 *)(buf + 7);
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"0x%04x",*imm1);
-					size=11;
-					break;
-
-				case 0:
-				default:
-					r1  = buf + 3;
-					r2  = buf + 4;
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"r_%02x",*r2);
-					size=5;
-					break;
-			}
+	switch (type) {
+	case 0: // 8 8 11 5 ESIL
+		r0  = buf + 2;
+		sprintf((char *)p0,"r_%02x",*r0);
+		switch (*c) {
+		case 1:
+			r1  = buf + 3;
+			imm = (ut32 *)(buf + 4);
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"0x%04x",*imm);
+			size=8;
 			break;
-		case 1: // 9 9 12 6
-			r0  = buf + 2;
-			r3  = buf +3; // guarda aki el resto
-			sprintf((char *)p0,"r_%02x",*r0);
-			sprintf((char *)p3,"r_%02x",*r3);
-			switch(*c) {
-				case 1:
-					r1  = buf + 4;
-					imm =(ut32 *)(buf + 5);
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"0x%04x",*imm);
-					size=9;
-					break;
-				case 2:
-					imm  = (ut32 *)(buf + 4);
-					r1   = buf + 8;
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"r_%02x",*r1);
-					size=9;
-					break;
-				case 4:
-					imm  = (ut32 *)(buf + 4);
-					imm1 = (ut32 *)(buf + 8);
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"0x%04x",*imm1);
-					size=12;
-					break;
-				case 0:
-				default:
-					r1  = buf + 4;
-					r2  = buf + 5;
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"r_%02x",*r2);
-					size=6;
-					break;
-			}
-			break;
-		case 2: // 7 7 10 4
-			switch(*c) {
-				case 1:
-					r1  = buf + 2;
-					imm = (ut32 *)(buf + 3);
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"0x%04x",*imm);
-					size=7;
-					break;
-				case 2:
-					imm  = (ut32 *)(buf + 2);
-					r1   = buf + 6;
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"r_%02x",*r1);
-					size=7;
-					break;
-				case 4:
-					imm  = (ut32 *)(buf + 2);
-					imm1 = (ut32 *)(buf + 6);
-					sprintf((char *)p1,"0x%04x",*imm);
-					sprintf((char *)p2,"0x%04x",*imm1);
-					size=10;
-					break;
-				case 0:
-				default:
-					r1  = buf + 2;
-					r2  = buf + 3;
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"r_%02x",*r2);
-					size=4;
-			}
-			break;
-		case 3:// 7 4 ESIL
-			switch(*c) {
-				case 1:
-					r1  = buf + 2;
-					imm = (ut32 *)(buf + 3);
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"0x%04x",*imm);
-					size=7;
-					break;
-				case 0:
-				default:
-					r1  = buf + 2;
-					r2  = buf + 3;
-					sprintf((char *)p1,"r_%02x",*r1);
-					sprintf((char *)p2,"r_%02x",*r2);
-					size=4;
-					break;
-			}
-			break;
-		case 4: // 6 3
-			switch(*c) {
-				case 1:
-					imm = (ut32 *)(buf + 2);
-					sprintf((char *)p1,"0x%04x",*imm);
-					size=6;
-					break;
-				default:
-				case 0:
-					r1  = buf + 2;
-					sprintf((char *)p1,"r_%02x",*r1);
-					size=3;
-					break;
-			}
-			break;
-		case 5: //5
-			imm  = (ut32 *)(buf + 1);
+		case 2:
+			imm  = (ut32 *)(buf + 3);
+			r1   = buf + 4;
 			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"r_%02x",*r1);
+			size=8;
+			break;
+		case 4:
+			imm  = (ut32 *)(buf + 3);
+			imm1 = (ut32 *)(buf + 7);
+			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"0x%04x",*imm1);
+			size=11;
+			break;
+
+		case 0:
+		default:
+			r1  = buf + 3;
+			r2  = buf + 4;
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"r_%02x",*r2);
 			size=5;
 			break;
-		case 6://2
-			r1  = buf + 1;
+		}
+		break;
+	case 1: // 9 9 12 6
+		r0  = buf + 2;
+		r3  = buf +3; // guarda aki el resto
+		sprintf((char *)p0,"r_%02x",*r0);
+		sprintf((char *)p3,"r_%02x",*r3);
+		switch (*c) {
+		case 1:
+			r1  = buf + 4;
+			imm =(ut32 *)(buf + 5);
 			sprintf((char *)p1,"r_%02x",*r1);
-			size=2;
+			sprintf((char *)p2,"0x%04x",*imm);
+			size=9;
 			break;
+		case 2:
+			imm  = (ut32 *)(buf + 4);
+			r1   = buf + 8;
+			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"r_%02x",*r1);
+			size=9;
+			break;
+		case 4:
+			imm  = (ut32 *)(buf + 4);
+			imm1 = (ut32 *)(buf + 8);
+			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"0x%04x",*imm1);
+			size=12;
+			break;
+		case 0:
+		default:
+			r1  = buf + 4;
+			r2  = buf + 5;
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"r_%02x",*r2);
+			size=6;
+			break;
+		}
+		break;
+	case 2: // 7 7 10 4
+		switch (*c) {
+		case 1:
+			r1  = buf + 2;
+			imm = (ut32 *)(buf + 3);
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"0x%04x",*imm);
+			size=7;
+			break;
+		case 2:
+			imm  = (ut32 *)(buf + 2);
+			r1   = buf + 6;
+			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"r_%02x",*r1);
+			size=7;
+			break;
+		case 4:
+			imm  = (ut32 *)(buf + 2);
+			imm1 = (ut32 *)(buf + 6);
+			sprintf((char *)p1,"0x%04x",*imm);
+			sprintf((char *)p2,"0x%04x",*imm1);
+			size=10;
+			break;
+		case 0:
+		default:
+			r1  = buf + 2;
+			r2  = buf + 3;
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"r_%02x",*r2);
+			size=4;
+		}
+		break;
+	case 3:// 7 4 ESIL
+		switch(*c) {
+		case 1:
+			r1  = buf + 2;
+			imm = (ut32 *)(buf + 3);
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"0x%04x",*imm);
+			size=7;
+			break;
+		case 0:
+		default:
+			r1  = buf + 2;
+			r2  = buf + 3;
+			sprintf((char *)p1,"r_%02x",*r1);
+			sprintf((char *)p2,"r_%02x",*r2);
+			size=4;
+			break;
+		}
+		break;
+	case 4: // 6 3
+		switch(*c) {
+		case 1:
+			imm = (ut32 *)(buf + 2);
+			sprintf((char *)p1,"0x%04x",*imm);
+			size=6;
+			break;
+		default:
+			r1  = buf + 2;
+			sprintf ((char *)p1,"r_%02x",*r1);
+			size = 3;
+			break;
+		}
+		break;
+	case 5: //5
+		imm = (ut32 *)(buf + 1);
+		sprintf ((char *)p1,"0x%04x",*imm);
+		size = 5;
+		break;
+	case 6: //2
+		r1  = buf + 1;
+		sprintf ((char *)p1,"r_%02x",*r1);
+		size = 2;
+		break;
 	}
 	return size;
 }
@@ -310,217 +310,218 @@ static int baleful_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int l
 	op->refptr = 0;
 	r_strbuf_init (&op->esil);
 	switch (buf[0]) {
-		case 2: // 8 8 11 5  ADD +
-			op->type = R_ANAL_OP_TYPE_ADD;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,+,%s,=",p2,p1,p0);
-			break;
-		case 3: // 8 8 11 5  SUB -
-			op->type = R_ANAL_OP_TYPE_SUB;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,-,%s,=",p2,p1,p0);
-			break;
-		case 4: // 8 8 11 5  MUL *
-			op->type = R_ANAL_OP_TYPE_MUL;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,*,%s,=",p2,p1,p0);
-			break;
-		case 6: // 8 8 11 5  XOR ^
-			op->type = R_ANAL_OP_TYPE_XOR;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,^,%s,=",p2,p1,p0);
-			break;
-		case 9: // 8 8 11 5  AND &
-			op->type = R_ANAL_OP_TYPE_AND;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,&,%s,=",p2,p1,p0);
-			break;
-		case 10: // 8 8 11 5 OR |
-			op->type = R_ANAL_OP_TYPE_OR;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,|,%s,=",p2,p1,p0);
-			break;
-		case 12: // 8 8 11 5 ROL <<<<
-			op->type = R_ANAL_OP_TYPE_ROL;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,<<<<,%s,=",p2,p1,p0);
-			break;
-		case 13: // 8 8 11 5 ROR >>>>
-			op->type = R_ANAL_OP_TYPE_ROR;
-			op->size = getp(buf,p0,p1,p2,p3,0);
-			r_strbuf_setf (&op->esil, "%s,%s,>>>>,%s,=",p2,p1,p0);
-			break;
-		case 25: //          ++
-			op->type = R_ANAL_OP_TYPE_ADD;
-			op->size = getp(buf,p0,p1,p2,p3,6);
-			r_strbuf_setf (&op->esil, "%s,++,=",p1);
-			break;
-		case 26: //          --
-			op->type = R_ANAL_OP_TYPE_SUB;
-			op->size = getp(buf,p0,p1,p2,p3,6);
-			r_strbuf_setf (&op->esil, "%s,--,=",p1);
-			break;
-			////////////////////////////////////////// SPECIAL DIV/MOD ////////////////////////////////
-		case 5: // 9 9 12 6  DIV
-			op->type = R_ANAL_OP_TYPE_DIV;
-			op->size = getp(buf,p0,p1,p2,p3,1);
-			r_strbuf_setf (&op->esil, "%s,%s,/,%s,=,%s,%s,%%,%s,=",p2,p1,p0,p2,p1,p3);
-			break;
-			////////////////////////////////// MOVS ///////////////////////////////////////////////////
-		case 24: //7 4       MOV
-			op->type = R_ANAL_OP_TYPE_MOV;
-			op->size = getp(buf,p0,p1,p2,p3,3);
-			r_strbuf_setf (&op->esil, "%s,%s,=",p2,p1);
-			break;
-		case 27: //          MOV r,[r]
-			r  = buf + 1;
-			r1 = buf + 2;
-			op->type = R_ANAL_OP_TYPE_MOV;
-			op->size = 3;
-			r_strbuf_setf (&op->esil, "r_%02x,[4],r_%02x,=",*r1,*r);
-			break;
-		case 28://           MOV [r],r1
-			r  = buf + 1;
-			r1 = buf + 2;
-			op->type = R_ANAL_OP_TYPE_MOV;
-			op->size = 3;
-			r_strbuf_setf (&op->esil, "r_%02x,r_%02x,=[4]",*r1,*r);
-			break;
-			///////////////////////////////// JUMPS /////////////////////////////////////////////////
-		case 14: //5         JMP
-			imm  = (ut32 *)(buf + 1);
-			op->type = R_ANAL_OP_TYPE_JMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			r_strbuf_setf(&op->esil,"%s,pc,=",p1);
-			break;
-		case 16: //5         JZ
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil, "zf,?{,%s,pc,=,}",p1);
-			break;
-		case 21: //5         JNZ
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil, "zf,!,?{,%s,pc,=,}",p1);
-			break;
-		case 17: //5         JS
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil, "sf,?{,%s,pc,=,}",p1);
-			break;
-		case 20: //5         JNS
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil, "sf,!,?{,%s,pc,=,}",p1);
-			break;
-		case 19: //5         JG
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil, "gf,?{,%s,pc,=,}",p1);
-			break;
-		case 18: //5         JBE
-			op->type = R_ANAL_OP_TYPE_CJMP;
-			op->size = getp (buf, p0, p1, p2, p3, 5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf (&op->esil, "gf,!,?{,%s,pc,=,}",p1);
-			break;
-			////////////////////////////////   EFLAGS WRITER  ///////////////////////////////////////////////////////////
-			// http://www.read.seas.harvard.edu/~kohler/class/aosref/i386/appc.htm
-			//http://sourceforge.net/p/fake86/code/ci/master/tree/src/fake86/cpu.c
-		case 22: // 7 7 10 4 AND
-			op->type = R_ANAL_OP_TYPE_AND;
-			op->size = getp(buf,p0,p1,p2,p3,2);
-			r_strbuf_setf(&op->esil,"0,sf,=,%s,%s,<,sf,=,0,zf,=,%s,%s,&,0,==,$z,zf,=,0,gf,=",p2,p1,p2,p1);
-			break;
-		case 23: // 7 7 10 4 CMP
-			op->type = R_ANAL_OP_TYPE_SUB;
-			op->size = getp(buf,p0,p1,p2,p3,2);
-			r_strbuf_setf(&op->esil,"0,sf,=,%s,%s,<,sf,=,0,zf,=,%s,%s,==,$z,zf,=,0,gf,=,%s,%s,>,gf,=",p2,p1,p2,p1,p2,p1);
-			//"0,sf,=,%s,%s,<,sf,="      //SF
-			//"0,zf,=,%s,%s,==,%%z,zf,=" //ZF
-			//"0,gf,=,%s,%s,>,gf,="      //GF
-			break;
-			/////////////////////////////////////// STACK ////////////////////////////////////////////////////////////
-		case 30: //6 3       PUSH
-			p = buf + 1;
-			op->type = R_ANAL_OP_TYPE_PUSH;
-			op->size = getp(buf,p0,p1,p2,p3,4);
-			r_strbuf_setf(&op->esil,"%s,stk,=[4],4,stk,+=",p1);
-			break;
-		case 31: //          POP
-			op->type = R_ANAL_OP_TYPE_POP;
-			op->size = getp(buf,p0,p1,p2,p3,6);
-			r_strbuf_setf(&op->esil,"4,stk,-=,stk,[4],%s,=",p1);
-			break;
-		case 15: //5         CALL
-			imm = (ut32 *)(buf + 1);
-			op->type = R_ANAL_OP_TYPE_CALL;
-			op->size = getp(buf,p0,p1,p2,p3,5);
-			op->jump = r_num_get (NULL, (const char *)p1);
-			op->fail = addr + op->size;
-			r_strbuf_setf(&op->esil,"%04x,$$,+,stk,=[4],4,stk,+=,%s,pc,=",op->size,p1);
-			break;
-		case 1:  //          RET
-			op->type = R_ANAL_OP_TYPE_RET;
-			op->size = 1;
-			r_strbuf_setf(&op->esil,"4,stk,-=,stk,[4],pc,=");
-			break;
-			///////////////////////////////////////////////////////////////////////////////////////////////////////////
-		case 11:
-			r_strbuf_setf (&op->esil, "regX = regY==0");
-			op->size = 3;
-			break;
-		case 7:
-			r_strbuf_setf (&op->esil, "regX = NEG regY");
-			op->size = 3;
-			break;
-		case 8:
-			r_strbuf_setf (&op->esil, "regX = NOT regY");
-			op->size = 3;
-			break;
-			///////////////////////////////////////////////////////////////////////////////////////////////////////////
-		case 32: //          SYSCALL
-			p = buf + 1;
-			op->type = R_ANAL_OP_TYPE_SWI;
-			op->size = 2;
-			r_strbuf_setf (&op->esil, "0x%02x,$",*p);
-			break;
-		case 29://           VMEND
-			op->type = R_ANAL_OP_TYPE_TRAP;
-			op->size = 1;
-			r_strbuf_setf (&op->esil, "end virtual");
-			break;
-		case 0://            NOP
-		default:
-			op->type = R_ANAL_OP_TYPE_NOP;
-			op->size = 1;
-			r_strbuf_setf (&op->esil, "nop");
-			break;
+	case 2: // 8 8 11 5  ADD +
+		op->type = R_ANAL_OP_TYPE_ADD;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,+,%s,=",p2,p1,p0);
+		break;
+	case 3: // 8 8 11 5  SUB -
+		op->type = R_ANAL_OP_TYPE_SUB;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,-,%s,=",p2,p1,p0);
+		break;
+	case 4: // 8 8 11 5  MUL *
+		op->type = R_ANAL_OP_TYPE_MUL;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,*,%s,=",p2,p1,p0);
+		break;
+	case 6: // 8 8 11 5  XOR ^
+		op->type = R_ANAL_OP_TYPE_XOR;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,^,%s,=",p2,p1,p0);
+		break;
+	case 9: // 8 8 11 5  AND &
+		op->type = R_ANAL_OP_TYPE_AND;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,&,%s,=",p2,p1,p0);
+		break;
+	case 10: // 8 8 11 5 OR |
+		op->type = R_ANAL_OP_TYPE_OR;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,|,%s,=",p2,p1,p0);
+		break;
+	case 12: // 8 8 11 5 ROL <<<
+		op->type = R_ANAL_OP_TYPE_ROL;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,<<<,%s,=",p2,p1,p0);
+		break;
+	case 13: // 8 8 11 5 ROR >>>
+		op->type = R_ANAL_OP_TYPE_ROR;
+		op->size = getp(buf,p0,p1,p2,p3,0);
+		r_strbuf_setf (&op->esil, "%s,%s,>>>,%s,=",p2,p1,p0);
+		break;
+	case 25: //          ++
+		op->type = R_ANAL_OP_TYPE_ADD;
+		op->size = getp(buf,p0,p1,p2,p3,6);
+		r_strbuf_setf (&op->esil, "%s,++,=",p1);
+		break;
+	case 26: //          --
+		op->type = R_ANAL_OP_TYPE_SUB;
+		op->size = getp(buf,p0,p1,p2,p3,6);
+		r_strbuf_setf (&op->esil, "%s,--,=",p1);
+		break;
+		////////////////////////////////////////// SPECIAL DIV/MOD ////////////////////////////////
+	case 5: // 9 9 12 6  DIV
+		op->type = R_ANAL_OP_TYPE_DIV;
+		op->size = getp(buf,p0,p1,p2,p3,1);
+		r_strbuf_setf (&op->esil, "%s,%s,/,%s,=,%s,%s,%%,%s,=",p2,p1,p0,p2,p1,p3);
+		break;
+		////////////////////////////////// MOVS ///////////////////////////////////////////////////
+	case 24: //7 4       MOV
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->size = getp(buf,p0,p1,p2,p3,3);
+		r_strbuf_setf (&op->esil, "%s,%s,=",p2,p1);
+		break;
+	case 27: //          MOV r,[r]
+		r  = buf + 1;
+		r1 = buf + 2;
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->size = 3;
+		r_strbuf_setf (&op->esil, "r_%02x,[4],r_%02x,=",*r1,*r);
+		break;
+	case 28://           MOV [r],r1
+		r  = buf + 1;
+		r1 = buf + 2;
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->size = 3;
+		r_strbuf_setf (&op->esil, "r_%02x,r_%02x,=[4]",*r1,*r);
+		break;
+		///////////////////////////////// JUMPS /////////////////////////////////////////////////
+	case 14: //5         JMP
+		imm  = (ut32 *)(buf + 1);
+		op->type = R_ANAL_OP_TYPE_JMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		r_strbuf_setf(&op->esil,"%s,pc,=",p1);
+		break;
+	case 16: //5         JZ
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil, "zf,?{,%s,pc,=,}",p1);
+		break;
+	case 21: //5         JNZ
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil, "zf,!,?{,%s,pc,=,}",p1);
+		break;
+	case 17: //5         JS
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil, "sf,?{,%s,pc,=,}",p1);
+		break;
+	case 20: //5         JNS
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil, "sf,!,?{,%s,pc,=,}",p1);
+		break;
+	case 19: //5         JG
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil, "gf,?{,%s,pc,=,}",p1);
+		break;
+	case 18: //5         JBE
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->size = getp (buf, p0, p1, p2, p3, 5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf (&op->esil, "gf,!,?{,%s,pc,=,}",p1);
+		break;
+		////////////////////////////////   EFLAGS WRITER  ///////////////////////////////////////////////////////////
+		// http://www.read.seas.harvard.edu/~kohler/class/aosref/i386/appc.htm
+		//http://sourceforge.net/p/fake86/code/ci/master/tree/src/fake86/cpu.c
+	case 22: // 7 7 10 4 AND
+		op->type = R_ANAL_OP_TYPE_AND;
+		op->size = getp(buf,p0,p1,p2,p3,2);
+		r_strbuf_setf(&op->esil,"0,sf,=,%s,%s,<,sf,=,0,zf,=,%s,%s,&,0,==,$z,zf,=,0,gf,=",p2,p1,p2,p1);
+		break;
+	case 23: // 7 7 10 4 CMP
+		op->type = R_ANAL_OP_TYPE_SUB;
+		op->size = getp(buf,p0,p1,p2,p3,2);
+		r_strbuf_setf(&op->esil,"0,sf,=,%s,%s,<,sf,=,0,zf,=,%s,%s,==,$z,zf,=,0,gf,=,%s,%s,>,gf,=",p2,p1,p2,p1,p2,p1);
+		//"0,sf,=,%s,%s,<,sf,="      //SF
+		//"0,zf,=,%s,%s,==,%%z,zf,=" //ZF
+		//"0,gf,=,%s,%s,>,gf,="      //GF
+		break;
+		/////////////////////////////////////// STACK ////////////////////////////////////////////////////////////
+	case 30: //6 3       PUSH
+		p = buf + 1;
+		op->type = R_ANAL_OP_TYPE_PUSH;
+		op->size = getp(buf,p0,p1,p2,p3,4);
+		r_strbuf_setf(&op->esil,"%s,stk,=[4],4,stk,+=",p1);
+		break;
+	case 31: //          POP
+		op->type = R_ANAL_OP_TYPE_POP;
+		op->size = getp(buf,p0,p1,p2,p3,6);
+		r_strbuf_setf(&op->esil,"4,stk,-=,stk,[4],%s,=",p1);
+		break;
+	case 15: //5         CALL
+		imm = (ut32 *)(buf + 1);
+		op->type = R_ANAL_OP_TYPE_CALL;
+		op->size = getp(buf,p0,p1,p2,p3,5);
+		op->jump = r_num_get (NULL, (const char *)p1);
+		op->fail = addr + op->size;
+		r_strbuf_setf(&op->esil,"%04x,$$,+,stk,=[4],4,stk,+=,%s,pc,=",op->size,p1);
+		break;
+	case 1:  //          RET
+		op->type = R_ANAL_OP_TYPE_RET;
+		op->size = 1;
+		r_strbuf_setf(&op->esil,"4,stk,-=,stk,[4],pc,=");
+		break;
+		///////////////////////////////////////////////////////////////////////////////////////////////////////////
+	case 11:
+		r_strbuf_setf (&op->esil, "regX = regY==0");
+		op->size = 3;
+		break;
+	case 7:
+		r_strbuf_setf (&op->esil, "regX = NEG regY");
+		op->size = 3;
+		break;
+	case 8:
+		r_strbuf_setf (&op->esil, "regX = NOT regY");
+		op->size = 3;
+		break;
+		///////////////////////////////////////////////////////////////////////////////////////////////////////////
+	case 32: //          SYSCALL
+		p = buf + 1;
+		op->type = R_ANAL_OP_TYPE_SWI;
+		op->size = 2;
+		r_strbuf_setf (&op->esil, "0x%02x,$",*p);
+		break;
+	case 29://           VMEND
+		op->type = R_ANAL_OP_TYPE_TRAP;
+		op->size = 1;
+		r_strbuf_setf (&op->esil, "end virtual");
+		break;
+	case 0://            NOP
+	default:
+		op->type = R_ANAL_OP_TYPE_NOP;
+		op->size = 1;
+		r_strbuf_setf (&op->esil, "nop");
+		break;
 	}
 	return op->size;
 }
 
-void *  internalMemory=NULL;
-int indicememoria=0;
-ut32 vtmp=0;
-ut32 idxInputText=0;
-char texto[] ="packers_and_vms_and_xors_oh_my\n";
+static void *  internalMemory = NULL;
+static int indicememoria = 0;
+static ut32 vtmp = 0;
+static ut32 idxInputText = 0;
+static char texto[] ="packers_and_vms_and_xors_oh_my\n";
+
 static int esil_baleful_intr (RAnalEsil *esil, int intr) {
 	ut64 valor1;
 	if (!esil)
-		return R_FALSE;
+		return false;
 	if (intr==0) {
 		reg_read(esil,"r_00",&valor1);
 		eprintf("%c\n",(ut32)valor1);
@@ -539,66 +540,94 @@ static int esil_baleful_intr (RAnalEsil *esil, int intr) {
 	}
 	else
 		eprintf ("INTERRUPT 0x%02x \n", intr);
-	return R_TRUE;
+	return true;
 }
 
+static bool esil_bale_interrupt_wrapper_cb (RAnalEsil *esil, ut32 interrupt, void *user) {	//user is always NULL, bc we has no init and fini
+	return !!esil_baleful_intr(esil, interrupt);
+}
+
+RAnalEsilInterruptHandler bale_intr_handler00 = {
+	.num = 0x00,				//interrupt number
+	.cb = esil_bale_interrupt_wrapper_cb,	//the actual handler
+};
+
+RAnalEsilInterruptHandler bale_intr_handler04 = {
+	.num = 0x04,				//interrupt number
+	.cb = esil_bale_interrupt_wrapper_cb,	//the actual handler
+};
+
+RAnalEsilInterruptHandler bale_intr_handler11 = {
+	.num = 0x11,				//interrupt number
+	.cb = esil_bale_interrupt_wrapper_cb,	//the actual handler
+};
+
+RAnalEsilInterruptHandler *bale_intr_handlers[] = {
+	&bale_intr_handler00,
+	&bale_intr_handler04,
+	&bale_intr_handler11,
+	NULL,
+};
+
 static int set_reg_profile(RAnal *anal) {
 	const char *p = \
-			"=PC    pc\n"
-			"=SP    stk\n"
-			"gpr    pc      .32 0   0\n"
-			"gpr    stk     .32 4   0\n"
-			"gpr    zf      .32 8   0\n"
-			"gpr    sf      .32 12  0\n"
-			"gpr    gf      .32 16  0\n"
-			"gpr    r_00    .32 20  0\n"
-			"gpr    r_01    .32 24  0\n"
-			"gpr    r_02    .32 28  0\n"
-			"gpr    r_03    .32 32  0\n"
-			"gpr    r_04    .32 36  0\n"
-			"gpr    r_05    .32 40  0\n"
-			"gpr    r_06    .32 44  0\n"
-			"gpr    r_07    .32 48  0\n"
-			"gpr    r_08    .32 52  0\n"
-			"gpr    r_09    .32 56  0\n"
-			"gpr    r_0a    .32 60  0\n"
-			"gpr    r_0b    .32 64  0\n"
-			"gpr    r_0c    .32 68  0\n"
-			"gpr    r_0d    .32 72  0\n"
-			"gpr    r_0e    .32 76  0\n"
-			"gpr    r_0f    .32 80  0\n"
-			"gpr    r_10    .32 84  0\n"
-			"gpr    r_11    .32 88  0\n"
-			"gpr    r_12    .32 92  0\n"
-			"gpr    r_13    .32 96  0\n"
-			"gpr    r_14    .32 100 0\n"
-			"gpr    r_15    .32 104 0\n"
-			"gpr    r_16    .32 108 0\n"
-			"gpr    r_17    .32 112 0\n"
-			"gpr    r_18    .32 116 0\n"
-			"gpr    r_19    .32 120 0\n"
-			"gpr    r_1a    .32 124 0\n"
-			"gpr    r_1b    .32 128 0\n"
-			"gpr    r_1c    .32 132 0\n"
-			"gpr    r_1d    .32 136 0\n"
-			"gpr    r_1e    .32 140 0\n"
-			"gpr    r_1f    .32 144 0\n"
-			"gpr    r_20    .32 148 0\n"
-			"gpr    r_21    .32 152 0\n"
-			"gpr    r_22    .32 156 0\n"
-			"gpr    r_23    .32 160 0\n"
-			"gpr    r_24    .32 168 0\n"
-			"gpr    r_25    .32 172 0\n"
-			"gpr    r_26    .32 176 0\n"
-			"gpr    r_27    .32 180 0\n"
-			"gpr    r_28    .32 184 0\n"
-			"gpr    r_29    .32 188 0\n"
-			"gpr    r_data  .32 192 0\n";
+		"=PC    pc\n"
+		"=SP    stk\n"
+		"gpr    pc      .32 0   0\n"
+		"gpr    stk     .32 4   0\n"
+		"gpr    zf      .32 8   0\n"
+		"gpr    sf      .32 12  0\n"
+		"gpr    gf      .32 16  0\n"
+		"gpr    r_00    .32 20  0\n"
+		"gpr    r_01    .32 24  0\n"
+		"gpr    r_02    .32 28  0\n"
+		"gpr    r_03    .32 32  0\n"
+		"gpr    r_04    .32 36  0\n"
+		"gpr    r_05    .32 40  0\n"
+		"gpr    r_06    .32 44  0\n"
+		"gpr    r_07    .32 48  0\n"
+		"gpr    r_08    .32 52  0\n"
+		"gpr    r_09    .32 56  0\n"
+		"gpr    r_0a    .32 60  0\n"
+		"gpr    r_0b    .32 64  0\n"
+		"gpr    r_0c    .32 68  0\n"
+		"gpr    r_0d    .32 72  0\n"
+		"gpr    r_0e    .32 76  0\n"
+		"gpr    r_0f    .32 80  0\n"
+		"gpr    r_10    .32 84  0\n"
+		"gpr    r_11    .32 88  0\n"
+		"gpr    r_12    .32 92  0\n"
+		"gpr    r_13    .32 96  0\n"
+		"gpr    r_14    .32 100 0\n"
+		"gpr    r_15    .32 104 0\n"
+		"gpr    r_16    .32 108 0\n"
+		"gpr    r_17    .32 112 0\n"
+		"gpr    r_18    .32 116 0\n"
+		"gpr    r_19    .32 120 0\n"
+		"gpr    r_1a    .32 124 0\n"
+		"gpr    r_1b    .32 128 0\n"
+		"gpr    r_1c    .32 132 0\n"
+		"gpr    r_1d    .32 136 0\n"
+		"gpr    r_1e    .32 140 0\n"
+		"gpr    r_1f    .32 144 0\n"
+		"gpr    r_20    .32 148 0\n"
+		"gpr    r_21    .32 152 0\n"
+		"gpr    r_22    .32 156 0\n"
+		"gpr    r_23    .32 160 0\n"
+		"gpr    r_24    .32 168 0\n"
+		"gpr    r_25    .32 172 0\n"
+		"gpr    r_26    .32 176 0\n"
+		"gpr    r_27    .32 180 0\n"
+		"gpr    r_28    .32 184 0\n"
+		"gpr    r_29    .32 188 0\n"
+		"gpr    r_data  .32 192 0\n";
 	return r_reg_set_profile_string (anal->reg, p);
 }
 static int esil_baleful_init (RAnalEsil *esil) {
-	if (!esil)
-		return R_FALSE;
+	if (!esil) {
+		return false;
+	}
+	return r_anal_esil_load_interrupts (esil, bale_intr_handlers, 0);
 	/*
 	   internalMemory=malloc(4096);
 	   if (!internalMemory) {
@@ -609,15 +638,15 @@ static int esil_baleful_init (RAnalEsil *esil) {
 	 *((ut32 *)internalMemory)=0xdeadbeef;
 	 eprintf("leido :%08x\n",*((ut32 *)internalMemory));
 	 */
-	return R_TRUE;
 }
 
 static int esil_baleful_fini (RAnalEsil *esil) {
 	//	if (internalMemory)
 	//		free(internalMemory);
-	return R_TRUE;
+	return true;
 }
-struct r_anal_plugin_t r_anal_plugin_baleful = {
+
+static RAnalPlugin r_anal_plugin_baleful = {
 	.name = "baleful",
 	.desc = "baleful code analysis plugin",
 	.license = "LGPL3",
@@ -626,16 +655,13 @@ struct r_anal_plugin_t r_anal_plugin_baleful = {
 	.bits = 32,
 	.esil_init = esil_baleful_init,
 	.esil_fini = esil_baleful_fini,
-	.esil_intr = esil_baleful_intr,
-	.esil = R_TRUE,
+	.esil = true,
 	.op = &baleful_op,
 	.set_reg_profile = set_reg_profile,
 };
 
-#ifndef CORELIB
-struct r_lib_struct_t radare_plugin = {
+RLibStruct radare_plugin = {
 	.type = R_LIB_TYPE_ANAL,
 	.data = &r_anal_plugin_baleful,
 	.version = R2_VERSION
 };
-#endif

baleful/asm/asm_baleful.c

@@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2014-2015 - SkUaTeR */
+/* radare - LGPL - Copyright 2014-2016 - SkUaTeR */
 
 #include <stdio.h>
 #include <string.h>
@@ -6,21 +6,20 @@
 #include <r_lib.h>
 #include <r_asm.h>
 
-int asm_baleful_getregs(const ut8 *buf, char * b, char * oper, int type) {
-	const ut8 * c;
-	const ut8  *r0;
-	const ut8  *r1;
-	const ut8  *r2;
-	const ut8  *r3;
+static int asm_baleful_getregs(const ut8 *buf, char * b, char * oper, int type) {
+	const ut8 *c = buf + 1;
+	const ut8 *r0;
+	const ut8 *r1;
+	const ut8 *r2;
+	const ut8 *r3;
 	const ut32 *imm;
 	const ut32 *imm1;
+	int size = 0;
 
-	int size=0;
-	c   = buf+1;
-	switch(type) {
+	switch (type) {
 	case 0: // 8 8 11 5
 		r0  = buf + 2;
-		switch(*c) {
+		switch (*c) {
 		case 1:
 			r1  = buf + 3;
 			imm = (ut32*)(buf + 4);
@@ -212,128 +211,129 @@ static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
 	const ut8  *r1;
 	const ut32 *imm;
 	const ut32 *imm1;
-
+	char outbuf[32] = {0};
 	switch (*buf) {
 	case 2://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"+",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"+",0);
 		break;
 	case 3://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"-",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"-",0);
 		break;
 	case 4://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"*",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"*",0);
 		break;
 	case 6://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"^",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"^",0);
 		break;
 	case 9://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"&",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"&",0);
 		break;
 	case 10://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"|",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"|",0);
 		break;
 	case 12://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"<<",0);
+		op->size = asm_baleful_getregs(buf,outbuf,"<<",0);
 		break;
 	case 13://8 8 11 5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,">>",0);
+		op->size = asm_baleful_getregs(buf,outbuf,">>",0);
 		break;
 	case 5: // //9 9 12 6
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"/",1);
+		op->size = asm_baleful_getregs(buf,outbuf,"/",1);
 		break;
 	case 22: // 7 7 10 4
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"and",2);
+		op->size = asm_baleful_getregs(buf,outbuf,"and",2);
 		break;
 	case 23: // 7 7 10 4
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"cmp",2);
+		op->size = asm_baleful_getregs(buf,outbuf,"cmp",2);
 		break;
 	case 24: //7 4
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"mov",3);
+		op->size = asm_baleful_getregs(buf,outbuf,"mov",3);
 		break;
 	case 30: // 6 3
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"push",4);
+		op->size = asm_baleful_getregs(buf,outbuf,"push",4);
 		break;
 	case 15: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"call",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"call",5);
 		break;
 	case 14: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jmp",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jmp",5);
 		break;
 	case 16: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jz",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jz",5);
 		break;
 	case 17: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"js",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"js",5);
 		break;
 	case 18: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jbe",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jbe",5);
 		break;
 	case 19: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jg",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jg",5);
 		break;
 	case 20: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jns",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jns",5);
 		break;
 	case 21: //5
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"jnz",5);
+		op->size = asm_baleful_getregs(buf,outbuf,"jnz",5);
 		break;
 	case 27: //3
 		op->size = 3;
 		r  = buf + 1;
 		r1 = buf + 2;
-		snprintf (op->buf_asm, R_ASM_BUFSIZE, "mov r_%02x,[r_%02x]",*r,*r1);
+		snprintf (outbuf, sizeof (outbuf), "mov r_%02x,[r_%02x]",*r,*r1);
 		break;
 	case 28: //3
 		r  = buf + 1;
 		r1 = buf + 2;
 		op->size = 3;
-		snprintf (op->buf_asm, R_ASM_BUFSIZE, "mov [r_%02x],r_%02x",*r,*r1);
+		snprintf (outbuf, sizeof (outbuf), "mov [r_%02x],r_%02x",*r,*r1);
 		break;
 	case 11: //3
 		op->size = 3;
-		snprintf (op->buf_asm, R_ASM_BUFSIZE, "regX= regY==0");
+		snprintf (outbuf, sizeof (outbuf), "regX= regY==0");
 		break;
 	case 7: //3
 		op->size = 3;
-		snprintf (op->buf_asm, R_ASM_BUFSIZE, "regX= NEG regY");
+		snprintf (outbuf, sizeof (outbuf), "regX= NEG regY");
 		break;
 	case 8: //3
 		op->size = 3;
-		snprintf (op->buf_asm, R_ASM_BUFSIZE, "regX= NOT regY");
+		snprintf (outbuf, sizeof (outbuf), "regX= NOT regY");
 		break;
 	case 25: //2
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"++",6);
+		op->size = asm_baleful_getregs(buf,outbuf,"++",6);
 		break;
 	case 26: //2
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"--",6);
+		op->size = asm_baleful_getregs(buf,outbuf,"--",6);
 		break;
 	case 31: //2
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"pop",6);
+		op->size = asm_baleful_getregs(buf,outbuf,"pop",6);
 		break;
 	case 32: // 2
-		op->size = asm_baleful_getregs(buf,op->buf_asm,"apicall",7);
+		op->size = asm_baleful_getregs(buf,outbuf,"apicall",7);
 		break;
 	case 1:
 		op->size = 1;
-		strcpy (op->buf_asm, "ret");
+		strcpy (outbuf, "ret");
 		break;
 	case 0:
 		op->size = 1;
-		strcpy (op->buf_asm, "nop");
+		strcpy (outbuf, "nop");
 		break;
 	case 29:
 		op->size = 1;
-		strcpy (op->buf_asm, "end virtual");
+		strcpy (outbuf, "end virtual");
 		break;
 	default:
 		op->size = 1;
-		strcpy (op->buf_asm, "nop");
+		strcpy (outbuf, "nop");
 		break;
 	}
+	r_strbuf_set (&op->buf_asm, outbuf);
 	return op->size;
 }
 
-RAsmPlugin r_asm_plugin_baleful = {
+static RAsmPlugin r_asm_plugin_baleful = {
 	.name = "baleful",
 	.arch = "baleful",
 	.license = "LGPL3",
@@ -343,10 +343,7 @@ RAsmPlugin r_asm_plugin_baleful = {
 	//.assemble =null// &assemble
 };
 
-#ifndef CORELIB
-struct r_lib_struct_t radare_plugin = {
+RLibStruct radare_plugin = {
 	.type = R_LIB_TYPE_ASM,
 	.data = &r_asm_plugin_baleful
-
 };
-#endif

bcl/Makefile

@@ -1,22 +1,23 @@
 include ../options.mk
 
 CFLAGS+=$(shell pkg-config --cflags r_util)
-CC_ASM=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_asm)
-CC_ANA=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_anal)
-CC_BIN=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_bin)
-CC_COR=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_core)
+CC_LIB=$(CC) -shared $(CFLAGS) $(LDFLAGS) -fPIC
+CC_ASM=$(CC_LIB) $(shell pkg-config --libs r_asm)
+CC_ANA=$(CC_LIB) $(shell pkg-config --libs r_anal)
+CC_BIN=$(CC_LIB) $(shell pkg-config --libs r_bin)
+CC_COR=$(CC_LIB) $(shell pkg-config --libs r_core)
 
 all:
-	$(CC_ASM) -o asm_bcl.$(EXT_SO) asm_bcl.c
-	$(CC_ANA) -o anal_bcl.$(EXT_SO) anal_bcl.c
-	$(CC_BIN) -o bin_bcl.$(EXT_SO) bin_bcl.c
-	$(CC_COR) -o core_bcl.$(EXT_SO) core_bcl.c
+	$(CC_ASM) -o asm_bcl.$(LIBEXT) asm_bcl.c
+	$(CC_ANA) -o anal_bcl.$(LIBEXT) anal_bcl.c
+	$(CC_BIN) -o bin_bcl.$(LIBEXT) bin_bcl.c
+	$(CC_COR) -o core_bcl.$(LIBEXT) core_bcl.c
 
 install:
-	cp -f *.$(EXT_SO) ~/.config/radare2/plugins
+	cp -f *.$(LIBEXT) $(R2PM_PLUGDIR)
 
 uninstall:
-	for a in *.$(EXT_SO) ; do rm -f ~/.config/radare2/plugins/$$a ; done
+	for a in *.$(LIBEXT) ; do rm -f $(R2PM_PLUGDIR)/$$a ; done
 
 clean:
-	rm -f *.$(EXT_SO)
+	rm -f *.$(LIBEXT)

bcl/anal_bcl.c

@@ -13,7 +13,7 @@ static bool bcl_data[BCL_SIZE];
 static int findpair(ut64 addr, const ut8 *buf, int len, int base) {
 	int i, j;
 	for (i = 1; i<len; i++) {
-		if ((buf[i]&3)!=base) {
+		if ((buf[i] & 3) != base) {
 			continue;
 		}
 		if (bcl_addr != UT64_MAX) {
@@ -23,9 +23,11 @@ static int findpair(ut64 addr, const ut8 *buf, int len, int base) {
 		}
 		if (bcl_addr == UT64_MAX) {
 			bcl_addr = addr;
-			for (j=0; j<BCL_SIZE; j++) bcl_data[j] = false;
+			for (j = 0; j < BCL_SIZE; j++) {
+				bcl_data[j] = false;
+			}
 		} else {
-			if (bcl_data[ (addr - bcl_addr) -i ]) {
+			if (bcl_data[ (addr - bcl_addr) - i]) {
 			// XXX fix	continue;
 			}
 		}
@@ -76,12 +78,12 @@ static int bcl_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len)
 
 static int set_reg_profile(RAnal *anal) {
 	const char *p = \
-		"=pc	pc\n"
-		"=sp	sp\n"
-		"=a0	A\n"
-		"=a1	C\n"
-		"=a2	G\n"
-		"=a3	T\n"
+		"=PC	pc\n"
+		"=SP	sp\n"
+		"=A0	A\n"
+		"=A1	C\n"
+		"=A2	G\n"
+		"=A3	T\n"
 		"gpr	pc	.64	0	0\n"
 		"gpr	sp	.64	8	0\n"
 		"gpr	A	.8	16	0\n"
@@ -95,7 +97,7 @@ struct r_anal_plugin_t r_anal_plugin_bcl = {
 	.name = "bcl",
 	.desc = "Base Call DNA Illumina records",
 	.license = "BSD",
-	.arch = R_SYS_ARCH_BF, // XXX
+	.arch = "bcl",
 	.bits = 8,
 	.esil = true,
 	.op = &bcl_op,

bcl/asm_bcl.c

@@ -1,4 +1,4 @@
-/* radare - LGPL - Copyright 2015 - pancake */
+/* radare - LGPL - Copyright 2015-2016 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
@@ -9,13 +9,13 @@ static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
 	const char *bases = "ACGT";
 	if (a->pc == 0) {
 		ut32 *clusters = (ut32*)buf;
-		sprintf (op->buf_asm, "clusters %d\n", *clusters);
+		snprintf (op->buf_asm, sizeof (op->buf_asm), "clusters %d\n", *clusters);
 		return op->size = 4;
 	}
 	if (*buf != 0) {
 		char base = bases[*buf & 3];
 		int qual = *buf >> 2;
-		sprintf (op->buf_asm, "%c  ; %d", base, qual);
+		snprintf (op->buf_asm, sizeof (op->buf_asm), "%c ; %d", base, qual);
 		op->size = 1;
 		return 1;
 	}
@@ -25,10 +25,10 @@ static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
 
 static int assemble(RAsm *a, RAsmOp *op, const char *buf) {
 	bool qmode = false;
-	int count = 0;
-	int base = 0;
 	int quality = 0;
 	int outsz = 128;
+	int count = 0;
+	int base = 0;
 	char *out = (char *)op->buf;
 	for (; *buf; buf++) {
 		switch (*buf) {

bcl/bin_bcl.c

@@ -1,4 +1,4 @@
-/* radare2 - LGPL - Copyright 2015 - pancake */
+/* radare2 - LGPL - Copyright 2015-2016 - pancake */
 
 #include <r_types.h>
 #include <r_util.h>
@@ -7,10 +7,10 @@
 
 static int check_bytes(const ut8 *buf, ut64 length) {
 	if (buf && length >= 4) {
-		ut32 *clusters = (ut32*)buf;
-		if (*clusters + 4 == length) {
-			if (!clusters[1])
-				return true;
+		ut32 cls = r_mem_get_num (buf, 4);
+		ut32 cls2 = r_mem_get_num (buf + 4, 4);
+		if (cls + 4 == length && !cls2) {
+			return true;
 		}
 	}
 	return false;
@@ -22,7 +22,6 @@ static int check(RBinFile *arch) {
 	return check_bytes (bytes, sz);
 }
 
-
 static Sdb* get_sdb (RBinObject *o) {
 	if (!o) return NULL;
 	//struct r_bin_[NAME]_obj_t *bin = (struct r_bin_r_bin_[NAME]_obj_t *) o->bin_obj;
@@ -54,7 +53,7 @@ static ut64 findEntry(RBuffer *buf, int n) {
 	int i;
 	for (i=4;i<buf->length; i++) {
 		if (buf->buf[i] != 0) {
-			if (n==0) {
+			if (n == 0) {
 				return i;
 			}
 			n--;
@@ -68,20 +67,21 @@ static ut64 findEntry(RBuffer *buf, int n) {
 }
 
 static RList* entries(RBinFile *arch) {
-	RList* ret;
+	RList* ret = r_list_newf (free);
 	RBinAddr *ptr = NULL;
-
-	if (!(ret = r_list_new ()))
-		return NULL;
-	ret->free = free;
-	if ((ptr = R_NEW0 (RBinAddr))) {
-		ut64 entry = findEntry(arch->buf, 2);
-		if (!entry) entry = findEntry(arch->buf, 1);
-		if (!entry) entry = findEntry(arch->buf, 0);
-		if (!entry) entry = 4;
-		ptr->paddr = entry;
-		ptr->vaddr = entry;
-		r_list_append (ret, ptr);
+	if (ret) {
+		if ((ptr = R_NEW0 (RBinAddr))) {
+			ut64 entry = findEntry (arch->buf, 2);
+			if (!entry) entry = findEntry (arch->buf, 1);
+			if (!entry) entry = findEntry (arch->buf, 0);
+			if (!entry) entry = 4;
+			ptr->paddr = entry;
+			ptr->vaddr = entry;
+			r_list_append (ret, ptr);
+		} else {
+			r_list_free (ret);
+			ret = NULL;
+		}
 	}
 	return ret;
 }
@@ -90,20 +90,21 @@ static RList* sections(RBinFile *arch) {
 	RList *ret = NULL;
 	RBinSection *ptr = NULL;
 	ut64 textsize, datasize, symssize, spszsize, pcszsize;
-	int big_endian = arch->o->info->big_endian;
-	ut64 entry0 = findEntry(arch->buf, 0);
-	ut64 entry1 = findEntry(arch->buf, 1);
-	ut64 entry2 = findEntry(arch->buf, 2);
+	ut64 entry0 = findEntry (arch->buf, 0);
+	ut64 entry1 = findEntry (arch->buf, 1);
+	ut64 entry2 = findEntry (arch->buf, 2);
 
-	if (!(ret = r_list_new ()))
+	if (!(ret = r_list_newf (free))) {
 		return NULL;
-	ret->free = free;
-
+	}
 	// add text segment
-	textsize = r_mem_get_num (arch->buf->buf+4, 4, big_endian);
-	if (!(ptr = R_NEW0 (RBinSection)))
+	textsize = r_mem_get_num (arch->buf->buf + 4, 4);
+	if (!(ptr = R_NEW0 (RBinSection))) {
 		return ret;
-	if (!entry1) entry1 = arch->buf->length;
+	}
+	if (!entry1) {
+		entry1 = arch->buf->length;
+	}
 	strncpy (ptr->name, "init", R_BIN_SIZEOF_STRINGS);
 	ptr->size = entry1-entry0;
 	ptr->vsize = entry1-entry0;
@@ -155,37 +156,37 @@ static RList* libs(RBinFile *arch) {
 }
 
 static RBinInfo* info(RBinFile *arch) {
-	RBinInfo *ret = NULL;
-	if ((ret = R_NEW0 (RBinInfo)) == NULL)
-		return NULL;
-	ret->file = strdup (arch->file);
-	ret->bclass = strdup ("dna");
-	ret->rclass = strdup ("bcl");
-	ret->os = strdup ("Illumina DNA Sequences");
-	ret->arch = strdup ("bcl");
-	ret->machine = strdup (ret->arch);
-	ret->subsystem = strdup ("bcl");
-	ret->type = strdup ("DATA (ATCG streams)");
-	ret->bits = 8;
-	ret->has_va = true;
-	ret->big_endian = 0;
-	ret->dbg_info = 0;
-	ret->dbg_info = 0;
+	RBinInfo *ret = R_NEW0 (RBinInfo);
+	if (ret) {
+		ret->file = strdup (arch->file);
+		ret->bclass = strdup ("dna");
+		ret->rclass = strdup ("bcl");
+		ret->os = strdup ("Illumina DNA Sequences");
+		ret->arch = strdup ("bcl");
+		ret->machine = strdup (ret->arch);
+		ret->subsystem = strdup ("bcl");
+		ret->type = strdup ("DATA (ATCG streams)");
+		ret->bits = 8;
+		ret->has_va = true;
+		ret->big_endian = false;
+		ret->dbg_info = 0;
+	}
 	return ret;
 }
 
-static int size(RBinFile *arch) {
+static ut64 size(RBinFile *arch) {
 	ut64 text, data, syms, spsz;
 	int big_endian;
-	if (!arch->o->info)
+	if (!arch->o->info) {
 		arch->o->info = info (arch);
+	}
 	big_endian = arch->o->info->big_endian;
 	// TODO: reuse section list
-	text = r_mem_get_num (arch->buf->buf+4, 4, big_endian);
-	data = r_mem_get_num (arch->buf->buf+8, 4, big_endian);
-	syms = r_mem_get_num (arch->buf->buf+16, 4, big_endian);
-	spsz = r_mem_get_num (arch->buf->buf+24, 4, big_endian);
-	return text+data+syms+spsz+(6*4);
+	text = r_mem_get_num (arch->buf->buf + 4, 4);
+	data = r_mem_get_num (arch->buf->buf + 8, 4);
+	syms = r_mem_get_num (arch->buf->buf + 16, 4);
+	spsz = r_mem_get_num (arch->buf->buf + 24, 4);
+	return text + data + syms + spsz + (6 * 4);
 }
 
 RBinPlugin r_bin_plugin_bcl = {

bcl/core_bcl.c

@@ -22,8 +22,8 @@ static int mycall(void *user, const char *input) {
 	int i, j;
 	const int seqsz = 100;
 	int data[seqsz];
-        RCore *core = (RCore *) user;
-        if (!strncmp (input, "pbc", 3)) {
+	RCore *core = (RCore *) user;
+	if (!strncmp (input, "pbc", 3)) {
 		char lala = input[3];
 		int newsize, bsize;
 		int in_color = r_config_get_i (core->config, "scr.color");

binarly/README.md

@@ -0,0 +1,29 @@
+Binary support for radare2
+==========================
+
+Binarly is an online service that indexes zillions of binaries into a huge
+database in order to allow researchers to perform queries in their database
+to identify which other files contain the same or similar patterns.
+
+This can be useful for:
+
+* crypto detection
+* malware families
+* bindiffing
+* ...
+
+
+Extra links
+-----------
+
+For more information see:
+
+	https://www.binar.ly/
+
+Python API available at:
+
+	https://github.com/binarlyhq/binarly-sdk.git
+
+Example python tool:
+
+	https://github.com/binarlyhq/binarly-query.git

binarly/r2bly.py

@@ -0,0 +1,199 @@
+#!/usr/bin/env python
+#
+# r2bly : The Binarly extension for Radare2
+#
+#  Author: pancake <@nopcode.org>
+#  License: MIT
+#
+
+import os
+import sys
+import r2pipe
+import signal
+import base64
+
+try:
+    from BinarlyAPIv1 import BinarlyAPI, hex_pattern, ascii_pattern, wide_pattern, build_query
+except ImportError:
+    print("Error importing BinarlyAPI. You can find it here https://github.com/binarlyhq/binarly-sdk")
+    sys.exit(1)
+
+def signal_handler(signal, frame):
+        print '^C'
+        sys.exit(0)
+signal.signal(signal.SIGINT, signal_handler)
+
+APIKEY_FILENAME = 'apikey.txt'
+APIKEY_PATH = os.path.join(os.path.dirname(__file__), APIKEY_FILENAME)
+
+def get_api_key():
+	with open(APIKEY_PATH, 'r') as fhandle:
+		return fhandle.readline().strip()
+	return None
+
+APIKEY  = get_api_key()
+PROJECT = "r2binarly"
+usehttp = False
+
+if not APIKEY:
+	print "No apikey.txt"
+	sys.exit(1)
+
+def query_hex(xxxx, limit):
+	query = []
+	query.append(hex_pattern(xxxx))
+	result = bly.search(query, limit=limit, exact=False)
+	if result.has_key('error'):
+		print ("Error" + result['error']['message'])
+		return
+	return result
+
+def get_metadata(xxxx):
+	m = {}
+	meta = bly.get_metadata(xxxx)
+	try:
+		#print meta
+		M = meta[xxxx]['version_info']
+		m['fn'] = M['original_file_name']
+		m['fd'] = M['file_description']
+	except:
+		m['fn'] = ""
+		m['fd'] = ""
+		pass #raise
+	return m 
+
+def get_bytes(a, l):
+	return r2p.cmd("p8 %s@%s"%(l,a)).strip()
+
+def query_all_imports(limit, wide):
+	query = []
+	imps = r2p.cmdj("iij")
+	for i in imps:
+		n = i['name']
+		pos = n.find('.dll_')
+		if pos != -1:
+			n = n[pos + 5:]
+		print n
+		if wide:
+			query.append(wide_pattern(n))
+		else:
+			query.append(ascii_pattern(n))
+	result = bly.search(query, limit=limit, exact=True)
+	if result.has_key('error'):
+		print ("Error" + result['error']['message'])
+		return
+	return result
+
+def query_all_functions(limit, maxlen, every):
+	query = []
+	fcns = r2p.cmdj("aflj")
+	for f in fcns:
+		if f['size'] > maxlen:
+			print "skip"
+			continue
+		b = get_bytes(f['offset'], f['size'])
+		print "0x%x  %5d  %20s  %s"%(f['offset'], f['size'], f['name'], b)
+		query.append(hex_pattern(b))
+		if every:
+			result = bly.search(query, limit=limit, exact=True)
+			if result.has_key('error'):
+				print ("Error" + result['error']['message'])
+			else:
+				show_results(result)
+			query = []
+	if every:
+		return None
+	result = bly.search(query, limit=limit, exact=True)
+	if result.has_key('error'):
+		print ("Error" + result['error']['message'])
+		return
+	return result
+
+def query_all_strings(minlen, limit):
+	query = []
+	strs = r2p.cmdj("izj")
+	for s in strs:
+		if s['length'] > minlen:
+			msg = base64.b64decode(s['string'])
+			print msg
+			if s['type'] == 'ascii':
+				query.append(ascii_pattern(msg))
+			elif s['type'] == 'wide':
+				query.append(wide_pattern(msg))
+			else:
+				print "Unknown/unhandled string type %s"%(s['type'])
+	result = bly.search(query, limit=limit, exact=False)
+	if result.has_key('error'):
+		print ("Error" + result['error']['message'])
+		return
+	return result
+
+def show_results(res):
+	for r in res['stats']:
+		print("# %20s %s"%(r, res['stats'][r]))
+	for r in res['results']:
+		sys.stdout.write("%s  %8d  %s"%(r['sha1'], r['size'], r['label']))
+		m = get_metadata(r['sha1'])
+		print "  %s %s %s"%(m['fn'], ' '*(20 - len(m['fn'])), m['fd'])
+
+bly = BinarlyAPI(api_key=APIKEY, use_http=usehttp, project=PROJECT)
+r2p = r2pipe.open('#!pipe')
+
+def halp():
+	print "Usage: r2bly [op] [...]"
+	print "  Binarly extension for radare2 delivered by pancake."
+	print "Operations:"
+	print "  fcn      - find all functions smaller than X"
+	print "  hex (..) - find files matching given hexpairs"
+	print "  imp      - find files matching all imports"
+	print "  sha [..] - identify current file or given hash by using the sha1"
+	print "  str      - find which files contain all long strings"
+	print "  key      - set api key"
+	print "Radare2:"
+	print "  \"$r2bly=#!pipe python test.py\""
+	print "  $r2bly str"
+
+if len(sys.argv) < 2:
+	halp()
+	sys.exit(1)
+
+op = sys.argv[1]
+res = None
+
+if op == 'str':
+	res = query_all_strings(20, 10)
+elif op == 'sha':
+	msg = ""
+	if len(sys.argv) < 3:
+		fn = r2p.cmd('i~^file[1]')
+		msg = r2p.syscmd("rahash2 -qa sha1 "+fn).split(' ')[0]
+	else:
+		msg = sys.argv[2]
+	print "sha1 %s"%(msg)
+	m = get_metadata(msg)
+	if not m['fd'] and not m['fn']:
+		print "unknown"
+	else:
+		print "%s  %s"%(m['fn'], m['fd'])
+	sys.exit(0)
+elif op == 'imp':
+	res = query_all_imports(10, False)
+elif op == 'fcn':
+	res = query_all_functions(10, 100, True)
+elif op == 'hex':
+	res = query_hex(sys.argv[2], 10)
+elif op == 'key':
+	if len(sys.argv) < 3:
+		print APIKEY
+		res = sys.stdin.readline().strip()
+	else:
+		res = sys.argv[2]
+	if res:
+		with open(APIKEY_PATH, 'w') as fd:
+			fd.write("%s\n"%(res))
+	sys.exit(0)
+else:
+	halp()
+
+if res:
+	show_results(res)

binr/old.rarc2/emit_arm.d

@@ -1,40 +0,0 @@
-emit_arm.o: emit_arm.c rarc2.h /usr/include/stdio.h \
-  /usr/include/sys/cdefs.h /usr/include/sys/_symbol_aliasing.h \
-  /usr/include/sys/_posix_availability.h /usr/include/Availability.h \
-  /usr/include/AvailabilityInternal.h /usr/include/_types.h \
-  /usr/include/sys/_types.h /usr/include/machine/_types.h \
-  /usr/include/i386/_types.h /usr/include/sys/_pthread/_pthread_types.h \
-  /usr/include/sys/_types/_va_list.h /usr/include/sys/_types/_size_t.h \
-  /usr/include/sys/_types/_null.h /usr/include/sys/stdio.h \
-  /usr/include/sys/_types/_off_t.h /usr/include/sys/_types/_ssize_t.h \
-  /usr/include/secure/_stdio.h /usr/include/secure/_common.h \
-  /usr/include/string.h /usr/include/sys/_types/_rsize_t.h \
-  /usr/include/sys/_types/_errno_t.h /usr/include/strings.h \
-  /usr/include/secure/_string.h /usr/include/stdlib.h \
-  /usr/include/sys/wait.h /usr/include/sys/_types/_pid_t.h \
-  /usr/include/sys/_types/_id_t.h /usr/include/sys/signal.h \
-  /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
-  /usr/include/i386/signal.h /usr/include/machine/_mcontext.h \
-  /usr/include/i386/_mcontext.h /usr/include/mach/i386/_structs.h \
-  /usr/include/sys/_pthread/_pthread_attr_t.h \
-  /usr/include/sys/_types/_sigaltstack.h \
-  /usr/include/sys/_types/_ucontext.h \
-  /usr/include/sys/_types/_sigset_t.h /usr/include/sys/_types/_uid_t.h \
-  /usr/include/sys/resource.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdint.h \
-  /usr/include/stdint.h /usr/include/sys/_types/_int8_t.h \
-  /usr/include/sys/_types/_int16_t.h /usr/include/sys/_types/_int32_t.h \
-  /usr/include/sys/_types/_int64_t.h /usr/include/_types/_uint8_t.h \
-  /usr/include/_types/_uint16_t.h /usr/include/_types/_uint32_t.h \
-  /usr/include/_types/_uint64_t.h /usr/include/sys/_types/_intptr_t.h \
-  /usr/include/sys/_types/_uintptr_t.h /usr/include/_types/_intmax_t.h \
-  /usr/include/_types/_uintmax_t.h /usr/include/sys/_types/_timeval.h \
-  /usr/include/machine/endian.h /usr/include/i386/endian.h \
-  /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
-  /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
-  /usr/include/sys/_types/_ct_rune_t.h /usr/include/sys/_types/_rune_t.h \
-  /usr/include/sys/_types/_wchar_t.h /usr/include/machine/types.h \
-  /usr/include/i386/types.h /usr/include/sys/_types/_dev_t.h \
-  /usr/include/sys/_types/_mode_t.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdarg.h \
-  config.h

binr/old.rarc2/emit_x64.d

@@ -1,40 +0,0 @@
-emit_x64.o: emit_x64.c emit_x86.c rarc2.h /usr/include/stdio.h \
-  /usr/include/sys/cdefs.h /usr/include/sys/_symbol_aliasing.h \
-  /usr/include/sys/_posix_availability.h /usr/include/Availability.h \
-  /usr/include/AvailabilityInternal.h /usr/include/_types.h \
-  /usr/include/sys/_types.h /usr/include/machine/_types.h \
-  /usr/include/i386/_types.h /usr/include/sys/_pthread/_pthread_types.h \
-  /usr/include/sys/_types/_va_list.h /usr/include/sys/_types/_size_t.h \
-  /usr/include/sys/_types/_null.h /usr/include/sys/stdio.h \
-  /usr/include/sys/_types/_off_t.h /usr/include/sys/_types/_ssize_t.h \
-  /usr/include/secure/_stdio.h /usr/include/secure/_common.h \
-  /usr/include/string.h /usr/include/sys/_types/_rsize_t.h \
-  /usr/include/sys/_types/_errno_t.h /usr/include/strings.h \
-  /usr/include/secure/_string.h /usr/include/stdlib.h \
-  /usr/include/sys/wait.h /usr/include/sys/_types/_pid_t.h \
-  /usr/include/sys/_types/_id_t.h /usr/include/sys/signal.h \
-  /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
-  /usr/include/i386/signal.h /usr/include/machine/_mcontext.h \
-  /usr/include/i386/_mcontext.h /usr/include/mach/i386/_structs.h \
-  /usr/include/sys/_pthread/_pthread_attr_t.h \
-  /usr/include/sys/_types/_sigaltstack.h \
-  /usr/include/sys/_types/_ucontext.h \
-  /usr/include/sys/_types/_sigset_t.h /usr/include/sys/_types/_uid_t.h \
-  /usr/include/sys/resource.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdint.h \
-  /usr/include/stdint.h /usr/include/sys/_types/_int8_t.h \
-  /usr/include/sys/_types/_int16_t.h /usr/include/sys/_types/_int32_t.h \
-  /usr/include/sys/_types/_int64_t.h /usr/include/_types/_uint8_t.h \
-  /usr/include/_types/_uint16_t.h /usr/include/_types/_uint32_t.h \
-  /usr/include/_types/_uint64_t.h /usr/include/sys/_types/_intptr_t.h \
-  /usr/include/sys/_types/_uintptr_t.h /usr/include/_types/_intmax_t.h \
-  /usr/include/_types/_uintmax_t.h /usr/include/sys/_types/_timeval.h \
-  /usr/include/machine/endian.h /usr/include/i386/endian.h \
-  /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
-  /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
-  /usr/include/sys/_types/_ct_rune_t.h /usr/include/sys/_types/_rune_t.h \
-  /usr/include/sys/_types/_wchar_t.h /usr/include/machine/types.h \
-  /usr/include/i386/types.h /usr/include/sys/_types/_dev_t.h \
-  /usr/include/sys/_types/_mode_t.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdarg.h \
-  config.h

binr/old.rarc2/emit_x86.d

@@ -1,40 +0,0 @@
-emit_x86.o: emit_x86.c rarc2.h /usr/include/stdio.h \
-  /usr/include/sys/cdefs.h /usr/include/sys/_symbol_aliasing.h \
-  /usr/include/sys/_posix_availability.h /usr/include/Availability.h \
-  /usr/include/AvailabilityInternal.h /usr/include/_types.h \
-  /usr/include/sys/_types.h /usr/include/machine/_types.h \
-  /usr/include/i386/_types.h /usr/include/sys/_pthread/_pthread_types.h \
-  /usr/include/sys/_types/_va_list.h /usr/include/sys/_types/_size_t.h \
-  /usr/include/sys/_types/_null.h /usr/include/sys/stdio.h \
-  /usr/include/sys/_types/_off_t.h /usr/include/sys/_types/_ssize_t.h \
-  /usr/include/secure/_stdio.h /usr/include/secure/_common.h \
-  /usr/include/string.h /usr/include/sys/_types/_rsize_t.h \
-  /usr/include/sys/_types/_errno_t.h /usr/include/strings.h \
-  /usr/include/secure/_string.h /usr/include/stdlib.h \
-  /usr/include/sys/wait.h /usr/include/sys/_types/_pid_t.h \
-  /usr/include/sys/_types/_id_t.h /usr/include/sys/signal.h \
-  /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
-  /usr/include/i386/signal.h /usr/include/machine/_mcontext.h \
-  /usr/include/i386/_mcontext.h /usr/include/mach/i386/_structs.h \
-  /usr/include/sys/_pthread/_pthread_attr_t.h \
-  /usr/include/sys/_types/_sigaltstack.h \
-  /usr/include/sys/_types/_ucontext.h \
-  /usr/include/sys/_types/_sigset_t.h /usr/include/sys/_types/_uid_t.h \
-  /usr/include/sys/resource.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdint.h \
-  /usr/include/stdint.h /usr/include/sys/_types/_int8_t.h \
-  /usr/include/sys/_types/_int16_t.h /usr/include/sys/_types/_int32_t.h \
-  /usr/include/sys/_types/_int64_t.h /usr/include/_types/_uint8_t.h \
-  /usr/include/_types/_uint16_t.h /usr/include/_types/_uint32_t.h \
-  /usr/include/_types/_uint64_t.h /usr/include/sys/_types/_intptr_t.h \
-  /usr/include/sys/_types/_uintptr_t.h /usr/include/_types/_intmax_t.h \
-  /usr/include/_types/_uintmax_t.h /usr/include/sys/_types/_timeval.h \
-  /usr/include/machine/endian.h /usr/include/i386/endian.h \
-  /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
-  /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
-  /usr/include/sys/_types/_ct_rune_t.h /usr/include/sys/_types/_rune_t.h \
-  /usr/include/sys/_types/_wchar_t.h /usr/include/machine/types.h \
-  /usr/include/i386/types.h /usr/include/sys/_types/_dev_t.h \
-  /usr/include/sys/_types/_mode_t.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdarg.h \
-  config.h

binr/old.rarc2/out.d

@@ -1,51 +0,0 @@
-out.o: out.c /usr/include/stdio.h /usr/include/sys/cdefs.h \
-  /usr/include/sys/_symbol_aliasing.h \
-  /usr/include/sys/_posix_availability.h /usr/include/Availability.h \
-  /usr/include/AvailabilityInternal.h /usr/include/_types.h \
-  /usr/include/sys/_types.h /usr/include/machine/_types.h \
-  /usr/include/i386/_types.h /usr/include/sys/_pthread/_pthread_types.h \
-  /usr/include/sys/_types/_va_list.h /usr/include/sys/_types/_size_t.h \
-  /usr/include/sys/_types/_null.h /usr/include/sys/stdio.h \
-  /usr/include/sys/_types/_off_t.h /usr/include/sys/_types/_ssize_t.h \
-  /usr/include/secure/_stdio.h /usr/include/secure/_common.h \
-  /usr/include/stdlib.h /usr/include/sys/wait.h \
-  /usr/include/sys/_types/_pid_t.h /usr/include/sys/_types/_id_t.h \
-  /usr/include/sys/signal.h /usr/include/sys/appleapiopts.h \
-  /usr/include/machine/signal.h /usr/include/i386/signal.h \
-  /usr/include/machine/_mcontext.h /usr/include/i386/_mcontext.h \
-  /usr/include/mach/i386/_structs.h \
-  /usr/include/sys/_pthread/_pthread_attr_t.h \
-  /usr/include/sys/_types/_sigaltstack.h \
-  /usr/include/sys/_types/_ucontext.h \
-  /usr/include/sys/_types/_sigset_t.h /usr/include/sys/_types/_uid_t.h \
-  /usr/include/sys/resource.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdint.h \
-  /usr/include/stdint.h /usr/include/sys/_types/_int8_t.h \
-  /usr/include/sys/_types/_int16_t.h /usr/include/sys/_types/_int32_t.h \
-  /usr/include/sys/_types/_int64_t.h /usr/include/_types/_uint8_t.h \
-  /usr/include/_types/_uint16_t.h /usr/include/_types/_uint32_t.h \
-  /usr/include/_types/_uint64_t.h /usr/include/sys/_types/_intptr_t.h \
-  /usr/include/sys/_types/_uintptr_t.h /usr/include/_types/_intmax_t.h \
-  /usr/include/_types/_uintmax_t.h /usr/include/sys/_types/_timeval.h \
-  /usr/include/machine/endian.h /usr/include/i386/endian.h \
-  /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
-  /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
-  /usr/include/sys/_types/_ct_rune_t.h /usr/include/sys/_types/_rune_t.h \
-  /usr/include/sys/_types/_wchar_t.h /usr/include/machine/types.h \
-  /usr/include/i386/types.h /usr/include/sys/_types/_dev_t.h \
-  /usr/include/sys/_types/_mode_t.h /usr/include/string.h \
-  /usr/include/sys/_types/_rsize_t.h /usr/include/sys/_types/_errno_t.h \
-  /usr/include/strings.h /usr/include/secure/_string.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdarg.h \
-  /usr/include/unistd.h /usr/include/sys/unistd.h \
-  /usr/include/sys/_types/_posix_vdisable.h \
-  /usr/include/sys/_types/_seek_set.h /usr/include/sys/_types/_gid_t.h \
-  /usr/include/sys/_types/_useconds_t.h /usr/include/sys/select.h \
-  /usr/include/sys/_types/_fd_def.h /usr/include/sys/_types/_timespec.h \
-  /usr/include/sys/_types/_time_t.h \
-  /usr/include/sys/_types/_suseconds_t.h \
-  /usr/include/sys/_types/_fd_setsize.h \
-  /usr/include/sys/_types/_fd_set.h /usr/include/sys/_types/_fd_clr.h \
-  /usr/include/sys/_types/_fd_isset.h /usr/include/sys/_types/_fd_zero.h \
-  /usr/include/sys/_types/_fd_copy.h /usr/include/sys/_select.h \
-  /usr/include/sys/_types/_uuid_t.h /usr/include/gethostuuid.h

binr/old.rarc2/rarc2.d

@@ -1,56 +0,0 @@
-rarc2.o: rarc2.c /usr/include/stdio.h /usr/include/sys/cdefs.h \
-  /usr/include/sys/_symbol_aliasing.h \
-  /usr/include/sys/_posix_availability.h /usr/include/Availability.h \
-  /usr/include/AvailabilityInternal.h /usr/include/_types.h \
-  /usr/include/sys/_types.h /usr/include/machine/_types.h \
-  /usr/include/i386/_types.h /usr/include/sys/_pthread/_pthread_types.h \
-  /usr/include/sys/_types/_va_list.h /usr/include/sys/_types/_size_t.h \
-  /usr/include/sys/_types/_null.h /usr/include/sys/stdio.h \
-  /usr/include/sys/_types/_off_t.h /usr/include/sys/_types/_ssize_t.h \
-  /usr/include/secure/_stdio.h /usr/include/secure/_common.h \
-  /usr/include/fcntl.h /usr/include/sys/fcntl.h \
-  /usr/include/sys/_types/_mode_t.h /usr/include/sys/_types/_pid_t.h \
-  /usr/include/sys/_types/_o_sync.h /usr/include/sys/_types/_o_dsync.h \
-  /usr/include/sys/_types/_seek_set.h /usr/include/sys/_types/_s_ifmt.h \
-  /usr/include/sys/_types/_timespec.h \
-  /usr/include/sys/_types/_filesec_t.h /usr/include/string.h \
-  /usr/include/sys/_types/_rsize_t.h /usr/include/sys/_types/_errno_t.h \
-  /usr/include/strings.h /usr/include/secure/_string.h \
-  /usr/include/stdlib.h /usr/include/sys/wait.h \
-  /usr/include/sys/_types/_id_t.h /usr/include/sys/signal.h \
-  /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \
-  /usr/include/i386/signal.h /usr/include/machine/_mcontext.h \
-  /usr/include/i386/_mcontext.h /usr/include/mach/i386/_structs.h \
-  /usr/include/sys/_pthread/_pthread_attr_t.h \
-  /usr/include/sys/_types/_sigaltstack.h \
-  /usr/include/sys/_types/_ucontext.h \
-  /usr/include/sys/_types/_sigset_t.h /usr/include/sys/_types/_uid_t.h \
-  /usr/include/sys/resource.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdint.h \
-  /usr/include/stdint.h /usr/include/sys/_types/_int8_t.h \
-  /usr/include/sys/_types/_int16_t.h /usr/include/sys/_types/_int32_t.h \
-  /usr/include/sys/_types/_int64_t.h /usr/include/_types/_uint8_t.h \
-  /usr/include/_types/_uint16_t.h /usr/include/_types/_uint32_t.h \
-  /usr/include/_types/_uint64_t.h /usr/include/sys/_types/_intptr_t.h \
-  /usr/include/sys/_types/_uintptr_t.h /usr/include/_types/_intmax_t.h \
-  /usr/include/_types/_uintmax_t.h /usr/include/sys/_types/_timeval.h \
-  /usr/include/machine/endian.h /usr/include/i386/endian.h \
-  /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \
-  /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \
-  /usr/include/sys/_types/_ct_rune_t.h /usr/include/sys/_types/_rune_t.h \
-  /usr/include/sys/_types/_wchar_t.h /usr/include/machine/types.h \
-  /usr/include/i386/types.h /usr/include/sys/_types/_dev_t.h \
-  /usr/include/ctype.h /usr/include/runetype.h \
-  /usr/include/sys/_types/_wint_t.h /usr/include/unistd.h \
-  /usr/include/sys/unistd.h /usr/include/sys/_types/_posix_vdisable.h \
-  /usr/include/sys/_types/_gid_t.h /usr/include/sys/_types/_useconds_t.h \
-  /usr/include/sys/select.h /usr/include/sys/_types/_fd_def.h \
-  /usr/include/sys/_types/_time_t.h \
-  /usr/include/sys/_types/_suseconds_t.h \
-  /usr/include/sys/_types/_fd_setsize.h \
-  /usr/include/sys/_types/_fd_set.h /usr/include/sys/_types/_fd_clr.h \
-  /usr/include/sys/_types/_fd_isset.h /usr/include/sys/_types/_fd_zero.h \
-  /usr/include/sys/_types/_fd_copy.h /usr/include/sys/_select.h \
-  /usr/include/sys/_types/_uuid_t.h /usr/include/gethostuuid.h rarc2.h \
-  /Applications/Xcode-beta.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/7.0.0/include/stdarg.h \
-  config.h

blessr2/README.md

@@ -10,16 +10,16 @@ a curses-like library and r2pipe.
 Installation
 ------------
 
-	$ r2pm -i bless-r2
+	$ r2pm -i blessr2
 
 or
 
-	$ npm install -g bless-r2
+	$ npm install -g blessr2
 
 Usage
 -----
 
-	$ $(npm bin)/bless-r2 -h
+	$ $(npm bin)/blessr2 -h
 	Usage: blessr2 [-Htnwd] [file|url]
 
 or from r2

blessr2/index.js

@@ -193,7 +193,9 @@ function newBox(name, obj) {
         obj.selectedBg = '#000070';
         res = blessed.list(obj);
         res.setContent = function(x) {
-            res.setItems(x.split('\n'));
+            if (typeof x === 'string') {
+                res.setItems(x.split('\n'));
+            }
         }
     }
     res.cmd = name;
@@ -230,7 +232,7 @@ function walkInto(r2, foo) {
     box.setText('Loading...\n');
     screen.render();
     [bgbox, box, xbox, gbox].forEach((b) => {
-        r2.cmd(b.cmd, (txt) => {
+        r2.cmd(b.cmd, (err, txt) => {
             b.setContent(txt);
             screen.render();
         });
@@ -343,30 +345,38 @@ function layout(style) {
 function uiNewFrame(r2, cmd, opts) {
     const box = newBox(cmd, opts || {
         width: 80,
-        height: '40%'
+        height: '60%'
     });
-    if (cmd && box.cmd) {
-        r2.cmd(box.cmd, (txt) => {
-            box.setContent(txt);
-            screen.render();
-        });
-    }
     box.setContent('Loading...');
+    if (cmd && box.cmd) {
+        refreshBox (r2, box);
+    }
     box.focus();
     screen.append(box);
     screen.render();
     return box;
 }
 
-function refreshCurrentBox(r2) {
-    const box = screen.focused;
-    if (!box) return;
-    r2.cmd(box.cmd, (txt) => {
+function refreshBox(r2, box) {
+    if (!box || !box.cmd) {
+        return;
+    }
+    r2.cmd(box.cmd, (err, txt) => {
         box.setContent(txt);
         screen.render();
     });
 }
 
+function refreshCurrentBox(r2) {
+    return refreshBox(r2, screen.focused);
+}
+
+function refreshAllBoxes(r2, box) {
+    for (let box of screen.children) {
+        refreshBox(r2, box);
+    }
+}
+
 function keysHelp() {
     return `blessr2 keybindings
 ===================
@@ -506,6 +516,10 @@ function prevWindow() {
     screen.render();
 }
 
+function seekToLine(r2, box) {
+    return activateLine(r2, box);
+}
+
 function activateLine(r2, box) {
     if (box) {
         const item = box.items ? box.items[box.selected] : undefined;
@@ -516,7 +530,7 @@ function activateLine(r2, box) {
             const at = parseInt(line.substring(addr), 16);
             const isCode = true; //item.cmd && item.cmd.indexOf && item.cmd.indexOf('pd') != -1;
             if (isCode) {
-                r2.cmd('e scr.color=0;ao@' + at + ';e scr.color=1', (txt) => {
+                r2.cmd('e scr.color=0;ao@' + at + ';e scr.color=1', (err, txt) => {
                     let obj = {}
                     txt.split('\n').forEach((x) => {
                         const ab = x.split(': ');
@@ -538,22 +552,25 @@ function activateLine(r2, box) {
 }
 
 function stepInto(r2, box) {
-    r2.cmd(config.debug ? 'ds;dr*' : 'aes;.aer*', (cmds) => {
+    r2.cmd(config.debug ? 'ds;dr*' : 'aes;.aer*', (err, cmds) => {
         r2.cmd(cmds.split('\n').join(';'));
         if (!box) box = bgbox;
-        r2.cmd(box.cmd, (txt) => {
+        r2.cmd(box.cmd, (err, txt) => {
             box.setContent(txt);
             screen.render();
-            r2.cmd(bgbox.cmd, (txt) => {
+            r2.cmd(bgbox.cmd, (err, txt) => {
                 bgbox.setContent(txt);
                 screen.render();
+refreshAllBoxes(r2);
             });
+/*
             if (regs !== undefined) {
                 r2.cmd(regs.cmd, (txt) => {
                     regs.setContent(txt);
                     screen.render();
                 });
             }
+*/
         });
     });
     screen.render();
@@ -587,7 +604,7 @@ function gotoOffset(r2, val, box, nostack) {
     if (offsetStack) {
         offsetStack.push(val);
     }
-    r2.cmd('s ' + val + ';' + box.cmd, (txt) => {
+    r2.cmd('s ' + val + ';' + box.cmd, (err, txt) => {
         box.setContent(txt);
         box.setScroll(0);
         box.selected = 0;
@@ -632,9 +649,18 @@ function handleKeys(r2) {
         ['a', () => {
             uiNewFrame(r2, 'af;agf');
         }],
-        ['n', nextWindow],
-        ['S-n', prevWindow],
-        ['s', stepInto],
+        ['n', () => {
+            nextWindow();
+        }],
+        ['tab', () => {
+            nextWindow();
+        }],
+        ['S-n', () => {
+            prevWindow();
+        }],
+        ['s', () => {
+            stepInto(r2, screen.focused);
+        }],
         [';', () => {
             addComment(r2, screen.focused);
         }],
@@ -642,10 +668,10 @@ function handleKeys(r2) {
             uiQuestion('String', 'String to search', (val) => {
                 let box = uiNewFrame(r2, val);
                 box.setContent('Loading...');
-                r2.cmd('/ ' + val, (txt) => {
+                r2.cmd('/ ' + val, (err, txt) => {
                     box.setContent(txt);
                     screen.render();
-                    r2.cmd('fs searches;f', (txt) => {
+                    r2.cmd('fs searches;f', (err, txt) => {
                         box.setContent('Search for: "' + val + '":\n\n' + txt);
                         screen.render();
                     });
@@ -666,7 +692,7 @@ function handleKeys(r2) {
         ['S-a', () => {
             r2.cmd('af', () => {
                 let box = screen.focused;
-                r2.cmd(box.cmd, (txt) => {
+                r2.cmd(box.cmd, (err, txt) => {
                     box.setContent(txt);
                     screen.render();
                 });
@@ -674,7 +700,7 @@ function handleKeys(r2) {
         }],
         [':', () => {
             uiQuestion('Input', 'Command to run', (val) => {
-                r2.cmd(bgbox.cmd = val, (txt) => {
+                r2.cmd(bgbox.cmd = val, (err, txt) => {
                     bgbox.setContent(txt);
                     screen.render();
                 });
@@ -682,11 +708,11 @@ function handleKeys(r2) {
         }],
         ['!', () => {
             uiQuestion('Input', 'Command to run', (val) => {
-                r2.cmd(val, (txt) => {
+                r2.cmd(val, (err, txt) => {
                     uiNewFrame(r2, val);
                     const box = screen.focused;
                     if (box) {
-                        r2.cmd(box.cmd, (x) => {
+                        r2.cmd(box.cmd, (err, x) => {
                             box.setContent(x);
                         });
                     }
@@ -714,6 +740,9 @@ function handleKeys(r2) {
             box.setContent(keysHelp());
             screen.render();
         }],
+        ['S-r', () => {
+            refreshAllBoxes(r2);
+        }],
         ['S-e', () => {
             let ef = uiNewFrame(r2, 'e??', {
                 width: '100%',
@@ -729,7 +758,7 @@ function handleKeys(r2) {
                 screen.render();
             } else {
                 uiQuestion('Eval Config', 'key=value', (val) => {
-                    r2.cmd('e ' + val, (txt) => {
+                    r2.cmd('e ' + val, (err, txt) => {
                         screen.render();
                     });
                 });
@@ -753,7 +782,7 @@ function handleKeys(r2) {
             });
             screen.append(box);
             uiQuestion('Offset', 'Where to go?', (val) => {
-                r2.cmd('s ' + val + ';' + box.cmd, (txt) => {
+                r2.cmd('s ' + val + ';' + box.cmd, (err, txt) => {
                     box.setContent(txt);
                     screen.render();
                 });
@@ -1038,11 +1067,14 @@ function handleMouse(r2) {
     });
 }
 
-function main(r2) {
-    config.theme && r2.cmd("ecr");
-    handleKeys(r2);
-    handleMouse(r2);
-    walkInto(r2, 'entry0');
+function main(err, r2) {
+  if (err) {
+    throw err;
+  }
+  config.theme && r2.cmd("ecr");
+  handleKeys(r2);
+  handleMouse(r2);
+  walkInto(r2, 'entry0');
 }
 
 /* main */

blessr2/package.json

@@ -1,11 +1,11 @@
 {
   "name": "blessr2",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "bless-based ui for radare2",
   "main": "index.js",
   "repository": {
     "type": "git",
-    "url": "https://github.com/radare/radare2-bindings.git"
+    "url": "https://github.com/radareorg/radare2-bindings.git"
   },
   "keywords": [
     "radare",
@@ -24,7 +24,7 @@
   },
   "license": "LGPL-3.0",
   "bugs": {
-    "url": "https://github.com/radare/radare2-extras/issues"
+    "url": "https://github.com/radareorg/radare2-extras/issues"
   },
   "homepage": "http://www.radare.org",
   "devDependencies": {

bpf/Makefile

@@ -0,0 +1,31 @@
+R2_PLUGIN_PATH=$(shell r2 -hh|grep LIBR_PLUGINS|awk '{print $$2}')
+R2_INCLUDE_PATH=$(shell r2 -hh|grep INCDIR|awk '{print $$2}')
+R2_LIB_PATH=$(shell r2 -hh|grep LIBDIR|awk '{print $$2}')
+CFLAGS=-g -fPIC
+CFLAGS+=-I$(R2_INCLUDE_PATH)
+SUDO=sudo
+
+LDFLAGS=-shared -L$(R2_LIB_PATH) -lr_util -lr_parse -lr_syscall
+
+EXT_SO=$(shell r2 -hh|grep LIBEXT|awk '{print $$2}')
+
+CC_ASM=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_asm)
+CC_ANA=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_anal)
+CC_BIN=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_bin) -lr_magic
+CC_COR=$(CC) $(CFLAGS) $(LDFLAGS) $(shell pkg-config --libs r_core)
+
+all:
+	$(CC_ASM) -o asm_bpf.$(EXT_SO) asm_bpf.c
+	$(CC_ANA) -o anal_bpf.$(EXT_SO) anal_bpf.c
+	$(CC_BIN) -o bin_bpf.$(EXT_SO) bin_bpf.c
+#	$(CC_COR) -o bpf_core.$(EXT_SO) bpf_core.c
+
+install: all
+	$(SUDO) cp -f *.$(EXT_SO) $(R2_PLUGIN_PATH)
+
+uninstall:
+	for a in *.$(EXT_SO) ; do rm -f $(R2_PLUGIN_PATH)/$$a ; done
+
+clean:
+	rm -f *.$(EXT_SO)
+	rm -rf *.$(EXT_SO).dSYM

bpf/README.md

@@ -0,0 +1,54 @@
+#BPF architecture for radare2
+
+This is meant to add support for Berkeley Packet Filter in radare2, with full [ESIL](https://radare.gitbooks.io/radare2book/content/esil.html) emulation. The main purpose is to ease the analysis of existing filters encountered in reverse engineering, but can also aid filter development through ESIL emulation.
+
+## Components
+
+It is composed by three plugins:
+
+* **asm_bpf** is the disassembler, i'm planning to add also assembler functionality, but for now it's only disassembler - it is mostly ripped from bpf_dbg.c in the Linux kernel
+* **anal_bpf** this is the major contribution of this package, i.e. the analysis plugin which translates everything to ESIL and permits to emulate it completely
+* **bin_bpf** is a placeholder, not sure if it's useful at all since there isn't a specific file format - i'm using it just to remember that data is represented big endian by enforcing this information
+
+## Installing using r2pm
+
+This plugin is available in latest r2pm, therefore can be installed simply by:
+
+```
+r2pm -i bpf
+```
+
+## Building manually
+
+In unix system (tested on mac, but should work in Linux or *BSD out of the box) it should be as easy as doing:
+
+```bash
+make install
+```
+
+There are two known warnings:
+
+* be sure to have the latest [radare2 from git](https://github.com/radareorg/radare2)
+* on mac systems radare2 should be installed with sys/install.sh (and not sys/user.sh) because the Makefile relies on a properly working `pkg-config`
+
+## Example
+
+The provided [bpf.bin](bpf.bin) is ripped from the [berkeley crackme](http://crackmes.de/users/kwisatz_haderach/berkeley/), here is an example session:
+
+[![asciicast](https://asciinema.org/a/1q8oq25bjpp00aut5v5sd4sez.png)](https://asciinema.org/a/1q8oq25bjpp00aut5v5sd4sez)
+
+Moreover, i wrote an [r2pipe script](https://github.com/mrmacete/r2scripts/tree/master/bpf-test/bpftest.py) able to read a pcap file, iterate packets, and test them against the filter by using ESIL emulation.
+
+Here is a not-so-clear live action trying to explain the steps of the above python script:
+
+[![asciicast](https://asciinema.org/a/e22kxl5wncmcnqfvseq0k6dxj.png)](https://asciinema.org/a/e22kxl5wncmcnqfvseq0k6dxj)
+
+## Testing
+
+There's a [python script](https://github.com/mrmacete/r2scripts/tree/master/bpf-test/testtool.py) which parses the Linux kernel's BPF test suite and runs it on radare2's emulated BPF using r2pipe. Until now, all the test which doesn't involve kernel emulation are passing (for the CLASSIC bpf test category only).
+
+If you have collections of test cases you can disclose they're welcome, please open an issue or just PR a test script.
+
+## License
+
+Since most of asm_bpf.c is ripped from Linux kernel, it's licensed on GPLv2.

bpf/anal_bpf.c

@@ -0,0 +1,538 @@
+/*
+ *
+ * Copyright 2015 - mrmacete <[email protected]>
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
+#include <string.h>
+#include <r_types.h>
+#include <r_lib.h>
+#include <r_asm.h>
+#include <r_anal.h>
+#include "bpf.h"
+
+#define EMIT_CJMP(op, addr, f)\
+	(op)->type = R_ANAL_OP_TYPE_CJMP;\
+	(op)->jump = (addr) + 8 + (st8) (f)->jt * 8;\
+	(op)->fail = (addr) + 8 + (st8) (f)->jf * 8;
+
+#define EMIT_LOAD(op, addr, size)\
+	(op)->type = R_ANAL_OP_TYPE_LOAD;\
+	(op)->ptr = (addr);\
+	(op)->ptrsize = (size);
+
+#define NEW_SRC_DST(op)\
+	(op)->src[0] = r_anal_value_new ();\
+	(op)->dst = r_anal_value_new ();
+
+#define SET_REG_SRC_DST(op, _src, _dst)\
+	NEW_SRC_DST ((op));\
+	(op)->src[0]->reg = r_reg_get (anal->reg, (_src), R_REG_TYPE_GPR);\
+	(op)->dst->reg = r_reg_get (anal->reg, (_dst), R_REG_TYPE_GPR);
+
+#define SET_REG_DST_IMM(op, _dst, _imm)\
+	NEW_SRC_DST ((op));\
+	(op)->dst->reg = r_reg_get (anal->reg, (_dst), R_REG_TYPE_GPR);\
+	(op)->src[0]->imm = (_imm);
+
+#define SET_A_SRC(op)\
+	(op)->src[0] = r_anal_value_new ();\
+	(op)->src[0]->reg = r_reg_get (anal->reg, "A", R_REG_TYPE_GPR);
+
+#define SET_A_DST(op)\
+	(op)->dst = r_anal_value_new ();\
+	(op)->dst->reg = r_reg_get (anal->reg, "A", R_REG_TYPE_GPR);
+
+#define INSIDE_M(k) ((k) >= 0 && (k) <= 16)
+
+static bool bpf_int_exit(RAnalEsil *esil, ut32 interrupt, void *user);
+RAnalEsilInterruptHandler ih = { 0, NULL, NULL, &bpf_int_exit, NULL };
+
+static const char *M[] = {
+	"M[0]",
+	"M[1]",
+	"M[2]",
+	"M[3]",
+	"M[4]",
+	"M[5]",
+	"M[6]",
+	"M[7]",
+	"M[8]",
+	"M[9]",
+	"M[10]",
+	"M[11]",
+	"M[12]",
+	"M[13]",
+	"M[14]",
+	"M[15]"
+};
+
+static int bpf_anal(RAnal *anal, RAnalOp *op, ut64 addr,
+	const ut8 *data, int len) {
+	RBpfSockFilter *f = (RBpfSockFilter *)data;
+	memset (op, '\0', sizeof (RAnalOp));
+	op->jump = UT64_MAX;
+	op->fail = UT64_MAX;
+	op->ptr = op->val = UT64_MAX;
+	op->type = R_ANAL_OP_TYPE_UNK;
+	op->size = 8;
+	op->addr = addr;
+
+	r_strbuf_init (&op->esil);
+
+	switch (f->code) {
+	case BPF_RET | BPF_A:
+		op->type = R_ANAL_OP_TYPE_RET;
+		esilprintf (op, "A,R0,=,0,$");
+		break;
+	case BPF_RET | BPF_K:
+	case BPF_RET | BPF_X:
+		op->type = R_ANAL_OP_TYPE_RET;
+		if (BPF_SRC (f->code) == BPF_K) {
+			esilprintf (op, "%" PFMT64d ",R0,=,0,$", f->k);
+		} else if (BPF_SRC (f->code) == BPF_X) {
+			esilprintf (op, "X,R0,=,0,$");
+		}
+		break;
+	case BPF_MISC_TAX:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		SET_REG_SRC_DST (op, "A", "X");
+		esilprintf (op, "A,X,=");
+		break;
+	case BPF_MISC_TXA:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		SET_REG_SRC_DST (op, "X", "A");
+		esilprintf (op, "X,A,=");
+		break;
+	case BPF_ST:
+		if (INSIDE_M (f->k)) {
+			op->type = R_ANAL_OP_TYPE_MOV;
+			SET_REG_SRC_DST (op, "A", M[f->k]);
+			esilprintf (op, "A,M[%" PFMT64d "],=", f->k);
+		} else {
+			op->type = R_ANAL_OP_TYPE_ILL;
+		}
+		break;
+	case BPF_STX:
+		if (INSIDE_M (f->k)) {
+			op->type = R_ANAL_OP_TYPE_MOV;
+			SET_REG_SRC_DST (op, "X", M[f->k]);
+			esilprintf (op, "X,M[%" PFMT64d "],=", f->k);
+		} else {
+			op->type = R_ANAL_OP_TYPE_ILL;
+		}
+		break;
+	case BPF_LD_W | BPF_LEN:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		SET_REG_SRC_DST (op, "len", "A");
+		esilprintf (op, "len,A,=", f->k);
+		break;
+	case BPF_LDX | BPF_LEN:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		SET_REG_SRC_DST (op, "len", "X");
+		esilprintf (op, "len,X,=", f->k);
+		break;
+	case BPF_LD_W | BPF_ABS:
+		EMIT_LOAD (op, anal->gp + f->k, 4);
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",>,?{,0,R0,=,0,$,BREAK,},%" PFMT64d ",[4],A,=",
+			f->k + 4, op->ptr);
+		break;
+	case BPF_LD_H | BPF_ABS:
+		EMIT_LOAD (op, anal->gp + f->k, 2);
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",>,?{,0,R0,=,0,$,BREAK,},"
+			"%" PFMT64d ",[2],A,=",
+			f->k + 2, op->ptr);
+		break;
+	case BPF_LD_B | BPF_ABS:
+		EMIT_LOAD (op, anal->gp + f->k, 1);
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",>,?{,0,R0,=,0,$,BREAK,},"
+			"%" PFMT64d ",[1],A,=",
+			f->k + 1, op->ptr);
+		break;
+	case BPF_LD_W | BPF_IND:
+		op->type = R_ANAL_OP_TYPE_LOAD;
+		op->ptrsize = 4;
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",X,+,0xffffffff,&,>,?{,0,R0,=,0,$,BREAK,},"
+			"%" PFMT64d ",X,+,0xffffffff,&,[4],A,=",
+			(st32)f->k + 4, anal->gp + (st32)f->k);
+		break;
+	case BPF_LD_H | BPF_IND:
+		op->type = R_ANAL_OP_TYPE_LOAD;
+		op->ptrsize = 2;
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",X,+,0xffffffff,&,>,?{,0,R0,=,0,$,BREAK,},"
+			"%" PFMT64d ",X,+,0xffffffff,&,[2],A,=",
+			(st32)f->k + 2, anal->gp + (st32)f->k);
+		break;
+	case BPF_LD_B | BPF_IND:
+		op->type = R_ANAL_OP_TYPE_LOAD;
+		op->ptrsize = 1;
+		SET_A_DST (op);
+		esilprintf (op,
+			"len,%" PFMT64d ",X,+,0xffffffff,&,>,?{,0,R0,=,0,$,BREAK,},"
+			"%" PFMT64d ",X,+,0xffffffff,&,[1],A,=",
+			(st32)f->k + 1, anal->gp + (st32)f->k);
+		break;
+	case BPF_LD | BPF_IMM:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->val = f->k;
+		SET_REG_DST_IMM (op, "A", f->k);
+		esilprintf (op, "0x%08" PFMT64x ",A,=", f->k);
+		break;
+	case BPF_LDX | BPF_IMM:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->val = f->k;
+		SET_REG_DST_IMM (op, "X", f->k);
+		esilprintf (op, "0x%08" PFMT64x ",X,=", f->k);
+		break;
+	case BPF_LDX_B | BPF_MSH:
+		op->type = R_ANAL_OP_TYPE_LOAD;
+		op->ptrsize = 1;
+		op->ptr = anal->gp + f->k;
+		SET_A_DST (op);
+		esilprintf (op, "%" PFMT64d ",[1],0xf,&,4,*,X,=", op->ptr);
+		break;
+	case BPF_LD | BPF_MEM:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		if (INSIDE_M (f->k)) {
+			SET_REG_SRC_DST (op, M[f->k], "A");
+			esilprintf (op, "M[%" PFMT64d "],A,=", f->k);
+		} else {
+			op->type = R_ANAL_OP_TYPE_ILL;
+		}
+		break;
+	case BPF_LDX | BPF_MEM:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		if (INSIDE_M (f->k)) {
+			SET_REG_SRC_DST (op, M[f->k], "X");
+			esilprintf (op, "M[%" PFMT64d "],X,=", f->k);
+		} else {
+			op->type = R_ANAL_OP_TYPE_ILL;
+		}
+		break;
+	case BPF_JMP_JA:
+		op->type = R_ANAL_OP_TYPE_JMP;
+		op->jump = addr + 8 + f->k * 8;
+		esilprintf (op, "%" PFMT64d ",pc,=", op->jump);
+
+		break;
+	case BPF_JMP_JGT | BPF_X:
+	case BPF_JMP_JGT | BPF_K:
+		EMIT_CJMP (op, addr, f);
+		op->cond = R_ANAL_COND_GT;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			esilprintf (op,
+				"%" PFMT64d ",A,>,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->val, op->jump, op->fail);
+		} else if (BPF_SRC (f->code) == BPF_X) {
+			esilprintf (op,
+				"X,A,>,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->jump, op->fail);
+		} else {
+			op->type = R_ANAL_OP_TYPE_ILL;
+		}
+		break;
+	case BPF_JMP_JGE | BPF_X:
+	case BPF_JMP_JGE | BPF_K:
+		EMIT_CJMP (op, addr, f);
+		op->cond = R_ANAL_COND_GE;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			esilprintf (op,
+				"%" PFMT64d ",A,>=,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->val, op->jump, op->fail);
+		} else {
+			esilprintf (op,
+				"X,A,>=,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->jump, op->fail);
+		}
+		break;
+	case BPF_JMP_JEQ | BPF_X:
+	case BPF_JMP_JEQ | BPF_K:
+		EMIT_CJMP (op, addr, f);
+		op->cond = R_ANAL_COND_EQ;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			esilprintf (op,
+				"%" PFMT64d ",A,==,$z,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->val, op->jump, op->fail);
+		} else {
+			esilprintf (op,
+				"X,A,==,$z,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->jump, op->fail);
+		}
+		break;
+	case BPF_JMP_JSET | BPF_X:
+	case BPF_JMP_JSET | BPF_K:
+		EMIT_CJMP (op, addr, f);
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			esilprintf (op,
+				"%" PFMT64d ",A,&,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->val, op->jump, op->fail);
+		} else {
+			esilprintf (op,
+				"X,A,&,!,?{,%" PFMT64d ",pc,=,BREAK,},%" PFMT64d ",pc,=",
+				op->val, op->jump, op->fail);
+		}
+		break;
+	case BPF_ALU_NEG:
+		op->type = R_ANAL_OP_TYPE_NOT;
+		esilprintf (op, "A,0,-,A,=");
+		SET_REG_SRC_DST (op, "A", "A");
+		break;
+	case BPF_ALU_LSH | BPF_X:
+	case BPF_ALU_LSH | BPF_K:
+		op->type = R_ANAL_OP_TYPE_SHL;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,<<=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,<<=");
+		}
+		break;
+	case BPF_ALU_RSH | BPF_X:
+	case BPF_ALU_RSH | BPF_K:
+		op->type = R_ANAL_OP_TYPE_SHR;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,>>=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,>>=");
+		}
+		break;
+	case BPF_ALU_ADD | BPF_X:
+	case BPF_ALU_ADD | BPF_K:
+		op->type = R_ANAL_OP_TYPE_ADD;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", op->val);
+			esilprintf (op, "%" PFMT64d ",A,+=", op->val);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,+=");
+		}
+		break;
+	case BPF_ALU_SUB | BPF_X:
+	case BPF_ALU_SUB | BPF_K:
+		op->type = R_ANAL_OP_TYPE_SUB;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", op->val);
+			esilprintf (op, "%" PFMT64d ",A,-=", op->val);
+
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,-=");
+		}
+		break;
+	case BPF_ALU_MUL | BPF_X:
+	case BPF_ALU_MUL | BPF_K:
+		op->type = R_ANAL_OP_TYPE_MUL;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,*=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,*=");
+		}
+		break;
+	case BPF_ALU_DIV | BPF_X:
+	case BPF_ALU_DIV | BPF_K:
+		op->type = R_ANAL_OP_TYPE_DIV;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			if (f->k == 0) {
+				esilprintf (op, "0,R0,=,0,$");
+			} else {
+				esilprintf (op, "%" PFMT64d ",A,/=", f->k);
+			}
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "0,X,==,$z,?{,0,R0,=,0,$,BREAK,},X,A,/=");
+		}
+		break;
+	case BPF_ALU_MOD | BPF_X:
+	case BPF_ALU_MOD | BPF_K:
+		op->type = R_ANAL_OP_TYPE_MOD;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			if (f->k == 0) {
+				esilprintf (op, "0,R0,=,0,$");
+			} else {
+				esilprintf (op, "%" PFMT64d ",A,%%=", f->k);
+			}
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "0,X,==,$z,?{,0,R0,=,0,$,BREAK,},X,A,%%=");
+		}
+		break;
+	case BPF_ALU_AND | BPF_X:
+	case BPF_ALU_AND | BPF_K:
+		op->type = R_ANAL_OP_TYPE_AND;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,&=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,&=");
+		}
+		break;
+	case BPF_ALU_OR | BPF_X:
+	case BPF_ALU_OR | BPF_K:
+		op->type = R_ANAL_OP_TYPE_OR;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,|=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,|,A,=");
+		}
+		break;
+	case BPF_ALU_XOR | BPF_X:
+	case BPF_ALU_XOR | BPF_K:
+		op->type = R_ANAL_OP_TYPE_XOR;
+		if (BPF_SRC (f->code) == BPF_K) {
+			op->val = f->k;
+			SET_REG_DST_IMM (op, "A", f->k);
+			esilprintf (op, "%" PFMT64d ",A,^=", f->k);
+		} else {
+			SET_REG_SRC_DST (op, "X", "A");
+			esilprintf (op, "X,A,^=");
+		}
+		break;
+	default:
+		op->type = R_ANAL_OP_TYPE_ILL;
+		break;
+	}
+
+	return op->size;
+}
+
+static int set_reg_profile(RAnal *anal) {
+	const char *p =
+		"=PC    pc\n"
+		"gpr    A        .32 0    0\n"
+		"gpr    X        .32 4    0\n"
+		"gpr    M[0]     .32 8    0\n"
+		"gpr    M[1]     .32 12   0\n"
+		"gpr    M[2]     .32 16   0\n"
+		"gpr    M[3]     .32 20   0\n"
+		"gpr    M[4]     .32 24   0\n"
+		"gpr    M[5]     .32 28   0\n"
+		"gpr    M[6]     .32 32   0\n"
+		"gpr    M[7]     .32 36   0\n"
+		"gpr    M[8]     .32 40   0\n"
+		"gpr    M[9]     .32 44   0\n"
+		"gpr    M[10]    .32 48   0\n"
+		"gpr    M[11]    .32 52   0\n"
+		"gpr    M[12]    .32 56   0\n"
+		"gpr    M[13]    .32 60   0\n"
+		"gpr    M[14]    .32 64   0\n"
+		"gpr    M[15]    .32 68   0\n"
+		"gpr    pc       .32 72   0\n"
+		"gpr    len      .32 76   0\n"
+		"gpr    R0       .32 80   0\n"
+		"gpr    R1       .32 84   0\n"
+		"gpr    R2       .32 88   0\n"
+		"gpr    R3       .32 92   0\n"
+		"gpr    R4       .32 96   0\n"
+		"gpr    R5       .32 100  0\n";
+	return r_reg_set_profile_string (anal->reg, p);
+}
+
+static bool bpf_int_exit(RAnalEsil *esil, ut32 interrupt, void *user) {
+	int syscall;
+	ut64 r0;
+	if (!esil || (interrupt != 0x0))
+		return false;
+	r_anal_esil_reg_read (esil, "R0", &r0, NULL);
+	if (r0 == 0) {
+		esil->anal->cb_printf ("; BPF result: DROP value: %d\n", (int)r0);
+		eprintf ("BPF result: DROP value: %d\n", (int)r0);
+	} else {
+		esil->anal->cb_printf ("; BPF result: ACCEPT value: %d\n", (int)r0);
+		eprintf ("BPF result: ACCEPT value: %d\n", (int)r0);
+	}
+	return true;
+}
+
+static int esil_bpf_init(RAnalEsil *esil) {
+	if (!esil)
+		return false;
+	RAnalEsilInterrupt *intr = r_anal_esil_interrupt_new (esil, 0, &ih);
+	r_anal_esil_set_interrupt (esil, intr);
+	return true;
+}
+
+static int esil_bpf_fini(RAnalEsil *esil) {
+	return true;
+}
+
+struct r_anal_plugin_t r_anal_plugin_bpf = {
+	.name = "bpf",
+	.desc = "Berkely packet filter analysis plugin",
+	.license = "GPLv2",
+	.arch = "bpf",
+	.bits = 32,
+	.esil = true,
+	.init = NULL,
+	.fini = NULL,
+	.reset_counter = NULL,
+	.archinfo = NULL,
+	.op = &bpf_anal,
+	.bb = NULL,
+	.fcn = NULL,
+	.analyze_fns = NULL,
+	.op_from_buffer = NULL,
+	.bb_from_buffer = NULL,
+	.fn_from_buffer = NULL,
+	.analysis_algorithm = NULL,
+	.set_reg_profile = &set_reg_profile,
+	.fingerprint_bb = NULL,
+	.fingerprint_fcn = NULL,
+	.diff_bb = NULL,
+	.diff_fcn = NULL,
+	.diff_eval = NULL,
+	.pre_anal = NULL,
+	.pre_anal_fn_cb = NULL,
+	.pre_anal_op_cb = NULL,
+	.post_anal_op_cb = NULL,
+	.pre_anal_bb_cb = NULL,
+	.post_anal_bb_cb = NULL,
+	.post_anal_fn_cb = NULL,
+	.post_anal = NULL,
+	.revisit_bb_anal = NULL,
+	.cmd_ext = NULL,
+	.esil_init = &esil_bpf_init,
+	.esil_post_loop = NULL,
+	.esil_trap = NULL,
+	.esil_fini = &esil_bpf_fini
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ANAL,
+	.data = &r_anal_plugin_bpf,
+	.version = R2_VERSION
+};
+#endif

bpf/asm_bpf.c

@@ -0,0 +1,767 @@
+/*
+ * Most of this is copied and pasted from linux source (except
+ * for the assembler part).
+ *
+ * Copyright 2015 - mrmacete <[email protected]>
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
+#include <r_types.h>
+#include <r_util.h>
+#include <r_lib.h>
+#include <r_asm.h>
+#include "bpf.h"
+
+static int disassemble(RAsm *a, RAsmOp *r_op, const ut8 *buf, int len) {
+	const char *op, *fmt;
+	RBpfSockFilter *f = (RBpfSockFilter *)buf;
+	int val = f->k;
+	char vbuf[256];
+
+	switch (f->code) {
+	case BPF_RET | BPF_K:
+		op = r_bpf_op_table[BPF_RET];
+		fmt = "%#x";
+		break;
+	case BPF_RET | BPF_A:
+		op = r_bpf_op_table[BPF_RET];
+		fmt = "a";
+		break;
+	case BPF_RET | BPF_X:
+		op = r_bpf_op_table[BPF_RET];
+		fmt = "x";
+		break;
+	case BPF_MISC_TAX:
+		op = r_bpf_op_table[BPF_MISC_TAX];
+		fmt = "";
+		break;
+	case BPF_MISC_TXA:
+		op = r_bpf_op_table[BPF_MISC_TXA];
+		fmt = "";
+		break;
+	case BPF_ST:
+		op = r_bpf_op_table[BPF_ST];
+		fmt = "M[%d]";
+		break;
+	case BPF_STX:
+		op = r_bpf_op_table[BPF_STX];
+		fmt = "M[%d]";
+		break;
+	case BPF_LD_W | BPF_ABS:
+		op = r_bpf_op_table[BPF_LD_W];
+		fmt = "[%d]";
+		break;
+	case BPF_LD_H | BPF_ABS:
+		op = r_bpf_op_table[BPF_LD_H];
+		fmt = "[%d]";
+		break;
+	case BPF_LD_B | BPF_ABS:
+		op = r_bpf_op_table[BPF_LD_B];
+		fmt = "[%d]";
+		break;
+	case BPF_LD_W | BPF_LEN:
+		op = r_bpf_op_table[BPF_LD_W];
+		fmt = "len";
+		break;
+	case BPF_LD_W | BPF_IND:
+		op = r_bpf_op_table[BPF_LD_W];
+		fmt = "[x+%d]";
+		break;
+	case BPF_LD_H | BPF_IND:
+		op = r_bpf_op_table[BPF_LD_H];
+		fmt = "[x+%d]";
+		break;
+	case BPF_LD_B | BPF_IND:
+		op = r_bpf_op_table[BPF_LD_B];
+		fmt = "[x+%d]";
+		break;
+	case BPF_LD | BPF_IMM:
+		op = r_bpf_op_table[BPF_LD_W];
+		fmt = "%#x";
+		break;
+	case BPF_LDX | BPF_IMM:
+		op = r_bpf_op_table[BPF_LDX];
+		fmt = "%#x";
+		break;
+	case BPF_LDX | BPF_LEN:
+		op = r_bpf_op_table[BPF_LDX];
+		fmt = "len";
+		break;
+	case BPF_LDX | BPF_ABS:
+		op = r_bpf_op_table[BPF_LDX];
+		fmt = "[%d]";
+		break;
+	case BPF_LDX_B | BPF_MSH:
+		op = r_bpf_op_table[BPF_LDX_B];
+		fmt = "4*([%d]&0xf)";
+		break;
+	case BPF_LD | BPF_MEM:
+		op = r_bpf_op_table[BPF_LD_W];
+		fmt = "M[%d]";
+		break;
+	case BPF_LDX | BPF_MEM:
+		op = r_bpf_op_table[BPF_LDX];
+		fmt = "M[%d]";
+		break;
+	case BPF_JMP_JA:
+		op = r_bpf_op_table[BPF_JMP_JA];
+		fmt = "%d";
+		val = a->pc + 8 + f->k * 8;
+		break;
+	case BPF_JMP_JGT | BPF_X:
+		op = r_bpf_op_table[BPF_JMP_JGT];
+		fmt = "x";
+		break;
+	case BPF_JMP_JGT | BPF_K:
+		op = r_bpf_op_table[BPF_JMP_JGT];
+		fmt = "%#x";
+		break;
+	case BPF_JMP_JGE | BPF_X:
+		op = r_bpf_op_table[BPF_JMP_JGE];
+		fmt = "x";
+		break;
+	case BPF_JMP_JGE | BPF_K:
+		op = r_bpf_op_table[BPF_JMP_JGE];
+		fmt = "%#x";
+		break;
+	case BPF_JMP_JEQ | BPF_X:
+		op = r_bpf_op_table[BPF_JMP_JEQ];
+		fmt = "x";
+		break;
+	case BPF_JMP_JEQ | BPF_K:
+		op = r_bpf_op_table[BPF_JMP_JEQ];
+		fmt = "%#x";
+		break;
+	case BPF_JMP_JSET | BPF_X:
+		op = r_bpf_op_table[BPF_JMP_JSET];
+		fmt = "x";
+		break;
+	case BPF_JMP_JSET | BPF_K:
+		op = r_bpf_op_table[BPF_JMP_JSET];
+		fmt = "%#x";
+		break;
+	case BPF_ALU_NEG:
+		op = r_bpf_op_table[BPF_ALU_NEG];
+		fmt = "";
+		break;
+	case BPF_ALU_LSH | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_LSH];
+		fmt = "x";
+		break;
+	case BPF_ALU_LSH | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_LSH];
+		fmt = "%d";
+		break;
+	case BPF_ALU_RSH | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_RSH];
+		fmt = "x";
+		break;
+	case BPF_ALU_RSH | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_RSH];
+		fmt = "%d";
+		break;
+	case BPF_ALU_ADD | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_ADD];
+		fmt = "x";
+		break;
+	case BPF_ALU_ADD | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_ADD];
+		fmt = "%d";
+		break;
+	case BPF_ALU_SUB | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_SUB];
+		fmt = "x";
+		break;
+	case BPF_ALU_SUB | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_SUB];
+		fmt = "%d";
+		break;
+	case BPF_ALU_MUL | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_MUL];
+		fmt = "x";
+		break;
+	case BPF_ALU_MUL | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_MUL];
+		fmt = "%d";
+		break;
+	case BPF_ALU_DIV | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_DIV];
+		fmt = "x";
+		break;
+	case BPF_ALU_DIV | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_DIV];
+		fmt = "%d";
+		break;
+	case BPF_ALU_MOD | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_MOD];
+		fmt = "x";
+		break;
+	case BPF_ALU_MOD | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_MOD];
+		fmt = "%d";
+		break;
+	case BPF_ALU_AND | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_AND];
+		fmt = "x";
+		break;
+	case BPF_ALU_AND | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_AND];
+		fmt = "%#x";
+		break;
+	case BPF_ALU_OR | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_OR];
+		fmt = "x";
+		break;
+	case BPF_ALU_OR | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_OR];
+		fmt = "%#x";
+		break;
+	case BPF_ALU_XOR | BPF_X:
+		op = r_bpf_op_table[BPF_ALU_XOR];
+		fmt = "x";
+		break;
+	case BPF_ALU_XOR | BPF_K:
+		op = r_bpf_op_table[BPF_ALU_XOR];
+		fmt = "%#x";
+		break;
+	default:
+		op = "invalid";
+		fmt = "%#x";
+		val = f->code;
+		break;
+	}
+
+	memset (vbuf, 0, sizeof (vbuf));
+	snprintf (vbuf, sizeof (vbuf), fmt, val);
+	vbuf[sizeof (vbuf) - 1] = 0;
+
+	if ((BPF_CLASS (f->code) == BPF_JMP && BPF_OP (f->code) != BPF_JA))
+		r_strbuf_setf (&r_op->buf_asm, "%s %s, 0x%08" PFMT64x ", 0x%08" PFMT64x "", op, vbuf,
+			a->pc + 8 + f->jt * 8, a->pc + 8 + f->jf * 8);
+	else r_strbuf_setf (&r_op->buf_asm, "%s %s", op, vbuf);
+
+	return r_op->size = 8;
+}
+
+/* start of ASSEMBLER code */
+
+#define PARSER_MAX_TOKENS 4
+
+#define COPY_AND_RET(a, b)\
+	r_strbuf_setbin (&a, (const ut8 *)b, sizeof (*b) + 1);\
+	return 0;
+
+#define PARSE_FAILURE(message, arg...)\
+	{\
+		eprintf ("PARSE FAILURE: " message "\n", ##arg);\
+		return -1;\
+	}
+
+#define CMP4(tok, n, x, y, z, w)\
+	(tok[n][0] == x && tok[n][1] == y && tok[n][2] == z && tok[n][3] == w)
+
+#define CMP3(tok, n, x, y, z)\
+	(tok[n][0] == x && tok[n][1] == y && tok[n][2] == z)
+
+#define CMP2(tok, n, x, y)\
+	(tok[n][0] == x && tok[n][1] == y)
+
+#define IS_K_TOK(tok, n)\
+	(tok[n][0] == '-' || R_BETWEEN ('0', tok[n][0], '9'))
+
+#define IS_LEN(tok, n)\
+	CMP4 (tok, n, 'l', 'e', 'n', '\0')
+
+#define PARSE_K_OR_FAIL(dst, tok, n)\
+	dst = strtol (&tok[n][0], &end, 0);\
+	if (*end != '\0' && *end != ',')\
+		PARSE_FAILURE ("could not parse k");
+
+#define PARSE_LABEL_OR_FAIL(dst, tok, n)\
+	dst = strtoul (&tok[n][0], &end, 0);\
+	if (*end != '\0' && *end != ',') {\
+		return -1;\
+	}
+
+#define PARSE_OFFSET_OR_FAIL(dst, tok, n, off)\
+	dst = strtoul (&tok[n][off], &end, 10);\
+	if (*end != ']')\
+		PARSE_FAILURE ("could not parse offset value");
+
+#define PARSE_IND_ABS_OR_FAIL(f, tok, n)\
+	if (CMP3 (tok, 1, '[', 'x', '+')) {\
+		f->code = f->code | BPF_IND;\
+		PARSE_OFFSET_OR_FAIL (f->k, tok, 1, 3);\
+		return 0;\
+	} else if (tok[1][0] == '[') {\
+		f->code = f->code | BPF_ABS;\
+		PARSE_OFFSET_OR_FAIL (f->k, tok, 1, 1);\
+		return 0;\
+	}\
+	PARSE_FAILURE ("could not parse addressing mode");
+
+#define PARSE_K_OR_X_OR_FAIL(f, tok)\
+	if (IS_K_TOK (tok, 1)) {\
+		PARSE_K_OR_FAIL (f->k, tok, 1);\
+		f->code = f->code | BPF_K;\
+	} else if (tok[1][0] == 'x' && (tok[1][1] == '\0' || tok[1][1] == ',')) {\
+		f->code = f->code | BPF_X;\
+	} else {\
+		PARSE_FAILURE ("could not parse k or x: %s", tok[1]);\
+	}
+
+#define PARSE_A_OR_X_OR_FAIL(f, tok)\
+	if (tok[1][0] == 'x' && (tok[1][1] == '\0' || tok[1][1] == ',')) {\
+		f->code = f->code | BPF_X;\
+	} else if (tok[1][0] == 'a' && (tok[1][1] == '\0' || tok[1][1] == ',')) {\
+		f->code = f->code | BPF_A;\
+	} else {\
+		PARSE_FAILURE ("could not parse a or x");\
+	}
+
+#define PARSE_JUMP_TARGETS(a, f, tok, count)\
+	PARSE_K_OR_X_OR_FAIL (f, tok);\
+	if (count >= 3) {\
+		PARSE_LABEL_OR_FAIL (label, tok, 2);\
+		f->jt = (st64) (label - a->pc - 8) / 8;\
+		f->jf = (a->pc >> 3) + 1;\
+	}\
+	if (count == 4) {\
+		PARSE_LABEL_OR_FAIL (label, tok, 3);\
+		f->jf = (st64) (label - a->pc - 8) / 8;\
+	}
+
+#define SWAP_JUMP_TARGETS(f)\
+	temp = f->jt;\
+	f->jt = f->jf;\
+	f->jf = temp;
+
+#define ENFORCE_COUNT(count, n)\
+	if (count != n)\
+		PARSE_FAILURE ("invalid argument count, try to omit '#'");
+
+#define ENFORCE_COUNT_GE(count, n)\
+	if (count < n)\
+		PARSE_FAILURE ("invalid argument count, try to omit '#'");
+
+static int assemble_ld(RAsm *a, RAsmOp *op,
+	char *tok[PARSER_MAX_TOKENS], int count, RBpfSockFilter *f) {
+	char *end;
+
+	switch (tok[0][2]) {
+	case '\0':
+		if (CMP2 (tok, 1, 'm', '[')) {
+			f->code = BPF_LD | BPF_MEM;
+			PARSE_OFFSET_OR_FAIL (f->k, tok, 1, 2);
+		} else if (IS_K_TOK (tok, 1)) {
+			f->code = BPF_LD | BPF_IMM;
+			PARSE_K_OR_FAIL (f->k, tok, 1);
+		} else if (IS_LEN (tok, 1)) {
+			f->code = BPF_LD | BPF_LEN;
+		} else {
+			f->code = BPF_LD_W;
+			PARSE_IND_ABS_OR_FAIL (f, tok, 1);
+		}
+		break;
+	case 'i':
+		if (IS_K_TOK (tok, 1)) {
+			f->code = BPF_LD | BPF_IMM;
+			PARSE_K_OR_FAIL (f->k, tok, 1);
+		} else {
+			PARSE_FAILURE ("ldi without k");
+		}
+		break;
+	case 'b':
+		f->code = BPF_LD_B;
+		PARSE_IND_ABS_OR_FAIL (f, tok, 1);
+		break;
+	case 'h':
+		f->code = BPF_LD_H;
+		PARSE_IND_ABS_OR_FAIL (f, tok, 1);
+		break;
+	case 'x':
+		switch (tok[0][3]) {
+		case '\0':
+			if (CMP2 (tok, 1, 'm', '[')) {
+				f->code = BPF_LDX | BPF_MEM;
+				PARSE_OFFSET_OR_FAIL (f->k, tok, 1, 2);
+			} else if (IS_K_TOK (tok, 1)) {
+				f->code = BPF_LDX | BPF_IMM;
+				PARSE_K_OR_FAIL (f->k, tok, 1);
+			} else if (IS_LEN (tok, 1)) {
+				f->code = BPF_LDX | BPF_LEN;
+			} else {
+				f->code = BPF_LDX_W;
+				PARSE_IND_ABS_OR_FAIL (f, tok, 1);
+			}
+			break;
+		case 'i':
+			if (IS_K_TOK (tok, 1)) {
+				f->code = BPF_LDX | BPF_IMM;
+				PARSE_K_OR_FAIL (f->k, tok, 1);
+			} else {
+				PARSE_FAILURE ("ldxi without k");
+			}
+			break;
+		case 'b':
+			f->code = BPF_LDX_B | BPF_MSH;
+			if (sscanf (tok[1], "4*([%d]&0xf)", &f->k) != 1) {
+				PARSE_FAILURE ("invalid nibble addressing");
+			}
+			break;
+		}
+		break;
+	default:
+		PARSE_FAILURE ("unsupported load instruction");
+	}
+
+	return 0;
+}
+
+static int assemble_j(RAsm *a, RAsmOp *op, char *tok[PARSER_MAX_TOKENS],
+	int count, RBpfSockFilter *f) {
+	int label;
+	ut8 temp;
+	char *end;
+
+	if (CMP4 (tok, 0, 'j', 'm', 'p', '\0') ||
+		CMP3 (tok, 0, 'j', 'a', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_JMP_JA;
+		PARSE_LABEL_OR_FAIL (f->k, tok, 1);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'n', 'e', '\0') ||
+		CMP4 (tok, 0, 'j', 'n', 'e', 'q')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JEQ;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		SWAP_JUMP_TARGETS (f);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'e', 'q', '\0')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JEQ;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'l', 't', '\0')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JGE;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		SWAP_JUMP_TARGETS (f);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'l', 'e', '\0')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JGT;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		SWAP_JUMP_TARGETS (f);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'g', 't', '\0')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JGT;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 'g', 'e', '\0')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JGE;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'j', 's', 'e', 't')) {
+		ENFORCE_COUNT_GE (count, 3);
+		f->code = BPF_JMP_JSET;
+		PARSE_JUMP_TARGETS (a, f, tok, count);
+		return 0;
+	}
+
+	return -1;
+}
+
+static int assemble_alu(RAsm *a, RAsmOp *op, char *tok[PARSER_MAX_TOKENS],
+	int count, RBpfSockFilter *f) {
+	char *end;
+
+	if (CMP4 (tok, 0, 'a', 'd', 'd', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_ADD;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 's', 'u', 'b', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_SUB;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'm', 'u', 'l', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_MUL;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'd', 'i', 'v', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_DIV;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'm', 'o', 'd', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_MOD;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'n', 'e', 'g', '\0')) {
+		ENFORCE_COUNT (count, 1);
+		f->code = BPF_ALU_NEG;
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'a', 'n', 'd', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_AND;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP3 (tok, 0, 'o', 'r', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_OR;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'x', 'o', 'r', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_XOR;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'l', 's', 'h', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_LSH;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	if (CMP4 (tok, 0, 'r', 's', 'h', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		f->code = BPF_ALU_RSH;
+		PARSE_K_OR_X_OR_FAIL (f, tok);
+		return 0;
+	}
+
+	return -1;
+}
+
+static int assemble_tok(RAsm *a, RAsmOp *op,
+	char *tok[PARSER_MAX_TOKENS], int count) {
+	char *end;
+	int oplen = 0;
+	RBpfSockFilter f = { 0, 0, 0, 0 };
+	oplen = strnlen (tok[0], 5);
+
+	if (oplen < 2 || oplen > 4) {
+		PARSE_FAILURE ("mnemonic length not valid");
+	}
+
+	if (CMP4 (tok, 0, 't', 'x', 'a', '\0')) {
+		ENFORCE_COUNT (count, 1);
+		f.code = BPF_MISC_TXA;
+		COPY_AND_RET (op->buf, &f);
+	}
+
+	if (CMP4 (tok, 0, 't', 'a', 'x', '\0')) {
+		ENFORCE_COUNT (count, 1);
+		f.code = BPF_MISC_TAX;
+		COPY_AND_RET (op->buf, &f);
+	}
+
+	if (CMP4 (tok, 0, 'r', 'e', 't', '\0')) {
+		ENFORCE_COUNT (count, 2);
+		if (IS_K_TOK (tok, 1)) {
+			f.code = BPF_RET | BPF_K;
+			PARSE_K_OR_FAIL (f.k, tok, 1);
+		} else if (tok[1][0] == 'x') {
+			f.code = BPF_RET | BPF_X;
+		} else if (tok[1][0] == 'a') {
+			f.code = BPF_RET | BPF_A;
+		} else {
+			PARSE_FAILURE ("unsupported ret instruction");
+		}
+		COPY_AND_RET (op->buf, &f);
+	}
+
+	if (CMP2 (tok, 0, 'l', 'd')) {
+		ENFORCE_COUNT (count, 2);
+		if (assemble_ld (a, op, tok, count, &f) == 0) {
+			COPY_AND_RET (op->buf, &f);
+		} else {
+			return -1;
+		}
+	}
+
+	if (CMP2 (tok, 0, 's', 't')) {
+		ENFORCE_COUNT (count, 2);
+		if (tok[0][2] == '\0') {
+			f.code = BPF_ST;
+		} else if (tok[0][2] == 'x') {
+			f.code = BPF_STX;
+		}
+
+		if (CMP2 (tok, 1, 'm', '[')) {
+			PARSE_OFFSET_OR_FAIL (f.k, tok, 1, 2);
+			if (f.k > 15) {
+				PARSE_FAILURE ("mem addressing out of bounds");
+			}
+			COPY_AND_RET (op->buf, &f);
+		} else {
+			PARSE_FAILURE ("invalid store addressing");
+		}
+	}
+
+	if (tok[0][0] == 'j') {
+		if (assemble_j (a, op, tok, count, &f) == 0) {
+			COPY_AND_RET (op->buf, &f);
+		} else {
+			return -1;
+		}
+	}
+
+	if (assemble_alu (a, op, tok, count, &f) == 0) {
+		COPY_AND_RET (op->buf, &f);
+	} else {
+		return -1;
+	}
+}
+
+static void lower_op(char *c) {
+	if ((c[0] <= 'Z') && (c[0] >= 'A')) {
+		c[0] += 0x20;
+	}
+}
+#define R_TRUE 1
+static void normalize(RStrBuf *buf) {
+	int i;
+	char *buf_asm;
+	if (!buf)
+		return;
+	buf_asm = r_strbuf_get (buf);
+
+	/* this normalization step is largely sub-optimal */
+
+	i = strlen (buf_asm);
+	while (strstr (buf_asm, "  ")) {
+		r_str_replace_in (buf_asm, (ut32)i, "  ", " ", R_TRUE);
+	}
+	r_str_replace_in (buf_asm, (ut32)i, " ,", ",", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "[ ", "[", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, " ]", "]", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "( ", "(", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, " )", ")", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "+ ", "+", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, " +", "+", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "* ", "*", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, " *", "*", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "& ", "&", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, " &", "&", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "%", "", R_TRUE);
+	r_str_replace_in (buf_asm, (ut32)i, "#", "", R_TRUE);
+	r_str_do_until_token (lower_op, buf_asm, '\0');
+	r_strbuf_set (buf, buf_asm);
+}
+
+static int assemble(RAsm *a, RAsmOp *op, const char *buf) {
+	char *tok[PARSER_MAX_TOKENS];
+	char tmp[128];
+	int i, j, l;
+	const char *p = NULL;
+	if (!a || !op || !buf) {
+		return 0;
+	}
+
+	r_strbuf_set (&op->buf_asm, buf);
+	normalize (&op->buf_asm);
+
+	// tokenization, copied from profile.c
+	j = 0;
+	p = r_strbuf_get (&op->buf_asm);
+
+	// For every word
+	while (*p) {
+		// Skip the whitespace
+		while (*p == ' ' || *p == '\t') {
+			p++;
+		}
+		// Skip the rest of the line is a comment is encountered
+		if (*p == ';') {
+			while (*p != '\0') {
+				p++;
+			}
+		}
+		// EOL ?
+		if (*p == '\0') {
+			break;
+		}
+		// Gather a handful of chars
+		// Use isgraph instead of isprint because the latter considers ' ' printable
+		for (i = 0; isgraph ((const unsigned char)*p) && i < sizeof (tmp) - 1;) {
+			tmp[i++] = *p++;
+		}
+		tmp[i] = '\0';
+		// Limit the number of tokens
+		if (j > PARSER_MAX_TOKENS - 1) {
+			break;
+		}
+		// Save the token
+		tok[j++] = strdup (tmp);
+	}
+
+	if (j) {
+		if (assemble_tok (a, op, tok, j) < 0) {
+			return -1;
+		}
+
+		// Clean up
+		for (i = 0; i < j; i++) {
+			free (tok[i]);
+		}
+	}
+
+	return op->size = 8;
+}
+
+RAsmPlugin r_asm_plugin_bpf = {
+	.name = "bpf",
+	.desc = "Berkeley Packet Filter disassembler",
+	.license = "GPLv2",
+	.arch = "bpf",
+	.bits = 32,
+	.disassemble = &disassemble,
+	.assemble = &assemble
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_bpf,
+	.version = R2_VERSION
+};
+#endif

bpf/bin_bpf.c

@@ -0,0 +1,98 @@
+/* LGPL3 - Copyright 2015 - mrmacete */
+/* it's a blatant copy of "any" bin plugin from radare, big_endian = 1 */
+
+#include <r_types.h>
+#include <r_util.h>
+#include <r_lib.h>
+#include <r_bin.h>
+#include <r_magic.h>
+
+static char *get_filetype(RBinFile *arch) {
+	ut8 buf[4096] = { 0 };
+	char *res = NULL;
+	RMagic *ck;
+	if (!arch)
+		return NULL;
+	ck = r_magic_new (0);
+	if (ck && arch && arch->buf) {
+		const char *tmp = NULL;
+		r_magic_load (ck, R2_SDB_MAGIC);
+		r_buf_read_at (arch->buf, 0, buf, sizeof (buf));
+		tmp = r_magic_buffer (ck, buf, sizeof (buf));
+		if (tmp)
+			res = strdup (tmp);
+	}
+	r_magic_free (ck);
+	return res;
+}
+
+static RBinInfo *info(RBinFile *arch) {
+	RBinInfo *ret = R_NEW0 (RBinInfo);
+	if (!ret)
+		return NULL;
+	ret->lang = "";
+	ret->file = arch->file ? strdup (arch->file) : NULL;
+	ret->type = get_filetype (arch);
+	ret->has_pi = 0;
+	ret->has_canary = 0;
+	if (R_SYS_BITS & R_SYS_BITS_64) {
+		ret->bits = 64;
+	} else {
+		ret->bits = 32;
+	}
+	ret->big_endian = 1;
+	ret->has_va = 0;
+	ret->has_nx = 0;
+	ret->dbg_info = 0;
+	ret->dbg_info = 0;
+	ret->dbg_info = 0;
+	return ret;
+}
+
+static bool load(RBinFile *arch) {
+	return true;
+}
+
+static int destroy(RBinFile *arch) {
+	return true;
+}
+
+static ut64 baddr(RBinFile *arch) {
+	return 0LL;
+}
+
+struct r_bin_plugin_t r_bin_plugin_bpf = {
+	.name = "bpf",
+	.desc = "Berkeley Packet Filter - raw binary",
+	.license = "LGPL3",
+	.init = NULL,
+	.fini = NULL,
+	.get_sdb = NULL,
+	.load = &load,
+	.load_bytes = NULL,
+	.destroy = &destroy,
+	.baddr = &baddr,
+	.boffset = NULL,
+	.binsym = NULL,
+	.entries = NULL,
+	.sections = NULL,
+	.symbols = NULL,
+	.imports = NULL,
+	.strings = NULL,
+	.info = info,
+	.fields = NULL,
+	.libs = NULL,
+	.relocs = NULL,
+	.dbginfo = NULL,
+	.create = NULL,
+	.write = NULL,
+	.minstrlen = 0,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_BIN,
+	.data = &r_bin_plugin_bpf,
+	.version = R2_VERSION
+};
+#endif

bpf/bpf.h

@@ -0,0 +1,82 @@
+/*
+ * Most of this is copied and pasted from linux kernel source
+ *
+ * Copyright 2015 - mrmacete <[email protected]>
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
+#ifndef _BPF_H_
+#define _BPF_H_
+
+#include "bpf_common.h"
+
+/* defines ripped from linux/filter.h : */
+
+#define         BPF_A           0x10
+#define         BPF_TAX         0x00
+#define         BPF_TXA         0x80
+
+/*  defines ripped from bpf_dbg.c : */
+
+#define BPF_LDX_B	(BPF_LDX | BPF_B)
+#define BPF_LDX_W	(BPF_LDX | BPF_W)
+#define BPF_JMP_JA	(BPF_JMP | BPF_JA)
+#define BPF_JMP_JEQ	(BPF_JMP | BPF_JEQ)
+#define BPF_JMP_JGT	(BPF_JMP | BPF_JGT)
+#define BPF_JMP_JGE	(BPF_JMP | BPF_JGE)
+#define BPF_JMP_JSET	(BPF_JMP | BPF_JSET)
+#define BPF_ALU_ADD	(BPF_ALU | BPF_ADD)
+#define BPF_ALU_SUB	(BPF_ALU | BPF_SUB)
+#define BPF_ALU_MUL	(BPF_ALU | BPF_MUL)
+#define BPF_ALU_DIV	(BPF_ALU | BPF_DIV)
+#define BPF_ALU_MOD	(BPF_ALU | BPF_MOD)
+#define BPF_ALU_NEG	(BPF_ALU | BPF_NEG)
+#define BPF_ALU_AND	(BPF_ALU | BPF_AND)
+#define BPF_ALU_OR	(BPF_ALU | BPF_OR)
+#define BPF_ALU_XOR	(BPF_ALU | BPF_XOR)
+#define BPF_ALU_LSH	(BPF_ALU | BPF_LSH)
+#define BPF_ALU_RSH	(BPF_ALU | BPF_RSH)
+#define BPF_MISC_TAX	(BPF_MISC | BPF_TAX)
+#define BPF_MISC_TXA	(BPF_MISC | BPF_TXA)
+#define BPF_LD_B	(BPF_LD | BPF_B)
+#define BPF_LD_H	(BPF_LD | BPF_H)
+#define BPF_LD_W	(BPF_LD | BPF_W)
+
+static const char * const r_bpf_op_table[] = {
+	[BPF_ST]	= "st",
+	[BPF_STX]	= "stx",
+	[BPF_LD_B]	= "ldb",
+	[BPF_LD_H]	= "ldh",
+	[BPF_LD_W]	= "ld",
+	[BPF_LDX]	= "ldx",
+	[BPF_LDX_B]	= "ldxb",
+	[BPF_JMP_JA]	= "ja",
+	[BPF_JMP_JEQ]	= "jeq",
+	[BPF_JMP_JGT]	= "jgt",
+	[BPF_JMP_JGE]	= "jge",
+	[BPF_JMP_JSET]	= "jset",
+	[BPF_ALU_ADD]	= "add",
+	[BPF_ALU_SUB]	= "sub",
+	[BPF_ALU_MUL]	= "mul",
+	[BPF_ALU_DIV]	= "div",
+	[BPF_ALU_MOD]	= "mod",
+	[BPF_ALU_NEG]	= "neg",
+	[BPF_ALU_AND]	= "and",
+	[BPF_ALU_OR]	= "or",
+	[BPF_ALU_XOR]	= "xor",
+	[BPF_ALU_LSH]	= "lsh",
+	[BPF_ALU_RSH]	= "rsh",
+	[BPF_MISC_TAX]	= "tax",
+	[BPF_MISC_TXA]	= "txa",
+	[BPF_RET]	= "ret",
+};
+
+
+typedef struct r_bpf_sock_filter {	/* Filter block */
+	ut16 	code;   /* Actual filter code */
+	st8		jt;	/* Jump true */
+	st8		jf;	/* Jump false */
+	ut32	k;      /* Generic multiuse field */
+} RBpfSockFilter;
+
+#endif

bpf/bpf_common.h

@@ -0,0 +1,60 @@
+/*
+ * this file is directly copied from linux source
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
+#ifndef _UAPI__LINUX_BPF_COMMON_H__
+#define _UAPI__LINUX_BPF_COMMON_H__
+
+/* Instruction classes */
+#define BPF_CLASS(code) ((code) & 0x07)
+#define		BPF_LD		0x00
+#define		BPF_LDX		0x01
+#define		BPF_ST		0x02
+#define		BPF_STX		0x03
+#define		BPF_ALU		0x04
+#define		BPF_JMP		0x05
+#define		BPF_RET		0x06
+#define		BPF_MISC        0x07
+
+/* ld/ldx fields */
+#define BPF_SIZE(code)  ((code) & 0x18)
+#define		BPF_W		0x00
+#define		BPF_H		0x08
+#define		BPF_B		0x10
+#define BPF_MODE(code)  ((code) & 0xe0)
+#define		BPF_IMM		0x00
+#define		BPF_ABS		0x20
+#define		BPF_IND		0x40
+#define		BPF_MEM		0x60
+#define		BPF_LEN		0x80
+#define		BPF_MSH		0xa0
+
+/* alu/jmp fields */
+#define BPF_OP(code)    ((code) & 0xf0)
+#define		BPF_ADD		0x00
+#define		BPF_SUB		0x10
+#define		BPF_MUL		0x20
+#define		BPF_DIV		0x30
+#define		BPF_OR		0x40
+#define		BPF_AND		0x50
+#define		BPF_LSH		0x60
+#define		BPF_RSH		0x70
+#define		BPF_NEG		0x80
+#define		BPF_MOD		0x90
+#define		BPF_XOR		0xa0
+
+#define		BPF_JA		0x00
+#define		BPF_JEQ		0x10
+#define		BPF_JGT		0x20
+#define		BPF_JGE		0x30
+#define		BPF_JSET        0x40
+#define BPF_SRC(code)   ((code) & 0x08)
+#define		BPF_K		0x00
+#define		BPF_X		0x08
+
+#ifndef BPF_MAXINSNS
+#define BPF_MAXINSNS 4096
+#endif
+
+#endif /* _UAPI__LINUX_BPF_COMMON_H__ */

checkm8/README.md

@@ -0,0 +1,11 @@
+This is the r2 plugin to read/write memory using the checkm8 exploit.
+
+1. Clone https://github.com/axi0mX/ipwndfu
+2. Copy this file into the root directory of this repository
+3. r2 -I r2io.py ipwndfu://
+4. enjoy
+
+NOTES
+
+* This is very unstable, reading on unallocated regions results in device reboot
+* Requires python3 .. so maybe better use @geohot's fork

checkm8/r2io.py

@@ -0,0 +1,65 @@
+# iOS pwndfu checkm8 io plugin for radare2
+# ========================================
+#
+#  -- pancake @ nopcode.org
+#
+# Usage:
+#   r2 -I test-py-io.py pwndfu://
+#
+# The r2lang.plugin function exposes a way to register new plugins
+# into the RCore instance. This API is only available from RLang.
+# You must call with with '#!python test.py' or 'r2 -i test.py ..'
+
+import r2lang
+from dfuexec import *
+
+FAKESIZE = 512
+
+device = None
+
+def pyio(a):
+	def _open(path, rw, perm):
+		global device
+		device = dfu.acquire_device()
+		serial_number = device.serial_number
+		dfu.release_device(device)
+		device = PwnedDFUDevice()
+		print("MyPyIO Opening %s"%(path))
+		return 1234 
+	def _check(path, many):
+		print("python-check %s"%(path))
+		return path[0:9] == "pwndfu://"
+	def _read(offset, length):
+		global device
+		res = device.read_memory(address, length)
+		print("python-read")
+		return res
+	def _seek(offset, whence):
+		print("python-seek")
+		if whence == 0: # SET
+			return offset
+		if whence == 1: # CUR
+			return offset
+		if whence == 2: # END
+			return ROM_SIZE
+		return ROM_SIZE
+	def _write(offset, data, length):
+		print("TODO: python-write")
+		return True
+	def _system(cmd):
+		print("pwndfu://%s"%(cmd))
+		return True
+	return {
+		"name": "pwndfu",
+		"license": "GPL",
+		"desc": "pwndfu IO plugin (pwndfu://3)",
+		"check": _check,
+		"open": _open,
+		"read": _read,
+		"seek": _seek,
+		"write": _write,
+		"system": _system,
+	}
+
+print("Registering Python IO plugin...")
+print(r2lang.plugin("io", pyio))

configure

@@ -1,9 +1,10 @@
 #!/bin/sh
-# This script was automatically generated by ACR v0.10.0
+# This script was automatically generated by ACR v1.7.2
 # @author: pancake <nopcode.org>
 # @url:    http://www.nopcode.org
 # @repo:   git clone https://github.com/radare/acr
 
+[ -z "${AWK}" ] && AWK=awk
 do_remove() {
 if [ "${ACR_RMFILES}" ]; then
   printf "cleaning temporally files... "
@@ -25,7 +26,7 @@ while : ; do
 ENVWORDS="${ENVWORDS} $1_CPU $1_OS"
 STR=`eval "echo ${S}$1"`
 SPLIT_CPU="`echo "$STR" | cut -d - -f 1`"
-SPLIT_OS="`echo "$STR" | awk -F - '{
+SPLIT_OS="`echo "$STR" | $AWK -F - '{
 	if ($2=="unknown"){
 		if (NF<3) { print $2; } else { print $3; }
 	} else {
@@ -41,7 +42,7 @@ done
 }
 
 VPATH=`dirname ${0}`
-if [ "${VPATH}" = "." ]; then 
+if [ "${VPATH}" = "." ]; then
 	WODIS=current
 else
 	if [ "${VPATH}" = "${PWD}" ]; then
@@ -63,6 +64,7 @@ if [ -e "${VPATH}/config.guess" ]; then
 fi
 CPU="`uname -m|sed -e 's, ,,g'|cut -d - -f 1`"
 OS="`uname -s|tr A-Z a-z`"
+uname -r | grep -qE "(Microsoft|WSL)" 2>/dev/null && OS="wsl"
 GNU="`uname --help 2>&1 | grep gnu`"
 [ "${GNU}" ] && OS="${OS}-gnu"
 [ "${CPU}" = ppc ] && CPU="powerpc"
@@ -79,21 +81,22 @@ TARGET="${HOST}"
 SYSCONFDIR=""
 
 create_environ() {
-: ${EPREFIX:=${PREFIX}}
-: ${SPREFIX:=${PREFIX}}
-: ${BINDIR:=${SPREFIX}/bin}
-: ${SBINDIR:=${PREFIX}/sbin}
-: ${SYSCONFDIR:=${SPREFIX}/etc}
-: ${LIBDIR:=${SPREFIX}/lib}
-: ${LIBEXECDIR:=${SPREFIX}/libexec}
-: ${INCLUDEDIR:=${SPREFIX}/include}
-: ${DATADIR:=${SPREFIX}/share}
-: ${INFODIR:=${DATADIR}/info}
-: ${MANDIR:=${DATADIR}/man}
-: ${LOCALSTATEDIR:=${SPREFIX}/var}
+: ${EPREFIX:="${PREFIX}"}
+: ${SPREFIX:="${PREFIX}"}
+: ${BINDIR:="${SPREFIX}/bin"}
+: ${SBINDIR:="${PREFIX}/sbin"}
+: ${SYSCONFDIR:="${SPREFIX}/etc"}
+: ${LIBDIR:="${SPREFIX}/lib"}
+: ${LIBEXECDIR:="${SPREFIX}/libexec"}
+: ${INCLUDEDIR:="${SPREFIX}/include"}
+: ${DATADIR:="${SPREFIX}/share"}
+: ${INFODIR:="${DATADIR}/info"}
+: ${MANDIR:="${DATADIR}/man"}
+: ${DOCDIR:="${DATADIR}/doc/radare2-extras"}
+: ${LOCALSTATEDIR:="${SPREFIX}/var"}
 for A in `echo ${PATH} | sed -e 's,:, ,g'` ; do
-  [ -e $A/ginstall ] && : ${INSTALL:=$A/ginstall} && break
-  [ -e $A/install ] && : ${INSTALL:=$A/install} && break
+  [ -e "$A"/ginstall ] && : ${INSTALL:="$A"/ginstall} && break
+  [ -e "$A"/install ] && : ${INSTALL:="$A"/install} && break
 done
 : ${INSTALL_DIR:=${INSTALL} -d}
 : ${INSTALL_DATA:=${INSTALL} -m 644}
@@ -102,12 +105,12 @@ done
 : ${INSTALL_PROGRAM_STRIP:=${INSTALL} -m 755 -s}
 : ${INSTALL_MAN:=${INSTALL} -m 444}
 : ${INSTALL_LIB:=${INSTALL} -m 755 -c}
- PKGNAME='radare2-extras' ; VERSION='0.10.2' ; CONTACT_MAIL="[email protected]" ; CONTACT_NAME="pancake" ; CONTACT="pancake <[email protected]>" ;
+ PKGNAME='radare2-extras' ; VERSION='4.0.0' ; CONTACT_MAIL="[email protected]" ; CONTACT_NAME="pancake" ; CONTACT="pancake <[email protected]>" ;
 }
-                
+
 show_usage() {
 cat <<EOF2
-'configure' configures radare2-extras-0.10.2 to adapt to many kinds of systems.
+'configure' configures radare2-extras-4.0.0 to adapt to many kinds of systems.
 
 Usage: ./configure [OPTION]... [VAR=VALUE]...
 
@@ -118,27 +121,28 @@ Defaults for the options are specified in brackets.
 
 Configuration:
   -h, --help              display this help and exit
-  -V, --version           display version information and exit
   -r, --report            show what libs/programs require to work
+  -V, --version           display version information and exit
 
 Installation directories:
-  --prefix=PREFIX        install arch-independent files in PREFIX [/usr/local]
   --exec-prefix=EPREFIX  install arch-dependent files in EPREFIX [PREFIX]
+  --prefix=PREFIX        install arch-independent files in PREFIX [/usr/local]
   --sandbox=SPREFIX      sandbox prefix directory: SPREFIX [PREFIX]
 
 Fine tuning of the installation directories:
   --bindir=DIR           user executables [EPREFIX/bin]
-  --sbindir=DIR          system admin executables [EPREFIX/sbin]
-  --libexecdir=DIR       program executables [EPREFIX/libexec]
   --datadir=DIR          read-only architecture-independent data [PREFIX/share]
-  --sysconfdir=DIR       read-only single-machine data [PREFIX/etc]
-  --sharedstatedir=DIR   modifiable architecture-independent data [PREFIX/com]
-  --localstatedir=DIR    modifiable single-machine data [PREFIX/var]
-  --libdir=DIR           object code libraries [EPREFIX/lib]
-  --libpath=DIR          set rpath/libname-path to linker
+  --docdir=DIR           documentation directory [DATADIR/doc/radare2-extras]
   --includedir=DIR       C header files [PREFIX/include]
   --infodir=DIR          info documentation [DATADIR/info]
+  --libexecdir=DIR       program executables [EPREFIX/libexec]
+  --libdir=DIR           object code libraries [EPREFIX/lib]
+  --libpath=DIR          set rpath/libname-path to linker
+  --localstatedir=DIR    modifiable single-machine data [PREFIX/var]
   --mandir=DIR           man documentation [DATADIR/man]
+  --sbindir=DIR          system admin executables [EPREFIX/sbin]
+  --sysconfdir=DIR       read-only single-machine data [PREFIX/etc]
+  --sharedstatedir=DIR   modifiable architecture-independent data [PREFIX/com]
 
 System types:
   --build=BUILD          configure for building on BUILD [guessed]
@@ -148,8 +152,8 @@ EOF2
 
 printf "
 Optional Features:
-  --with-ostype          Choose OS type ( gnulinux windows darwin haiku )  (USEROSTYPE=auto)
-  --without-ewf          build without libewf 
+  --with-ostype          Choose OS type ( gnulinux windows darwin haiku ) (USEROSTYPE=auto)
+  --without-ewf          build without libewf
 "
 printf "
 Some influential environment variables:
@@ -176,7 +180,7 @@ take_environ() {
 }
 
 show_version() {
-echo "radare2-extras-0.10.2 configuration script done with acr v0.10.0.
+echo "radare2-extras-4.0.0 configuration script done with acr v1.7.2.
 The 'Free Software Foundation' message is only for autodetection.
 Originally written by pancake <nopcode.org>."
 exit 0
@@ -184,7 +188,7 @@ exit 0
 
 parse_options() {
 flag=`echo $1| cut -d = -f 1`
-value=`echo $1| awk 'BEGIN{FS="=";}{print $2}'`
+value=`echo $1| $AWK 'BEGIN{FS="=";}{print $2}'`
 flag2=`echo $flag|cut -f2- -d -| sed -e 's,-,_,g' -e 's,^_,,g'|tr '[a-z]' '[A-Z]'`
 
 if [ "${TARGET_OS}" = "darwin" ]; then
@@ -200,14 +204,14 @@ case $flag in
 	show_version ; ;;
 -r|--r|--report)
 echo "PKGNAME:   radare2-extras"
-echo "VERSION:   0.10.2"
+echo "VERSION:   4.0.0"
 echo "LANGS:     c"
-echo "OPTIONAL:  libewf"
+echo "OPTIONAL:  libewf libyara"
 echo "PKG-CONFIG:  r_core libewf unicorn yara"
 echo "FLAGS:     --with-ostype=auto --without-ewf"
 	exit 0
 	;;
---cache-file) 
+--cache-file)
 	# ignored: acr have no cache
 	;;
 --build)
@@ -229,6 +233,8 @@ echo "FLAGS:     --with-ostype=auto --without-ewf"
 	SBINDIR="$value"; ;;
 --libexecdir)
 	LIBEXECDIR="$value"; ;;
+--docdir)
+	DOCDIR="$value"; ;;
 --datadir)
 	DATADIR="$value"; ;;
 --sysconfdir)
@@ -250,7 +256,7 @@ echo "FLAGS:     --with-ostype=auto --without-ewf"
 
 --with-ostype) if [ -z "${value}" ]; then USEROSTYPE="auto"; else USEROSTYPE="${value}" ; fi ;;
 "--without-ewf") WANT_EWF="0"; ;;
-*) if [ "$value" ]; then eval "`echo $flag2=$value`" ; 
+*) if [ "$value" ]; then eval "`echo $flag2=$value`" ;
 else echo ; echo "WARNING: Unknown flag '$flag'." >&2 ; echo ; fi ;;
 esac
 }
@@ -263,11 +269,11 @@ split_host BUILD HOST TARGET
 
 while : ; do
 [ -z "$1" ] && break
-parse_options $1
+parse_options "$1"
 shift
 done
 
-ENVWORDS="MANDIR INFODIR LIBDIR INCLUDEDIR LOCALSTATEDIR SYSCONFDIR DATADIR LIBEXECDIR SBINDIR BINDIR EPREFIX PREFIX SPREFIX TARGET HOST BUILD INSTALL INSTALL_LIB INSTALL_MAN INSTALL_PROGRAM INSTALL_PROGRAM_STRIP INSTALL_DIR INSTALL_SCRIPT INSTALL_DATA HOST_OS HOST_CPU BUILD_OS BUILD_CPU TARGET_OS TARGET_CPU PKGNAME VPATH VERSION CONTACT CONTACT_NAME CONTACT_MAIL CC CFLAGS CPPFLAGS LDFLAGS HAVE_LANG_C R2_CFLAGS R2_LDFLAGS HAVE_PKGCFG_R_CORE USEROSTYPE HAVE_LIB_EWF EWF_CFLAGS EWF_LDFLAGS HAVE_PKGCFG_LIBEWF WANT_EWF UC_CFLAGS UC_LDFLAGS HAVE_PKGCFG_UNICORN HAVE_LIB_YARA YARA_CFLAGS YARA_LDFLAGS HAVE_PKGCFG_YARA"
+ENVWORDS="MANDIR INFODIR LIBDIR INCLUDEDIR LOCALSTATEDIR SYSCONFDIR DATADIR DOCDIR LIBEXECDIR SBINDIR BINDIR EPREFIX PREFIX SPREFIX TARGET HOST BUILD INSTALL INSTALL_LIB INSTALL_MAN INSTALL_PROGRAM INSTALL_PROGRAM_STRIP INSTALL_DIR INSTALL_SCRIPT INSTALL_DATA HOST_OS HOST_CPU BUILD_OS BUILD_CPU TARGET_OS TARGET_CPU PKGNAME VPATH VERSION CONTACT CONTACT_NAME CONTACT_MAIL CC CFLAGS CPPFLAGS LDFLAGS HAVE_LANG_C R2_CFLAGS R2_LDFLAGS HAVE_PKGCFG_R_CORE USEROSTYPE HAVE_LIB_EWF EWF_CFLAGS EWF_LDFLAGS HAVE_PKGCFG_LIBEWF WANT_EWF UC_CFLAGS UC_LDFLAGS HAVE_PKGCFG_UNICORN HAVE_LIB_YARA YARA_CFLAGS YARA_LDFLAGS HAVE_PKGCFG_YARA"
 
 create_environ
 
@@ -277,12 +283,12 @@ echo "checking target system type... ${TARGET}"
 [ "${CROSSBUILD}" = 1 ] && echo "using crosscompilation mode."
 
 #split_host BUILD HOST TARGET
-[ -n "${prefix}" ] && PREFIX=${prefix}
+[ -n "${prefix}" ] && PREFIX="${prefix}"
 echo "checking for working directories... ${WODIS}"
 echo "using prefix '${PREFIX}'"
 ACR_RMFILES=" test.c a.out a.exe"
 
-: 
+
 COMPILER=CC
 printf "checking for c compiler... "
 HAVE_LANG_C=1
@@ -298,17 +304,19 @@ do_remove
 echo "ERROR: ${CC} cannot create executables" >&2 ;
 exit 1 ; fi
 [ -z "${PKGCONFIG}" ] && PKGCONFIG=pkg-config
+type ${PKGCONFIG} > /dev/null 2>&1 || echo "ERROR: Cannot find PKGCONFIG ${PKGCONFIG}"
 echo 'Using PKGCONFIG: '${PKGCONFIG}
 printf 'checking pkg-config flags for r_core... '
 tmp=`${PKGCONFIG} --cflags r_core 2>/dev/null`
-if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_R_CORE=0; 
+if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_R_CORE=0;
+R2_CFLAGS='';R2_LDFLAGS='';
 echo 'This package is required'
 exit 1
-else 
-R2_CFLAGS=$tmp; 
+else
+R2_CFLAGS=$tmp;
 tmp=`${PKGCONFIG} --libs r_core 2>/dev/null`
-if [ $? = 0 ]; then 
-echo yes; HAVE_PKGCFG_R_CORE=1; 
+if [ $? = 0 ]; then
+echo yes; HAVE_PKGCFG_R_CORE=1;
 R2_LDFLAGS=$tmp; fi; fi
 check_library() {
 VAR=$1
@@ -324,18 +332,26 @@ if [ $? = 0 ]; then
 	echo yes
 else
 	eval ${VAR}=0
-	echo no  ; fi }
-check_library HAVE_LIB_EWF ewf 0 
+	echo no
+	if [ "${_REQUIRED}" = 1 ]; then
+	  echo "this library is required."
+	  do_remove
+	  exit 1
+	fi
+fi
+}
+
+check_library HAVE_LIB_EWF ewf 0
 [ -z "${PKGCONFIG}" ] && PKGCONFIG=pkg-config
-echo 'Using PKGCONFIG: '${PKGCONFIG}
 printf 'checking pkg-config flags for libewf... '
 tmp=`${PKGCONFIG} --cflags libewf 2>/dev/null`
-if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_LIBEWF=0; 
-else 
-EWF_CFLAGS=$tmp; 
+if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_LIBEWF=0;
+EWF_CFLAGS='';EWF_LDFLAGS='';
+else
+EWF_CFLAGS=$tmp;
 tmp=`${PKGCONFIG} --libs libewf 2>/dev/null`
-if [ $? = 0 ]; then 
-echo yes; HAVE_PKGCFG_LIBEWF=1; 
+if [ $? = 0 ]; then
+echo yes; HAVE_PKGCFG_LIBEWF=1;
 EWF_LDFLAGS=$tmp; fi; fi
 if [ "$HAVE_PKGCFG_LIBEWF" = "1" ]; then
 HAVE_LIB_EWF="1"
@@ -344,33 +360,33 @@ HAVE_LIB_EWF="0"; fi
 if [ "$WANT_EWF" = "0" ]; then
 HAVE_LIB_EWF="0"; fi
 [ -z "${PKGCONFIG}" ] && PKGCONFIG=pkg-config
-echo 'Using PKGCONFIG: '${PKGCONFIG}
 printf 'checking pkg-config flags for unicorn... '
 tmp=`${PKGCONFIG} --cflags unicorn 2>/dev/null`
-if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_UNICORN=0; 
-else 
-UC_CFLAGS=$tmp; 
+if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_UNICORN=0;
+UC_CFLAGS='';UC_LDFLAGS='';
+else
+UC_CFLAGS=$tmp;
 tmp=`${PKGCONFIG} --libs unicorn 2>/dev/null`
-if [ $? = 0 ]; then 
-echo yes; HAVE_PKGCFG_UNICORN=1; 
+if [ $? = 0 ]; then
+echo yes; HAVE_PKGCFG_UNICORN=1;
 UC_LDFLAGS=$tmp; fi; fi
-check_library HAVE_LIB_YARA yara 0 
+check_library HAVE_LIB_YARA yara 0
 [ -z "${PKGCONFIG}" ] && PKGCONFIG=pkg-config
-echo 'Using PKGCONFIG: '${PKGCONFIG}
 printf 'checking pkg-config flags for yara... '
 tmp=`${PKGCONFIG} --cflags yara 2>/dev/null`
-if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_YARA=0; 
-else 
-YARA_CFLAGS=$tmp; 
+if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_YARA=0;
+YARA_CFLAGS='';YARA_LDFLAGS='';
+else
+YARA_CFLAGS=$tmp;
 tmp=`${PKGCONFIG} --libs yara 2>/dev/null`
-if [ $? = 0 ]; then 
-echo yes; HAVE_PKGCFG_YARA=1; 
+if [ $? = 0 ]; then
+echo yes; HAVE_PKGCFG_YARA=1;
 YARA_LDFLAGS=$tmp; fi; fi
 SEDFLAGS=" -e '"
 COUNT=0
 for A in ${ENVWORDS} ; do
 	[ "${A}" = VPATH ] && continue
-	[ "${A}" = srcdir ] && continue 
+	[ "${A}" = srcdir ] && continue
 	eval "VAR=\$${A}"
 	VAR="`echo ${VAR} | sed -e 's/\,/\\\,/g'`"
 	[ $COUNT = 10 ] && COUNT=0 && SEDFLAGS="${SEDFLAGS}' -e '"
@@ -401,7 +417,7 @@ if [ "$VALUE" = 0 ]; then ## FALSE
  MARK="##${A}##"
 if [ -n "`grep \"${MARK}\" ${SD_TARGET}.tmp`" ]; then
  mv ${SD_TARGET}.tmp ${SD_TARGET}.tmp2
- cat ${SD_TARGET}.tmp2 | MARK=$MARK awk 'BEGIN{a=0;}{if($1==ENVIRON["MARK"]){if(a)a=0;else a=1}else{if(!a)print;}}' > ${SD_TARGET}.tmp
+ cat ${SD_TARGET}.tmp2 | MARK=$MARK $AWK 'BEGIN{a=0;}{if($1==ENVIRON["MARK"]){if(a)a=0;else a=1}else{if(!a)print;}}' > ${SD_TARGET}.tmp
  fi
 fi
 done

configure.acr

@@ -1,5 +1,5 @@
 PKGNAME radare2-extras
-VERSION 0.10.2
+VERSION 4.0.0
 CONTACT pancake ; [email protected]
 
 REPORT PREFIX ;

crashlog/r2crash.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+
+const fs = require('fs');
+if (process.argv.length > 2) {
+  walkTheLines(process.argv[2]);
+} else {
+  console.error('Usage: r2crash.js [crashlog]');
+  process.exit(1);
+}
+
+function walkTheLines(file) {
+  const lines = fs.readFileSync(file).toString().split('\n');
+  lines.forEach(walkLine);
+}
+
+// global state is bad
+var threadId = 0;
+var mode = '';
+
+function walkLine(line) {
+  switch (mode) {
+  case 'thread-state':
+    mode = parseThreadState(line);
+    break;
+  default:
+    if (line.startsWith('Crashed Thread')) {
+      const threadId = +line.substring(20).trim().split(/ /)[0];
+      console.error("# tid", threadId);
+    }
+    break;
+  }
+  if (line.startsWith('Thread ') && line.indexOf('Thread State') !== -1) {
+    mode = 'thread-state';
+  }
+}
+
+function parseThreadState(line) {
+  if (line.trim() === '') {
+    return '';
+  }
+  const regpairs = line.replace(/: /g,':').replace(/\ \ */g,' ').trim().split(/ /);
+  for (let rp of regpairs) {
+    const rv = rp.split(':');
+    console.log('ar', rv[0], '=', rv[1]);
+  }
+  return 'thread-state';
+}

crashlog/twitter.log

@@ -0,0 +1,613 @@
+Process:               Twitter [46000]
+Path:                  /Applications/Twitter.app/Contents/MacOS/Twitter
+Identifier:            com.twitter.twitter-mac
+Version:               4.3.2 (5002734)
+App Item ID:           409789998
+App External ID:       821012958
+Code Type:             X86-64 (Native)
+Parent Process:        ??? [1]
+Responsible:           Twitter [46000]
+User ID:               501
+
+Date/Time:             2018-01-28 19:26:40.932 +0100
+OS Version:            Mac OS X 10.13.2 (17C88)
+Report Version:        12
+Anonymous UUID:        824E4619-C89D-460F-CA58-EEDCCDFC4890
+
+Sleep/Wake UUID:       312CC193-CFF9-445F-BFE8-FB4128F12753
+
+Time Awake Since Boot: 230000 seconds
+Time Since Wake:       2100 seconds
+
+System Integrity Protection: disabled
+
+Crashed Thread:        0  Dispatch queue: com.apple.main-thread
+
+Exception Type:        EXC_BAD_INSTRUCTION (SIGILL)
+Exception Codes:       0x0000000000000001, 0x0000000000000000
+Exception Note:        EXC_CORPSE_NOTIFY
+
+Termination Signal:    Illegal instruction: 4
+Termination Reason:    Namespace SIGNAL, Code 0x4
+Terminating Process:   exc handler [0]
+
+Application Specific Information:
+Crashing on exception: NSConcreteMutableAttributedString initWithString:: nil value
+
+Application Specific Backtrace 1:
+0   CoreFoundation                      0x00007fff2dbd100b __exceptionPreprocess + 171
+1   libobjc.A.dylib                     0x00007fff547afc76 objc_exception_throw + 48
+2   CoreFoundation                      0x00007fff2dc62c9d +[NSException raise:format:] + 205
+3   Foundation                          0x00007fff2fc4d9c8 -[NSConcreteMutableAttributedString initWithString:] + 129
+4   Twitter                             0x000000010f70d3d6 Twitter + 431062
+5   Twitter                             0x000000010f70c564 Twitter + 427364
+6   AppKit                              0x00007fff2b9d87c8 _NSViewLayout + 587
+7   AppKit                              0x00007fff2b1d3323 -[NSView _layoutSubtreeWithOldSize:] + 437
+8   AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+9   AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+10  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+11  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+12  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+13  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+14  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+15  AppKit                              0x00007fff2b1d359c -[NSView _layoutSubtreeWithOldSize:] + 1070
+16  AppKit                              0x00007fff2b9df524 -[NSView _layoutSubtreeIfNeededAndAllowTemporaryEngine:] + 1380
+17  AppKit                              0x00007fff2b26e480 -[NSView _sendViewWillDrawInRect:clipRootView:] + 47
+18  AppKit                              0x00007fff2b26d301 -[NSView displayIfNeeded] + 1142
+19  AppKit                              0x00007fff2b3cfbb1 -[NSProgressIndicator startAnimation:] + 246
+20  AppKit                              0x00007fff2b3cfce1 -[NSProgressIndicator viewDidUnhide] + 169
+21  AppKit                              0x00007fff2b1ebc59 -[NSView _recursiveLostHiddenAncestor] + 127
+i2  AppKit                              0x00007fff2b1ebd0e -[NSView _recursiveLostHiddenAncestor] + 308
+23  AppKit                              0x00007fff2b1ebd0e -[NSView _recursiveLostHiddenAncestor] + 308
+24  AppKit                              0x00007fff2b164aa1 -[NSView(NSInternal) _setHidden:setNeedsDisplay:] + 326
+25  AppKit                              0x00007fff2b2c9b6c -[NSView prepareForReuse] + 55
+26  AppKit                              0x00007fff2b30ac0c -[NSTableRowView prepareForReuse] + 70
+27  Foundation                          0x00007fff2fc5f33a -[NSISEngine withBehaviors:performModifications:] + 131
+28  AppKit                              0x00007fff2b10e5a1 -[NSView(NSConstraintBasedLayout) _withAutomaticEngineOptimizationDisabled:] + 70
+29  AppKit                              0x00007fff2b300236 -[NSTableRowData _prepareViewForReuse:] + 81
+30  AppKit                              0x00007fff2b231fd1 -[NSTableRowData makeViewWithIdentifier:owner:] + 312
+31  AppKit                              0x00007fff2b231e70 -[NSTableView makeViewWithIdentifier:owner:] + 58
+32  Twitter                             0x000000010f891959 Twitter + 2021721
+33  Twitter                             0x000000010f835012 Twitter + 1642514
+34  AppKit                              0x00007fff2b2ba8da -[NSTableView(NSTableViewViewBased) _delegateRowViewForRow:] + 64
+35  AppKit                              0x00007fff2b2313e9 -[NSTableView(NSTableViewViewBased) makeRowViewForRow:] + 121
+36  AppKit                              0x00007fff2bb1e59e -[NSTableRowData _preparedRowViewForRow:storageHandler:] + 118
+37  AppKit                              0x00007fff2b2312e5 -[NSTableRowData _addRowViewForVisibleRow:withPriorView:] + 392
+38  AppKit                              0x00007fff2b2310a8 -[NSTableRowData _addRowViewForVisibleRow:withPriorRowIndex:inDictionary:withRowAnimation:] + 416
+39  AppKit                              0x00007fff2bb20741 -[NSTableRowData _updateVisibleRowEntries] + 1720
+40  AppKit                              0x00007fff2b22fda6 -[NSTableRowData updateVisibleRowViews] + 294
+41  AppKit                              0x00007fff2b3d924e -[NSTableRowData prepareContentInRect:] + 106
+42  AppKit                              0x00007fff2b3d8d46 -[NSTableView prepareContentInRect:] + 303
+43  AppKit                              0x00007fff2b9d9519 -[NSView _updateSuggestedContentRectToValue:] + 616
+44  AppKit                              0x00007fff2b32268c -[NSView _updateSuggestedContentRect] + 100
+45  AppKit                              0x00007fff2b36c40e -[NSView _updateSuggestedContentRectForVisibleRectChange] + 219
+46  AppKit                              0x00007fff2b24478b -[NSScrollView(NSRulerSupport) _handleBoundsChangeForSubview:] + 364
+47  AppKit                              0x00007fff2b206ca7 -[NSView _postBoundsChangeNotification] + 60
+48  AppKit                              0x00007fff2b206c00 -[NSView translateOriginToPoint:] + 261
+49  AppKit                              0x00007fff2b20679b -[NSClipView _immediateScrollToPoint:] + 536
+50  AppKit                              0x00007fff2b2064bf -[NSClipView scrollToPoint:] + 232
+51  AppKit                              0x00007fff2b241f8f -[NSScrollView scrollClipView:toPoint:] + 75
+52  AppKit                              0x00007fff2b1ecd49 -[NSClipView _scrollTo:animateScroll:flashScrollerKnobs:] + 1273
+53  AppKit                              0x00007fff2b40d149 -[NSScrollView _doScroller:hitPart:multiplier:] + 1323
+54  AppKit                              0x00007fff2b8c575a -[NSApplication(NSResponder) sendAction:to:from:] + 312
+55  AppKit                              0x00007fff2b36b933 -[NSControl sendAction:to:] + 86
+56  AppKit                              0x00007fff2b40cb80 -[NSScroller sendAction:to:] + 91
+57  AppKit                              0x00007fff2b40c995 -[NSScroller(NSScrollerPrivate) _scrollByDelta:] + 842
+58  AppKit                              0x00007fff2b40bd4b -[NSScrollingBehaviorLegacy _scrollView:smoothScrollWithEvent:] + 2746
+59  AppKit                              0x00007fff2b40ae16 -[NSScrollingBehaviorLegacy scrollView:scrollWheelWithEvent:] + 1177
+60  Twitter                             0x000000010f7c7e59 Twitter + 1195609
+61  AppKit                              0x00007fff2b40eee5 __71-[NSScrollingBehaviorLegacy _latchAcceleratedScrollEventsToScrollView:]_block_invoke + 282
+62  AppKit                              0x00007fff2b298366 _NSSendEventToObservers + 337
+63  AppKit                              0x00007fff2b8c152a -[NSApplication(NSEvent) sendEvent:] + 70
+64  AppKit                              0x00007fff2b122d9d -[NSApplication run] + 812
+65  AppKit                              0x00007fff2b0f1f1a NSApplicationMain + 804
+66  libdyld.dylib                       0x00007fff5539f115 start + 1
+67  ???                                 0x0000000000000001 0x0 + 1
+
+Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
+0   com.apple.AppKit              	0x00007fff2b458794 -[NSApplication _crashOnException:] + 109
+1   com.apple.AppKit              	0x00007fff2b45867c -[NSApplication reportException:] + 953
+2   com.twitter.twitter-mac       	0x000000010f9205fd 0x10f6a4000 + 2606589
+3   com.apple.AppKit              	0x00007fff2b122e2e -[NSApplication run] + 957
+4   com.apple.AppKit              	0x00007fff2b0f1f1a NSApplicationMain + 804
+5   libdyld.dylib                 	0x00007fff5539f115 start + 1
+
+Thread 1:: com.twitter.crashlytics.mac.MachExceptionServer
+0   libsystem_kernel.dylib        	0x00007fff554f09d2 write + 10
+1   com.twitter.twitter-mac       	0x000000010f91f68a 0x10f6a4000 + 2602634
+2   com.twitter.twitter-mac       	0x000000010f90ea54 0x10f6a4000 + 2533972
+3   libsystem_pthread.dylib       	0x00007fff5562a6c1 _pthread_body + 340
+4   libsystem_pthread.dylib       	0x00007fff5562a56d _pthread_start + 377
+5   libsystem_pthread.dylib       	0x00007fff55629c5d thread_start + 13
+
+Thread 2:: com.apple.NSEventThread
+0   libsystem_kernel.dylib        	0x00007fff554e57c2 mach_msg_trap + 10
+1   libsystem_kernel.dylib        	0x00007fff554e4cdc mach_msg + 60
+2   com.apple.CoreFoundation      	0x00007fff2db4c355 __CFRunLoopServiceMachPort + 341
+3   com.apple.CoreFoundation      	0x00007fff2db4b6a7 __CFRunLoopRun + 1783
+4   com.apple.CoreFoundation      	0x00007fff2db4ad23 CFRunLoopRunSpecific + 483
+5   com.apple.AppKit              	0x00007fff2b26b3c8 _NSEventThread + 184
+6   libsystem_pthread.dylib       	0x00007fff5562a6c1 _pthread_body + 340
+7   libsystem_pthread.dylib       	0x00007fff5562a56d _pthread_start + 377
+8   libsystem_pthread.dylib       	0x00007fff55629c5d thread_start + 13
+
+Thread 3:: com.apple.NSURLConnectionLoader
+0   libsystem_kernel.dylib        	0x00007fff554e57c2 mach_msg_trap + 10
+1   libsystem_kernel.dylib        	0x00007fff554e4cdc mach_msg + 60
+2   com.apple.CoreFoundation      	0x00007fff2db4c355 __CFRunLoopServiceMachPort + 341
+3   com.apple.CoreFoundation      	0x00007fff2db4b6a7 __CFRunLoopRun + 1783
+4   com.apple.CoreFoundation      	0x00007fff2db4ad23 CFRunLoopRunSpecific + 483
+5   com.apple.CFNetwork           	0x00007fff2ccc3f84 -[__CoreSchedulingSetRunnable runForever] + 722
+6   com.apple.Foundation          	0x00007fff2fc38e48 __NSThread__start__ + 1197
+7   libsystem_pthread.dylib       	0x00007fff5562a6c1 _pthread_body + 340
+8   libsystem_pthread.dylib       	0x00007fff5562a56d _pthread_start + 377
+9   libsystem_pthread.dylib       	0x00007fff55629c5d thread_start + 13
+
+Thread 4:: com.apple.coreaudio.AQClient
+0   libsystem_kernel.dylib        	0x00007fff554e57c2 mach_msg_trap + 10
+1   libsystem_kernel.dylib        	0x00007fff554e4cdc mach_msg + 60
+2   com.apple.CoreFoundation      	0x00007fff2db4c355 __CFRunLoopServiceMachPort + 341
+3   com.apple.CoreFoundation      	0x00007fff2db4b6a7 __CFRunLoopRun + 1783
+4   com.apple.CoreFoundation      	0x00007fff2db4ad23 CFRunLoopRunSpecific + 483
+5   com.apple.audio.toolbox.AudioToolbox	0x00007fff2c4f61aa GenericRunLoopThread::Entry(void*) + 158
+6   com.apple.audio.toolbox.AudioToolbox	0x00007fff2c4f5eb9 CAPThread::Entry(CAPThread*) + 77
+7   libsystem_pthread.dylib       	0x00007fff5562a6c1 _pthread_body + 340
+8   libsystem_pthread.dylib       	0x00007fff5562a56d _pthread_start + 377
+9   libsystem_pthread.dylib       	0x00007fff55629c5d thread_start + 13
+
+Thread 5:
+0   libsystem_kernel.dylib        	0x00007fff554ef562 __workq_kernreturn + 10
+1   libsystem_pthread.dylib       	0x00007fff5562a06a _pthread_wqthread + 1035
+2   libsystem_pthread.dylib       	0x00007fff55629c4d start_wqthread + 13
+
+Thread 6:
+0   libsystem_kernel.dylib        	0x00007fff554ef562 __workq_kernreturn + 10
+1   libsystem_pthread.dylib       	0x00007fff5562a26f _pthread_wqthread + 1552
+2   libsystem_pthread.dylib       	0x00007fff55629c4d start_wqthread + 13
+
+Thread 7:
+0   libsystem_kernel.dylib        	0x00007fff554ef562 __workq_kernreturn + 10
+1   libsystem_pthread.dylib       	0x00007fff5562a06a _pthread_wqthread + 1035
+2   libsystem_pthread.dylib       	0x00007fff55629c4d start_wqthread + 13
+
+Thread 8:: Dispatch queue: com.apple.CFNetwork.Connection
+0   libsystem_blocks.dylib        	0x00007fff553ed991 _Block_release + 99
+1   libdispatch.dylib             	0x00007fff55365d50 _dispatch_client_callout + 8
+2   libdispatch.dylib             	0x00007fff5537a20c _dispatch_queue_serial_drain + 635
+3   libdispatch.dylib             	0x00007fff5536d0fd _dispatch_queue_invoke + 373
+4   libdispatch.dylib             	0x00007fff5537a06f _dispatch_queue_serial_drain + 222
+5   libdispatch.dylib             	0x00007fff5536d0fd _dispatch_queue_invoke + 373
+6   libdispatch.dylib             	0x00007fff5537af02 _dispatch_root_queue_drain_deferred_wlh + 332
+7   libdispatch.dylib             	0x00007fff5537ed16 _dispatch_workloop_worker_thread + 880
+8   libsystem_pthread.dylib       	0x00007fff5562a033 _pthread_wqthread + 980
+9   libsystem_pthread.dylib       	0x00007fff55629c4d start_wqthread + 13
+
+Thread 9:
+0   libsystem_pthread.dylib       	0x00007fff55629c40 start_wqthread + 0
+1   ???                           	0xa8fafa6ba58200f2 0 + 12176319882794762482
+
+Thread 0 crashed with X86 Thread State (64-bit):
+  rax: 0x00007fe8a52f2200  rbx: 0x0000600002e42c40  rcx: 0x0000000000000000  rdx: 0x0000000000001bbb
+  rdi: 0x0000000008000101  rsi: 0x00007fe8a54dd5a1  rbp: 0x00007ffee055b910  rsp: 0x00007ffee055b900
+   r8: 0x0000000000000000   r9: 0x0000000000000000  r10: 0x00007ffee055b408  r11: 0xffffffffffe167ff
+  r12: 0x00007ffee055b910  r13: 0x0000600000126180  r14: 0x00007fff547a1e80  r15: 0x00007ffee055b920
+  rip: 0x00007fff2b458794  rfl: 0x0000000000010206  cr2: 0x000070000ac9a628
+  
+Logical CPU:     2
+Error Code:      0x00000000
+Trap Number:     6
+
+
+Binary Images:
+       0x10f6a4000 -        0x10fac2ff7 +com.twitter.twitter-mac (4.3.2 - 5002734) <3BC0BF69-D205-3845-9A00-492B8F015F12> /Applications/Twitter.app/Contents/MacOS/Twitter
+       0x10fbec000 -        0x10fc48ff7 +com.growl.growlframework (2.0.1 - 2.0.1) <6C20B93B-75B2-30A4-8267-8C81BF90872B> /Applications/Twitter.app/Contents/Frameworks/Growl.framework/Versions/A/Growl
+       0x113705000 -        0x113709fff  com.apple.audio.AppleHDAHALPlugIn (280.12 - 280.12) <9ACA0127-E687-3885-9475-1D5E4DD83168> /System/Library/Extensions/AppleHDA.kext/Contents/PlugIns/AppleHDAHALPlugIn.bundle/Contents/MacOS/AppleHDAHALPlugIn
+       0x113b49000 -        0x114083ff7  com.apple.driver.AppleIntelBDWGraphicsGLDriver (10.30.12 - 10.3.0) <E227A086-C662-335C-8B36-EA875AD6478F> /System/Library/Extensions/AppleIntelBDWGraphicsGLDriver.bundle/Contents/MacOS/AppleIntelBDWGraphicsGLDriver
+       0x11796a000 -        0x1179b498f  dyld (519.2.2) <6695F30B-4E88-3C0B-9867-7D738C44A3E6> /usr/lib/dyld
+       0x124585000 -        0x124af0fff  com.apple.audio.codecs.Components (7.0 - 7.0) <7233F241-5DC2-38E5-9156-2D825117075B> /System/Library/Components/AudioCodecs.component/Contents/MacOS/AudioCodecs
+       0x124bfe000 -        0x124da4ff7  com.apple.audio.units.Components (1.14 - 1.14) <5AE65A6C-EF2F-37AC-9DDD-4ABB69E78EF2> /System/Library/Components/CoreAudio.component/Contents/MacOS/CoreAudio
+    0x7fff261ee000 -     0x7fff2653cff7  com.apple.RawCamera.bundle (8.02.0 - 1017.2.2) <C799730B-C745-3775-BCE7-C67B8BD97FDB> /System/Library/CoreServices/RawCamera.bundle/Contents/MacOS/RawCamera
+    0x7fff2781a000 -     0x7fff278a6ff7  com.apple.driver.AppleIntelBDWGraphicsMTLDriver (10.30.12 - 10.3.0) <7A1AD3EA-2D09-381F-A080-CC108AE459DB> /System/Library/Extensions/AppleIntelBDWGraphicsMTLDriver.bundle/Contents/MacOS/AppleIntelBDWGraphicsMTLDriver
+    0x7fff29d11000 -     0x7fff29eecff7  com.apple.avfoundation (2.0 - 1528.24) <E4CE97EA-94C7-3CC4-B768-15AA25E76A83> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
+    0x7fff29eed000 -     0x7fff29fa7ff7  com.apple.audio.AVFAudio (1.0 - ???) <E7DFCDAF-97A8-314F-BBED-76B9C5041E38> /System/Library/Frameworks/AVFoundation.framework/Versions/A/Frameworks/AVFAudio.framework/Versions/A/AVFAudio
+    0x7fff29fa9000 -     0x7fff2a0acff3  com.apple.AVKit (1.1 - 440.5.1) <11682387-4506-3294-8355-6130128A0C68> /System/Library/Frameworks/AVKit.framework/Versions/A/AVKit
+    0x7fff2a0ad000 -     0x7fff2a0adfff  com.apple.Accelerate (1.11 - Accelerate 1.11) <5AA750F5-D633-32BA-B7F3-4F651FB1761E> /System/Library/Frameworks/Accelerate.framework/Versions/A/Accelerate
+    0x7fff2a0ae000 -     0x7fff2a0c4fe3  libCGInterfaces.dylib (417) <27E09D39-51B5-3297-BE33-0DB1736B833A> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/Libraries/libCGInterfaces.dylib
+    0x7fff2a0c5000 -     0x7fff2a5c3fc3  com.apple.vImage (8.1 - ???) <310976EE-E12D-39D7-8F58-6EE924E08576> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vImage.framework/Versions/A/vImage
+    0x7fff2a5c4000 -     0x7fff2a71efcb  libBLAS.dylib (1211.30.1) <0DB0D952-BCF4-3479-BA2F-785FB1A57479> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBLAS.dylib
+    0x7fff2a71f000 -     0x7fff2a74dfef  libBNNS.dylib (37) <49EB4DBA-877C-3D41-90A2-C3D982C72A54> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libBNNS.dylib
+    0x7fff2a74e000 -     0x7fff2ab0eff7  libLAPACK.dylib (1211.30.1) <2D4E4446-6B63-350C-BD68-A1B8FBE99539> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLAPACK.dylib
+    0x7fff2ab0f000 -     0x7fff2ab24ff7  libLinearAlgebra.dylib (1211.30.1) <6C68F41D-1398-3AFE-BE72-C0ECA1B24BDC> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libLinearAlgebra.dylib
+    0x7fff2ab25000 -     0x7fff2ab2aff3  libQuadrature.dylib (3) <3D6BF66A-55B2-3692-BAC7-DEB0C676ED29> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libQuadrature.dylib
+    0x7fff2ab2b000 -     0x7fff2ab89fff  libSparse.dylib (79.1.1) <7AD0F8A8-FD36-36FE-B83D-58648EBD0027> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libSparse.dylib
+    0x7fff2ab8a000 -     0x7fff2ab9dfff  libSparseBLAS.dylib (1211.30.1) <42506F6F-0F38-322E-9903-C1DB66E4DA05> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libSparseBLAS.dylib
+    0x7fff2ab9e000 -     0x7fff2ad4afc3  libvDSP.dylib (622.20.8) <6FFCA52B-7D60-326A-ADF2-601F39A8685A> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvDSP.dylib
+    0x7fff2ad4b000 -     0x7fff2adfbfef  libvMisc.dylib (622.20.8) <54F90047-879F-3260-8604-6E453149B49E> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/libvMisc.dylib
+    0x7fff2adfc000 -     0x7fff2adfcfff  com.apple.Accelerate.vecLib (3.11 - vecLib 3.11) <8A96A8ED-7B88-3D17-8D17-41D224E0EC90> /System/Library/Frameworks/Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/A/vecLib
+    0x7fff2adfd000 -     0x7fff2ae54ff7  com.apple.Accounts (113 - 113) <02AC0AF3-D620-340E-BE52-CD31119F9CD8> /System/Library/Frameworks/Accounts.framework/Versions/A/Accounts
+    0x7fff2ae55000 -     0x7fff2b0ebfff  com.apple.AddressBook.framework (11.0 - 1808.6) <F6D3B5FE-46C5-31E6-8D30-2DE805D883AA> /System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
+    0x7fff2b0ec000 -     0x7fff2bf49fff  com.apple.AppKit (6.9 - 1561.20.106) <7A71ACCF-2DF5-3557-BB22-3A9FC9F71CCF> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
+    0x7fff2bf9b000 -     0x7fff2bf9bfff  com.apple.ApplicationServices (48 - 50) <7627DBD6-497B-3AB7-9B63-F0532EDF09B8> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
+    0x7fff2bf9c000 -     0x7fff2c002fff  com.apple.ApplicationServices.ATS (377 - 445) <CDF5F6D7-4E7D-3D28-9FBA-1B53AD9FA8F8> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/ATS
+    0x7fff2c09b000 -     0x7fff2c1bdfff  libFontParser.dylib (222.1.2) <11BD5EEF-AF18-33FB-B114-DD611932E822> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontParser.dylib
+    0x7fff2c1be000 -     0x7fff2c208ff7  libFontRegistry.dylib (221) <A22F82C0-B4FE-3DB5-B968-79B28257DF2F> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libFontRegistry.dylib
+    0x7fff2c2ad000 -     0x7fff2c2e0ff7  libTrueTypeScaler.dylib (222.1.2) <33C245B4-E1AD-3C89-B735-5A5610E547C8> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/Versions/A/Resources/libTrueTypeScaler.dylib
+    0x7fff2c34a000 -     0x7fff2c34eff3  com.apple.ColorSyncLegacy (4.13.0 - 1) <42C25E85-1CF3-3DEC-A434-BE69F68F4318> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ColorSyncLegacy.framework/Versions/A/ColorSyncLegacy
+    0x7fff2c3ee000 -     0x7fff2c440ff7  com.apple.HIServices (1.22 - 622) <2E83CD6F-ED98-3C29-BD0A-8525E38AB5DB> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/HIServices.framework/Versions/A/HIServices
+    0x7fff2c441000 -     0x7fff2c44ffff  com.apple.LangAnalysis (1.7.0 - 1.7.0) <71A9C815-AC55-3E36-A618-F6778F5119AD> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/LangAnalysis.framework/Versions/A/LangAnalysis
+    0x7fff2c450000 -     0x7fff2c49cfff  com.apple.print.framework.PrintCore (13 - 503) <A69E2BAD-2B66-38CC-9D3A-0A0EBC41341D> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
+    0x7fff2c49d000 -     0x7fff2c4d7fff  com.apple.QD (3.12 - 403) <38D8106A-4FFA-3FE9-9999-714CADD7EE9C> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/QD.framework/Versions/A/QD
+    0x7fff2c4d8000 -     0x7fff2c4e4fff  com.apple.speech.synthesis.framework (7.2.1 - 7.2.1) <BA7EDC49-E216-3D96-A7B7-8C76B862D484> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
+    0x7fff2c4e5000 -     0x7fff2c770ff7  com.apple.audio.toolbox.AudioToolbox (1.14 - 1.14) <71699B6E-8B94-39E2-801F-8467C2B5B621> /System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
+    0x7fff2c772000 -     0x7fff2c772fff  com.apple.audio.units.AudioUnit (1.14 - 1.14) <28C7FC0C-D2E5-3703-916F-866A0F823229> /System/Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
+    0x7fff2ca87000 -     0x7fff2ce19fff  com.apple.CFNetwork (893.13.1 - 893.13.1) <567231F4-4080-3B2D-8349-9177BD358804> /System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
+    0x7fff2ce2e000 -     0x7fff2ce2efff  com.apple.Carbon (158 - 158) <FCD7A9FF-5E53-3B0C-8A52-691C11B2A0C5> /System/Library/Frameworks/Carbon.framework/Versions/A/Carbon
+    0x7fff2ce2f000 -     0x7fff2ce32ffb  com.apple.CommonPanels (1.2.6 - 98) <39C8EBA3-EEB2-335B-8A88-D6C64BAA112F> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/CommonPanels.framework/Versions/A/CommonPanels
+    0x7fff2ce33000 -     0x7fff2d138ff7  com.apple.HIToolbox (2.1.1 - 910.4) <ADBE7A1B-0402-369C-A6F3-494E8CACD619> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox
+    0x7fff2d139000 -     0x7fff2d13cffb  com.apple.help (1.3.8 - 64) <18D02016-119A-33E8-AEB0-E9466BA4AD56> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Help.framework/Versions/A/Help
+    0x7fff2d13d000 -     0x7fff2d142fff  com.apple.ImageCapture (9.0 - 9.0) <2DE590E5-DF0E-3962-A2BE-06EBC79B3D72> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/ImageCapture.framework/Versions/A/ImageCapture
+    0x7fff2d143000 -     0x7fff2d1d8ffb  com.apple.ink.framework (10.9 - 220) <D8AECAE3-9FD2-32E3-B659-026F33650BB2> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Ink.framework/Versions/A/Ink
+    0x7fff2d1d9000 -     0x7fff2d1f3ff7  com.apple.openscripting (1.7 - 174) <66899B51-ADFD-360D-88E9-B52439F531B4> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/OpenScripting.framework/Versions/A/OpenScripting
+    0x7fff2d214000 -     0x7fff2d215fff  com.apple.print.framework.Print (12 - 267) <E4CBAAFC-9045-38AC-9F93-8C931DDED9D8> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/Print.framework/Versions/A/Print
+    0x7fff2d216000 -     0x7fff2d218ff7  com.apple.securityhi (9.0 - 55006) <E7668200-B4CB-3612-96B8-D57E94077787> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SecurityHI.framework/Versions/A/SecurityHI
+    0x7fff2d219000 -     0x7fff2d21ffff  com.apple.speech.recognition.framework (6.0.3 - 6.0.3) <1F10ED1F-12C7-39AC-88A0-43A1338F9316> /System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/SpeechRecognition.framework/Versions/A/SpeechRecognition
+    0x7fff2d32c000 -     0x7fff2d32cfff  com.apple.Cocoa (6.11 - 22) <F1AED1E8-ACC2-31F0-B85E-17E41167FC88> /System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa
+    0x7fff2d33a000 -     0x7fff2d3f3ff7  com.apple.ColorSync (4.13.0 - 546) <A5E013D9-7305-3026-879E-4D1F038A430D> /System/Library/Frameworks/ColorSync.framework/Versions/A/ColorSync
+    0x7fff2d580000 -     0x7fff2d613ff7  com.apple.audio.CoreAudio (4.3.0 - 4.3.0) <4DE794D4-F018-31E8-B3CE-CF8DBE68D14E> /System/Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
+    0x7fff2d67a000 -     0x7fff2d6a3ffb  com.apple.CoreBluetooth (1.0 - 1) <942F88A5-AD68-3359-90D5-6F1A3311C51A> /System/Library/Frameworks/CoreBluetooth.framework/Versions/A/CoreBluetooth
+    0x7fff2d6a4000 -     0x7fff2d9f8fe7  com.apple.CoreData (120 - 849.2) <4407C44B-34CC-3D23-AEDF-AD866D414EBF> /System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
+    0x7fff2d9f9000 -     0x7fff2dac5fff  com.apple.CoreDisplay (1.0 - 81.7) <CE6B9237-B33D-3D8F-8C1C-4F57BD810D24> /System/Library/Frameworks/CoreDisplay.framework/Versions/A/CoreDisplay
+    0x7fff2dac6000 -     0x7fff2df66fff  com.apple.CoreFoundation (6.9 - 1450.16) <23F8373A-FA3F-37A2-BA5B-70061BFCCD21> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
+    0x7fff2df68000 -     0x7fff2e575fef  com.apple.CoreGraphics (2.0 - 1129.5) <F37BFBD2-CC21-3521-B034-9D4D36197487> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
+    0x7fff2e577000 -     0x7fff2e866fff  com.apple.CoreImage (13.0.0 - 579.2.9) <B5661FF7-7558-308E-A3B7-C280F7A1DA78> /System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage
+    0x7fff2e867000 -     0x7fff2e8d2ff7  com.apple.corelocation (2237.0.22) <0E78BBE7-9016-3A12-88EB-425EFE69E643> /System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation
+    0x7fff2eaf5000 -     0x7fff2ebd5ff7  com.apple.CoreMedia (1.0 - 2267.40.5) <AE634D2B-FEB5-3669-80CC-F1C238698D44> /System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia
+    0x7fff2ebd6000 -     0x7fff2ec24fff  com.apple.CoreMediaIO (812.0 - 4993) <1D78D2AE-626B-3D0C-83EA-EA385682F3F3> /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/CoreMediaIO
+    0x7fff2ec25000 -     0x7fff2ec25fff  com.apple.CoreServices (822.19 - 822.19) <0C60B639-4CC4-3F57-BC5E-DB71EB75F7F4> /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
+    0x7fff2ec26000 -     0x7fff2ec9affb  com.apple.AE (735.1 - 735.1) <D0C73200-90A7-3FD1-A6EC-97055AA367E2> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/AE.framework/Versions/A/AE
+    0x7fff2ec9b000 -     0x7fff2ef72ff7  com.apple.CoreServices.CarbonCore (1178.2 - 1178.2) <A1FE74F8-953B-371E-A8AC-E87B30FB79C6> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/CarbonCore
+    0x7fff2ef73000 -     0x7fff2efa7ff7  com.apple.DictionaryServices (1.2 - 284) <3FCEE280-8DD0-37C9-BFD4-7BA87AAFC8EF> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/DictionaryServices
+    0x7fff2efa8000 -     0x7fff2efb0ff3  com.apple.CoreServices.FSEvents (1239 - 1239) <7BBC5CB7-DBC8-316B-99B0-781827159A2F> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/FSEvents.framework/Versions/A/FSEvents
+    0x7fff2efb1000 -     0x7fff2f169ff7  com.apple.LaunchServices (822.19 - 822.19) <F3AC96C3-0B52-3AA9-9DA8-288BBC523C07> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/LaunchServices
+    0x7fff2f16a000 -     0x7fff2f219ff7  com.apple.Metadata (10.7.0 - 1191.2.6) <FB66B298-D55D-398A-BEDB-CB7B82956AE5> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Metadata
+    0x7fff2f21a000 -     0x7fff2f277ff7  com.apple.CoreServices.OSServices (822.19 - 822.19) <408FB1A4-58E9-34D4-8022-A9EEC8502762> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/OSServices.framework/Versions/A/OSServices
+    0x7fff2f278000 -     0x7fff2f2e6fff  com.apple.SearchKit (1.4.0 - 1.4.0) <14053F88-2C76-35CA-9FC1-2A9BC0B63F88> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SearchKit.framework/Versions/A/SearchKit
+    0x7fff2f2e7000 -     0x7fff2f30bffb  com.apple.coreservices.SharedFileList (71.4 - 71.4) <4AA6DCF5-BAF8-36FA-A8B0-EDF518EFEF14> /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/SharedFileList.framework/Versions/A/SharedFileList
+    0x7fff2f5b5000 -     0x7fff2f703ffb  com.apple.CoreText (352.0 - 578.12) <DA0BC559-277A-32BA-91EA-FD2F02EA186F> /System/Library/Frameworks/CoreText.framework/Versions/A/CoreText
+    0x7fff2f704000 -     0x7fff2f73eff3  com.apple.CoreVideo (1.8 - 279.2) <A8FC5325-D092-3A28-A1CF-5C94B8101F71> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
+    0x7fff2f73f000 -     0x7fff2f7c9ffb  com.apple.framework.CoreWLAN (13.0 - 1339) <FFA24EBB-75A1-3B33-9B26-96BDAF758CC0> /System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN
+    0x7fff2f957000 -     0x7fff2f962ff7  com.apple.DirectoryService.Framework (10.13 - 207) <79F272D7-48AE-3D1E-AC5B-3CEB5F16E7D5> /System/Library/Frameworks/DirectoryService.framework/Versions/A/DirectoryService
+    0x7fff2f963000 -     0x7fff2fa1dfff  com.apple.DiscRecording (9.0.3 - 9030.4.5) <2094BAC4-4F37-3741-B9BD-60158A63C503> /System/Library/Frameworks/DiscRecording.framework/Versions/A/DiscRecording
+    0x7fff2fa44000 -     0x7fff2fa49fff  com.apple.DiskArbitration (2.7 - 2.7) <44836CE9-A9ED-3017-972A-7A0A3D6B472B> /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
+    0x7fff2fc0a000 -     0x7fff2ffcffff  com.apple.Foundation (6.9 - 1450.16) <7FEC6610-70EA-3A8D-8EC4-7E99BAF1E312> /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
+    0x7fff3003f000 -     0x7fff3006ffff  com.apple.GSS (4.0 - 2.0) <3B4B4509-B5A3-396B-9C71-80BAE84476FA> /System/Library/Frameworks/GSS.framework/Versions/A/GSS
+    0x7fff30181000 -     0x7fff30284ff3  com.apple.Bluetooth (6.0.2 - 6.0.2f2) <AFC4A40B-AE56-3C53-A2B1-D0D9C335E21D> /System/Library/Frameworks/IOBluetooth.framework/Versions/A/IOBluetooth
+    0x7fff302e4000 -     0x7fff3037ffff  com.apple.framework.IOKit (2.0.2 - 1445.31.1) <7556086A-EFAF-3262-9822-6F666CFC6655> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
+    0x7fff30381000 -     0x7fff30388ffb  com.apple.IOSurface (209.2.2 - 209.2.2) <6D35A601-1C47-37BE-AD31-F8EB88F67573> /System/Library/Frameworks/IOSurface.framework/Versions/A/IOSurface
+    0x7fff30389000 -     0x7fff303deff3  com.apple.ImageCaptureCore (7.0 - 7.0) <CBE349D4-2C8B-31F5-B5ED-B8E978DA9245> /System/Library/Frameworks/ImageCaptureCore.framework/Versions/A/ImageCaptureCore
+    0x7fff303df000 -     0x7fff30556ff7  com.apple.ImageIO.framework (3.3.0 - 1713) <DB207AD2-06B5-3065-976B-F53C477D79C0> /System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO
+    0x7fff30557000 -     0x7fff3055bffb  libGIF.dylib (1713) <C65B2846-1B94-3BB3-BBBF-5A9E5054CE1E> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libGIF.dylib
+    0x7fff3055c000 -     0x7fff30643fff  libJP2.dylib (1713) <8323253E-278A-3486-801A-83E143C19712> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJP2.dylib
+    0x7fff30644000 -     0x7fff30667ff7  libJPEG.dylib (1713) <2D846A18-D8AF-3573-803B-BEABCBAC38D1> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libJPEG.dylib
+    0x7fff30943000 -     0x7fff30969feb  libPng.dylib (1713) <546F41CE-185C-31A0-B61C-1012AA932624> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libPng.dylib
+    0x7fff3096a000 -     0x7fff3096cffb  libRadiance.dylib (1713) <31787C46-4A2B-3CDF-95E9-EC1BD4794917> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libRadiance.dylib
+    0x7fff3096d000 -     0x7fff309bafeb  libTIFF.dylib (1713) <5319B2E1-83D2-30C7-A7BC-A0CE0B07885D> /System/Library/Frameworks/ImageIO.framework/Versions/A/Resources/libTIFF.dylib
+    0x7fff30b76000 -     0x7fff316dcff7  com.apple.JavaScriptCore (13604 - 13604.4.7.1.3) <3ACE94F3-B9B6-38FD-9CE7-7B44F374C143> /System/Library/Frameworks/JavaScriptCore.framework/Versions/A/JavaScriptCore
+    0x7fff316f4000 -     0x7fff3170dff7  com.apple.Kerberos (3.0 - 1) <CAF075C0-4C24-3ACE-9AE6-77BEFDEA3622> /System/Library/Frameworks/Kerberos.framework/Versions/A/Kerberos
+    0x7fff3170e000 -     0x7fff31743fff  com.apple.LDAPFramework (2.4.28 - 194.5) <8419BDB5-12DF-3BC9-871D-7A270E080249> /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
+    0x7fff319c5000 -     0x7fff319ccfff  com.apple.MediaAccessibility (1.0 - 114) <D72C593A-AC32-3419-AB86-6B07217EBFD5> /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/MediaAccessibility
+    0x7fff319e2000 -     0x7fff31a6effb  com.apple.MediaPlayer (1.0 - 1.0) <76758A48-DB40-3331-8517-07D9A445836D> /System/Library/Frameworks/MediaPlayer.framework/Versions/A/MediaPlayer
+    0x7fff31a6f000 -     0x7fff32088ff7  com.apple.MediaToolbox (1.0 - 2267.40.5) <BC84C8E1-FC56-3996-9110-E1BEF85587F7> /System/Library/Frameworks/MediaToolbox.framework/Versions/A/MediaToolbox
+    0x7fff3208a000 -     0x7fff32109fff  com.apple.Metal (124.7 - 124.7) <C266564D-21B5-3FD9-92D5-03974F3186C4> /System/Library/Frameworks/Metal.framework/Versions/A/Metal
+    0x7fff32126000 -     0x7fff3213bfff  com.apple.MetalPerformanceShaders.MPSCore (1.0 - 1) <D4BCBA84-AD1B-33DC-99F3-16F9E5E50906> /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSCore.framework/Versions/A/MPSCore
+    0x7fff3213c000 -     0x7fff321a7fef  com.apple.MetalPerformanceShaders.MPSImage (1.0 - 1) <E504EC97-FAD7-36DC-B151-6F89AB911E3A> /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSImage.framework/Versions/A/MPSImage
+    0x7fff321a8000 -     0x7fff321cbfff  com.apple.MetalPerformanceShaders.MPSMatrix (1.0 - 1) <A5B6F6FC-A19A-32C0-A999-98B6688760C7> /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSMatrix.framework/Versions/A/MPSMatrix
+    0x7fff321cc000 -     0x7fff3224cff7  com.apple.MetalPerformanceShaders.MPSNeuralNetwork (1.0 - 1) <D0D8F13F-ACD4-3B61-BE54-121CCB05ECF4> /System/Library/Frameworks/MetalPerformanceShaders.framework/Frameworks/MPSNeuralNetwork.framework/Versions/A/MPSNeuralNetwork
+    0x7fff3224d000 -     0x7fff3224dff7  com.apple.MetalPerformanceShaders.MetalPerformanceShaders (1.0 - 1) <2E8723FC-AA53-3596-B6A4-220A378B7A5A> /System/Library/Frameworks/MetalPerformanceShaders.framework/Versions/A/MetalPerformanceShaders
+    0x7fff33256000 -     0x7fff33262ffb  com.apple.NetFS (6.0 - 4.0) <81B22AE7-7094-30F2-BF41-84CA05EDB95B> /System/Library/Frameworks/NetFS.framework/Versions/A/NetFS
+    0x7fff333e2000 -     0x7fff33418ffb  com.apple.notificationcenter (1.0 - 639.10) <EA67E1F8-9506-3336-8F84-FD3512F321B7> /System/Library/Frameworks/NotificationCenter.framework/Versions/A/NotificationCenter
+    0x7fff3604a000 -     0x7fff36052fef  libcldcpuengine.dylib (2.8.7) <DD781325-D94E-3AD7-8D6C-817FB3068917> /System/Library/Frameworks/OpenCL.framework/Versions/A/Libraries/libcldcpuengine.dylib
+    0x7fff36053000 -     0x7fff360a0ffb  com.apple.opencl (2.8.12 - 2.8.12) <0AACB21D-AAC4-337C-8FF6-A8F6196614EE> /System/Library/Frameworks/OpenCL.framework/Versions/A/OpenCL
+    0x7fff360a1000 -     0x7fff360bdffb  com.apple.CFOpenDirectory (10.13 - 207) <7664F745-96E0-3F9F-964B-6014928902FB> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/CFOpenDirectory
+    0x7fff360be000 -     0x7fff360c9fff  com.apple.OpenDirectory (10.13 - 207) <1550BB27-D605-398C-8670-48700C86D674> /System/Library/Frameworks/OpenDirectory.framework/Versions/A/OpenDirectory
+    0x7fff37248000 -     0x7fff3724afff  libCVMSPluginSupport.dylib (16.4.2) <A967BC8B-ABB3-393F-BF34-BD32B45831F7> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCVMSPluginSupport.dylib
+    0x7fff3724b000 -     0x7fff3724fff7  libCoreFSCache.dylib (162.4) <B325B709-0C81-357A-B9F1-6E0027B64F9B> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreFSCache.dylib
+    0x7fff37250000 -     0x7fff37254fff  libCoreVMClient.dylib (162.4) <B129DB84-39BA-34E4-9FB7-20A020A1BB86> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libCoreVMClient.dylib
+    0x7fff37255000 -     0x7fff3725dfff  libGFXShared.dylib (16.4.2) <07F1D947-F79B-3608-9080-E4DBFE13AF1D> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGFXShared.dylib
+    0x7fff3725e000 -     0x7fff37269fff  libGL.dylib (16.4.2) <97D6871A-BAF1-33DD-9ED7-BE7BB437F378> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGL.dylib
+    0x7fff3726a000 -     0x7fff372a5fe7  libGLImage.dylib (16.4.2) <3E2802DF-4998-31DB-B3A2-65720DE919A5> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
+    0x7fff372a6000 -     0x7fff37412fff  libGLProgrammability.dylib (16.4.2) <3505EF20-FA3D-321B-8C11-D9CA74656F30> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLProgrammability.dylib
+    0x7fff37413000 -     0x7fff37451ffb  libGLU.dylib (16.4.2) <ECABCFAB-E400-3667-8EE1-586C07E0E214> /System/Library/Frameworks/OpenGL.framework/Versions/A/Libraries/libGLU.dylib
+    0x7fff37dc9000 -     0x7fff37dd7ffb  com.apple.opengl (16.4.2 - 16.4.2) <C8C31EF5-8DB4-336F-A87C-5D520C7EFDC5> /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL
+    0x7fff37dd8000 -     0x7fff37f6fffb  GLEngine (16.4.2) <8F35484D-9C09-3D79-9825-7E73661326D4> /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLEngine.bundle/GLEngine
+    0x7fff37f70000 -     0x7fff37f98ffb  GLRendererFloat (16.4.2) <463BD481-6E1A-3EFC-A93B-C7E9292F76ED> /System/Library/Frameworks/OpenGL.framework/Versions/A/Resources/GLRendererFloat.bundle/GLRendererFloat
+    0x7fff3814f000 -     0x7fff3829bfff  com.apple.QTKit (7.7.3 - 3014) <CF2818E6-E215-3C24-A2AC-1B5F8AD7E398> /System/Library/Frameworks/QTKit.framework/Versions/A/QTKit
+    0x7fff3829c000 -     0x7fff38501ff7  com.apple.imageKit (3.0 - 1040) <5A1261EA-76C5-386C-9F46-06EE804E2234> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/ImageKit.framework/Versions/A/ImageKit
+    0x7fff38502000 -     0x7fff385eeff3  com.apple.PDFKit (1.0 - 677.4) <B5E41E73-0F19-3026-A30E-121F66A38019> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/PDFKit.framework/Versions/A/PDFKit
+    0x7fff385ef000 -     0x7fff38b01ff7  com.apple.QuartzComposer (5.1 - 364) <D99600D5-C066-3D49-8641-369A69300D16> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuartzComposer.framework/Versions/A/QuartzComposer
+    0x7fff38b02000 -     0x7fff38b25fff  com.apple.quartzfilters (1.10.0 - 1.10.0) <8CBE10F3-828F-373C-B92A-A5289CBCF77A> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuartzFilters.framework/Versions/A/QuartzFilters
+    0x7fff38b26000 -     0x7fff38c1dff7  com.apple.QuickLookUIFramework (5.0 - 743.7) <53CAEAD9-0C1D-3CFB-866A-21F4745544D7> /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/QuickLookUI
+    0x7fff38c1e000 -     0x7fff38c1efff  com.apple.quartzframework (1.5 - 21) <3F3BE91F-A032-3E92-ACEA-E2DFEC999E93> /System/Library/Frameworks/Quartz.framework/Versions/A/Quartz
+    0x7fff38c1f000 -     0x7fff38e67fff  com.apple.QuartzCore (1.11 - 584.8.94) <8D6B5735-852F-36D3-9349-C423582F743B> /System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore
+    0x7fff38e68000 -     0x7fff38ebfff7  com.apple.QuickLookFramework (5.0 - 743.7) <0CB6717C-CCE2-3591-A31E-A8EF01DD4FC8> /System/Library/Frameworks/QuickLook.framework/Versions/A/QuickLook
+    0x7fff39084000 -     0x7fff3909afff  com.apple.SafariServices.framework (13604 - 13604.4.7.1.3) <4DA6B5BD-0F79-3E34-9206-58A0FF3C01D2> /System/Library/Frameworks/SafariServices.framework/Versions/A/SafariServices
+    0x7fff396a0000 -     0x7fff399b7fff  com.apple.security (7.0 - 58286.31.2) <D31B36DF-8956-3205-BFBA-98732DA715E5> /System/Library/Frameworks/Security.framework/Versions/A/Security
+    0x7fff399b8000 -     0x7fff39a42ff7  com.apple.securityfoundation (6.0 - 55185.30.4) <A1201529-3718-31C4-9D9E-BBD2A04B6751> /System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation
+    0x7fff39a43000 -     0x7fff39a73ff3  com.apple.securityinterface (10.0 - 55109.30.2) <B305DA7D-7866-3194-B498-F9995D232486> /System/Library/Frameworks/SecurityInterface.framework/Versions/A/SecurityInterface
+    0x7fff39a74000 -     0x7fff39a77ffb  com.apple.xpc.ServiceManagement (1.0 - 1) <B11C3C64-6FE7-3A78-B583-D790B7CCE95A> /System/Library/Frameworks/ServiceManagement.framework/Versions/A/ServiceManagement
+    0x7fff39e1c000 -     0x7fff39e8cff3  com.apple.SystemConfiguration (1.17 - 1.17) <3C6B2BB9-43AB-39AD-8027-38E30A8A4186> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
+    0x7fff3a041000 -     0x7fff3a3baff7  com.apple.VideoToolbox (1.0 - 2267.40.5) <CC88FFB3-5DBE-33C0-AF8D-2C915D915A24> /System/Library/Frameworks/VideoToolbox.framework/Versions/A/VideoToolbox
+    0x7fff3a662000 -     0x7fff3ab7bfe3  libwebrtc.dylib (7604.4.7.1.3) <777100A8-D98C-3DC1-931C-BBC689345FA2> /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/Frameworks/libwebrtc.dylib
+    0x7fff3ab7c000 -     0x7fff3c018fff  com.apple.WebCore (13604 - 13604.4.7.1.3) <FD0252AD-1BF9-30EE-BF2E-4409722582EB> /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebCore.framework/Versions/A/WebCore
+    0x7fff3c019000 -     0x7fff3c20aff7  com.apple.WebKitLegacy (13604 - 13604.4.7.1.3) <91DD2BFE-AA52-38AD-920C-D21D22ECA1B3> /System/Library/Frameworks/WebKit.framework/Versions/A/Frameworks/WebKitLegacy.framework/Versions/A/WebKitLegacy
+    0x7fff3c20b000 -     0x7fff3c5fafff  com.apple.WebKit (13604 - 13604.4.7.1.3) <E9C0A9B5-5331-3FDE-9587-968A86981D53> /System/Library/Frameworks/WebKit.framework/Versions/A/WebKit
+    0x7fff3ca6a000 -     0x7fff3caf6ff7  com.apple.APFS (1.0 - 1) <834EAD5F-0C4E-3C33-A654-8E1670CEC457> /System/Library/PrivateFrameworks/APFS.framework/Versions/A/APFS
+    0x7fff3d704000 -     0x7fff3d72cfff  com.apple.framework.Apple80211 (13.0 - 1345) <BD86685B-6221-300D-9A97-119285C43DE9> /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Apple80211
+    0x7fff3d72e000 -     0x7fff3d73dff7  com.apple.AppleFSCompression (96.30.2 - 1.0) <CFA90544-68EB-3CCE-A8F7-1B03974F3B85> /System/Library/PrivateFrameworks/AppleFSCompression.framework/Versions/A/AppleFSCompression
+    0x7fff3d73e000 -     0x7fff3d822ff7  com.apple.AppleGVAFramework (11.3.7 - 11.3.7) <EB9E64AF-AFF6-3747-8F0E-E77377328143> /System/Library/PrivateFrameworks/AppleGVA.framework/Versions/A/AppleGVA
+    0x7fff3d879000 -     0x7fff3d8c1ff3  com.apple.AppleJPEG (1.0 - 1) <8BBD5180-5BF9-33DB-8B91-974B1D0AECFB> /System/Library/PrivateFrameworks/AppleJPEG.framework/Versions/A/AppleJPEG
+    0x7fff3d8d4000 -     0x7fff3d8f2ff3  com.apple.aps.framework (4.0 - 4.0) <932274E4-DCD5-30D5-9AC7-58CEF4571EB3> /System/Library/PrivateFrameworks/ApplePushService.framework/Versions/A/ApplePushService
+    0x7fff3d8f3000 -     0x7fff3d8fbff3  com.apple.AppleSRP (5.0 - 1) <4CEC34CF-63E3-3023-B61B-F8D133698534> /System/Library/PrivateFrameworks/AppleSRP.framework/Versions/A/AppleSRP
+    0x7fff3d8fc000 -     0x7fff3d924fff  com.apple.applesauce (1.0 - ???) <32FF4851-2F68-35BA-835F-91856A20C323> /System/Library/PrivateFrameworks/AppleSauce.framework/Versions/A/AppleSauce
+    0x7fff3d9ed000 -     0x7fff3d9f0ff3  com.apple.AppleSystemInfo (3.1.5 - 3.1.5) <A6795AC1-D528-3A2F-9C43-14EBFC57B7D6> /System/Library/PrivateFrameworks/AppleSystemInfo.framework/Versions/A/AppleSystemInfo
+    0x7fff3d9f1000 -     0x7fff3da41ff7  com.apple.AppleVAFramework (5.0.39 - 5.0.39) <4B830521-2A54-3116-8103-127E631FEDC8> /System/Library/PrivateFrameworks/AppleVA.framework/Versions/A/AppleVA
+    0x7fff3e110000 -     0x7fff3e117ff7  com.apple.coreservices.BackgroundTaskManagement (1.0 - 57.1) <47B6301F-D908-3811-BB9E-DA16D9B29A34> /System/Library/PrivateFrameworks/BackgroundTaskManagement.framework/Versions/A/BackgroundTaskManagement
+    0x7fff3e118000 -     0x7fff3e19fff7  com.apple.backup.framework (1.9.2 - 1.9.2) <40C6CFA8-4013-3AFB-97CE-8A09388FA343> /System/Library/PrivateFrameworks/Backup.framework/Versions/A/Backup
+    0x7fff3e215000 -     0x7fff3e251fff  com.apple.bom (14.0 - 194.2) <ED2FFB9D-4DA4-322B-89C0-102D790649CD> /System/Library/PrivateFrameworks/Bom.framework/Versions/A/Bom
+    0x7fff3e86f000 -     0x7fff3e89cfff  com.apple.CalendarAgentLink (8.0 - 250) <55B60B04-2EAA-3F22-88EF-1602129D5294> /System/Library/PrivateFrameworks/CalendarAgentLink.framework/Versions/A/CalendarAgentLink
+    0x7fff3ef63000 -     0x7fff3efb2ff3  com.apple.ChunkingLibrary (188 - 188) <84E024A0-5F95-3A30-A60B-102343AE46B7> /System/Library/PrivateFrameworks/ChunkingLibrary.framework/Versions/A/ChunkingLibrary
+    0x7fff3fb2e000 -     0x7fff3fb37ff3  com.apple.CommonAuth (4.0 - 2.0) <11B2D184-36B8-3624-B1AD-7B6037D76160> /System/Library/PrivateFrameworks/CommonAuth.framework/Versions/A/CommonAuth
+    0x7fff3fb4c000 -     0x7fff3fb61ff7  com.apple.commonutilities (8.0 - 900) <518FBC2C-0AF3-39DF-B454-526311796A49> /System/Library/PrivateFrameworks/CommonUtilities.framework/Versions/A/CommonUtilities
+    0x7fff3fce5000 -     0x7fff3fd45fff  com.apple.AddressBook.ContactsFoundation (8.0 - ???) <9B39DF3E-5B7F-3467-AC17-23258F76A376> /System/Library/PrivateFrameworks/ContactsFoundation.framework/Versions/A/ContactsFoundation
+    0x7fff3fd46000 -     0x7fff3fd68fff  com.apple.contacts.ContactsPersistence (1.0 - 2330.3) <B7EA2D0A-8A43-3E9C-A7D2-E9585064C328> /System/Library/PrivateFrameworks/ContactsPersistence.framework/Versions/A/ContactsPersistence
+    0x7fff3fdc8000 -     0x7fff401a8fff  com.apple.CoreAUC (249.0.0 - 249.0.0) <7F406271-A215-3C75-BDAA-B9611BA2822E> /System/Library/PrivateFrameworks/CoreAUC.framework/Versions/A/CoreAUC
+    0x7fff401a9000 -     0x7fff401d9ff7  com.apple.CoreAVCHD (5.9.0 - 5900.4.1) <D0879D8F-488A-3D46-BC50-AD7B0642C0E8> /System/Library/PrivateFrameworks/CoreAVCHD.framework/Versions/A/CoreAVCHD
+    0x7fff401f0000 -     0x7fff4021dfff  com.apple.CoreAnalytics.CoreAnalytics (1.0 - 1) <2D7C7B8C-C9C8-3F32-B43E-E792CD88A77D> /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics
+    0x7fff403d4000 -     0x7fff403ddff7  com.apple.frameworks.CoreDaemon (1.3 - 1.3) <0A87A91C-A2CF-3BB1-9038-7F610111BC30> /System/Library/PrivateFrameworks/CoreDaemon.framework/Versions/B/CoreDaemon
+    0x7fff40544000 -     0x7fff40554ff7  com.apple.CoreEmoji (1.0 - 69.3) <A4357F5C-0C38-3A61-B456-D7321EB2CEE5> /System/Library/PrivateFrameworks/CoreEmoji.framework/Versions/A/CoreEmoji
+    0x7fff40e0f000 -     0x7fff40e25ff7  com.apple.CoreMediaAuthoring (2.2 - 956) <A5003E93-68B3-3A0E-8252-454CC4CFEC4D> /System/Library/PrivateFrameworks/CoreMediaAuthoring.framework/Versions/A/CoreMediaAuthoring
+    0x7fff40f67000 -     0x7fff40fc4ff7  com.apple.CoreNLP (1.0 - 130.4.1) <1F329E38-E7D0-3455-981B-48F434C9E8CC> /System/Library/PrivateFrameworks/CoreNLP.framework/Versions/A/CoreNLP
+    0x7fff4114d000 -     0x7fff41152ff7  com.apple.CoreOptimization (1.0 - 1) <785B622B-8F7D-3B4D-83AF-EB98CB79FFF6> /System/Library/PrivateFrameworks/CoreOptimization.framework/Versions/A/CoreOptimization
+    0x7fff41153000 -     0x7fff411f8ff7  com.apple.CorePDF (4.0 - 414) <353C8875-F5A0-37B0-82CF-CAFCE1A95D50> /System/Library/PrivateFrameworks/CorePDF.framework/Versions/A/CorePDF
+    0x7fff41298000 -     0x7fff412a0ff7  com.apple.CorePhoneNumbers (1.0 - 1) <9966298D-C45D-39FC-8CC4-58288F50D3F8> /System/Library/PrivateFrameworks/CorePhoneNumbers.framework/Versions/A/CorePhoneNumbers
+    0x7fff412a1000 -     0x7fff412fdfff  com.apple.CorePrediction (1.0 - 1) <B1E687BA-4E62-321B-8C87-D37C540A5A68> /System/Library/PrivateFrameworks/CorePrediction.framework/Versions/A/CorePrediction
+    0x7fff4142a000 -     0x7fff4145bff3  com.apple.CoreServicesInternal (309.1 - 309.1) <EB09CAFC-AE9B-3257-BE45-5471D9F64AAD> /System/Library/PrivateFrameworks/CoreServicesInternal.framework/Versions/A/CoreServicesInternal
+    0x7fff417aa000 -     0x7fff4183bfff  com.apple.CoreSymbolication (63075) <2458D96C-1C31-34F8-93F0-73DB0042CB30> /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication
+    0x7fff418be000 -     0x7fff419f2fff  com.apple.coreui (2.1 - 492.2) <FE0B32BC-958D-3445-866E-A3905626396D> /System/Library/PrivateFrameworks/CoreUI.framework/Versions/A/CoreUI
+    0x7fff419f3000 -     0x7fff41afeff3  com.apple.CoreUtils (5.3 - 530.57) <1DE5249E-35C5-3B13-BA5B-0C1AA4E17CDD> /System/Library/PrivateFrameworks/CoreUtils.framework/Versions/A/CoreUtils
+    0x7fff41b53000 -     0x7fff41bb7fff  com.apple.framework.CoreWiFi (13.0 - 1339) <1741FD6D-3DF2-3D2D-9B56-92A6AA0D1146> /System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi
+    0x7fff41bb8000 -     0x7fff41bc7ff7  com.apple.CrashReporterSupport (10.13 - 1) <6B5B2B78-15D2-363F-BE34-8F9226E79E24> /System/Library/PrivateFrameworks/CrashReporterSupport.framework/Versions/A/CrashReporterSupport
+    0x7fff41c44000 -     0x7fff41c53ff7  com.apple.framework.DFRFoundation (1.0 - 191.1) <09E9A14C-E7A8-3386-8323-270FA28BFB81> /System/Library/PrivateFrameworks/DFRFoundation.framework/Versions/A/DFRFoundation
+    0x7fff41c56000 -     0x7fff41c5affb  com.apple.DSExternalDisplay (3.1 - 380) <BEC07C7C-F3AC-3CF3-B13E-3EBFD6224C0D> /System/Library/PrivateFrameworks/DSExternalDisplay.framework/Versions/A/DSExternalDisplay
+    0x7fff41c9f000 -     0x7fff41cdfffb  com.apple.datadetectors (5.0 - 376) <612C677D-BB71-35D2-BBF3-EA9EC51ADF12> /System/Library/PrivateFrameworks/DataDetectors.framework/Versions/A/DataDetectors
+    0x7fff41ce0000 -     0x7fff41d56fff  com.apple.datadetectorscore (7.0 - 590.3) <792593BC-21C7-3E0C-929E-067CD725FCBD> /System/Library/PrivateFrameworks/DataDetectorsCore.framework/Versions/A/DataDetectorsCore
+    0x7fff41da4000 -     0x7fff41de4ff7  com.apple.DebugSymbols (141 - 141) <99562E28-0E56-3F6F-93A1-EF997A5E1F87> /System/Library/PrivateFrameworks/DebugSymbols.framework/Versions/A/DebugSymbols
+    0x7fff41de5000 -     0x7fff41f14fff  com.apple.desktopservices (1.12.2 - 1.12.2) <8E068AF7-FB72-38E2-948E-6C13F359C69D> /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/DesktopServicesPriv
+    0x7fff41f73000 -     0x7fff41f74ff7  com.apple.diagnosticlogcollection (10.0 - 1000) <DFD57FDB-CB78-3FB0-B49B-4586F9E0DFC1> /System/Library/PrivateFrameworks/DiagnosticLogCollection.framework/Versions/A/DiagnosticLogCollection
+    0x7fff42006000 -     0x7fff420d8ff7  com.apple.DiskImagesFramework (480.30.2 - 480.30.2) <251D047D-D79A-3300-8DFC-D6D6D4D0015D> /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/DiskImages
+    0x7fff420d9000 -     0x7fff42150ff7  com.apple.DiskManagement (11.2 - 1339) <0B17E79A-0BF6-3FD8-8AD0-A8498545030F> /System/Library/PrivateFrameworks/DiskManagement.framework/Versions/A/DiskManagement
+    0x7fff42151000 -     0x7fff4215cff7  com.apple.DisplayServicesFW (3.1 - 380) <FB1FBB24-7FD5-3B57-8D3C-39F953F8A9BB> /System/Library/PrivateFrameworks/DisplayServices.framework/Versions/A/DisplayServices
+    0x7fff421e4000 -     0x7fff421e6ff7  com.apple.EFILogin (2.0 - 2) <5B6E5A73-C2B2-3188-ADE9-C29CE29BB225> /System/Library/PrivateFrameworks/EFILogin.framework/Versions/A/EFILogin
+    0x7fff42932000 -     0x7fff4294afff  com.apple.Engram (1.0 - 1) <93DC8AE3-B3F7-326E-93DB-C85A2BFD3C3F> /System/Library/PrivateFrameworks/Engram.framework/Versions/A/Engram
+    0x7fff42c88000 -     0x7fff430b6fff  com.apple.vision.FaceCore (3.3.2 - 3.3.2) <80C97AD7-D5C2-311A-B268-4AA60CAD6CED> /System/Library/PrivateFrameworks/FaceCore.framework/Versions/A/FaceCore
+    0x7fff44d1e000 -     0x7fff44d1efff  libmetal_timestamp.dylib (802.3.14) <D2CD48A8-5989-32AC-B64B-76E29D4E2449> /System/Library/PrivateFrameworks/GPUCompiler.framework/Versions/3802/Libraries/libmetal_timestamp.dylib
+    0x7fff4637e000 -     0x7fff46389ff7  libGPUSupportMercury.dylib (16.4.2) <F5BA5D7A-FD23-3416-B9B3-7EABFD4279D5> /System/Library/PrivateFrameworks/GPUSupport.framework/Versions/A/Libraries/libGPUSupportMercury.dylib
+    0x7fff46726000 -     0x7fff4674bff3  com.apple.GenerationalStorage (2.0 - 285) <07E7BC5F-8EF2-34FC-9EEC-B4E61EAAFA9A> /System/Library/PrivateFrameworks/GenerationalStorage.framework/Versions/A/GenerationalStorage
+    0x7fff46763000 -     0x7fff47087fff  com.apple.GeoServices (1.0 - 1359.22.9.1.19) <0D30FD8E-BAED-3383-AF27-965D3A09B05E> /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/GeoServices
+    0x7fff470ca000 -     0x7fff470d9fff  com.apple.GraphVisualizer (1.0 - 5) <0A93C5DE-0D28-312E-8764-6B0FB805ED91> /System/Library/PrivateFrameworks/GraphVisualizer.framework/Versions/A/GraphVisualizer
+    0x7fff47151000 -     0x7fff471c5fff  com.apple.Heimdal (4.0 - 2.0) <ACC132E5-97F1-3B36-AD7B-4E6CC077E691> /System/Library/PrivateFrameworks/Heimdal.framework/Versions/A/Heimdal
+    0x7fff4725f000 -     0x7fff47371ff3  com.apple.ids (10.0 - 1000) <3BAA60B0-8F63-3570-B276-01EF45B9B4DF> /System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDS
+    0x7fff47372000 -     0x7fff47450ff3  com.apple.idsfoundation (10.0 - 1000) <22E80DC0-4246-3B6B-903F-D1D191E615F8> /System/Library/PrivateFrameworks/IDSFoundation.framework/Versions/A/IDSFoundation
+    0x7fff47957000 -     0x7fff479bdff3  com.apple.imfoundation (10.0 - 1000) <32799DD1-91A2-3093-8D8C-4F4988560FC2> /System/Library/PrivateFrameworks/IMFoundation.framework/Versions/A/IMFoundation
+    0x7fff47a77000 -     0x7fff47a7effb  com.apple.IOAccelerator (376.6 - 376.6) <A47129CC-F386-3C31-AD66-C19A70615A50> /System/Library/PrivateFrameworks/IOAccelerator.framework/Versions/A/IOAccelerator
+    0x7fff47a82000 -     0x7fff47a99fff  com.apple.IOPresentment (1.0 - 32.1) <B95F06EA-9D5D-311D-9912-978AE42ECFCE> /System/Library/PrivateFrameworks/IOPresentment.framework/Versions/A/IOPresentment
+    0x7fff47e63000 -     0x7fff47e88fff  com.apple.IconServices (97.4 - 97.4) <C84A6CA5-8C50-3288-8572-CC3DABF5BBCE> /System/Library/PrivateFrameworks/IconServices.framework/Versions/A/IconServices
+    0x7fff47f92000 -     0x7fff47f95ff3  com.apple.InternationalSupport (1.0 - 1) <5AB382FD-BF81-36A1-9565-61F1FD398ECA> /System/Library/PrivateFrameworks/InternationalSupport.framework/Versions/A/InternationalSupport
+    0x7fff48003000 -     0x7fff48013ffb  com.apple.IntlPreferences (2.0 - 227) <0FF7209B-0E4D-3411-B325-03938B7C0938> /System/Library/PrivateFrameworks/IntlPreferences.framework/Versions/A/IntlPreferences
+    0x7fff4811d000 -     0x7fff48212fff  com.apple.LanguageModeling (1.0 - 159.3.1) <9B08E18E-69B4-3413-A03A-EF5AE4BE6277> /System/Library/PrivateFrameworks/LanguageModeling.framework/Versions/A/LanguageModeling
+    0x7fff48213000 -     0x7fff48255ff7  com.apple.Lexicon-framework (1.0 - 33.2) <5CC5E8EE-62A1-3EA5-B300-A39ABD0CF12D> /System/Library/PrivateFrameworks/Lexicon.framework/Versions/A/Lexicon
+    0x7fff48259000 -     0x7fff48260ff7  com.apple.LinguisticData (1.0 - 238.3) <228AF7CA-649A-3E24-BBC7-8A24B39B3FC4> /System/Library/PrivateFrameworks/LinguisticData.framework/Versions/A/LinguisticData
+    0x7fff48347000 -     0x7fff4834cfff  com.apple.LoginUICore (4.0 - 4.0) <A5F2EF2E-0999-376D-83EF-1B66171C5723> /System/Library/PrivateFrameworks/LoginUIKit.framework/Versions/A/Frameworks/LoginUICore.framework/Versions/A/LoginUICore
+    0x7fff48398000 -     0x7fff483b5ff3  com.apple.LookupFramework (1.2 - 239) <ACECB15D-1C21-3D3D-A4C5-F9736090E741> /System/Library/PrivateFrameworks/Lookup.framework/Versions/A/Lookup
+    0x7fff48a84000 -     0x7fff48a87fff  com.apple.Mangrove (1.0 - 1) <13832222-8A6B-3790-8914-BE874B5ED4DD> /System/Library/PrivateFrameworks/Mangrove.framework/Versions/A/Mangrove
+    0x7fff48b10000 -     0x7fff48b12ff7  com.apple.marco (10.0 - 1000) <86E99D5C-D56D-3874-B465-833A9B40DE88> /System/Library/PrivateFrameworks/Marco.framework/Versions/A/Marco
+    0x7fff48ba0000 -     0x7fff48bd3ff7  com.apple.MediaKit (16 - 871) <47A5B872-4139-315D-A047-581F9C485D15> /System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/MediaKit
+    0x7fff48bd4000 -     0x7fff48e18ff7  com.apple.MediaRemote (1.0 - 1) <ADDC2917-76C0-3F07-8DBF-746C9CA6A9BE> /System/Library/PrivateFrameworks/MediaRemote.framework/Versions/A/MediaRemote
+    0x7fff48e19000 -     0x7fff48e38ff3  com.apple.MediaServices (1.0 - 1) <2CA740A6-7E26-3865-8A5B-C2912665D01C> /System/Library/PrivateFrameworks/MediaServices.framework/Versions/A/MediaServices
+    0x7fff48eac000 -     0x7fff48f15ff7  com.apple.gpusw.MetalTools (1.0 - 1) <F77943BC-0466-3700-BEDF-CDD13125D36A> /System/Library/PrivateFrameworks/MetalTools.framework/Versions/A/MetalTools
+    0x7fff48f1d000 -     0x7fff48f32ff3  com.apple.MobileAssets (1.0 - 437.30.17) <9C014350-D76E-3143-ACFF-F3D1B2668988> /System/Library/PrivateFrameworks/MobileAsset.framework/Versions/A/MobileAsset
+    0x7fff49089000 -     0x7fff490a1ff3  com.apple.MobileKeyBag (2.0 - 1.0) <170AD2F3-9D3E-3FF6-BA02-60C48C1E6724> /System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag
+    0x7fff4912d000 -     0x7fff49155fff  com.apple.MultitouchSupport.framework (1204.13 - 1204.13) <6C5D778D-4AB7-39A4-989B-2E8D2D57B3A0> /System/Library/PrivateFrameworks/MultitouchSupport.framework/Versions/A/MultitouchSupport
+    0x7fff493ba000 -     0x7fff493c5fff  com.apple.NetAuth (6.2 - 6.2) <5C6F492A-28EF-3A0E-B573-6F3D60CFF0C7> /System/Library/PrivateFrameworks/NetAuth.framework/Versions/A/NetAuth
+    0x7fff493d2000 -     0x7fff4949fff7  com.apple.Network (1.0 - 1) <3C391F45-3801-3C27-8D89-FDE554156CDD> /System/Library/PrivateFrameworks/Network.framework/Versions/A/Network
+    0x7fff4abc7000 -     0x7fff4ac07ffb  com.apple.PerformanceAnalysis (1.183.1 - 183.1) <2BE359F2-DCE6-3E33-BA99-964507A3F540> /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/PerformanceAnalysis
+    0x7fff4ac7f000 -     0x7fff4ac7fff7  com.apple.PhoneNumbers (1.0 - 1) <DB9AC990-BA10-3BAC-8109-3C71E9D45BE2> /System/Library/PrivateFrameworks/PhoneNumbers.framework/Versions/A/PhoneNumbers
+    0x7fff4c66b000 -     0x7fff4c690fff  com.apple.pluginkit.framework (1.0 - 1) <D627D78B-BEDA-3E53-B5F8-B3805F1C4D2A> /System/Library/PrivateFrameworks/PlugInKit.framework/Versions/A/PlugInKit
+    0x7fff4c98f000 -     0x7fff4c9e2fff  com.apple.ProtectedCloudStorage (1.0 - 1) <8C4D5271-406F-3455-88FA-995A95D6D4A1> /System/Library/PrivateFrameworks/ProtectedCloudStorage.framework/Versions/A/ProtectedCloudStorage
+    0x7fff4c9e3000 -     0x7fff4ca01fff  com.apple.ProtocolBuffer (1 - 259) <D047A3FE-C7A8-3CAA-9891-6232BA88C247> /System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBuffer
+    0x7fff4cb6e000 -     0x7fff4cb83ff3  com.apple.QuickLookThumbnailing (1.0 - 1) <0771325B-BBAD-3865-B2A3-BE7089641C52> /System/Library/PrivateFrameworks/QuickLookThumbnailing.framework/Versions/A/QuickLookThumbnailing
+    0x7fff4cb84000 -     0x7fff4cb8cff3  com.apple.RTCReporting (9.32.35.1 - 9.32.35.1) <A62555BF-C5C0-3CD8-BBFA-DB6D0F25722B> /System/Library/PrivateFrameworks/RTCReporting.framework/Versions/A/RTCReporting
+    0x7fff4cbd5000 -     0x7fff4cbe0fff  com.apple.xpc.RemoteServiceDiscovery (1.0 - 1205.30.29) <E2AEA0D7-23E6-3198-96EF-2F1F8ACD98B4> /System/Library/PrivateFrameworks/RemoteServiceDiscovery.framework/Versions/A/RemoteServiceDiscovery
+    0x7fff4cbe1000 -     0x7fff4cc04ffb  com.apple.RemoteViewServices (2.0 - 125) <AEDBCE8C-88B7-315A-9F81-3E068F0D3EDC> /System/Library/PrivateFrameworks/RemoteViewServices.framework/Versions/A/RemoteViewServices
+    0x7fff4cc05000 -     0x7fff4cc16ffb  com.apple.xpc.RemoteXPC (1.0 - 1205.30.29) <1FD53EC6-A9E9-3AEC-86A7-C52729D1A135> /System/Library/PrivateFrameworks/RemoteXPC.framework/Versions/A/RemoteXPC
+    0x7fff4e51d000 -     0x7fff4e62dff7  com.apple.Sharing (972.6 - 972.6) <2F72F828-7A05-345F-8ABA-1EDADACA4D57> /System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing
+    0x7fff4e657000 -     0x7fff4e658fff  com.apple.performance.SignpostNotification (1.0 - 1) <D4C967BA-92C6-3BAB-AFB5-59F98B35F921> /System/Library/PrivateFrameworks/SignpostNotification.framework/Versions/A/SignpostNotification
+    0x7fff4f355000 -     0x7fff4f5effff  com.apple.SkyLight (1.600.0 - 312.23.4) <390012E0-39E3-3D18-8271-D447990FDD21> /System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/SkyLight
+    0x7fff4fda0000 -     0x7fff4fdadff7  com.apple.SpeechRecognitionCore (4.0.13 - 4.0.13) <AC026FB9-78F8-31F9-BB80-619D5378DB70> /System/Library/PrivateFrameworks/SpeechRecognitionCore.framework/Versions/A/SpeechRecognitionCore
+    0x7fff50246000 -     0x7fff5026dff7  com.apple.StreamingZip (1.0 - 1) <F06F4CDC-138C-3991-A987-7C7332BE4508> /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/StreamingZip
+    0x7fff5093f000 -     0x7fff509c3fe7  com.apple.Symbolication (9.0 - 63079.1) <177BC9CA-E6AE-3B40-806F-0080C0CDFF29> /System/Library/PrivateFrameworks/Symbolication.framework/Versions/A/Symbolication
+    0x7fff50c85000 -     0x7fff50cb1fff  com.apple.framework.SystemAdministration (1.0 - 1.0) <6AE03DE8-E5C1-38E5-B788-0A763CAACDC2> /System/Library/PrivateFrameworks/SystemAdministration.framework/Versions/A/SystemAdministration
+    0x7fff50eb4000 -     0x7fff50ebbff3  com.apple.TCC (1.0 - 1) <C807D3F0-FE20-3FC0-8D61-306477ABEBC4> /System/Library/PrivateFrameworks/TCC.framework/Versions/A/TCC
+    0x7fff510c8000 -     0x7fff51185ff7  com.apple.TextureIO (3.7 - 3.7) <C98BFACA-7807-3DCA-945D-58EBA2B723C8> /System/Library/PrivateFrameworks/TextureIO.framework/Versions/A/TextureIO
+    0x7fff511d6000 -     0x7fff511f1ffb  com.apple.ToneKit (1.0 - 1) <A0242052-983B-3726-B5BD-D2E672CEFE2F> /System/Library/PrivateFrameworks/ToneKit.framework/Versions/A/ToneKit
+    0x7fff511f2000 -     0x7fff51219fff  com.apple.ToneLibrary (1.0 - 1) <7EEABD7F-D0CB-327E-A772-ACF406B9C8F2> /System/Library/PrivateFrameworks/ToneLibrary.framework/Versions/A/ToneLibrary
+    0x7fff51229000 -     0x7fff5122afff  com.apple.TrustEvaluationAgent (2.0 - 31) <39F533B2-211E-3635-AF47-23F27749FF4A> /System/Library/PrivateFrameworks/TrustEvaluationAgent.framework/Versions/A/TrustEvaluationAgent
+    0x7fff51230000 -     0x7fff513dfff3  com.apple.UIFoundation (1.0 - 546.1.1) <2B50EBBC-9221-31BC-92A9-7ED0A4A46E2D> /System/Library/PrivateFrameworks/UIFoundation.framework/Versions/A/UIFoundation
+    0x7fff520a8000 -     0x7fff52177ff7  com.apple.ViewBridge (343.2 - 343.2) <DD3D1ED5-DF9E-3C48-8897-0B84B0AD2377> /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/ViewBridge
+    0x7fff5253c000 -     0x7fff52762ff7  libAWDSupportFramework.dylib (749.13) <B8711178-CE8C-3786-A269-E83710A1B71D> /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libraries/libAWDSupportFramework.dylib
+    0x7fff52763000 -     0x7fff52774fff  libprotobuf-lite.dylib (749.13) <9344E035-93AA-3197-8033-93348005AFF5> /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libraries/libprotobuf-lite.dylib
+    0x7fff52775000 -     0x7fff527d7fff  libprotobuf.dylib (749.13) <EA5D182D-2E4B-3DF3-BEED-ADEF1FE4EBC5> /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/Libraries/libprotobuf.dylib
+    0x7fff527d8000 -     0x7fff5281bff7  com.apple.awd (1.0 - 919) <60D12A36-C579-348F-B84C-E25F20C422E0> /System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/WirelessDiagnostics
+    0x7fff52b22000 -     0x7fff52b24ffb  com.apple.loginsupport (1.0 - 1) <5E2C4AA7-066D-3FDB-B0E1-4CDAF287392C> /System/Library/PrivateFrameworks/login.framework/Versions/A/Frameworks/loginsupport.framework/Versions/A/loginsupport
+    0x7fff52b25000 -     0x7fff52b3afff  com.apple.login (3.0 - 3.0) <140118A7-8FB9-35C5-92FA-BD79C9C32309> /System/Library/PrivateFrameworks/login.framework/Versions/A/login
+    0x7fff52b65000 -     0x7fff52b92fff  com.apple.contacts.vCard (1.0 - 2330.3) <02AB9DF0-0471-3FDA-8EC6-27C72E00DD75> /System/Library/PrivateFrameworks/vCard.framework/Versions/A/vCard
+    0x7fff52c88000 -     0x7fff52cbbfff  libclosured.dylib (519.2.2) <48051216-5647-3643-B979-B77D0FD20011> /usr/lib/closure/libclosured.dylib
+    0x7fff52d5b000 -     0x7fff52d94ff7  libCRFSuite.dylib (41) <AB2DA745-F22C-30CF-81D4-35DD716463B8> /usr/lib/libCRFSuite.dylib
+    0x7fff52d95000 -     0x7fff52da0fff  libChineseTokenizer.dylib (28) <D30A7DB6-058F-3286-9583-60C9EEB77A6E> /usr/lib/libChineseTokenizer.dylib
+    0x7fff52da1000 -     0x7fff52e2eff7  libCoreStorage.dylib (546) <B495D87B-FE21-3C14-9017-F02D9CA226D5> /usr/lib/libCoreStorage.dylib
+    0x7fff52e32000 -     0x7fff52e33ff3  libDiagnosticMessagesClient.dylib (104) <9712E980-76EE-3A89-AEA6-DF4BAF5C0574> /usr/lib/libDiagnosticMessagesClient.dylib
+    0x7fff52e6a000 -     0x7fff53034ff3  libFosl_dynamic.dylib (17.7) <B2476843-7FA7-3E62-B79F-2B15FE557E63> /usr/lib/libFosl_dynamic.dylib
+    0x7fff5306c000 -     0x7fff5306cfff  libOpenScriptingUtil.dylib (174) <203D2C39-61BB-3713-A502-2D17B04A42AC> /usr/lib/libOpenScriptingUtil.dylib
+    0x7fff53195000 -     0x7fff53199ffb  libScreenReader.dylib (562.13) <21638ECC-87BF-3CC5-B2D8-6F7883F5FDCA> /usr/lib/libScreenReader.dylib
+    0x7fff5319a000 -     0x7fff5319bff3  libSystem.B.dylib (1252) <5EDEEA85-0387-31EE-9D9B-DA1B75E7AEF3> /usr/lib/libSystem.B.dylib
+    0x7fff5319c000 -     0x7fff53219fff  libTelephonyUtilDynamic.dylib (3086.2) <47109727-F31F-3777-BD41-1DED1B8C96DC> /usr/lib/libTelephonyUtilDynamic.dylib
+    0x7fff5321a000 -     0x7fff5321bfff  libThaiTokenizer.dylib (2.2) <04AC7CD4-BD9A-3B1D-8CEB-9E2030B6B667> /usr/lib/libThaiTokenizer.dylib
+    0x7fff5322e000 -     0x7fff5322efff  libapple_crypto.dylib (109.30.8) <E0162198-C97F-3286-9FF7-254D23F6FD04> /usr/lib/libapple_crypto.dylib
+    0x7fff5322f000 -     0x7fff53245ff7  libapple_nghttp2.dylib (1.24) <01402BC4-4822-3676-9C80-50D83F816424> /usr/lib/libapple_nghttp2.dylib
+    0x7fff53246000 -     0x7fff53270ff3  libarchive.2.dylib (54) <8FC28DD8-E315-3C3E-95FE-D1D2CBE49888> /usr/lib/libarchive.2.dylib
+    0x7fff53271000 -     0x7fff532f2fdf  libate.dylib (1.13.1) <178ACDAD-DE7E-346C-A613-1CBF7929AC07> /usr/lib/libate.dylib
+    0x7fff532f6000 -     0x7fff532f6ff3  libauto.dylib (187) <A05C7900-F8C7-3E75-8D3F-909B40C19717> /usr/lib/libauto.dylib
+    0x7fff532f7000 -     0x7fff533aeff7  libboringssl.dylib (109.30.8) <E62E3E83-BA8A-3CCE-8E71-84FB184FBBB5> /usr/lib/libboringssl.dylib
+    0x7fff533af000 -     0x7fff533bfff3  libbsm.0.dylib (39) <770B341F-3BB7-3123-B53C-F2D58868A963> /usr/lib/libbsm.0.dylib
+    0x7fff533c0000 -     0x7fff533cdffb  libbz2.1.0.dylib (38) <0A5086BB-4724-3C14-979D-5AD4F26B5B45> /usr/lib/libbz2.1.0.dylib
+    0x7fff533ce000 -     0x7fff53424fff  libc++.1.dylib (400.9) <FCF5E1F6-2B04-3545-8004-F3AB32FED172> /usr/lib/libc++.1.dylib
+    0x7fff53425000 -     0x7fff53449ff7  libc++abi.dylib (400.7) <217656D5-BC40-37FF-B322-91CB2AAD4F34> /usr/lib/libc++abi.dylib
+    0x7fff5344b000 -     0x7fff5345bfff  libcmph.dylib (6) <A5509EE8-7E00-3224-8814-015B077A3CF5> /usr/lib/libcmph.dylib
+    0x7fff5345c000 -     0x7fff53472fff  libcompression.dylib (47) <E64D4416-DFBF-314B-BBB9-BED23C3A251C> /usr/lib/libcompression.dylib
+    0x7fff5371f000 -     0x7fff53737ff7  libcoretls.dylib (155) <DFE2454F-2FE3-3B2B-A22B-422947C34C69> /usr/lib/libcoretls.dylib
+    0x7fff53738000 -     0x7fff53739ffb  libcoretls_cfhelpers.dylib (155) <D3F4B882-40C1-3CD4-927B-0E0ED6031D0B> /usr/lib/libcoretls_cfhelpers.dylib
+    0x7fff538d2000 -     0x7fff53a62fff  libcrypto.35.dylib (22) <067CFC21-249D-392D-ADE1-785100BF0F83> /usr/lib/libcrypto.35.dylib
+    0x7fff53bfd000 -     0x7fff53c08ff7  libcsfde.dylib (546) <B6F6340A-F874-38BD-A7BB-FFADEBA54789> /usr/lib/libcsfde.dylib
+    0x7fff53c09000 -     0x7fff53c5fff3  libcups.2.dylib (462.1) <B78448A0-9C97-3D4A-823E-EBE37B2B7CA6> /usr/lib/libcups.2.dylib
+    0x7fff53c8a000 -     0x7fff53cdeffb  libcurl.4.dylib (105.30.2) <DB7326B0-DE38-392D-AAFA-E81BE0EDE99E> /usr/lib/libcurl.4.dylib
+    0x7fff53ce1000 -     0x7fff53ce8ff3  libdscsym.dylib (183.1) <2DE012BF-CE9A-3BDF-9A2D-55D66B51AA35> /usr/lib/libdscsym.dylib
+    0x7fff53d9d000 -     0x7fff53d9dfff  libenergytrace.dylib (16) <A92AB8B8-B986-3CE6-980D-D55090FEF387> /usr/lib/libenergytrace.dylib
+    0x7fff53dcf000 -     0x7fff53dd3ff7  libgermantok.dylib (17) <379C5DC6-BEDB-378D-B09C-A63D297EAA6D> /usr/lib/libgermantok.dylib
+    0x7fff53dd4000 -     0x7fff53dd9ff3  libheimdal-asn1.dylib (520.30.1) <14DC1451-6E22-3A48-80CB-5D33DC0F8C3B> /usr/lib/libheimdal-asn1.dylib
+    0x7fff53e05000 -     0x7fff53ef6ff7  libiconv.2.dylib (51) <0772997F-4109-38A1-91ED-0F3F16AE99E5> /usr/lib/libiconv.2.dylib
+    0x7fff53ef7000 -     0x7fff5411effb  libicucore.A.dylib (59152.0.1) <281C39FD-0C9A-3EB2-A407-36D4CCE938E5> /usr/lib/libicucore.A.dylib
+    0x7fff5416b000 -     0x7fff5416cfff  liblangid.dylib (128) <39C39393-0D05-301D-93B2-F224FC4949AA> /usr/lib/liblangid.dylib
+    0x7fff5416d000 -     0x7fff54186ffb  liblzma.5.dylib (10) <3D419A50-961F-37D2-8A01-3DC7AB7B8D18> /usr/lib/liblzma.5.dylib
+    0x7fff54187000 -     0x7fff5419dff7  libmarisa.dylib (9) <D6D2D55D-1D2E-3442-B152-B18803C0ABB4> /usr/lib/libmarisa.dylib
+    0x7fff5419e000 -     0x7fff5424dfff  libmecab.1.0.0.dylib (779.7.6) <F179766A-0448-37A6-9AD0-99E2FF2C0AD9> /usr/lib/libmecab.1.0.0.dylib
+    0x7fff5424e000 -     0x7fff54476ff7  libmecabra.dylib (779.7.6) <7808C544-161E-37CE-9D42-F368C82A180D> /usr/lib/libmecabra.dylib
+    0x7fff5464e000 -     0x7fff54725ffb  libnetwork.dylib (1229.30.11) <2A9846DE-C063-3340-89D1-D5DAC2B8A08A> /usr/lib/libnetwork.dylib
+    0x7fff5479b000 -     0x7fff54b897e7  libobjc.A.dylib (723) <93A92316-DE1E-378C-8891-99720B50D075> /usr/lib/libobjc.A.dylib
+    0x7fff54b8a000 -     0x7fff54b8bff7  libodfde.dylib (24) <1BBC519E-EF89-38F3-B226-70F086670D0F> /usr/lib/libodfde.dylib
+    0x7fff54b9c000 -     0x7fff54ba0fff  libpam.2.dylib (22) <7B4D2CE2-1438-387A-9802-5CEEFBF26F86> /usr/lib/libpam.2.dylib
+    0x7fff54ba3000 -     0x7fff54bd7fff  libpcap.A.dylib (79.20.1) <FA13918B-A247-3181-B256-9B852C7BA316> /usr/lib/libpcap.A.dylib
+    0x7fff54c56000 -     0x7fff54c72ffb  libresolv.9.dylib (65) <E8F3415B-4472-3202-8901-41FD87981DB2> /usr/lib/libresolv.9.dylib
+    0x7fff54cad000 -     0x7fff54cbffff  libsasl2.2.dylib (211) <D9E281A2-D7BA-32CD-8B96-54972B1D9E66> /usr/lib/libsasl2.2.dylib
+    0x7fff54cc0000 -     0x7fff54cc1ff7  libspindump.dylib (248) <12E8B8BA-072F-39AE-8BC9-7D5840DA80EB> /usr/lib/libspindump.dylib
+    0x7fff54cc2000 -     0x7fff54e55fe7  libsqlite3.dylib (274.5) <A1DEB5AB-8FE8-332E-A7E5-F493F2223FE3> /usr/lib/libsqlite3.dylib
+    0x7fff54eb1000 -     0x7fff54f04ffb  libssl.35.dylib (22) <4D77B502-E065-3794-90E7-39E83F9683F6> /usr/lib/libssl.35.dylib
+    0x7fff54fac000 -     0x7fff54fbcff7  libsystemstats.dylib (403.31.1) <9FE5E908-88F1-3593-ADCD-4BC78100DA68> /usr/lib/libsystemstats.dylib
+    0x7fff54fd9000 -     0x7fff5500efff  libtidy.A.dylib (15.18.1) <3E33A53A-53AB-3FD5-BBAB-DFA6A3A90132> /usr/lib/libtidy.A.dylib
+    0x7fff55026000 -     0x7fff5505ffff  libusrtcp.dylib (1229.30.11) <537F14D0-84DF-349F-8EA0-52BB7A241E60> /usr/lib/libusrtcp.dylib
+    0x7fff55060000 -     0x7fff55063ffb  libutil.dylib (51.20.1) <216D18E5-0BAF-3EAF-A38E-F6AC37CBABD9> /usr/lib/libutil.dylib
+    0x7fff55064000 -     0x7fff55071fff  libxar.1.dylib (400) <0316128D-3B47-3052-995D-97B4FE5491DC> /usr/lib/libxar.1.dylib
+    0x7fff55075000 -     0x7fff5515cfff  libxml2.2.dylib (31.7) <49544596-BCF8-3765-8DC5-DB1A9A90EF92> /usr/lib/libxml2.2.dylib
+    0x7fff5515d000 -     0x7fff55185fff  libxslt.1.dylib (15.10) <66682AF6-C2D5-374C-901F-25A3E72814DC> /usr/lib/libxslt.1.dylib
+    0x7fff55186000 -     0x7fff55198ffb  libz.1.dylib (70) <48C67CFC-940D-3857-8DAD-857774605352> /usr/lib/libz.1.dylib
+    0x7fff55236000 -     0x7fff5523aff7  libcache.dylib (80) <354F3B7D-404E-3398-9EBF-65CA2CE65211> /usr/lib/system/libcache.dylib
+    0x7fff5523b000 -     0x7fff55245ff3  libcommonCrypto.dylib (60118.30.2) <674286D3-7744-36A3-9AAA-49DFCD97A986> /usr/lib/system/libcommonCrypto.dylib
+    0x7fff55246000 -     0x7fff5524dfff  libcompiler_rt.dylib (62) <4487CFBA-A5D7-3282-9E6B-94CAD7BE507E> /usr/lib/system/libcompiler_rt.dylib
+    0x7fff5524e000 -     0x7fff55256ffb  libcopyfile.dylib (146.30.2) <2C7C67D7-562B-3FFA-973D-BACF4C10E1EC> /usr/lib/system/libcopyfile.dylib
+    0x7fff55257000 -     0x7fff552dcfff  libcorecrypto.dylib (562.30.10) <8A53EFE1-AFCA-3676-BEE1-FA5ED9F0E222> /usr/lib/system/libcorecrypto.dylib
+    0x7fff55364000 -     0x7fff5539dff7  libdispatch.dylib (913.30.4) <7D0E3183-282B-3FEE-A734-2C0ADC092084> /usr/lib/system/libdispatch.dylib
+    0x7fff5539e000 -     0x7fff553bbff7  libdyld.dylib (519.2.2) <C50D02BC-A333-3313-B787-02F255A6783F> /usr/lib/system/libdyld.dylib
+    0x7fff553bc000 -     0x7fff553bcffb  libkeymgr.dylib (28) <6D84A96F-C65B-38EC-BDB5-21FD2C97E7B2> /usr/lib/system/libkeymgr.dylib
+    0x7fff553bd000 -     0x7fff553c9ff3  libkxld.dylib (4570.31.3) <C0DBCF74-E669-3AAD-934F-F07F3FE32908> /usr/lib/system/libkxld.dylib
+    0x7fff553ca000 -     0x7fff553caff7  liblaunch.dylib (1205.30.29) <E66F58ED-C15E-3DFB-BC22-A861E13918C6> /usr/lib/system/liblaunch.dylib
+    0x7fff553cb000 -     0x7fff553cfffb  libmacho.dylib (900.0.1) <756F2553-07B6-3B42-ACEA-2F0F1A5E8D0F> /usr/lib/system/libmacho.dylib
+    0x7fff553d0000 -     0x7fff553d2ff3  libquarantine.dylib (86) <6AC8773F-3817-3D82-99C2-01BABB9C3CBB> /usr/lib/system/libquarantine.dylib
+    0x7fff553d3000 -     0x7fff553d4ff3  libremovefile.dylib (45) <912FA211-DD8C-3C92-8424-21B89F8B10FD> /usr/lib/system/libremovefile.dylib
+    0x7fff553d5000 -     0x7fff553ecfff  libsystem_asl.dylib (356.1.1) <94972913-9DF0-3C78-847C-43E58919E3DA> /usr/lib/system/libsystem_asl.dylib
+    0x7fff553ed000 -     0x7fff553edfff  libsystem_blocks.dylib (67) <F2493BB5-B1C6-3C4D-9F1F-1B402E0F1DB7> /usr/lib/system/libsystem_blocks.dylib
+    0x7fff553ee000 -     0x7fff55477ff7  libsystem_c.dylib (1244.30.3) <E0136C71-0648-36F0-9F84-82EA2748A8D7> /usr/lib/system/libsystem_c.dylib
+    0x7fff55478000 -     0x7fff5547bffb  libsystem_configuration.dylib (963.30.1) <0F8D0B76-4F7D-34EC-AB6C-50F9465809DA> /usr/lib/system/libsystem_configuration.dylib
+    0x7fff5547c000 -     0x7fff5547fffb  libsystem_coreservices.dylib (51) <21A488D0-2D07-344E-8631-CC8B2A246F35> /usr/lib/system/libsystem_coreservices.dylib
+    0x7fff55480000 -     0x7fff55481fff  libsystem_darwin.dylib (1244.30.3) <2F750CB1-BC26-3FA3-AE59-553EE30D451B> /usr/lib/system/libsystem_darwin.dylib
+    0x7fff55482000 -     0x7fff55488ff7  libsystem_dnssd.dylib (878.30.4) <EB9BB165-45A4-367C-B33A-688D4F383A95> /usr/lib/system/libsystem_dnssd.dylib
+    0x7fff55489000 -     0x7fff554d2ff7  libsystem_info.dylib (517.30.1) <7D79E167-4B5C-3833-81EE-3AF3FB53616D> /usr/lib/system/libsystem_info.dylib
+    0x7fff554d3000 -     0x7fff554f8ff7  libsystem_kernel.dylib (4570.31.3) <D2E842AA-3B8D-31BF-8234-8C1BE11CFE32> /usr/lib/system/libsystem_kernel.dylib
+    0x7fff554f9000 -     0x7fff55544fcb  libsystem_m.dylib (3146) <ABB1B85F-9FFE-31B8-AD4F-E39A30794A93> /usr/lib/system/libsystem_m.dylib
+    0x7fff55545000 -     0x7fff55564fff  libsystem_malloc.dylib (140.1.1) <9F0745FF-B92F-330D-8812-BB74001D1D33> /usr/lib/system/libsystem_malloc.dylib
+    0x7fff55565000 -     0x7fff55609ff3  libsystem_network.dylib (1229.30.11) <40BAD301-8744-3AD8-A688-E7925C587B00> /usr/lib/system/libsystem_network.dylib
+    0x7fff5560a000 -     0x7fff55614ffb  libsystem_networkextension.dylib (767.30.7) <C5ED4BAB-2480-369D-8AB6-DFB37C15A1EE> /usr/lib/system/libsystem_networkextension.dylib
+    0x7fff55615000 -     0x7fff5561eff3  libsystem_notify.dylib (172) <98EA3D62-7C86-30DE-8261-D020D2F1EFF3> /usr/lib/system/libsystem_notify.dylib
+    0x7fff5561f000 -     0x7fff55626ff7  libsystem_platform.dylib (161.20.1) <C049250F-8C35-314D-810F-4E28AEAED983> /usr/lib/system/libsystem_platform.dylib
+    0x7fff55627000 -     0x7fff55632fff  libsystem_pthread.dylib (301.30.1) <ABA848E1-6978-3B42-A3A7-608B2C36FA93> /usr/lib/system/libsystem_pthread.dylib
+    0x7fff55633000 -     0x7fff55636ff3  libsystem_sandbox.dylib (765.30.4) <A51828BA-26D8-3205-AF3A-DF5C37269468> /usr/lib/system/libsystem_sandbox.dylib
+    0x7fff55637000 -     0x7fff55638ff3  libsystem_secinit.dylib (30) <F06ADB8F-9E94-34A7-B3C9-2C22FDD14BAD> /usr/lib/system/libsystem_secinit.dylib
+    0x7fff55639000 -     0x7fff55640ff7  libsystem_symptoms.dylib (820.30.7) <DC3586C2-AA56-3419-88D3-FC0DBF08E3C0> /usr/lib/system/libsystem_symptoms.dylib
+    0x7fff55641000 -     0x7fff55654ff7  libsystem_trace.dylib (829.30.14) <69EBF017-D40F-30D7-9B0B-BFC862D761A5> /usr/lib/system/libsystem_trace.dylib
+    0x7fff55656000 -     0x7fff5565bff7  libunwind.dylib (35.3) <6D4FCD49-D2A9-3233-95C7-A7635CE265F2> /usr/lib/system/libunwind.dylib
+    0x7fff5565c000 -     0x7fff55688ff7  libxpc.dylib (1205.30.29) <F7E5F1BC-614B-39CB-B6CE-92A9C7B7EC0B> /usr/lib/system/libxpc.dylib
+
+External Modification Summary:
+  Calls made by other processes targeting this process:
+    task_for_pid: 1
+    thread_create: 0
+    thread_set_state: 0
+  Calls made by this process:
+    task_for_pid: 0
+    thread_create: 0
+    thread_set_state: 0
+  Calls made by all processes on this machine:
+    task_for_pid: 168737
+    thread_create: 0
+    thread_set_state: 387
+
+VM Region Summary:
+ReadOnly portion of Libraries: Total=456.2M resident=0K(0%) swapped_out_or_unallocated=456.2M(100%)
+Writable regions: Total=432.3M written=0K(0%) resident=0K(0%) swapped_out=0K(0%) unallocated=432.3M(100%)
+ 
+                                VIRTUAL   REGION 
+REGION TYPE                        SIZE    COUNT (non-coalesced) 
+===========                     =======  ======= 
+Accelerate framework               768K        7 
+Activity Tracing                   256K        2 
+CG backing stores                 1172K        4 
+CG image                          1348K      106 
+CoreAnimation                     61.6M      312 
+CoreGraphics                         8K        2 
+CoreImage                           44K        6 
+CoreUI image data                 4404K       75 
+CoreUI image file                  364K        9 
+Foundation                          28K        3 
+Image IO                          6476K      134 
+Kernel Alloc Once                    8K        2 
+MALLOC                           336.3M       94 
+MALLOC guard page                  112K       25 
+Mach message                         8K        3 
+Memory Tag 242                      12K        2 
+Memory Tag 251                      80K        4 
+SQLite page cache                 7680K        8 
+STACK GUARD                       56.0M       10 
+Stack                             12.1M       11 
+VM_ALLOCATE                        688K       22 
+__DATA                            39.4M      347 
+__FONT_DATA                          4K        2 
+__GLSLBUILTINS                    2588K        2 
+__LINKEDIT                       191.6M        9 
+__TEXT                           264.6M      346 
+__UNICODE                          560K        2 
+libnetwork                         384K       16 
+mapped file                      323.2M       46 
+shared memory                      692K       15 
+===========                     =======  ======= 
+TOTAL                              1.3G     1596 
+
+Model: MacBookPro12,1, BootROM MBP121.0171.B00, 2 processors, Intel Core i5, 2,9 GHz, 16 GB, SMC 2.28f7
+Graphics: Intel Iris Graphics 6100, Intel Iris Graphics 6100, Built-In
+Memory Module: BANK 0/DIMM0, 8 GB, DDR3, 1867 MHz, 0x02FE, 0x4544464232333241314D412D4A442D460000
+Memory Module: BANK 1/DIMM0, 8 GB, DDR3, 1867 MHz, 0x02FE, 0x4544464232333241314D412D4A442D460000
+AirPort: spairport_wireless_card_type_airport_extreme (0x14E4, 0x133), Broadcom BCM43xx 1.0 (7.77.37.5.1a3)
+Bluetooth: Version 6.0.2f2, 3 services, 18 devices, 1 incoming serial ports
+Network Service: Wi-Fi, AirPort, en0
+Serial ATA Device: APPLE SSD SM0512G, 500,28 GB
+USB Device: USB 3.0 Bus
+USB Device: Bluetooth USB Host Controller
+Thunderbolt Bus: MacBook Pro, Apple Inc., 27.1
+

docker/go/README.md

@@ -0,0 +1,174 @@
+# radare2_go.docker
+Dockerfile Build File for Master with Go
+###Basic build for a radare2 container
+
+To build your own radare2 docker image, cat the code below into a Dockerfile (radare2.docker), and run the following command:
+```
+docker build - < radare2_go.docker
+```
+After the image completes it's build, perform the following command to run it:
+```
+docker  <image_id> -t -i  /bin/bash
+```
+Or you can just pull it 
+
+```
+docker pull xn0px90/radare2_go
+```
+It is composed of two files:
+- dockerfile 
+- go-wrapper 
+
+**radare2_go.docker**;
+```
+# using phusion/baseimage as base image. 
+FROM phusion/baseimage:0.9.9
+
+# Set correct environment variables.
+ENV HOME /root
+
+# Regenerate SSH host keys. baseimage-docker does not contain any
+RUN /etc/my_init.d/00_regen_ssh_host_keys.sh
+
+# Use baseimage-docker's init system.
+CMD ["/sbin/my_init"]
+
+# create code directory
+RUN mkdir -p /opt/code/
+# install packages required to compile vala and radare2
+RUN apt-get update
+RUN apt-get upgrade -y
+RUN apt-get install -y software-properties-common python-all-dev wget
+RUN apt-get install -y swig flex bison git gcc g++ make pkg-config glib-2.0
+RUN apt-get install -y python-gobject-dev valgrind gdb
+
+ENV VALA_TAR vala-0.26.1
+
+# compile vala
+RUN cd /opt/code && \
+	wget -c https://download.gnome.org/sources/vala/0.26/${VALA_TAR}.tar.xz && \
+	shasum ${VALA_TAR}.tar.xz | grep -q 0839891fa02ed2c96f0fa704ecff492ff9a9cd24 && \
+	tar -Jxf ${VALA_TAR}.tar.xz
+RUN cd /opt/code/${VALA_TAR}; ./configure --prefix=/usr ; make && make install
+# compile radare and bindings
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+#install Go
+
+ENV GOLANG_VERSION 1.6.2
+ENV GOLANG_DOWNLOAD_URL https://golang.org/dl/go$GOLANG_VERSION.linux-amd64.tar.gz
+ENV GOLANG_DOWNLOAD_SHA256 e40c36ae71756198478624ed1bb4ce17597b3c19d243f3f0899bb5740d56212a
+
+RUN curl -fsSL "$GOLANG_DOWNLOAD_URL" -o golang.tar.gz \
+	&& echo "$GOLANG_DOWNLOAD_SHA256  golang.tar.gz" | sha256sum -c - \
+	&& tar -C /usr/local -xzf golang.tar.gz \
+	&& rm golang.tar.gz
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
+
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH"
+WORKDIR $GOPATH
+
+COPY go-wrapper /usr/local/bin/
+#debugging Go apps with dlv DWARF spec th eright way
+RUN go get github.com/derekparker/delve/cmd/dlv 
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+
+RUN r2 -V
+
+
+```
+
+***go-wrapper***:
+```
+#!/bin/bash
+set -e
+
+usage() {
+	base="$(basename "$0")"
+	cat <<EOUSAGE
+usage: $base command [args]
+This script assumes that is is run from the root of your Go package (for
+example, "/go/src/app" if your GOPATH is set to "/go").
+In Go 1.4, a feature was introduced to supply the canonical "import path" for a
+given package in a comment attached to a package statement
+(https://golang.org/s/go14customimport).
+This script allows us to take a generic directory of Go source files such as
+"/go/src/app" and determine that the canonical "import path" of where that code
+expects to live and reference itself is "github.com/jsmith/my-cool-app".  It
+will then ensure that "/go/src/github.com/jsmith/my-cool-app" is a symlink to
+"/go/src/app", which allows us to build and run it under the proper package
+name.
+For compatibility with versions of Go older than 1.4, the "import path" may also
+be placed in a file named ".godir".
+Available Commands:
+  $base download
+  $base download -u
+    (equivalent to "go get -d [args] [godir]")
+  $base install
+  $base install -race
+    (equivalent to "go install [args] [godir]")
+  $base run
+  $base run -app -specific -arguments
+    (assumes "GOPATH/bin" is in "PATH")
+EOUSAGE
+}
+
+# "shift" so that "$@" becomes the remaining arguments and can be passed along to other "go" subcommands easily
+cmd="$1"
+if ! shift; then
+	usage >&2
+	exit 1
+fi
+
+goDir="$(go list -e -f '{{.ImportComment}}' 2>/dev/null || true)"
+
+if [ -z "$goDir" -a -s .godir ]; then
+	goDir="$(cat .godir)"
+fi
+
+dir="$(pwd -P)"
+if [ "$goDir" ]; then
+	goPath="${GOPATH%%:*}" # this just grabs the first path listed in GOPATH, if there are multiple (which is the detection logic "go get" itself uses, too)
+	goDirPath="$goPath/src/$goDir"
+	mkdir -p "$(dirname "$goDirPath")"
+	if [ ! -e "$goDirPath" ]; then
+		ln -sfv "$dir" "$goDirPath"
+	elif [ ! -L "$goDirPath" ]; then
+		echo >&2 "error: $goDirPath already exists but is unexpectedly not a symlink!"
+		exit 1
+	fi
+	goBin="$goPath/bin/$(basename "$goDir")"
+else
+	goBin="$(basename "$dir")" # likely "app"
+fi
+
+case "$cmd" in
+	download)
+		execCommand=( go get -v -d "$@" )
+		if [ "$goDir" ]; then execCommand+=( "$goDir" ); fi
+		set -x; exec "${execCommand[@]}"
+		;;
+		
+	install)
+		execCommand=( go install -v "$@" )
+		if [ "$goDir" ]; then execCommand+=( "$goDir" ); fi
+		set -x; exec "${execCommand[@]}"
+		;;
+		
+	run)
+		set -x; exec "$goBin" "$@"
+		;;
+		
+	*)
+		echo >&2 'error: unknown command:' "$cmd"
+		usage >&2
+		exit 1
+		;;
+esac
+
+``` 

docker/go/go-wrapper

@@ -0,0 +1,87 @@
+#!/bin/bash
+set -e
+
+usage() {
+	base="$(basename "$0")"
+	cat <<EOUSAGE
+usage: $base command [args]
+This script assumes that is is run from the root of your Go package (for
+example, "/go/src/app" if your GOPATH is set to "/go").
+In Go 1.4, a feature was introduced to supply the canonical "import path" for a
+given package in a comment attached to a package statement
+(https://golang.org/s/go14customimport).
+This script allows us to take a generic directory of Go source files such as
+"/go/src/app" and determine that the canonical "import path" of where that code
+expects to live and reference itself is "github.com/jsmith/my-cool-app".  It
+will then ensure that "/go/src/github.com/jsmith/my-cool-app" is a symlink to
+"/go/src/app", which allows us to build and run it under the proper package
+name.
+For compatibility with versions of Go older than 1.4, the "import path" may also
+be placed in a file named ".godir".
+Available Commands:
+  $base download
+  $base download -u
+    (equivalent to "go get -d [args] [godir]")
+  $base install
+  $base install -race
+    (equivalent to "go install [args] [godir]")
+  $base run
+  $base run -app -specific -arguments
+    (assumes "GOPATH/bin" is in "PATH")
+EOUSAGE
+}
+
+# "shift" so that "$@" becomes the remaining arguments and can be passed along to other "go" subcommands easily
+cmd="$1"
+if ! shift; then
+	usage >&2
+	exit 1
+fi
+
+goDir="$(go list -e -f '{{.ImportComment}}' 2>/dev/null || true)"
+
+if [ -z "$goDir" -a -s .godir ]; then
+	goDir="$(cat .godir)"
+fi
+
+dir="$(pwd -P)"
+if [ "$goDir" ]; then
+	goPath="${GOPATH%%:*}" # this just grabs the first path listed in GOPATH, if there are multiple (which is the detection logic "go get" itself uses, too)
+	goDirPath="$goPath/src/$goDir"
+	mkdir -p "$(dirname "$goDirPath")"
+	if [ ! -e "$goDirPath" ]; then
+		ln -sfv "$dir" "$goDirPath"
+	elif [ ! -L "$goDirPath" ]; then
+		echo >&2 "error: $goDirPath already exists but is unexpectedly not a symlink!"
+		exit 1
+	fi
+	goBin="$goPath/bin/$(basename "$goDir")"
+else
+	goBin="$(basename "$dir")" # likely "app"
+fi
+
+case "$cmd" in
+	download)
+		execCommand=( go get -v -d "$@" )
+		if [ "$goDir" ]; then execCommand+=( "$goDir" ); fi
+		set -x; exec "${execCommand[@]}"
+		;;
+		
+	install)
+		execCommand=( go install -v "$@" )
+		if [ "$goDir" ]; then execCommand+=( "$goDir" ); fi
+		set -x; exec "${execCommand[@]}"
+		;;
+		
+	run)
+		set -x; exec "$goBin" "$@"
+		;;
+		
+	*)
+		echo >&2 'error: unknown command:' "$cmd"
+		usage >&2
+		exit 1
+		;;
+esac
+
+

docker/go/radare2_go.docker

@@ -0,0 +1,58 @@
+# using phusion/baseimage as base image. 
+FROM phusion/baseimage:0.9.9
+
+# Set correct environment variables.
+ENV HOME /root
+
+# Regenerate SSH host keys. baseimage-docker does not contain any
+RUN /etc/my_init.d/00_regen_ssh_host_keys.sh
+
+# Use baseimage-docker's init system.
+CMD ["/sbin/my_init"]
+
+# create code directory
+RUN mkdir -p /opt/code/
+# install packages required to compile vala and radare2
+RUN apt-get update
+RUN apt-get upgrade -y
+RUN apt-get install -y software-properties-common python-all-dev wget
+RUN apt-get install -y swig flex bison git gcc g++ make pkg-config glib-2.0
+RUN apt-get install -y python-gobject-dev valgrind gdb
+
+ENV VALA_TAR vala-0.26.1
+
+# compile vala
+RUN cd /opt/code && \
+	wget -c https://download.gnome.org/sources/vala/0.26/${VALA_TAR}.tar.xz && \
+	shasum ${VALA_TAR}.tar.xz | grep -q 0839891fa02ed2c96f0fa704ecff492ff9a9cd24 && \
+	tar -Jxf ${VALA_TAR}.tar.xz
+RUN cd /opt/code/${VALA_TAR}; ./configure --prefix=/usr ; make && make install
+# compile radare and bindings
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+#install Go
+
+ENV GOLANG_VERSION 1.6.2
+ENV GOLANG_DOWNLOAD_URL https://golang.org/dl/go$GOLANG_VERSION.linux-amd64.tar.gz
+ENV GOLANG_DOWNLOAD_SHA256 e40c36ae71756198478624ed1bb4ce17597b3c19d243f3f0899bb5740d56212a
+
+RUN curl -fsSL "$GOLANG_DOWNLOAD_URL" -o golang.tar.gz \
+	&& echo "$GOLANG_DOWNLOAD_SHA256  golang.tar.gz" | sha256sum -c - \
+	&& tar -C /usr/local -xzf golang.tar.gz \
+	&& rm golang.tar.gz
+
+ENV GOPATH /go
+ENV PATH $GOPATH/bin:/usr/local/go/bin:$PATH
+
+RUN mkdir -p "$GOPATH/src" "$GOPATH/bin" && chmod -R 777 "$GOPATH"
+WORKDIR $GOPATH
+
+COPY go-wrapper /usr/local/bin/
+#debugging Go apps with dlv DWARF spec th eright way
+RUN go get github.com/derekparker/delve/cmd/dlv 
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+
+RUN r2 -V

docker/java/java_README.md

@@ -0,0 +1,63 @@
+#Editing Dockerfile Build File for Master with Java
+
+### Basic build for a radare2 container
+
+To build your own radare2 docker image, cat the code below into a Dockerfile (radare2.docker), and run the following command:
+```
+docker build - < radare2.docker
+```
+
+After the image completes it's build, perform the following command to run it:
+```
+docker  <image_id> -t -i  /bin/bash
+```
+
+**radare2_java.docker**:
+```
+# using phusion/baseimage as base image.
+FROM phusion/baseimage:0.9.9
+
+# Set correct environment variables.
+ENV HOME /root
+
+# Regenerate SSH host keys. baseimage-docker does not contain any
+RUN /etc/my_init.d/00_regen_ssh_host_keys.sh
+
+# Use baseimage-docker's init system.
+CMD ["/sbin/my_init"]
+
+# create code directory
+RUN mkdir /opt/code/
+# install packages required to compile vala and radare2
+RUN apt-get update
+RUN apt-get install -y software-properties-common python-all-dev wget
+RUN apt-get install -y swig flex bison git gcc g++ make pkg-config glib-2.0
+RUN apt-get install -y python-gobject-dev python-software-properties
+RUN apt-get install -y python-pip jython
+
+# compile vala
+RUN cd /opt/code; wget http://download.gnome.org/sources/vala/0.24/vala-0.24.0.tar.xz; tar -Jxf vala-0.24.0.tar.xz
+RUN cd /opt/code/vala-0.24.0; ./configure --prefix=/usr ; make && make install
+# compile radare
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# compile vala
+RUN cd /opt/code; wget http://download.gnome.org/sources/vala/0.24/vala-0.24.0.tar.xz; tar -Jxf vala-0.24.0.tar.xz
+RUN cd /opt/code/vala-0.24.0; ./configure --prefix=/usr ; make && make install
+# compile radare
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+
+#install oracle jre stuffs
+RUN add-apt-repository -y ppa:webupd8team/java
+RUN apt-get update
+RUN echo debconf shared/accepted-oracle-license-v1-1 select true | debconf-set-selections
+RUN echo debconf shared/accepted-oracle-license-v1-1 seen true | debconf-set-selections
+RUN apt-get install -y oracle-java7-installer
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+```

docker/java/radare2_java.docker

@@ -0,0 +1,46 @@
+# using phusion/baseimage as base image.
+FROM phusion/baseimage:0.9.9
+
+# Set correct environment variables.
+ENV HOME /root
+
+# Regenerate SSH host keys. baseimage-docker does not contain any
+RUN /etc/my_init.d/00_regen_ssh_host_keys.sh
+
+# Use baseimage-docker's init system.
+CMD ["/sbin/my_init"]
+
+# create code directory
+RUN mkdir /opt/code/
+# install packages required to compile vala and radare2
+RUN apt-get update
+RUN apt-get install -y software-properties-common python-all-dev wget
+RUN apt-get install -y swig flex bison git gcc g++ make pkg-config glib-2.0
+RUN apt-get install -y python-gobject-dev python-software-properties
+RUN apt-get install -y python-pip jython
+
+# compile vala
+RUN cd /opt/code; wget http://download.gnome.org/sources/vala/0.24/vala-0.24.0.tar.xz; tar -Jxf vala-0.24.0.tar.xz
+RUN cd /opt/code/vala-0.24.0; ./configure --prefix=/usr ; make && make install
+# compile radare
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+# compile vala
+RUN cd /opt/code; wget http://download.gnome.org/sources/vala/0.24/vala-0.24.0.tar.xz; tar -Jxf vala-0.24.0.tar.xz
+RUN cd /opt/code/vala-0.24.0; ./configure --prefix=/usr ; make && make install
+# compile radare
+RUN cd /opt/code; git clone https://github.com/radareorg/radare2.git; cd radare2; ./sys/all.sh
+
+
+#install oracle jre stuffs
+RUN add-apt-repository -y ppa:webupd8team/java
+RUN apt-get update
+RUN echo debconf shared/accepted-oracle-license-v1-1 select true | debconf-set-selections
+RUN echo debconf shared/accepted-oracle-license-v1-1 seen true | debconf-set-selections
+RUN apt-get install -y oracle-java7-installer
+
+# Clean up APT when done.
+RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

docker/spf13-vim.sh

@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+
+#   Copyright 2014 Steve Francia
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+############################  SETUP PARAMETERS
+app_name='spf13-vim'
+[ -z "$APP_PATH" ] && APP_PATH="$HOME/.spf13-vim-3"
+[ -z "$REPO_URI" ] && REPO_URI='https://github.com/spf13/spf13-vim.git'
+[ -z "$REPO_BRANCH" ] && REPO_BRANCH='3.0'
+debug_mode='0'
+fork_maintainer='0'
+[ -z "$VUNDLE_URI" ] && VUNDLE_URI="https://github.com/gmarik/vundle.git"
+
+############################  BASIC SETUP TOOLS
+msg() {
+    printf '%b\n' "$1" >&2
+}
+
+success() {
+    if [ "$ret" -eq '0' ]; then
+        msg "\33[32m[✔]\33[0m ${1}${2}"
+    fi
+}
+
+error() {
+    msg "\33[31m[✘]\33[0m ${1}${2}"
+    exit 1
+}
+
+debug() {
+    if [ "$debug_mode" -eq '1' ] && [ "$ret" -gt '1' ]; then
+        msg "An error occurred in function \"${FUNCNAME[$i+1]}\" on line ${BASH_LINENO[$i+1]}, we're sorry for that."
+    fi
+}
+
+program_exists() {
+    local ret='0'
+    command -v $1 >/dev/null 2>&1 || { local ret='1'; }
+
+    # fail on non-zero return value
+    if [ "$ret" -ne 0 ]; then
+        return 1
+    fi
+
+    return 0
+}
+
+program_must_exist() {
+    program_exists $1
+
+    # throw error on non-zero return value
+    if [ "$?" -ne 0 ]; then
+        error "You must have '$1' installed to continue."
+    fi
+}
+
+variable_set() {
+    if [ -z "$1" ]; then
+        error "You must have your HOME environmental variable set to continue."
+    fi
+}
+
+lnif() {
+    if [ -e "$1" ]; then
+        ln -sf "$1" "$2"
+    fi
+    ret="$?"
+    debug
+}
+
+############################ SETUP FUNCTIONS
+
+do_backup() {
+    if [ -e "$1" ] || [ -e "$2" ] || [ -e "$3" ]; then
+        msg "Attempting to back up your original vim configuration."
+        today=`date +%Y%m%d_%s`
+        for i in "$1" "$2" "$3"; do
+            [ -e "$i" ] && [ ! -L "$i" ] && mv -v "$i" "$i.$today";
+        done
+        ret="$?"
+        success "Your original vim configuration has been backed up."
+        debug
+   fi
+}
+
+sync_repo() {
+    local repo_path="$1"
+    local repo_uri="$2"
+    local repo_branch="$3"
+    local repo_name="$4"
+
+    msg "Trying to update $repo_name"
+
+    if [ ! -e "$repo_path" ]; then
+        mkdir -p "$repo_path"
+        git clone -b "$repo_branch" "$repo_uri" "$repo_path"
+        ret="$?"
+        success "Successfully cloned $repo_name."
+    else
+        cd "$repo_path" && git pull origin "$repo_branch"
+        ret="$?"
+        success "Successfully updated $repo_name"
+    fi
+
+    debug
+}
+
+create_symlinks() {
+    local source_path="$1"
+    local target_path="$2"
+
+    lnif "$source_path/.vimrc"         "$target_path/.vimrc"
+    lnif "$source_path/.vimrc.bundles" "$target_path/.vimrc.bundles"
+    lnif "$source_path/.vimrc.before"  "$target_path/.vimrc.before"
+    lnif "$source_path/.vim"           "$target_path/.vim"
+
+    if program_exists "nvim"; then
+        lnif "$source_path/.vim"       "$target_path/.config/nvim"
+        lnif "$source_path/.vimrc"     "$target_path/.config/nvim/init.vim"
+    fi
+
+    touch  "$target_path/.vimrc.local"
+
+    ret="$?"
+    success "Setting up vim symlinks."
+    debug
+}
+
+setup_fork_mode() {
+    local source_path="$2"
+    local target_path="$3"
+
+    if [ "$1" -eq '1' ]; then
+        touch "$target_path/.vimrc.fork"
+        touch "$target_path/.vimrc.bundles.fork"
+        touch "$target_path/.vimrc.before.fork"
+
+        lnif "$source_path/.vimrc.fork"         "$target_path/.vimrc.fork"
+        lnif "$source_path/.vimrc.bundles.fork" "$target_path/.vimrc.bundles.fork"
+        lnif "$source_path/.vimrc.before.fork"  "$target_path/.vimrc.before.fork"
+
+        ret="$?"
+        success "Created fork maintainer files."
+        debug
+    fi
+}
+
+setup_vundle() {
+    local system_shell="$SHELL"
+    export SHELL='/bin/sh'
+
+    vim \
+        -u "$1" \
+        "+set nomore" \
+        "+BundleInstall!" \
+        "+BundleClean" \
+        "+qall"
+
+    export SHELL="$system_shell"
+
+    success "Now updating/installing plugins using Vundle"
+    debug
+}
+
+############################ MAIN()
+variable_set "$HOME"
+program_must_exist "vim"
+program_must_exist "git"
+
+do_backup       "$HOME/.vim" \
+                "$HOME/.vimrc" \
+                "$HOME/.gvimrc"
+
+sync_repo       "$APP_PATH" \
+                "$REPO_URI" \
+                "$REPO_BRANCH" \
+                "$app_name"
+
+create_symlinks "$APP_PATH" \
+                "$HOME"
+
+setup_fork_mode "$fork_maintainer" \
+                "$APP_PATH" \
+                "$HOME"
+
+sync_repo       "$HOME/.vim/bundle/vundle" \
+                "$VUNDLE_URI" \
+                "master" \
+                "vundle"
+
+setup_vundle    "$APP_PATH/.vimrc.bundles.default"
+
+msg             "\nThanks for installing $app_name."
+msg             "© `date +%Y` http://vim.spf13.com/"

dwarf/Makefile

@@ -0,0 +1,23 @@
+include ../options.mk
+
+LIBDWARFPATH=../../libdwarf-code/
+LIBDWARFLIB=${LIBDWARFPATH}/libdwarf/
+EXTRA_TARGETS+=${LIBDWARFLIB}/libdwarf.a -lelf -lz
+
+CFLAGS+=$(shell pkg-config --cflags r_util)
+CFLAGS+=-I${LIBDWARFLIB}
+
+CC_COR=$(CC) -shared $(CFLAGS) -fPIC
+CC_LIB=$(LDFLAGS) $(shell pkg-config --libs r_core) $(EXTRA_TARGETS)
+
+all:
+	$(CC_COR) -O2 -o dparser.$(LIBEXT) main.c $(CC_LIB)
+
+install:
+	cp -f *.$(LIBEXT) $(R2PM_PLUGDIR)
+
+uninstall:
+	for a in *.$(LIBEXT) ; do rm -f $(R2PM_PLUGDIR)/$$a ; done
+
+clean:
+	rm -f *.$(LIBEXT)

dwarf/Readme.md

@@ -0,0 +1,52 @@
+DPARSER
+=======
+
+A r2 core plugin to read struct and its member from the DWARF structure.
+
+Requirements:
+-------------
+
+ - libdwarf (currently, it is preferred to use `r2pm -i libdwarf`)
+ - sdb
+
+Compilation:
+------------
+
+```make && make install```
+
+Usage:
+------
+
+Currently it works like a simple r2 core plugin.
+
+```
+iddi     path_to_file_having_dwarf_info
+idd      structname [offset]
+iddj     structname [offset]                // Output in JSON format
+iddv     structname.member1.submember2      // Print value of submember2 struct which is a member of member1 struct
+idda     structname.member1.submember2      // Print address of submember2 struct which is a member of member1 struct
+iddlg                                       // Print flags in r2 format for all global variables
+iddlf                                       // Print flags in r2 format for all functions
+iddd[j]  structname[.members]*              // Print C-Type declaration. Output in JSON format supported
+idddl    structname[.members]*              // Print C-Type declaration with sub structures shown
+iddt     structname[.members]*              // Print type and size
+```
+
+Known problems:
+---------------
+
++ Might fail while using with other libdwarf versions
++ Problem in compilation because of libdwarf and sdb source path
+
+Please file an issue if you find any
+
+Things to do:
+-------------
+
+ - Allow printing of array fields. For example: `struct->field[2]`
+ - Issue with setting flags for stubs (they should be named differently)
+
+License:
+--------
+
+GPL

examples/my-cpu/Makefile

@@ -1,5 +1,5 @@
 NAME=mycpu
-R2_PLUGIN_PATH=$(shell r2 -hh|grep LIBR_PLUGINS|awk '{print $$2}')
+R2_PLUGIN_PATH=$(shell r2 -hh|grep R2_LIBR_PLUGINS|awk '{print $$2}')
 CFLAGS=-g -fPIC $(shell pkg-config --cflags r_asm)
 LDFLAGS=-shared $(shell pkg-config --libs r_asm)
 OBJS=$(NAME).o

examples/my-cpu/mycpu.c

@@ -30,10 +30,10 @@ static int disassemble (RAsm *a, RAsmOp *op, const ut8 *b, int l) {
 	int idx = (b[0]&0xf)*2;
 	op->size = 2;
 	if (idx>=(OPS*2)) {
-		strcpy (op->buf_asm, "invalid");
+		r_strbuf_set (&op->buf_asm, "invalid");
 		return -1;
 	}
-	strcpy (op->buf_asm, ops[idx]);
+	r_strbuf_set (&op->buf_asm, ops[idx]);
 	if (ops[idx+1]) {
 		const char *p = ops[idx+1];
 		arg[0] = 0;
@@ -50,8 +50,8 @@ static int disassemble (RAsm *a, RAsmOp *op, const ut8 *b, int l) {
 			sprintf (arg, "r%d, %d", b[1]>>4, (char)b[1]&0xf);
 		}
 		if (*arg) {
-			strcat (op->buf_asm, " ");
-			strcat (op->buf_asm, arg);
+			r_strbuf_append (&op->buf_asm, " ");
+			r_strbuf_append (&op->buf_asm, arg);
 		}
 	}
 	return op->size;
@@ -67,7 +67,7 @@ RAsmPlugin r_asm_plugin_mycpu = {
 };
 
 #ifndef CORELIB
-struct r_lib_struct_t radare_plugin = {
+RLibStruct radare_plugin = {
         .type = R_LIB_TYPE_ASM,
         .data = &r_asm_plugin_mycpu
 };

jaguar-gpu/Makefile

@@ -0,0 +1,21 @@
+NAME=jaguar-gpu
+R2_PLUGIN_PATH=$(shell r2 -hh|grep R2_LIBR_PLUGINS|awk '{print $$2}')
+CFLAGS=-g -fPIC $(shell pkg-config --cflags r_asm)
+LDFLAGS=-shared $(shell pkg-config --libs r_asm)
+OBJS=$(NAME).o
+SO_EXT=$(shell uname|grep -q Darwin && echo dylib || echo so)
+LIB=$(NAME).$(SO_EXT)
+
+all: $(LIB)
+
+clean:
+	rm -f $(LIB) $(OBJS)
+
+$(LIB): $(OBJS)
+	$(CC) $(CFLAGS) $(LDFLAGS) $(OBJS) -o $(LIB)
+
+install:
+	cp -f $(LIB) $(R2_PLUGIN_PATH)
+
+uninstall:
+	rm -f $(R2_PLUGIN_PATH)/$(LIB)

jaguar-gpu/jaguar-gpu.c

@@ -0,0 +1,222 @@
+/*
+ * Disassembler for the Jaguar GPU/DSP
+ * Copyright (C) 2018 - Sebastien Alaiwan
+ */
+
+#include <r_asm.h>
+#include <r_lib.h>
+
+static int read16_BE (const ut8** b)
+{
+	int val = ((*b)[0] << 8) | ((*b)[1] << 0);
+	(*b) += 2;
+	return val;
+}
+
+static const char* condition (int code)
+{
+	switch (code)
+	{
+	case 0:  return "mp"; /* always */
+	case 1:  return "nz";
+	case 2:  return "z";
+	case 4:  return "nc";
+	case 5:  return "nc/nz";
+	case 6:  return "nc/z";
+	case 8:  return "c";
+	case 9:  return "c/nz";
+	case 10: return "c/z";
+	case 20: return "nn";
+	case 21: return "nn/nz";
+	case 22: return "nn/z";
+	case 24: return "n";
+	case 25: return "n/nz";
+	case 26: return "n/z";
+	case 31: return "never";
+	default: return "?";
+	}
+};
+
+static int notZero (int val)
+{
+	return val == 0 ? 32 : val;
+}
+
+static int disassemble (RAsm *a, RAsmOp *op, const ut8 *b, int l) {
+	const ut8* p = b; /* read pointer */
+
+	const uint word = read16_BE (&p);
+	const uint opCode = (word >> 10) & 63;
+	const uint reg1 = (word >> 5) & 31;
+	const uint reg2 = (word >> 0) & 31;
+
+	uint pc = a->pc;
+
+	pc += 2;
+	switch (opCode)
+	{
+	case 0:  r_strbuf_setf (&op->buf_asm, "add     r%d, r%d", reg1, reg2);
+					 break;
+	case 1:  r_strbuf_setf (&op->buf_asm, "addc    r%d, r%d", reg1, reg2);
+					 break;
+	case 2:  r_strbuf_setf (&op->buf_asm, "addq    0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 3:  r_strbuf_setf (&op->buf_asm, "addqt   0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 4:  r_strbuf_setf (&op->buf_asm, "sub     r%d, r%d", reg1, reg2);
+					 break;
+	case 5:  r_strbuf_setf (&op->buf_asm, "subc    r%d, r%d", reg1, reg2);
+					 break;
+	case 6:  r_strbuf_setf (&op->buf_asm, "subq    0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 7:  r_strbuf_setf (&op->buf_asm, "subqt   0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 8:  r_strbuf_setf (&op->buf_asm, "neg     r%d", reg2);
+					 break;
+	case 9:  r_strbuf_setf (&op->buf_asm, "and     r%d, r%d", reg1, reg2);
+					 break;
+	case 10: r_strbuf_setf (&op->buf_asm, "or      r%d, r%d", reg1, reg2);
+					 break;
+	case 11: r_strbuf_setf (&op->buf_asm, "xor     r%d, r%d", reg1, reg2);
+					 break;
+	case 12: r_strbuf_setf (&op->buf_asm, "not     r%d", reg2);
+					 break;
+	case 13: r_strbuf_setf (&op->buf_asm, "btst    0x%x, r%d", reg1, reg2);
+					 break;
+	case 14: r_strbuf_setf (&op->buf_asm, "bset    0x%x, r%d", reg1, reg2);
+					 break;
+	case 15: r_strbuf_setf (&op->buf_asm, "bclr    0x%x, r%d", reg1, reg2);
+					 break;
+	case 16: r_strbuf_setf (&op->buf_asm, "mult    r%d, r%d", reg1, reg2);
+					 break;
+	case 17: r_strbuf_setf (&op->buf_asm, "imult   r%d, r%d", reg1, reg2);
+					 break;
+	case 18: r_strbuf_setf (&op->buf_asm, "imultn  r%d, r%d", reg1, reg2);
+					 break;
+	case 19: r_strbuf_setf (&op->buf_asm, "resmac  r%d", reg2);
+					 break;
+	case 20: r_strbuf_setf (&op->buf_asm, "imacn   r%d, r%d", reg1, reg2);
+					 break;
+	case 21: r_strbuf_setf (&op->buf_asm, "div     r%d, r%d", reg1, reg2);
+					 break;
+	case 22: r_strbuf_setf (&op->buf_asm, "abs     r%d", reg2);
+					 break;
+	case 23: r_strbuf_setf (&op->buf_asm, "sh      r%d, r%d", reg1, reg2);
+					 break;
+	case 24: r_strbuf_setf (&op->buf_asm, "shlq    0x%x, r%d", 32 - notZero (reg1), reg2);
+					 break;
+	case 25: r_strbuf_setf (&op->buf_asm, "shrq    0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 26: r_strbuf_setf (&op->buf_asm, "sha     r%d, r%d", reg1, reg2);
+					 break;
+	case 27: r_strbuf_setf (&op->buf_asm, "sharq   0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 28: r_strbuf_setf (&op->buf_asm, "ror     r%d, r%d", reg1, reg2);
+					 break;
+	case 29: r_strbuf_setf (&op->buf_asm, "rorq    0x%x, r%d", notZero (reg1), reg2);
+					 break;
+	case 30: r_strbuf_setf (&op->buf_asm, "cmp     r%d, r%d", reg1, reg2);
+					 break;
+	case 31: r_strbuf_setf (&op->buf_asm, "cmpq    0x%x, r%d", reg1, reg2);
+					 break;
+	case 32: r_strbuf_setf (&op->buf_asm, "sat8    r%d", reg2);
+					 break;
+	case 33: r_strbuf_setf (&op->buf_asm, "sat16   r%d", reg2);
+					 break;
+	case 34: r_strbuf_setf (&op->buf_asm, "move    r%d, r%d", reg1, reg2);
+					 break;
+	case 35: r_strbuf_setf (&op->buf_asm, "moveq   0x%x, r%d", reg1, reg2);
+					 break;
+	case 36: r_strbuf_setf (&op->buf_asm, "moveta  r%d, r%d", reg1, reg2);
+					 break;
+	case 37: r_strbuf_setf (&op->buf_asm, "movefa  r%d, r%d", reg1, reg2);
+					 break;
+	case 38:
+					 {
+						 uint low = read16_BE (&p);
+						 uint high = read16_BE (&p);
+						 r_strbuf_setf (&op->buf_asm, "movei   0x%x, r%d", low | (high << 16), reg2);
+						 break;
+					 }
+	case 39: r_strbuf_setf (&op->buf_asm, "loadb   [r%d], r%d", reg1, reg2);
+					 break;
+	case 40: r_strbuf_setf (&op->buf_asm, "loadw   [r%d], r%d", reg1, reg2);
+					 break;
+	case 41: r_strbuf_setf (&op->buf_asm, "load    [r%d], r%d", reg1, reg2);
+					 break;
+	case 42: r_strbuf_setf (&op->buf_asm, "loadp   [r%d], r%d", reg1, reg2);
+					 break;
+	case 43: r_strbuf_setf (&op->buf_asm, "load    [r14+0x%x], r%d", notZero (reg1)*4, reg2);
+					 break;
+	case 44: r_strbuf_setf (&op->buf_asm, "load    [r15+0x%x], r%d", notZero (reg1)*4, reg2);
+					 break;
+	case 45: r_strbuf_setf (&op->buf_asm, "storeb  r%d, [r%d]", reg2, reg1);
+					 break;
+	case 46: r_strbuf_setf (&op->buf_asm, "storew  r%d, [r%d]", reg2, reg1);
+					 break;
+	case 47: r_strbuf_setf (&op->buf_asm, "store   r%d, [r%d]", reg2, reg1);
+					 break;
+	case 48: r_strbuf_setf (&op->buf_asm, "storep  r%d, [r%d]", reg2, reg1);
+					 break;
+	case 49: r_strbuf_setf (&op->buf_asm, "store   r%d, [r14+0x%x]", reg2, notZero (reg1)*4);
+					 break;
+	case 50: r_strbuf_setf (&op->buf_asm, "store   r%d, [r15+0x%x]", reg2, notZero (reg1)*4);
+					 break;
+	case 51: r_strbuf_setf (&op->buf_asm, "move    pc, r%d", reg2);
+					 break;
+	case 52: r_strbuf_setf (&op->buf_asm, "j%s     [r%d]", condition(reg2), reg1);
+					 break;
+	case 53: r_strbuf_setf (&op->buf_asm, "j%s     0x%.8X", condition(reg2), pc + ((int8_t)(reg1 << 3) >> 2));
+					 break;
+	case 54: r_strbuf_setf (&op->buf_asm, "mmult   r%d, r%d", reg1, reg2);
+					 break;
+	case 55: r_strbuf_setf (&op->buf_asm, "mtoi    r%d, r%d", reg1, reg2);
+					 break;
+	case 56: r_strbuf_setf (&op->buf_asm, "normi   r%d, r%d", reg1, reg2);
+					 break;
+	case 57: r_strbuf_setf (&op->buf_asm, "nop");
+					 break;
+	case 58: r_strbuf_setf (&op->buf_asm, "load    [r14+r%d], r%d", reg1, reg2);
+					 break;
+	case 59: r_strbuf_setf (&op->buf_asm, "load    [r15+r%d], r%d", reg1, reg2);
+					 break;
+	case 60: r_strbuf_setf (&op->buf_asm, "store   r%d, [r14+r%d]", reg2, reg1);
+					 break;
+	case 61: r_strbuf_setf (&op->buf_asm, "store   r%d, [r15+r%d]", reg2, reg1);
+					 break;
+	case 62: r_strbuf_setf (&op->buf_asm, "sat24   r%d", reg2);
+					 break;
+	case 63:
+					 {
+						 if (reg1 == 0)
+							 r_strbuf_setf (&op->buf_asm, "pack    r%d", reg2);
+						 else if (reg1 == 1)
+							 r_strbuf_setf (&op->buf_asm, "unpack    r%d", reg2);
+						 else
+							 r_strbuf_setf (&op->buf_asm, "invalid");
+						 break;
+					 }
+	}
+
+	op->size = p - b;
+	r_strbuf_setbin (&op->buf_hex, b, op->size);
+
+	return op->size;
+}
+
+RAsmPlugin r_asm_plugin_jaguar_gpu = {
+	.name = "jaguar-gpu",
+	.arch = "jaguar-gpu",
+	.author = "Sebastien Alaiwan",
+	.bits = 32,
+	.desc = "Disassembler for the Jaguar GPU",
+	.license = "LGPL3",
+	.disassemble = &disassemble,
+};
+
+#ifndef CORELIB
+RLibStruct radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_jaguar_gpu
+};
+#endif

kaitai/Makefile

@@ -0,0 +1,7 @@
+all:
+
+install:
+	cp -f r2kaitai ${DESTDIR}/${PREFIX}/bin/r2kaitai
+
+uninstall:
+	rm -f  ${DESTDIR}/${PREFIX}/bin/r2kaitai

kaitai/README.md

@@ -0,0 +1,27 @@
+Integrating r2 with Kaitai
+==========================
+
+Installation:
+
+	$ r2pm -i kaitai-struct-compiler
+	$ r2pm -i ksv
+	$ r2pm -i r2kaitai
+
+Demo Session:
+
+	$ r2 /bin/ls
+	> !r2kaitai
+	archive/lzh
+	archive/rar
+	archive/zip
+	common/vlq_base128_be
+	common/vlq_base128_le
+	executable/dos_mz
+	executable/elf
+	executable/java_class
+	executable/mach_o
+	...
+
+	> !r2kaitai executables/mach_o
+
+	(... ksv show goes here ...)

kaitai/r2kaitai

@@ -0,0 +1,39 @@
+#!/bin/sh
+
+s='$'
+showHelp() {
+	echo "Usage: r2kaitai [signature.ksy] [$s{R2_BLOCK}]"
+}
+[ "$1" = -h ] && showHelp && exit 0
+
+SIGN="$1"
+FILE="$2"
+R2PM_GITDIR=`r2pm -H R2PM_GITDIR`
+ROOT=${R2PM_GITDIR}/kaitai-struct-compiler/formats
+
+if [ ! -d "${ROOT}" ]; then
+	echo "Cannot find kaitai-struct-compiler"
+	echo '  $ r2pm -i kaitai-struct-compiler'
+	exit 1
+fi
+
+if [ -z "$SIGN" ]; then
+	( cd ${ROOT} && find * -iname '*.ksy' | sed -e 's,.ksy$,,' )
+	exit 0
+fi
+
+if [ ! -f "${ROOT}/${SIGN}.ksy" ]; then
+	echo "Invalid kaitai signature file"
+	exit 1
+fi
+
+if [ -z "${FILE}" ]; then
+	FILE="${R2_FILE}"
+	if [ -z "${FILE}" ]; then
+		showHelp
+		exit 1
+	fi
+fi
+
+echo r2pm -r ksv ${FILE} ${R2PM_GITDIR}/kaitai-struct-compiler/formats/${SIGN}.ksy
+exec r2pm -r ksv ${FILE} ${ROOT}/${SIGN}.ksy

keystone/Makefile

@@ -0,0 +1,56 @@
+include build.mk
+
+PLUGINS=arm x86 mips sparc ppc hexagon sysz
+
+LIBS=$(addsuffix _ks.$(SO_EXT),$(addprefix asm_,${PLUGINS}))
+#R2PM_PLUGDIR?=${LIBDIR}/radare2/last/
+R2PM_PLUGDIR?=~/.config/radare2/plugins
+R2PM_PREFIX?=~/.config/radare2/prefix
+
+ifeq ($(shell uname),Darwin)
+KS_LDFLAGS+=-Xlinker -rpath -Xlinker $(R2PM_PREFIX)/lib
+endif
+ifeq ($(shell uname),Linux)
+KS_LDFLAGS+=-Wl,-R$(R2PM_PREFIX)/lib
+endif
+
+.PHONY: all clean install uninstall mrproper test
+
+all: $(PLUGINS)
+
+#$(info $(LIBS))
+
+define kscc
+$(CC) -c -fPIC -Wall\
+	$(R2_CFLAGS) $(KS_CFLAGS)\
+	-o asm_$(1)_ks.$(O_EXT) asm_$(1)_ks.c
+$(CXX) $(LDFLAGS_SHARED)\
+	$(R2_LDFLAGS) $(KS_LDFLAGS)\
+	-o asm_$(1)_ks.$(SO_EXT) asm_$(1)_ks.$(O_EXT) $(KS_LINK)
+rm asm_$(1)_ks.$(O_EXT)
+endef
+
+define ksmake
+asm_$(1)_ks.$(SO_EXT): asm_$(1)_ks.c keystone.c
+	$$(call kscc,$(1))
+endef
+
+$(foreach lib,$(PLUGINS),$(eval $(call ksmake,$(lib))))
+
+$(PLUGINS):
+	$(MAKE) asm_$@_ks.$(SO_EXT)
+
+install:
+	$(foreach lib,$(LIBS),$(INSTALL_LIB) $(lib) $(R2PM_PLUGDIR);)
+
+uninstall:
+	rm -rf $(R2PM_PLUGDIR)/*_ks.*
+
+test:
+	sh suite.sh
+
+clean:
+	rm -f *.$(SO_EXT)
+
+mrproper: clean
+	rm -f config.mk

keystone/README.md

@@ -0,0 +1,32 @@
+radare2-keystone
+================
+
+This repository contains the source code for the keystone
+assembler plugins for radare2.
+
+How to install
+--------------
+
+The plugins will be installed at ~/.config/radare2/plugins
+
+	$ make
+	$ make install
+
+To uninstall them just:
+
+	$ make uninstall
+
+How to use it?
+--------------
+
+	$ rasm2 -L | grep .ks
+	a___  16 32 64   arm.ks      BSD     ARM keystone assembler
+	a___  32         hexagon.ks  BSD     Hexagon keystone assembler
+	a___  16 32 64   mips.ks     BSD     MIPS keystone assembler
+	a___  32 64      ppc.ks      BSD     powerpc keystone assembler
+	a___  32 64      sparc.ks    BSD     sparc keystone assembler
+	a___  32         sysz.ks     BSD     SystemZ keystone assembler (S390X)
+	a___  16 32 64   x86.ks      BSD     x86 keystone assembler
+
+	$ rasm2 -a x86.ks -b 32 int3
+	cc

keystone/asm_arm_ks.c

@@ -0,0 +1,43 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/arm.h>
+#include "keystone.c"
+
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_arch arch = KS_ARCH_ARM;
+	ks_mode mode = KS_MODE_ARM;
+	switch (a->bits) {
+	case 16:
+		mode = KS_MODE_THUMB;
+		break;
+	case 64:
+		arch = KS_ARCH_ARM64;
+		mode = KS_MODE_LITTLE_ENDIAN;
+		a->big_endian = false;
+		break;
+	}
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, arch, mode);
+}
+
+RAsmPlugin r_asm_plugin_arm_ks = {
+	.name = "arm.ks",
+	.desc = "ARM keystone assembler",
+	.license = "GPL",
+	.arch = "arm",
+	.bits = 16|32|64,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+RLibStruct radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_arm_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_hexagon_ks.c

@@ -0,0 +1,32 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/hexagon.h>
+#include "keystone.c"
+
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode = (ks_mode)0;
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_HEXAGON, mode);
+}
+
+RAsmPlugin r_asm_plugin_hexagon_ks = {
+	.name = "hexagon.ks",
+	.desc = "Hexagon keystone assembler",
+	.license = "GPL",
+	.arch = "hexagon",
+	.bits = 32,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_hexagon_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_mips_ks.c

@@ -0,0 +1,43 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/mips.h>
+#include "keystone.c"
+
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode;
+	switch (a->bits) {
+	case 16:
+		mode = KS_MODE_MICRO; // micromips mode
+		break;
+	case 32:
+		mode = KS_MODE_MIPS32;
+		break;
+	case 64:
+		mode = KS_MODE_MIPS64;
+		break;
+	}
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_MIPS, mode);
+}
+
+RAsmPlugin r_asm_plugin_mips_ks = {
+	.name = "mips.ks",
+	.desc = "MIPS keystone assembler",
+	.license = "GPL",
+	.arch = "mips",
+	.bits = 16|32|64,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_mips_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_ppc_ks.c

@@ -0,0 +1,40 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/ppc.h>
+#include "keystone.c"
+
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode = (ks_mode)0;
+	switch (a->bits) {
+	case 32:
+		mode = KS_MODE_PPC32;
+		break;
+	case 64:
+		mode = KS_MODE_PPC64;
+		break;
+	}
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_PPC, mode);
+}
+
+RAsmPlugin r_asm_plugin_ppc_ks = {
+	.name = "ppc.ks",
+	.desc = "powerpc keystone assembler",
+	.license = "GPL",
+	.arch = "ppc",
+	.bits = 32|64,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_ppc_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_sparc_ks.c

@@ -0,0 +1,40 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/sparc.h>
+
+#include "keystone.c"
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode = (ks_mode)0;
+	switch (a->bits) {
+	case 32:
+		mode = KS_MODE_SPARC32;
+		break;
+	case 64:
+		mode = KS_MODE_SPARC64;
+		break;
+	}
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_SPARC, mode);
+}
+
+RAsmPlugin r_asm_plugin_sparc_ks = {
+	.name = "sparc.ks",
+	.desc = "sparc keystone assembler",
+	.license = "GPL",
+	.arch = "sparc",
+	.bits = 32|64,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_sparc_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_sysz_ks.c

@@ -0,0 +1,32 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/systemz.h>
+#include "keystone.c"
+
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode = (ks_mode)0;
+	if (a->big_endian) {
+		mode = (ks_mode)((int)mode | KS_MODE_BIG_ENDIAN);
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_SYSTEMZ, mode);
+}
+
+RAsmPlugin r_asm_plugin_sysz_ks = {
+	.name = "sysz.ks",
+	.desc = "SystemZ keystone assembler (S390X)",
+	.license = "GPL",
+	.arch = "sysz",
+	.bits = 32,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_sysz_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/asm_x86_ks.c

@@ -0,0 +1,40 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+#include <r_asm.h>
+#include <r_lib.h>
+#include <keystone/keystone.h>
+#include <keystone/x86.h>
+
+#include "keystone.c"
+static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
+	ks_mode mode = (ks_mode)0;
+	switch (a->bits) {
+	case 16:
+		mode = KS_MODE_16;
+		break;
+	case 32:
+		mode = KS_MODE_32;
+		break;
+	case 64:
+		mode = KS_MODE_64;
+		break;
+	}
+	return keystone_assemble (a, ao, str, KS_ARCH_X86, mode);
+}
+
+RAsmPlugin r_asm_plugin_x86_ks = {
+	.name = "x86.ks",
+	.desc = "x86 keystone assembler",
+	.license = "GPL",
+	.arch = "x86",
+	.bits = 16 | 32 | 64,
+	.assemble = &assemble,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ASM,
+	.data = &r_asm_plugin_x86_ks,
+	.version = R2_VERSION
+};
+#endif

keystone/autogen.sh

@@ -0,0 +1 @@
+acr -p

keystone/build.mk

@@ -0,0 +1,19 @@
+-include config.mk
+
+ifeq ($(BUILD_OS),darwin)
+SO_EXT=dylib
+LDFLAGS_SHARED=-dynamiclib
+else
+LDFLAGS_SHARED=-shared
+ifeq ($(BUILD_OS),windows)
+SO_EXT=dll
+else
+SO_EXT=so
+endif
+endif
+O_EXT=o
+
+KS_CFLAGS=$(shell pkg-config --cflags keystone)
+KS_LDFLAGS=$(shell pkg-config --libs keystone)
+KS_LINK=-lkeystone
+CFLAGS+=-Wextern-c-compat

keystone/config.mk.acr

@@ -0,0 +1,15 @@
+CC=@CC@
+CFLAGS=@CFLAGS@
+LDFLAGS=@LDFLAGS@
+
+R2_CFLAGS=@R2_CFLAGS@
+R2_LDFLAGS=@R2_LDFLAGS@
+
+HAVE_LIB_KEYSTONE=@HAVE_LIB_KEYSTONE@
+
+BUILD_OS=@BUILD_OS@
+
+PREFIX=@PREFIX@
+DESTDIR?=/
+LIBDIR=@LIBDIR@
+INSTALL_LIB=@INSTALL_LIB@

keystone/configure

@@ -0,0 +1,402 @@
+#!/bin/sh
+# This script was automatically generated by ACR v1.7.2
+# @author: pancake <nopcode.org>
+# @url:    http://www.nopcode.org
+# @repo:   git clone https://github.com/radare/acr
+
+[ -z "${AWK}" ] && AWK=awk
+do_remove() {
+if [ "${ACR_RMFILES}" ]; then
+  printf "cleaning temporally files... "
+  rm -f ${ACR_RMFILES}
+  echo "done"
+fi
+}
+control_c() {
+  printf "\n\n^C control-c : script execution interrupted.\n"
+  do_remove
+  exit 1
+}
+trap control_c 2
+split_host() {
+S="$"
+while : ; do
+ENVWORDS="${ENVWORDS} $1_CPU $1_OS"
+STR=`eval "echo ${S}$1"`
+SPLIT_CPU="`echo "$STR" | cut -d - -f 1`"
+SPLIT_OS="`echo "$STR" | $AWK -F - '{
+	if ($2=="unknown"){
+		if (NF<3) { print $2; } else { print $3; }
+	} else {
+		if ($2=="linux") { print $2; } else
+		if (NF<3) { print $2; } else { print $3; }
+	}
+}'`"
+eval "$1_CPU=\"$SPLIT_CPU\""
+eval "$1_OS=\"$SPLIT_OS\""
+shift
+[ -z "$1" ] && break
+done
+}
+
+VPATH=`dirname ${0}`
+if [ "${VPATH}" = "." ]; then
+	WODIS=current
+else
+	if [ "${VPATH}" = "${PWD}" ]; then
+		VPATH=.
+		WODIS=current
+	else
+		WODIS=crosspath
+		CURDIR=$PWD
+		cd $VPATH
+		VPATH="${PWD}/"
+		cd $CURDIR
+	fi
+fi
+
+guess_os() {
+if [ -e "${VPATH}/config.guess" ]; then
+	sh ${VPATH}/config.guess
+	return
+fi
+CPU="`uname -m|sed -e 's, ,,g'|cut -d - -f 1`"
+OS="`uname -s|tr A-Z a-z`"
+uname -r | grep -qE "(Microsoft|WSL)" 2>/dev/null && OS="wsl"
+GNU="`uname --help 2>&1 | grep gnu`"
+[ "${GNU}" ] && OS="${OS}-gnu"
+[ "${CPU}" = ppc ] && CPU="powerpc"
+echo "${CPU}-unknown-${OS}"
+}
+
+SEARCHPATH="/usr /usr/local /usr/pkg /sw"
+
+: ${PREFIX:=/usr/local}
+CROSSBUILD=0
+BUILD=`guess_os`
+HOST="${BUILD}"
+TARGET="${HOST}"
+SYSCONFDIR=""
+
+create_environ() {
+: ${EPREFIX:="${PREFIX}"}
+: ${SPREFIX:="${PREFIX}"}
+: ${BINDIR:="${SPREFIX}/bin"}
+: ${SBINDIR:="${PREFIX}/sbin"}
+: ${SYSCONFDIR:="${SPREFIX}/etc"}
+: ${LIBDIR:="${SPREFIX}/lib"}
+: ${LIBEXECDIR:="${SPREFIX}/libexec"}
+: ${INCLUDEDIR:="${SPREFIX}/include"}
+: ${DATADIR:="${SPREFIX}/share"}
+: ${INFODIR:="${DATADIR}/info"}
+: ${MANDIR:="${DATADIR}/man"}
+: ${DOCDIR:="${DATADIR}/doc/radare2-keystone"}
+: ${LOCALSTATEDIR:="${SPREFIX}/var"}
+for A in `echo ${PATH} | sed -e 's,:, ,g'` ; do
+  [ -e "$A"/ginstall ] && : ${INSTALL:="$A"/ginstall} && break
+  [ -e "$A"/install ] && : ${INSTALL:="$A"/install} && break
+done
+: ${INSTALL_DIR:=${INSTALL} -d}
+: ${INSTALL_DATA:=${INSTALL} -m 644}
+: ${INSTALL_SCRIPT:=${INSTALL} -m 755}
+: ${INSTALL_PROGRAM:=${INSTALL} -m 755}
+: ${INSTALL_PROGRAM_STRIP:=${INSTALL} -m 755 -s}
+: ${INSTALL_MAN:=${INSTALL} -m 444}
+: ${INSTALL_LIB:=${INSTALL} -m 755 -c}
+ PKGNAME='radare2-keystone' ; VERSION='0.1' ; CONTACT_MAIL="[email protected]" ; CONTACT_NAME="pancake" ; CONTACT="pancake <[email protected]>" ;
+}
+
+show_usage() {
+cat <<EOF2
+'configure' configures radare2-keystone-0.1 to adapt to many kinds of systems.
+
+Usage: ./configure [OPTION]... [VAR=VALUE]...
+
+To assign environment variables (e.g., CC, CFLAGS...), specify them as
+VAR=VALUE.  See below for descriptions of some of the useful variables.
+
+Defaults for the options are specified in brackets.
+
+Configuration:
+  -h, --help              display this help and exit
+  -r, --report            show what libs/programs require to work
+  -V, --version           display version information and exit
+
+Installation directories:
+  --exec-prefix=EPREFIX  install arch-dependent files in EPREFIX [PREFIX]
+  --prefix=PREFIX        install arch-independent files in PREFIX [/usr/local]
+  --sandbox=SPREFIX      sandbox prefix directory: SPREFIX [PREFIX]
+
+Fine tuning of the installation directories:
+  --bindir=DIR           user executables [EPREFIX/bin]
+  --datadir=DIR          read-only architecture-independent data [PREFIX/share]
+  --docdir=DIR           documentation directory [DATADIR/doc/radare2-keystone]
+  --includedir=DIR       C header files [PREFIX/include]
+  --infodir=DIR          info documentation [DATADIR/info]
+  --libexecdir=DIR       program executables [EPREFIX/libexec]
+  --libdir=DIR           object code libraries [EPREFIX/lib]
+  --libpath=DIR          set rpath/libname-path to linker
+  --localstatedir=DIR    modifiable single-machine data [PREFIX/var]
+  --mandir=DIR           man documentation [DATADIR/man]
+  --sbindir=DIR          system admin executables [EPREFIX/sbin]
+  --sysconfdir=DIR       read-only single-machine data [PREFIX/etc]
+  --sharedstatedir=DIR   modifiable architecture-independent data [PREFIX/com]
+
+System types:
+  --build=BUILD          configure for building on BUILD [guessed]
+  --host=HOST            cross-compile to build programs to run on HOST [BUILD]
+  --target=TARGET        configure for building compilers for TARGET [HOST]
+EOF2
+
+printf "
+Some influential environment variables:
+  CC          C compiler command
+  CFLAGS      C compiler flags
+  CPPFLAGS    C preprocessor flags
+  LDFLAGS     linker flags, e.g. -L<lib dir> if you have libraries in a
+              nonstandard directory <lib dir>
+  CPPFLAGS    C/C++ preprocessor flags, e.g. -I<include dir> if you have
+              headers in a nonstandard directory <include dir>
+  CPP         C preprocessor
+  CXX         C++ compiler command
+  CXXFLAGS    C++ compiler flags
+"
+printf "
+Report bugs to: pancake <[email protected]>"
+echo ""
+exit 0
+}
+
+take_environ() {
+: ${SH:=/bin/sh}
+: ${CPP:=cpp}
+: ${CC:=gcc}
+: ${CPP:=cpp}
+: ${CXX:=g++}
+: ${PREFIX:=/usr/local/}
+}
+
+show_version() {
+echo "radare2-keystone-0.1 configuration script done with acr v1.7.2.
+The 'Free Software Foundation' message is only for autodetection.
+Originally written by pancake <nopcode.org>."
+exit 0
+}
+
+parse_options() {
+flag=`echo $1| cut -d = -f 1`
+value=`echo $1| $AWK 'BEGIN{FS="=";}{print $2}'`
+flag2=`echo $flag|cut -f2- -d -| sed -e 's,-,_,g' -e 's,^_,,g'|tr '[a-z]' '[A-Z]'`
+
+if [ "${TARGET_OS}" = "darwin" ]; then
+	LIBPATH=-Wl,-install_name,
+else
+	LIBPATH=-Wl,-R
+fi
+
+case $flag in
+-h|--help|--hel|--h|--he|-help)
+	show_usage ; ;;
+-V|-version|--version)
+	show_version ; ;;
+-r|--r|--report)
+echo "PKGNAME:   radare2-keystone"
+echo "VERSION:   0.1"
+echo "LANGS:     c c++"
+echo "REQUIRED:  libkeystone"
+echo "PKG-CONFIG:  r_asm"
+	exit 0
+	;;
+--cache-file)
+	# ignored: acr have no cache
+	;;
+--build)
+	BUILD="$value"; split_host BUILD ; ;;
+--host)
+	CROSSBUILD=1 # XXX
+	HOST="$value"; split_host HOST ; ;;
+--target)
+	TARGET="$value"; split_host TARGET ; ;;
+--prefix)
+	PREFIX="$value"; ;;
+--exec-prefix)
+	EPREFIX="$value"; ;;
+--sandbox|--sprefix)
+	SPREFIX="$value"; ;;
+--bindir)
+	BINDIR="$value"; ;;
+--sbindir)
+	SBINDIR="$value"; ;;
+--libexecdir)
+	LIBEXECDIR="$value"; ;;
+--docdir)
+	DOCDIR="$value"; ;;
+--datadir)
+	DATADIR="$value"; ;;
+--sysconfdir)
+	SYSCONFDIR="$value"; ;;
+--sharedstatedir)
+	SHAREDSTATEDIR="$value"; ;;
+--localstatedir)
+	LOCALSTATEDIR="$value"; ;;
+--libdir)
+	LIBDIR="$value"; ;;
+--libpath)
+	LDFLAGS="${LDFLAGS} ${LIBPATH}$value"; ;;
+--includedir)
+	INCLUDEDIR="$value"; CFLAGS="${CFLAGS} -I$value"; ;;
+--infodir)
+	INFODIR="$value"; ;;
+--mandir)
+	MANDIR="$value"; ;;
+
+*) if [ "$value" ]; then eval "`echo $flag2=$value`" ;
+else echo ; echo "WARNING: Unknown flag '$flag'." >&2 ; echo ; fi ;;
+esac
+}
+
+# MAIN #
+take_environ
+split_host BUILD HOST TARGET
+[ -z "$ACRHOOK" ] && ACRHOOK=./configure.hook
+[ -e "$ACRHOOK" ] && . ${ACRHOOK}
+
+while : ; do
+[ -z "$1" ] && break
+parse_options "$1"
+shift
+done
+
+ENVWORDS="MANDIR INFODIR LIBDIR INCLUDEDIR LOCALSTATEDIR SYSCONFDIR DATADIR DOCDIR LIBEXECDIR SBINDIR BINDIR EPREFIX PREFIX SPREFIX TARGET HOST BUILD INSTALL INSTALL_LIB INSTALL_MAN INSTALL_PROGRAM INSTALL_PROGRAM_STRIP INSTALL_DIR INSTALL_SCRIPT INSTALL_DATA HOST_OS HOST_CPU BUILD_OS BUILD_CPU TARGET_OS TARGET_CPU PKGNAME VPATH VERSION CONTACT CONTACT_NAME CONTACT_MAIL CC CFLAGS CPPFLAGS LDFLAGS HAVE_LANG_C CXX CXXFLAGS HAVE_LANG_CXX HAVE_LIB_KEYSTONE R2_CFLAGS R2_LDFLAGS HAVE_PKGCFG_R_ASM"
+
+create_environ
+
+echo "checking build system type... ${BUILD}"
+echo "checking host system type... ${HOST}"
+echo "checking target system type... ${TARGET}"
+[ "${CROSSBUILD}" = 1 ] && echo "using crosscompilation mode."
+
+#split_host BUILD HOST TARGET
+[ -n "${prefix}" ] && PREFIX="${prefix}"
+echo "checking for working directories... ${WODIS}"
+echo "using prefix '${PREFIX}'"
+ACR_RMFILES=" test.c a.out a.exe test.c test.cxx a.out a.exe"
+
+
+
+
+COMPILER=CC
+printf "checking for c compiler... "
+HAVE_LANG_C=1
+if [ "${CROSSBUILD}" = 1 ]; then
+ (command -v ${HOST}-${CC} >/dev/null 2>&1)
+ if [ $? = 0 ]; then CC="${HOST}-${CC}"; fi
+fi
+echo "int main(int argc, char **argv){return 0;}" > test.c
+ (exec ${CC} ${CFLAGS} ${CPPFLAGS} ${LDFLAGS} test.c >/dev/null 2>&1)
+if [ $? = 0 ]; then echo ${CC}; else
+ echo no ; HAVE_LANG_C=0
+do_remove
+echo "ERROR: ${CC} cannot create executables" >&2 ;
+exit 1 ; fi
+COMPILER=CXX
+HAVE_LANG_CXX=1
+printf "checking for c++ compiler... "
+if [ "${CROSSBUILD}" = 1 ]; then
+(command -v ${HOST}-${CXX} 2>&1 >/dev/null)
+if [ "$?" = 0 ]; then CXX="${HOST}-${CXX}"; fi
+fi
+echo "#include <iostream>" > test.cxx
+echo "int main(){ std::cout << 1; return 0;}" >> test.cxx
+(exec ${CXX} ${CXXFLAGS} ${LDFLAGS} test.cxx -lstdc++ >/dev/null 2>&1)
+if [ $? = 0 ]; then echo ${CXX}; else
+HAVE_LANG_CXX=0
+echo no
+
+echo "ERROR: ${CXX} cannot create executables" >&2 ;
+do_remove
+exit 1
+ fi
+check_library() {
+VAR=$1
+S="$"
+_REQUIRED=$3
+_CHKLIB_NAME=$2
+_CHKLIB_LIBS=$(echo "-l${_CHKLIB_NAME}" | sed 's,+, -l,g')
+printf "checking for lib${_CHKLIB_NAME} ... "
+echo "int main(int ac, char **av){return 0;}" > test.c
+eval ${S}${COMPILER} ${CFLAGS} ${CPPFLAGS} ${CXXFLAGS} ${LDFLAGS} ${_CHKLIB_LIBS} test.c >/dev/null 2>&1
+if [ $? = 0 ]; then
+	eval ${VAR}=1
+	echo yes
+else
+	eval ${VAR}=0
+	echo no
+	if [ "${_REQUIRED}" = 1 ]; then
+	  echo "this library is required."
+	  do_remove
+	  exit 1
+	fi
+fi
+}
+
+check_library HAVE_LIB_KEYSTONE keystone 1
+[ -z "${PKGCONFIG}" ] && PKGCONFIG=pkg-config
+type ${PKGCONFIG} > /dev/null 2>&1 || echo "ERROR: Cannot find PKGCONFIG ${PKGCONFIG}"
+echo 'Using PKGCONFIG: '${PKGCONFIG}
+printf 'checking pkg-config flags for r_asm... '
+tmp=`${PKGCONFIG} --cflags r_asm 2>/dev/null`
+if [ $? != 0 ]; then echo no ; HAVE_PKGCFG_R_ASM=0;
+R2_CFLAGS='';R2_LDFLAGS='';
+echo 'This package is required'
+exit 1
+else
+R2_CFLAGS=$tmp;
+tmp=`${PKGCONFIG} --libs r_asm 2>/dev/null`
+if [ $? = 0 ]; then
+echo yes; HAVE_PKGCFG_R_ASM=1;
+R2_LDFLAGS=$tmp; fi; fi
+SEDFLAGS=" -e '"
+COUNT=0
+for A in ${ENVWORDS} ; do
+	[ "${A}" = VPATH ] && continue
+	[ "${A}" = srcdir ] && continue
+	eval "VAR=\$${A}"
+	VAR="`echo ${VAR} | sed -e 's/\,/\\\,/g'`"
+	[ $COUNT = 10 ] && COUNT=0 && SEDFLAGS="${SEDFLAGS}' -e '"
+	COUNT=$(($COUNT+1))
+	SEDFLAGS="${SEDFLAGS}s,@${A}@,${VAR},g;"
+done
+SEDFLAGS="${SEDFLAGS}'"
+for A in ./config.mk  ; do # SUBDIRS
+if [ -f "${VPATH}/${A}.acr" ]; then
+  SD_TARGET=${A}
+ else
+  if [ -d "${VPATH}/${A}" ]; then
+   SD_TARGET=${A}/Makefile
+   mkdir -p ${A}
+  else
+   echo "ERROR: Cannot find ${VPATH}/${A}.acr" >&2
+   exit 1
+  fi
+ fi
+ echo "creating ${SD_TARGET}"
+mkdir -p $(echo ${A} | sed -e "s,/`basename ${A}`$,,g")
+ cat ${VPATH}/${SD_TARGET}.acr | \
+eval sed -e "s,@VPATH@,${VPATH}/${A},g" ${SEDFLAGS} > ${SD_TARGET}.tmp
+
+for A in ${ENVWORDS}; do
+VALUE=`eval echo "$"${A}`
+if [ "$VALUE" = 0 ]; then ## FALSE
+ MARK="##${A}##"
+if [ -n "`grep \"${MARK}\" ${SD_TARGET}.tmp`" ]; then
+ mv ${SD_TARGET}.tmp ${SD_TARGET}.tmp2
+ cat ${SD_TARGET}.tmp2 | MARK=$MARK $AWK 'BEGIN{a=0;}{if($1==ENVIRON["MARK"]){if(a)a=0;else a=1}else{if(!a)print;}}' > ${SD_TARGET}.tmp
+ fi
+fi
+done
+ mv ${SD_TARGET}.tmp ${SD_TARGET} && rm -f ${SD_TARGET}.tmp2
+ if [ ! $? = 0 ]; then echo Cannot write target file ; control_c ; fi
+done
+
+do_remove

keystone/configure.acr

@@ -0,0 +1,12 @@
+PKGNAME radare2-keystone
+VERSION 0.1
+CONTACT pancake ; [email protected]
+
+LANG_C!
+LANG_CXX!
+
+
+CHKLIB! keystone
+PKGCFG! R2_CFLAGS R2_LDFLAGS r_asm
+
+SUBDIRS ./config.mk ;

keystone/keystone.c

@@ -0,0 +1,68 @@
+/* radare2-keystone - GPL - Copyright 2016 - pancake */
+
+static void *oldcur = NULL;
+static ks_engine *ks = NULL;
+static int oldbit = 0;
+
+static int keystone_assemble(RAsm *a, RAsmOp *ao, const char *str, ks_arch arch, ks_mode mode) {
+	ks_err err = KS_ERR_ARCH;
+	bool must_init = false;
+	size_t count, size;
+	ut8 *insn = NULL;
+
+	if (!ks_arch_supported (arch)) {
+		return -1;
+	}
+
+	must_init = true; //!oldcur || (a->cur != oldcur || oldbit != a->bits);
+	oldcur = a->cur;
+	oldbit = a->bits;
+
+	if (must_init) {
+		if (ks) {
+			ks_close (ks);
+			ks = NULL;
+		}
+		err = ks_open (arch, mode, &ks);
+		if (err || !ks) {
+			eprintf ("Cannot initialize keystone\n");
+			ks_free (insn);
+			if (ks) {
+				ks_close (ks);
+				ks = NULL;
+			}
+			return -1;
+		}
+	}
+
+	if (!ks) {
+		ks_free (insn);
+		if (ks) {
+			ks_close (ks);
+			ks = NULL;
+		}
+		return -1;
+	}
+	if (a->syntax == R_ASM_SYNTAX_ATT) {
+		ks_option (ks, KS_OPT_SYNTAX, KS_OPT_SYNTAX_ATT);
+	} else {
+		ks_option (ks, KS_OPT_SYNTAX, KS_OPT_SYNTAX_NASM);
+	}
+	int rc = ks_asm (ks, str, a->pc, &insn, &size, &count);
+	if (rc) {
+		eprintf ("ks_asm: (%s) %s\n", str, ks_strerror ((ks_err)ks_errno (ks)));
+		ks_free (insn);
+		if (ks) {
+			ks_close (ks);
+			ks = NULL;
+		}
+		return -1;
+	}
+	r_asm_op_set_buf (ao, insn, size);
+	ks_free (insn);
+	if (ks) {
+		ks_close (ks);
+		ks = NULL;
+	}
+	return size;
+}

keystone/suite.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+#
+# testsuite for keystone assembler plugins
+#
+# author: [email protected]
+#
+ks() {
+	printf "Assembling: %s... " "$3"
+	B=`rasm2 -a $1 -b $2 "$3" 2> /dev/null`
+	if [ "$B" = "$4" ]; then
+		echo "\033[32mOK\033[0m"
+	else
+		echo "\033[31mFAIL\033[0m  $B vs $4"
+	fi
+}
+
+ks x86 32 "mov eax, 33" b821000000
+ks x86 32 "mov rax, 33" ""
+ks x86 64 "mov rax, 33" 48c7c021000000
+ks x86 32 "int3" cc
+ks x86 32 "int 3" cd03
+
+ks arm 32 "bl 0x300" be0000eb
+ks arm 32 "bpkt" 000000ea
+ks mips 32 "addi t0, t0, 3" 03000821
+
+ks arm' -e' 32 "bl 0x300" eb0000be
+ks arm' -e' 32 "bpkt" ea000000
+ks mips' -e' 32 "addi t0, t0, 3" 21080003
+
+ks sysz 32 "lnr %r12, %r7" 11c7
+# ks ppc 32 "addis r0, r29, 0x3d83" 11c7

libr/Makefile

@@ -1,18 +1,80 @@
-HOMEDEST?=~/.config/radare2/plugins
-
 all:
-	
+
 bea:
 	$(MAKE) -C asm bea
 	$(MAKE) -C anal bea
 
+atombios:
+	$(MAKE) -C asm atombios
+	$(MAKE) -C anal atombios
+	$(MAKE) -C bin atombios
+
+blackfin:
+	$(MAKE) -C asm blackfin
+
+tab:
+	$(MAKE) -C asm tab
+
+olly:
+	$(MAKE) -C asm olly
+
+udis udis86:
+	$(MAKE) -C asm x86_udis
+	$(MAKE) -C anal x86_udis
+
+m68k:
+	$(MAKE) -C asm m68k_net
+	$(MAKE) -C anal m68k_net
+
+zyan:
+	$(MAKE) -C asm zyan
+
+evm:
+	$(MAKE) -C asm evm
+	$(MAKE) -C anal evm
+	$(MAKE) -C io evm
+	$(MAKE) -C debug evm
+
+nios:
+	$(MAKE) -C asm nios
+
 clean:
 	$(MAKE) -C asm clean
 	$(MAKE) -C anal clean
 
+atombios-install:
+	cp -f asm/p/asm_atombios.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f anal/p/anal_atombios.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f bin/p/bin_atombios.$(LIBEXT) $(R2PM_PLUGDIR)
+
 bea-install:
-	mkdir -p $(HOMEDEST)
-	cp -f asm/p/asm_x86_bea.$(EXT_SO) $(HOMEDEST)
-	cp -f anal/p/anal_x86_bea.$(EXT_SO) $(HOMEDEST)
-	
+	cp -f asm/p/asm_x86_bea.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f anal/p/anal_x86_bea.$(LIBEXT) $(R2PM_PLUGDIR)
+
+udis86-install udis-install:
+	cp -f asm/p/asm_x86_udis.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f anal/p/anal_x86_udis.$(LIBEXT) $(R2PM_PLUGDIR)
+
+tab-install:
+	cp -f asm/p/asm_x86_tab.$(LIBEXT) $(R2PM_PLUGDIR)
+
+olly-install:
+	cp -f asm/p/asm_x86_olly.$(LIBEXT) $(R2PM_PLUGDIR)
+
+m68k-install:
+	cp -f asm/p/asm_m68k_net.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f anal/p/anal_m68k_net.$(LIBEXT) $(R2PM_PLUGDIR)
+
+zyan-install:
+	cp -f asm/p/asm_x86_zyan.$(LIBEXT) $(R2PM_PLUGDIR)
+
+evm-install:
+	cp -f asm/p/asm_evm.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f anal/p/anal_evm.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f io/p/io_evm.$(LIBEXT) $(R2PM_PLUGDIR)
+	cp -f debug/p/debug_evm.$(LIBEXT) $(R2PM_PLUGDIR)
+
+nios-install:
+	cp -f asm/p/asm_nios.$(LIBEXT) $(R2PM_PLUGDIR)
+
 include ../options.mk

libr/anal/Makefile

@@ -1,7 +1,21 @@
 bea:
-	cd p ; $(MAKE) anal_x86_bea.$(EXT_SO)
+	cd p ; $(MAKE) anal_x86_bea.$(LIBEXT)
+
+x86_udis udis udis86:
+	cd p ; $(MAKE) anal_x86_udis.$(LIBEXT)
+
+m68k_net:
+	cd p ; $(MAKE) anal_m68k_net.$(LIBEXT)
+
+atombios:
+	cd p ; $(MAKE) anal_atombios.$(LIBEXT)
+
+evm:
+	cd p ; $(MAKE) anal_evm.$(LIBEXT)
 
 clean:
-	rm -f p/anal_x86_bea.$(EXT_SO)
+	rm -f p/anal_x86_bea.$(LIBEXT)
+	rm -f p/anal_m68k_net.$(LIBEXT)
+	rm -f p/anal_atombios.{$(LIBEXT),o}
 
 include ../../options.mk

libr/anal/p/Makefile

@@ -3,5 +3,9 @@ ARCHS=
 ARCHS+=x86_bea.mk
 #ARCHS+=x86_im.mk
 ARCHS+=x86_simple.mk
+ARCHS+=x86_udis.mk
+ARCHS+=m68k_net.mk
+ARCHS+=evm.mk
+ARCHS+=atombios.mk
 
 include ../../plugs.mk

libr/anal/p/anal_evm.c

@@ -0,0 +1,638 @@
+#include <string.h>
+#include <errno.h>
+
+#include <jansson.h>
+
+#include <r_types.h>
+#include <r_lib.h>
+#include <r_asm.h>
+#include <r_anal.h>
+#include <r_util.h>
+#include <sdb.h>
+
+#include "evm.h"
+
+struct evm_anal_info {
+	Sdb *pushs_db;
+};
+
+static struct evm_anal_info *evm_ai = NULL;
+
+static unsigned opcodes_types[] = {
+	[EVM_OP_STOP] = R_ANAL_OP_TYPE_RET,
+	[EVM_OP_ADD] = R_ANAL_OP_TYPE_ADD,
+	[EVM_OP_MUL] = R_ANAL_OP_TYPE_MUL,
+	[EVM_OP_SUB] = R_ANAL_OP_TYPE_SUB,
+	[EVM_OP_DIV] = R_ANAL_OP_TYPE_DIV,
+	[EVM_OP_SDIV] = R_ANAL_OP_TYPE_DIV,
+	[EVM_OP_MOD] = R_ANAL_OP_TYPE_MOD,
+	[EVM_OP_SMOD] = R_ANAL_OP_TYPE_MOD,
+	[EVM_OP_ADDMOD] = R_ANAL_OP_TYPE_ADD,
+	[EVM_OP_MULMOD] = R_ANAL_OP_TYPE_MUL,
+	[EVM_OP_EXP] = R_ANAL_OP_TYPE_MUL,
+	[EVM_OP_SIGNEXTEND] = R_ANAL_OP_TYPE_CAST,
+	[EVM_OP_LT] = R_ANAL_OP_TYPE_COND,
+	[EVM_OP_GT] = R_ANAL_OP_TYPE_COND,
+	[EVM_OP_SLT] = R_ANAL_OP_TYPE_COND,
+	[EVM_OP_SGT] = R_ANAL_OP_TYPE_COND,
+
+	[EVM_OP_EQ] = R_ANAL_OP_TYPE_CMP,
+	[EVM_OP_ISZERO] = R_ANAL_OP_TYPE_CMP,
+	[EVM_OP_AND] = R_ANAL_OP_TYPE_AND,
+	[EVM_OP_OR] = R_ANAL_OP_TYPE_OR,
+	[EVM_OP_XOR] = R_ANAL_OP_TYPE_XOR,
+	[EVM_OP_NOT] = R_ANAL_OP_TYPE_NOT,
+	[EVM_OP_BYTE] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SHA3] = R_ANAL_OP_TYPE_CRYPTO,
+
+	[EVM_OP_ADDRESS] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_BALANCE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_ORIGIN] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLER] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLVALUE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLDATALOAD] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLDATASIZE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLDATACOPY] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CODESIZE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CODECOPY] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_GASPRICE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_EXTCODESIZE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_EXTCODECOPY] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_RETURNDATASIZE] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_RETURNDATACOPY] = R_ANAL_OP_TYPE_STORE,
+
+	[EVM_OP_BLOCKHASH] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_COINBASE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_TIMESTAMP] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_NUMBER] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_DIFFICULTY] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_GASLIMIT] = R_ANAL_OP_TYPE_CRYPTO,
+
+	[EVM_OP_POP] = R_ANAL_OP_TYPE_POP,
+	[EVM_OP_MLOAD] = R_ANAL_OP_TYPE_LOAD,
+	[EVM_OP_MSTORE] = R_ANAL_OP_TYPE_STORE,
+	[EVM_OP_MSTORE8] = R_ANAL_OP_TYPE_STORE,
+	[EVM_OP_SLOAD] = R_ANAL_OP_TYPE_LOAD,
+	[EVM_OP_SSTORE] = R_ANAL_OP_TYPE_STORE,
+	[EVM_OP_JUMP] = R_ANAL_OP_TYPE_JMP,
+	[EVM_OP_JUMPI] = R_ANAL_OP_TYPE_JMP,
+	[EVM_OP_PC] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_MSIZE] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_GAS] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_JUMPDEST] = R_ANAL_OP_TYPE_NOP,
+
+	[EVM_OP_PUSH1] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH2] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH3] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH4] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH5] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH6] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH7] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH8] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH9] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH10] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH11] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH12] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH13] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH14] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH15] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH16] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH17] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH18] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH19] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH20] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH21] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH22] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH23] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH24] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH25] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH26] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH27] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH28] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH29] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH30] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH31] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_PUSH32] = R_ANAL_OP_TYPE_PUSH,
+	[EVM_OP_DUP1] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP2] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP3] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP4] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP5] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP6] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP7] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP8] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP9] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP10] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP11] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP12] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP13] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP14] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP15] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_DUP16] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP1] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP2] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP3] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP4] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP5] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP6] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP7] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP8] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP9] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP10] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP11] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP12] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP13] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP14] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP15] = R_ANAL_OP_TYPE_MOV,
+	[EVM_OP_SWAP16] = R_ANAL_OP_TYPE_MOV,
+
+	[EVM_OP_LOG0] = R_ANAL_OP_TYPE_TRAP,
+	[EVM_OP_LOG1] = R_ANAL_OP_TYPE_TRAP,
+	[EVM_OP_LOG2] = R_ANAL_OP_TYPE_TRAP,
+	[EVM_OP_LOG3] = R_ANAL_OP_TYPE_TRAP,
+	[EVM_OP_LOG4] = R_ANAL_OP_TYPE_TRAP,
+
+	[EVM_OP_CREATE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALL] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_CALLCODE] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_RETURN] = R_ANAL_OP_TYPE_RET,
+	[EVM_OP_DELEGATECALL] = R_ANAL_OP_TYPE_CRYPTO,
+	[EVM_OP_REVERT] = R_ANAL_OP_TYPE_RET,
+	[EVM_OP_SELFDESTRUCT] = R_ANAL_OP_TYPE_CRYPTO,
+};
+
+struct evm_sigs_info {
+	RIO *rio;
+	RIODesc *riodesc;
+	ut8 *contents;
+	size_t contents_len;
+	json_t *root;
+
+	Sdb	*sigs_db;
+	Sdb *found_sigs_db;
+};
+
+static struct evm_sigs_info *sigs_info = 0;
+
+static int evm_oplen(ut8 opcode) {
+	int ret;
+	const EvmOpDef *opdef = &opcodes[opcode];
+
+	if (opdef->txt) {
+		return opdef->len;
+	}
+	switch (opcode) {
+	case EVM_OP_PUSH1:
+	case EVM_OP_PUSH2:
+	case EVM_OP_PUSH3:
+	case EVM_OP_PUSH4:
+	case EVM_OP_PUSH5:
+	case EVM_OP_PUSH6:
+	case EVM_OP_PUSH7:
+	case EVM_OP_PUSH8:
+	case EVM_OP_PUSH9:
+	case EVM_OP_PUSH10:
+	case EVM_OP_PUSH11:
+	case EVM_OP_PUSH12:
+	case EVM_OP_PUSH13:
+	case EVM_OP_PUSH14:
+	case EVM_OP_PUSH15:
+	case EVM_OP_PUSH16:
+	case EVM_OP_PUSH17:
+	case EVM_OP_PUSH18:
+	case EVM_OP_PUSH19:
+	case EVM_OP_PUSH20:
+	case EVM_OP_PUSH21:
+	case EVM_OP_PUSH22:
+	case EVM_OP_PUSH23:
+	case EVM_OP_PUSH24:
+	case EVM_OP_PUSH25:
+	case EVM_OP_PUSH26:
+	case EVM_OP_PUSH27:
+	case EVM_OP_PUSH28:
+	case EVM_OP_PUSH29:
+	case EVM_OP_PUSH30:
+	case EVM_OP_PUSH31:
+	case EVM_OP_PUSH32:
+	{
+		int pushSize = opcode - EVM_OP_PUSH1;
+		/*
+		            op->imm = 0;
+		            for (i = 0; i < pushSize + 1; i++) {
+		                    op->imm <<= 8;
+		                    op->imm |= buf[i + 1];
+		            }
+		            settxtf (op, "push%d 0x%x", pushSize + 1, op->imm);
+		*/
+		ret = 2 + pushSize;
+	}
+	break;
+	case EVM_OP_DUP1:
+	case EVM_OP_DUP2:
+	case EVM_OP_DUP3:
+	case EVM_OP_DUP4:
+	case EVM_OP_DUP5:
+	case EVM_OP_DUP6:
+	case EVM_OP_DUP7:
+	case EVM_OP_DUP8:
+	case EVM_OP_DUP9:
+	case EVM_OP_DUP10:
+	case EVM_OP_DUP11:
+	case EVM_OP_DUP12:
+	case EVM_OP_DUP13:
+	case EVM_OP_DUP14:
+	case EVM_OP_DUP15:
+	case EVM_OP_DUP16:
+	{
+		// settxtf (op, "dup%d", dupSize);
+		ret = 1;
+	}
+	break;
+	case EVM_OP_SWAP1:
+	case EVM_OP_SWAP2:
+	case EVM_OP_SWAP3:
+	case EVM_OP_SWAP4:
+	case EVM_OP_SWAP5:
+	case EVM_OP_SWAP6:
+	case EVM_OP_SWAP7:
+	case EVM_OP_SWAP8:
+	case EVM_OP_SWAP9:
+	case EVM_OP_SWAP10:
+	case EVM_OP_SWAP11:
+	case EVM_OP_SWAP12:
+	case EVM_OP_SWAP13:
+	case EVM_OP_SWAP14:
+	case EVM_OP_SWAP15:
+	case EVM_OP_SWAP16:
+	{
+		// settxtf (op, "swap%d", swapSize);
+		ret = 1;
+	}
+	break;
+	case EVM_OP_LOG0:
+	case EVM_OP_LOG1:
+	case EVM_OP_LOG2:
+	case EVM_OP_LOG3:
+	case EVM_OP_LOG4:
+	{
+		// settxtf (op, "log%d", logSize);
+		ret = 1;
+	}
+	break;
+	default:
+		// settxtf (op, "invalid");
+		ret = 1;
+		break;
+	}
+
+	return ret;
+}
+
+/* Jumps/calls in EVM are done via first pushing dst value
+ * on the stack, and then calling a jump/jumpi instruction, for example:
+ *   0x0000000d push 0x42
+ *   0x0000000f jumpi
+ *
+ * we are storing the value in push instruction to db, but not at the
+ * addr of the push instruction, but at the addr of next jumpi instruction.
+ * So in our example we are inserting (0xf, 0x42)
+ */
+static int evm_add_push_to_db(ut64 addr, const ut8 *buf, int len) {
+	ut8 opcode = buf[0];
+	ut64 next_cmd_addr = addr + evm_oplen (opcode);
+	ut64 dst_addr = 0;
+	size_t i, push_size;
+	char key[16] = {0}, value[16] = {0};
+
+	push_size = opcode - EVM_OP_PUSH1;
+
+	for (i = 0; i < push_size + 1; i++) {
+		dst_addr <<= 8;
+		dst_addr |= buf[i + 1];
+	}
+
+	if (evm_ai) {
+		snprintf (key, sizeof(key) - 1, "%08x", (unsigned) next_cmd_addr);
+		snprintf (value, sizeof(value) - 1, "%08x", (unsigned) dst_addr);
+		sdb_set (evm_ai->pushs_db, key, value, 0);
+	}
+
+	return 0;
+}
+
+static st64 evm_get_jmp_addr(ut64 addr) {
+	char key[16] = {0};
+	const char *value;
+	unsigned ret;
+
+	snprintf (key, sizeof(key) - 1, "%08x", (unsigned) addr);
+
+	value = sdb_const_get (evm_ai->pushs_db, key, 0);
+
+	if (value) {
+		sscanf(value, "%08x", &ret);
+
+		return ret;
+	} else {
+		return -1;
+	}
+}
+
+static int evm_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *buf, int len) {
+	ut32 *push4op;
+	st64 ret;
+	ut8 opcode;
+	char sig[64] = {0};
+
+	opcode = buf[0];
+
+	memset (op, 0, sizeof(RAnalOp));
+
+	op->type = opcodes_types[opcode];
+	if (!op->type) {
+		op->type = R_ANAL_OP_TYPE_UNK;
+	}
+	op->addr = addr;
+	op->jump = op->fail = -1;
+	op->ptr = op->val = -1;
+
+	r_strbuf_init (&op->esil);
+
+	switch (opcode) {
+	case EVM_OP_JUMP:
+	case EVM_OP_JUMPI:
+		op->fail = addr + 1;
+
+		if (opcode == EVM_OP_JUMP) {
+			op->type = R_ANAL_OP_TYPE_JMP;
+		} else {
+			op->type = R_ANAL_OP_TYPE_CJMP;
+		}
+
+		ret = evm_get_jmp_addr(addr);
+
+		if (ret >= 0) {
+			op->jump = ret;
+		} else {
+			op->type = R_ANAL_OP_TYPE_UJMP;
+		}
+
+		op->eob = true;
+		break;
+	case EVM_OP_PC:
+		break;
+	case EVM_OP_MSIZE:
+		break;
+	case EVM_OP_GAS:
+		break;
+	case EVM_OP_JUMPDEST:
+		break;
+	case EVM_OP_PUSH1:
+	case EVM_OP_PUSH2:
+	case EVM_OP_PUSH3:
+	case EVM_OP_PUSH4:
+		evm_add_push_to_db (addr, buf, len);
+
+		if (opcode == EVM_OP_PUSH4 && sigs_info && sigs_info->sigs_db) {
+			push4op = (ut32 *)(buf + 1);
+
+			snprintf(sig, sizeof(sig) - 1, "0x%08x", ntohl((unsigned)(*push4op)));
+
+			const char *data = sdb_const_get (sigs_info->sigs_db, sig, 0);
+
+			if (data) {
+				char addr_str[16];
+				char value[1024];
+
+				snprintf(addr_str, sizeof(addr_str) - 1, "0x%08x", (unsigned int)addr);
+
+				addr_str[16 - 1] = '\0';
+
+				snprintf(value, sizeof(value) - 1, "calls a function %s with signature %s",
+						data, sig);
+
+				value[1023] = '\0';
+
+				sdb_set(sigs_info->found_sigs_db, addr_str, value, 0);
+				r_meta_set_string(anal, 'C', addr, data);
+			}
+		}
+
+		break;
+	default:
+		break;
+	}
+
+	op->size = evm_oplen (opcode);
+	return evm_oplen (opcode);
+}
+
+
+static int evm_load_symbol_map (RAnal *anal, const char *file) {
+	size_t i;
+	int ret = 0;
+	bool rc;
+
+	if (sigs_info) {
+		r_io_close (sigs_info->rio);
+		r_io_free (sigs_info->rio);
+		sdb_free (sigs_info->sigs_db);
+		sdb_free (sigs_info->found_sigs_db);
+
+		free (sigs_info->contents);
+		free (sigs_info);
+	}
+
+	sigs_info = malloc(sizeof(*sigs_info));
+	memset(sigs_info, 0, sizeof(*sigs_info));
+
+	if (!sigs_info) {
+		ret = -1;
+		goto out;
+	}
+
+	if (sigs_info) {
+		sigs_info->rio = r_io_new ();
+		sigs_info->riodesc = r_io_open (sigs_info->rio, file, R_PERM_R, 0644);
+
+		if (!sigs_info->riodesc) {
+			printf ("Failed to open %s: %s\n", file, strerror (errno));
+			ret = -1;
+
+			goto out_free;
+		} else {
+			json_error_t error;
+			sigs_info->contents_len = r_io_size (sigs_info->rio);
+			sigs_info->contents = malloc(sigs_info->contents_len + 1);
+
+			rc = r_io_read (sigs_info->rio, sigs_info->contents, sigs_info->contents_len);
+
+			if (rc == false) {
+				printf ("Failed to read file\n");
+				ret = -1;
+
+				goto out_close;
+			}
+
+			sigs_info->contents[sigs_info->contents_len] = '\0';
+
+			sigs_info->root = json_loads ((const char*)sigs_info->contents, 0, &error);
+
+			if (!sigs_info->root) {
+				printf ("Failed to parse json document on line %d: %s\n",
+						error.line, error.text);
+			} else {
+				printf ("Parsed successfully\n");
+				sigs_info->sigs_db = sdb_new0 ();
+				sigs_info->found_sigs_db = sdb_new0 ();
+
+				for (i = 0; i < json_array_size (sigs_info->root); i++) {
+					json_t *elem, *sig, *args, *name;
+					char *name_str, *sig_str, *args_str, *value;
+					size_t value_size;
+
+					elem = json_array_get (sigs_info->root, i);
+
+					if (!elem) {
+						continue;
+					}
+
+					sig = json_object_get (elem, "sig");
+					name = json_object_get (elem, "name");
+					args = json_object_get (elem, "args");
+
+					if (!sig || !name || !args) {
+						continue;
+					}
+
+					sig_str = strdup (json_string_value (sig));
+					name_str = strdup (json_string_value (name));
+					args_str = strdup (json_string_value (args));
+
+					value_size = strlen(name_str) + strlen(args_str) + 8;
+
+					value = malloc(sizeof(char) * value_size);
+
+					snprintf(value, value_size - 1, "%s(%s)", name_str, args_str);
+
+					sdb_set (sigs_info->sigs_db, sig_str, value, 0);
+
+					free (value);
+
+					free (args_str);
+					free (name_str);
+					free (sig_str);
+				}
+
+				json_decref (sigs_info->root);
+				free (sigs_info->contents);
+
+				sigs_info->root = 0;
+				sigs_info->contents = 0;
+			}
+		}
+	}
+
+	goto out;
+
+out_close:
+	r_io_close (sigs_info->rio);
+
+out_free:
+	r_io_free (sigs_info->rio);
+	sigs_info->rio = NULL;
+	free (sigs_info);
+	sigs_info = NULL;
+
+out:
+	return ret;
+}
+
+static int evm_list_found_symbols_cb (void *user, const char *k, const char *v) {
+	printf ("%s | %s\n", k, v);
+
+	return 1;
+}
+
+static int evm_list_found_symbols (RAnal *anal) {
+	if (sigs_info && sigs_info->found_sigs_db) {
+		sdb_foreach (sigs_info->found_sigs_db, evm_list_found_symbols_cb, NULL);
+	}
+
+	return 0;
+}
+
+static void evm_cmd_ext_help () {
+	printf ("a!l <file path> 	- Read a JSON file with function signatures\n"
+			"a!f				- List found function signatures\n"
+			"a!h				- Show this help message\n");
+}
+
+static int evm_cmd_ext (RAnal *anal, const char *input) {
+	const char *arg = input;
+	arg++;
+
+	while (*arg == ' ') {
+		arg++;
+	}
+
+	switch (input[0]) {
+	case 'l':
+		printf("here %s\n", arg);
+		evm_load_symbol_map (anal, arg);
+		break;
+	case 'f':
+		evm_list_found_symbols (anal);
+		break;
+	case 'h':
+	default:
+		evm_cmd_ext_help ();
+		return -1;
+	}
+
+	return 0;
+}
+
+static int evm_anal_init (void *user) {
+	if (!evm_ai) {
+		evm_ai = (struct evm_anal_info*)malloc (sizeof(*evm_ai));
+
+		evm_ai->pushs_db = sdb_new0 ();
+	}
+
+	return 0;
+}
+
+static int evm_anal_fini (void *user) {
+	if (evm_ai) {
+		if (evm_ai->pushs_db) {
+			sdb_free (evm_ai->pushs_db);
+		}
+
+		free(evm_ai);
+		evm_ai = NULL;
+	}
+
+	return 0;
+}
+
+RAnalPlugin r_anal_plugin_evm = {
+	.name = "evm",
+	.desc = "ETHEREUM VM code analysis plugin",
+	.license = "LGPL3",
+	.arch = "evm",
+	.bits = 8,
+	.op = evm_op,
+	.init = evm_anal_init,
+	.fini = evm_anal_fini,
+	.esil = false,
+	.cmd_ext = evm_cmd_ext,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ANAL,
+	.data = &r_anal_plugin_evm,
+	.version = R2_VERSION
+};
+#endif

libr/anal/p/anal_m68k_net.c

@@ -0,0 +1,200 @@
+/* radare - LGPL - Copyright 2012-2015 - pancake, pof */
+
+#include <string.h>
+#include <r_types.h>
+#include <r_lib.h>
+#include <r_asm.h>
+#include <r_anal.h>
+
+#define R_IPI static
+#include "../../asm/arch/m68k/m68k_disasm/m68k_disasm.c"
+
+static int instlen(const ut8 *buf, int len) {
+	m68k_word bof[8] = {0};
+	char opcode[256], operands[256];
+	const unsigned char *buf2;
+	static struct DisasmPara_68k dp;
+	/* initialize DisasmPara */
+	*operands = *opcode = 0;
+	memcpy (bof, buf, R_MIN(len, sizeof(bof)));
+	dp.opcode = opcode;
+	dp.operands = operands;
+	dp.iaddr = 0LL;
+	dp.instr = bof;
+	buf2 = (const ut8*)M68k_Disassemble (&dp);
+	if (!buf2) {
+		// invalid instruction
+		return 2;
+	}
+	return (buf2-(const ut8*)bof);
+}
+
+static int m68k_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *b, int len) {
+	int sz = 2;
+	if (!op)
+		return sz;
+	memset (op, 0, sizeof (RAnalOp));
+	op->type = R_ANAL_OP_TYPE_NULL;
+	op->nopcode = 1;
+	sz = instlen (b, len);
+	op->size = sz;
+// TODO: Use disasm string to detect type?
+	if (len>=2) {
+		if (!memcmp (b, "\xff\xff", 2)) {
+			op->type = R_ANAL_OP_TYPE_ILL;
+			op->size = sz;
+			return -1;
+
+		}
+	}
+	switch (b[0] & 0xf0) {
+	case 0xB0:
+		op->type = R_ANAL_OP_TYPE_CMP;
+		break;
+	case 0xe0:
+		// TODO:
+		op->type = R_ANAL_OP_TYPE_SHL;
+		op->type = R_ANAL_OP_TYPE_SHR;
+		break;
+	case 0x80:
+		op->type = R_ANAL_OP_TYPE_OR;
+		break;
+	case 0x60: {
+			   int off = 0;
+			   off = (st8)b[1];
+			   if (off==0)
+				   off = (st16)((b[2]<<8) | b[3]);
+			   else if (off==-1)
+				   off = (b[2]<<24) | (b[3]<<16) | (b[4]<<8) | b[5];
+			   op->type = R_ANAL_OP_TYPE_CJMP;
+			   op->jump = addr + 2 + off;
+			   op->fail = addr + op->size;
+			   op->eob = true;
+		   } break;
+	case 0x30:
+		  op->type = R_ANAL_OP_TYPE_MOV;
+		  break;
+	}
+
+	switch(b[0]) {
+	case 0x4e:
+		if (b[1]==0x75){
+			op->type = R_ANAL_OP_TYPE_RET;
+			op->eob = true;
+			break;
+		}
+		if (b[1]==0x71){
+			op->type = R_ANAL_OP_TYPE_NOP;
+			break;
+		}
+		if (b[1]==0xF8 || b[1]==0xF9 || b[1]==0xB8 || b[1]==0xB9){
+			op->type = (b[1]&0xf0) == 0xf0 ? R_ANAL_OP_TYPE_JMP : R_ANAL_OP_TYPE_CALL;
+
+			int off = 0;
+			if (op->size == 4)
+				off = (b[2]<<8) | b[3] ;
+			if (op->size == 6)
+				off = (b[2]<<24) | (b[3]<<16) | (b[4]<<8) | b[5];
+
+			op->jump += off;
+			op->fail = addr + op->size;
+			op->eob = true;
+			break;
+		}
+		break;
+	case 0x04:
+	case 0x53:
+	case 0x90:
+	case 0x93:
+	case 0x9D:
+		op->type = R_ANAL_OP_TYPE_SUB;
+		break;
+	case 0x06:
+	case 0x50:
+	case 0x52:
+	case 0x54:
+	case 0x58:
+	case 0xD1:
+	case 0xD3:
+		op->type = R_ANAL_OP_TYPE_ADD;
+		break;
+	case 0x0c:
+	case 0xB0:
+	case 0xB8:
+		op->type = R_ANAL_OP_TYPE_CMP;
+		break;
+	case 0x41:
+	case 0x43:
+	case 0x45:
+	case 0x47:
+	case 0x4D:
+		op->type = R_ANAL_OP_TYPE_LEA;
+		break;
+	case 0x02:
+	case 0xC0:
+		op->type = R_ANAL_OP_TYPE_AND;
+		break;
+	case 0x03:
+	case 0x10:
+	case 0x12:
+	case 0x15:
+	case 0x17:
+	case 0x18:
+	case 0x19:
+	case 0x1B:
+	case 0x1D:
+	case 0x20:
+	case 0x22:
+	case 0x26:
+	case 0x28:
+	case 0x2B:
+	case 0x2D:
+	case 0x30:
+	case 0x35:
+	case 0x38:
+	case 0x3B:
+	case 0x3C:
+	case 0x3D:
+	case 0x70:
+	case 0x72:
+	case 0x74:
+	case 0x7C:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		break;
+	}
+
+	return op->size;
+}
+
+static int archinfo(RAnal *anal, int query) {
+	switch (query) {
+	case R_ANAL_ARCHINFO_MIN_OP_SIZE:
+		/* all ops are at least 1 word long */
+		return 2;
+	case R_ANAL_ARCHINFO_MAX_OP_SIZE:
+		/* judging by the M68000 PROGRAMMER'S REFERENCE MANUAL the
+		 * cpTRAPcc opcode is the longest at 5 words */
+		return 10;
+	default:
+		return -1;
+	}
+
+}
+
+RAnalPlugin r_anal_plugin_m68k = {
+	.name = "m68k",
+	.desc = "Motorola 68000",
+	.license = "LGPL3",
+	.arch = "m68k",
+	.bits = 16|32,
+	.op = &m68k_op,
+	.archinfo = archinfo,
+};
+
+#ifndef CORELIB
+struct r_lib_struct_t radare_plugin = {
+	.type = R_LIB_TYPE_ANAL,
+	.data = &r_anal_plugin_m68k,
+	.version = R2_VERSION
+};
+#endif

libr/anal/p/anal_x86_im.c

@@ -89,7 +89,7 @@ static int anal_jmp(RAnal *anal, RAnalOp *op, x86im_instr_object io) {
 	st64 imm = r_hex_bin_truncate (io.imm, io.imm_size);
 	st64 disp = r_hex_bin_truncate (io.disp, io.disp_size);
 
-	op->eob = R_TRUE;
+	op->eob = true;
 	switch (io.id) {
 	case X86IM_IO_ID_JMP_N_R_S: /* jmp short 0x0ff */ 
 	case X86IM_IO_ID_JMP_N_R:   /* jmp 0x0ff */
@@ -139,7 +139,7 @@ static void anal_cjmp(RAnal *anal, RAnalOp *op, x86im_instr_object io) {
 	st64 imm;
 	imm = r_hex_bin_truncate (io.imm, io.imm_size);
 
-	op->eob = R_TRUE;
+	op->eob = true;
 	switch (io.id) {
 	case X86IM_IO_ID_JCC_S: /* j* 0x0ff */
 	case X86IM_IO_ID_JCC_N: /* j* dword 0x0ff */ 
@@ -208,7 +208,7 @@ static void anal_ret(RAnal *anal, RAnalOp *op, x86im_instr_object io) {
 	st64 imm;
 	imm = r_hex_bin_truncate (io.imm, io.imm_size);
 
-	op->eob = R_TRUE;
+	op->eob = true;
 	op->type = R_ANAL_OP_TYPE_RET;
 	switch (io.id) {
 	case X86IM_IO_ID_RET_N: /* ret */
@@ -226,7 +226,7 @@ static void anal_ret(RAnal *anal, RAnalOp *op, x86im_instr_object io) {
 }
 
 static void anal_hlt(RAnal *anal, RAnalOp *op, x86im_instr_object io) {
-	op->eob = R_TRUE;
+	op->eob = true;
 	op->type = R_ANAL_OP_TYPE_TRAP; // not really..
 }
 

libr/anal/p/anal_x86_simple.c

@@ -515,7 +515,7 @@ struct r_anal_plugin_t r_anal_plugin_x86_simple = {
 	.name = "x86.simple",
 	.desc = "X86 analysis plugin",
 	.license = "LGPL3",
-	.arch = R_SYS_ARCH_X86,
+	.arch = "x86",
 	.bits = 32,
 	.init = NULL,
 	.fini = NULL,

libr/anal/p/anal_x86_udis.c

@@ -0,0 +1,790 @@
+/* radare - LGPL - Copyright 2009-2016 - nibble, pancake */
+
+#include <r_lib.h>
+#include <r_types.h>
+#include <r_anal.h>
+#include <r_util.h>
+
+#include "udis86/types.h"
+#include "udis86/extern.h"
+#include "esil.h"
+
+static st64 getval(ud_operand_t *op);
+// XXX Copypasta from udis
+#define UD_REG_TAB_SIZE (sizeof (ud_reg_tab)/sizeof (*ud_reg_tab))
+static const char* ud_reg_tab[] = {
+	"al",   "cl",   "dl",   "bl",
+	"ah",   "ch",   "dh",   "bh",
+	"spl",  "bpl",  "sil",  "dil",
+	"r8b",  "r9b",  "r10b", "r11b",
+	"r12b", "r13b", "r14b", "r15b",
+
+	"ax",   "cx",   "dx",   "bx",
+	"sp",   "bp",   "si",   "di",
+	"r8w",  "r9w",  "r10w", "r11w",
+	"r12w", "r13w", "r14w", "r15w",
+
+	"eax",  "ecx",  "edx",  "ebx",
+	"esp",  "ebp",  "esi",  "edi",
+	"r8d",  "r9d",  "r10d", "r11d",
+	"r12d", "r13d", "r14d", "r15d",
+
+	"rax",  "rcx",    "rdx",    "rbx",
+	"rsp",  "rbp",    "rsi",    "rdi",
+	"r8",   "r9",     "r10",    "r11",
+	"r12",  "r13",    "r14",    "r15",
+
+	"es",   "cs",   "ss",   "ds",
+	"fs",   "gs",
+
+	"cr0",  "cr1",    "cr2",    "cr3",
+	"cr4",  "cr5",    "cr6",    "cr7",
+	"cr8",  "cr9",    "cr10",   "cr11",
+	"cr12", "cr13",   "cr14",   "cr15",
+
+	"dr0",  "dr1",    "dr2",    "dr3",
+	"dr4",  "dr5",    "dr6",    "dr7",
+	"dr8",  "dr9",    "dr10",   "dr11",
+	"dr12", "dr13",   "dr14",   "dr15",
+
+	"mm0",  "mm1",    "mm2",    "mm3",
+	"mm4",  "mm5",    "mm6",    "mm7",
+
+	"st0",  "st1",    "st2",    "st3",
+	"st4",  "st5",    "st6",    "st7",
+
+	"xmm0", "xmm1",   "xmm2",   "xmm3",
+	"xmm4", "xmm5",   "xmm6",   "xmm7",
+	"xmm8", "xmm9",   "xmm10",  "xmm11",
+	"xmm12","xmm13",  "xmm14",  "xmm15",
+
+	"ymm0", "ymm1",   "ymm2",   "ymm3",
+	"ymm4", "ymm5",   "ymm6",   "ymm7",
+	"ymm8", "ymm9",   "ymm10",  "ymm11",
+	"ymm12","ymm13",  "ymm14",  "ymm15",
+
+	"rip"
+};
+
+static int getarg(char *src, struct ud *u, st64 mask, int idx, int regsz) {
+	ud_operand_t *op = &u->operand[idx];
+	st64 n;
+	src[0] = 0;
+	if (!mask) mask = UT64_MAX;
+
+	switch (op->type) {
+	case UD_OP_PTR:
+	case UD_OP_CONST:
+	case UD_OP_JIMM:
+	case UD_OP_IMM:
+		n = getval (op) & mask;
+		//mask = UT64_MAX; // uhm?
+		if (op->type == UD_OP_JIMM) n += u->pc;
+		if (n>=0 && n<256)
+			sprintf (src, "%"PFMT64d, n & mask);
+		else sprintf (src, "0x%"PFMT64x, n&mask);
+		break;
+	case UD_OP_REG:
+		idx = op->base-UD_R_AL;
+		if (idx>=0 && idx<UD_REG_TAB_SIZE)
+			strcpy (src, ud_reg_tab[idx]);
+		break;
+	case UD_OP_MEM:
+		n = getval (op);
+		// TODO ->scale
+		if (op->base != UD_NONE) {
+			idx = op->base-UD_R_AL;
+			if (idx>=0 && idx<UD_REG_TAB_SIZE) {
+				sprintf (src, "%s", ud_reg_tab[idx]);
+                                src += strlen (src);
+                                if (op->index != UD_NONE) {
+                                        idx = op->index - UD_R_AL;
+                                        if (idx >= 0 && idx < UD_REG_TAB_SIZE) {
+                                                sprintf (src, ",%d,%s,*,+",
+						op->scale, ud_reg_tab[idx]);
+					}
+                                        src += strlen (src);
+                                }
+                                if (u->mnemonic == UD_Ilea) {
+					if ((st16)n>0) sprintf (src, ",%"PFMT64d",+", n);
+					else if ((st16)n<0) sprintf (src, ",%"PFMT64d",-", UT32_MAX-n);
+				} else if ((st16)n >= -256 && (st16)n < 256) {
+					char nb = (char)n;
+					char absn = ((st16)nb<0)? -nb: nb;
+					if (n==0) sprintf (src, ",[%d]", regsz);
+					else sprintf (src, ",%d,%c,[%d]",
+						absn, nb<0?'-':'+', regsz);
+				} else {
+					sprintf (src, ",0x%"PFMT64x",+,[%d]",
+						mask & n, regsz);
+				}
+			} else {
+				/* If UDis86 works properly, it will never reach this point.
+				 * Only useful for debug purposes ("unknown reg" is clearer
+				 * than an empty string, right?)
+				 */
+			}
+		} else sprintf (src, "0x%"PFMT64x",[%d]", n & mask, regsz);
+		break;
+	default:
+		break;
+	}
+
+	return 0;
+}
+
+static st64 getval(ud_operand_t *op) {
+	int bits = op->size;
+	switch (op->type) {
+	case UD_OP_PTR:
+		return (op->lval.ptr.seg<<4) + (op->lval.ptr.off & 0xFFFF);
+	default:
+		break;
+	}
+	if (!bits) bits = 32;
+	if (op->signed_lval) { // TODO: honor sign
+		switch (bits) {
+		case 8: return (st64)(char) (op->lval.sbyte);
+		case 16: return (st64)(short) op->lval.uword;
+		case 32: return (ut64)(ut32)(op->lval.udword&UT32_MAX);
+		case 64: return op->lval.uqword;
+		}
+	} else {
+		switch (bits) {
+		case 8: return (st64)(char)(255-op->lval.sbyte); // XXX?
+		case 16: return (st64)(short) (op->lval.uword& UT16_MAX);
+		case 32: return (ut64)(ut32)(op->lval.udword & UT32_MAX);
+		case 64: return op->lval.uqword;
+		}
+	}
+	return 0LL;
+}
+
+int x86_udis86_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) {
+	const char *pc = anal->bits==64? "rip": anal->bits==32? "eip": "ip";
+	const char *sp = anal->bits==64? "rsp": anal->bits==32? "esp": "sp";
+        const char *bp = anal->bits==64? "rbp": anal->bits==32? "ebp": "bp";
+	int delta, oplen, regsz = 4;
+	char str[64], src[32], dst[32];
+	struct ud u;
+	switch (anal->bits) {
+	case 64: regsz = 8; break;
+	case 16: regsz = 2; break;
+	default:
+	case 32: regsz = 4; break;
+	}
+
+	UDis86Esil *handler;
+	UDis86OPInfo info = {0, anal->bits, (1LL << anal->bits) - 1, regsz, 0, pc, sp, bp};
+	memset (op, '\0', sizeof (RAnalOp));
+	op->addr = addr;
+	op->jump = op->fail = -1;
+	op->ptr = op->val = -1;
+
+	ud_init (&u);
+	ud_set_pc (&u, addr);
+	ud_set_mode (&u, anal->bits);
+	ud_set_syntax (&u, NULL);
+	ud_set_input_buffer (&u, data, len);
+	ud_disassemble (&u);
+
+	op->id = u.mnemonic;
+	oplen = op->size = ud_insn_len (&u);
+	r_strbuf_init (&op->esil);
+
+	const bool decode = true;
+	if (decode && (handler = udis86_esil_get_handler (u.mnemonic))) {
+		info.oplen = oplen;
+		//if (anal->bits==32)
+			info.bitmask = UT32_MAX;
+		if (handler->argc > 0) {
+			info.n = getval (u.operand);
+			getarg (dst, &u, info.bitmask, 0, regsz);
+			if (handler->argc > 1) {
+				getarg (src, &u, info.bitmask, 1, regsz);
+				if (handler->argc > 2)
+					getarg (str, &u, info.bitmask, 2, regsz);
+			}
+		}
+		handler->callback (&info, op, dst, src, str);
+	}
+#if 0
+	u->pfx_seg   = 0;
+	u->pfx_opr   = 0;
+	u->pfx_adr   = 0;
+	u->pfx_lock  = 0;
+	u->pfx_repne = 0;
+	u->pfx_rep   = 0;
+	u->pfx_repe  = 0;
+	u->pfx_rex   = 0;
+	u->pfx_str   = 0;
+#endif
+	op->prefix = 0;
+	if (u.pfx_rep) op->prefix |= R_ANAL_OP_PREFIX_REP;
+	if (u.pfx_repe) op->prefix |= R_ANAL_OP_PREFIX_REP;
+	if (u.pfx_repne) op->prefix |= R_ANAL_OP_PREFIX_REPNE;
+	if (u.pfx_lock) op->prefix |= R_ANAL_OP_PREFIX_LOCK;
+	switch (u.mnemonic) {
+	case UD_Iinvalid:
+		oplen = op->size = -1;
+		return -1;
+		break;
+	case UD_Itest:
+	case UD_Icmp:
+		op->type = R_ANAL_OP_TYPE_CMP;
+		// TODO: support 2nd parameter too?
+		switch (u.operand[0].type) {
+		case UD_OP_MEM:
+			op->refptr = u.operand[0].size /8;
+			switch (u.operand[0].base) {
+			case UD_R_RIP:
+				// Self modifying code? relative local vars
+				switch (u.operand[1].size) {
+				case  8:
+				case 16:
+				case 32: delta = u.operand[1].lval.udword; break;
+				case 64: delta = u.operand[1].lval.uqword; break;
+				default: delta = u.operand[1].lval.udword; break;
+				}
+				op->ptr = addr + oplen + delta;
+				break;
+			case UD_R_RBP:
+				op->stackop = R_ANAL_STACK_SET;
+				op->ptr = getval (&u.operand[0]); //-(st64)u.operand[0].lval.sbyte; //getval (&u.operand[0]);
+				op->ptr = (st64)((char)u.operand[0].lval.sbyte); //getval (&u.operand[0]);
+				// if positive = arg
+				// if negative = var
+				break;
+			default:
+				op->ptr = getval (&u.operand[0]);
+				break;
+			}
+			break;
+		case UD_OP_IMM:
+			op->ptr = getval (&u.operand[0]);
+		default:
+			break;
+		}
+		switch (u.operand[1].type) {
+		case UD_OP_MEM:
+			op->refptr = u.operand[0].size /8;
+			switch (u.operand[1].base) {
+			case UD_R_RIP:
+				// Self modifying code? relative local vars
+				delta = u.operand[1].lval.uword;
+				op->ptr = addr + oplen + delta;
+				break;
+			case UD_R_RBP:
+				op->stackop = R_ANAL_STACK_SET;
+				op->ptr = getval (&u.operand[1]); //-(st64)u.operand[0].lval.sbyte; //getval (&u.operand[0]);
+				op->ptr = (st64)((char)u.operand[1].lval.sbyte); //getval (&u.operand[0]);
+				// if positive = arg
+				// if negative = var
+				break;
+			default:
+				op->ptr = getval (&u.operand[1]);
+				break;
+			}
+			break;
+		case UD_OP_IMM:
+			op->ptr = getval (&u.operand[0]);
+		default:
+			break;
+		}
+		break;
+	case UD_Isalc: // ??
+		// al = cf
+		break;
+	case UD_Ixor:
+		op->type = R_ANAL_OP_TYPE_XOR;
+		break;
+	case UD_Ior:
+		op->type = R_ANAL_OP_TYPE_OR;
+		break;
+	case UD_Iand:
+		op->type = R_ANAL_OP_TYPE_AND;
+		break;
+	case UD_Isar:
+		op->type = R_ANAL_OP_TYPE_SAR;
+		break;
+	// XXX: sal ?!?
+	case UD_Ishl:
+		op->type = R_ANAL_OP_TYPE_SHL;
+		break;
+	case UD_Ishr:
+		op->type = R_ANAL_OP_TYPE_SHR;
+		break;
+	case UD_Irol:
+		op->type = R_ANAL_OP_TYPE_ROL;
+		break;
+	case UD_Iror:
+		op->type = R_ANAL_OP_TYPE_ROR;
+		break;
+	case UD_Iint1:
+	case UD_Iint3:
+		op->type = R_ANAL_OP_TYPE_TRAP;
+		break;
+	case UD_Iint:
+		op->type = R_ANAL_OP_TYPE_SWI;
+		op->val = u.operand[0].lval.uword;
+		break;
+	case UD_Ilea:
+	case UD_Imov:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		switch (u.operand[0].type) {
+		case UD_OP_MEM:
+			op->refptr = u.operand[0].size/8;
+			switch (u.operand[0].base) {
+			case UD_R_RIP:
+				// Self modifying code? relative local vars
+				// op->type == 9
+				//switch (op->size) {
+				switch (u.operand[0].size) {
+				case  8:
+				case 16:
+				case 32: delta = u.operand[0].lval.udword; break;
+				case 64: delta = u.operand[0].lval.uqword; break;
+				default: delta = u.operand[0].lval.udword; break;
+				}
+				op->ptr = addr + oplen + delta;
+				break;
+			case UD_R_RBP:
+				op->stackop = R_ANAL_STACK_SET;
+				op->ptr = getval (&u.operand[0]); //-(st64)u.operand[0].lval.sbyte; //getval (&u.operand[0]);
+				// op->ptr = (st64)((char)u.operand[0].lval.sbyte); //getval (&u.operand[0]);
+				// if positive = arg
+				// if negative = var
+				break;
+			default:
+				/* nothing to do here yet */
+				op->ptr = getval (&u.operand[1]);
+				break;
+			}
+			break;
+		default:
+			switch (u.operand[1].type) {
+			case UD_OP_MEM:
+				op->refptr = u.operand[1].size /8;
+				switch (u.operand[1].base) {
+				case UD_R_RIP:
+					switch (u.operand[1].size) {
+					case  8:
+					case 16:
+					case 32: delta = u.operand[1].lval.udword; break;
+					case 64: delta = u.operand[1].lval.uqword; break;
+					default: delta = u.operand[1].lval.udword; break;
+					}
+					op->ptr = addr + oplen + delta;
+					break;
+				case UD_R_RBP:
+					op->stackop = R_ANAL_STACK_GET;
+					op->ptr = getval (&u.operand[1]);
+					// op->ptr = (st64)((char)u.operand[1].lval.sbyte); //getval (&u.operand[0]);
+					// if positive = arg
+					// if negative = var
+					break;
+				default:
+					/* nothing to do here yet */
+					op->ptr = getval (&u.operand[1]); //-(st64)u.operand[0].lval.sbyte; //getval (&u.operand[0]);
+					break;
+				}
+				break;
+			default:
+				op->ptr = getval (&u.operand[1]);
+				// XX
+				break;
+			}
+			break;
+		}
+		op->stackptr = regsz;
+		break;
+	case UD_Ipush:
+	case UD_Ipusha:
+	case UD_Ipushad:
+	case UD_Ipushfq:
+	case UD_Ipushfd:
+	case UD_Ipushfw:
+		switch (u.operand[0].type) {
+		case UD_OP_CONST:
+		case UD_OP_JIMM:
+		case UD_OP_IMM:
+			op->type = R_ANAL_OP_TYPE_PUSH;
+			op->ptr = getval (&u.operand[0]);
+			break;
+		case UD_OP_REG:
+		case UD_OP_PTR:
+		case UD_OP_MEM:
+		default:
+			op->type = R_ANAL_OP_TYPE_UPUSH;
+			op->ptr = 0;
+			break;
+		}
+		op->stackop = R_ANAL_STACK_INC;
+		op->stackptr = regsz;
+		break;
+	case UD_Ipop:
+	case UD_Ipopa:
+	case UD_Ipopad:
+	case UD_Ipopfw:
+	case UD_Ipopfd:
+	case UD_Ipopfq:
+		op->type = R_ANAL_OP_TYPE_POP;
+		op->stackop = R_ANAL_STACK_INC;
+		op->stackptr = -regsz;
+		break;
+	case UD_Ileave:
+		op->type = R_ANAL_OP_TYPE_MOV;
+		op->stackop = R_ANAL_STACK_INC;
+		op->stackptr = -regsz;
+		break;
+	case UD_Iadd:
+	case UD_Isub:
+		op->type = (u.mnemonic==UD_Iadd)? R_ANAL_OP_TYPE_ADD: R_ANAL_OP_TYPE_SUB;
+		op->ptr = 0;
+		op->stackptr = 0;
+		if (u.operand[0].type == UD_OP_REG) {
+			if (u.operand[0].base == UD_R_RSP) {
+				int o = (int)getval (&u.operand[1]);
+				op->stackop = R_ANAL_STACK_INC;
+				if (u.mnemonic ==UD_Iadd) {
+					op->stackptr = -o;
+				} else {
+					op->stackptr = o;
+				}
+			}
+			if (u.operand[1].type != UD_OP_REG)
+				op->val = getval (&u.operand[1]);
+		}
+		op->stackptr = 4;
+		break;
+	case UD_Iadc:
+	case UD_Iinc:
+		op->type = R_ANAL_OP_TYPE_ADD;
+		break;
+	case UD_Isbb:
+	case UD_Idec:
+		op->type = R_ANAL_OP_TYPE_SUB;
+		break;
+	case UD_Ijmp:
+		switch (u.operand[0].type) {
+		case UD_OP_MEM:
+			op->ptr = getval (&u.operand[0]);
+			op->type = R_ANAL_OP_TYPE_UJMP;
+			break;
+		case UD_OP_REG:
+			op->type = R_ANAL_OP_TYPE_UJMP;
+			break;
+		default:
+			op->type = R_ANAL_OP_TYPE_JMP;
+			if (u.operand[0].type==UD_OP_PTR) {
+				op->jump = getval (&u.operand[0]);
+			} else {
+				if (anal->bits==16) {
+					// honor segment
+					op->jump = (addr&0xf0000) + oplen + \
+						((((addr&0xffff)+getval (&u.operand[0]))&0xffff));
+				} else {
+					op->jump = addr + oplen + (int)getval (&u.operand[0]);
+				}
+			}
+		}
+		break;
+	case UD_Ije:
+	case UD_Ijne:
+	case UD_Ijb:
+	case UD_Ijbe:
+	case UD_Ija:
+	case UD_Ijae:
+	case UD_Ijs:
+	case UD_Ijns:
+	case UD_Ijo:
+	case UD_Ijno:
+	case UD_Ijp:
+	case UD_Ijnp:
+	case UD_Ijl:
+	case UD_Ijge:
+	case UD_Ijle:
+	case UD_Ijg:
+	case UD_Ijcxz:
+	case UD_Iloop:
+		op->type = R_ANAL_OP_TYPE_CJMP;
+		op->jump = addr + oplen + (int)getval (&u.operand[0]);
+		op->fail = addr+oplen;
+		break;
+	case UD_Icall:
+		op->type = R_ANAL_OP_TYPE_CALL;
+		switch (u.operand[0].type) {
+		case UD_OP_REG:
+			op->type = R_ANAL_OP_TYPE_UCALL;
+			op->jump = 0; // EAX, EBX, ... use anal->reg
+			break;
+		case UD_OP_PTR:
+			op->jump = (int)getval (&u.operand[0]);
+			break;
+		case UD_OP_IMM:
+		case UD_OP_MEM:
+		default:
+			op->jump = addr + oplen + (int)getval (&u.operand[0]);
+		}
+		op->fail = addr + oplen;
+		break;
+	case UD_Ihlt:
+		op->type = R_ANAL_OP_TYPE_TRAP; //HALT;
+		break;
+	case UD_Iin:
+	case UD_Iout:
+		op->type = R_ANAL_OP_TYPE_IO;
+		break;
+	case UD_Iret:
+	case UD_Iiretd:
+	case UD_Iretf:
+	case UD_Isysret:
+		op->type = R_ANAL_OP_TYPE_RET;
+		op->stackop = R_ANAL_STACK_INC;
+		op->stackptr = -regsz;
+		break;
+	case UD_Isyscall:
+		op->type = R_ANAL_OP_TYPE_SWI;
+		break;
+	case UD_Inop:
+		op->type = R_ANAL_OP_TYPE_NOP;
+		break;
+	default:
+		break;
+	}
+	return oplen;
+}
+
+static int set_reg_profile(RAnal *anal) {
+	const char *p = NULL;
+	switch (anal->bits) {
+	case 16: p =
+		"=PC	ip\n"
+		"=SP	sp\n"
+		"=BP	bp\n"
+		"=A0	ax\n"
+		"=A1	bx\n"
+		"=A2	cx\n"
+		"=A3	di\n"
+		"gpr	ip	.16	48	0\n"
+		"gpr	ax	.16	24	0\n"
+		"gpr	ah	.8	24	0\n"
+		"gpr	al	.8	25	0\n"
+		"gpr	bx	.16	0	0\n"
+		"gpr	bh	.8	1	0\n"
+		"gpr	bl	.8	0	0\n"
+		"gpr	cx	.16	4	0\n"
+		"gpr	ch	.8	5	0\n"
+		"gpr	cl	.8	4	0\n"
+		"gpr	dx	.16	8	0\n"
+		"gpr	dh	.8	9	0\n"
+		"gpr	dl	.8	8	0\n"
+		"gpr	sp	.16	60	0\n"
+		"gpr	bp	.16	20	0\n"
+		"gpr	si	.16	12	0\n"
+		"gpr	di	.16	16	0\n"
+		"seg	cs	.16	52	0\n"
+		"gpr	flags	.16	56	0\n"
+		"gpr	cf	.1	.448	0\n"
+		"flg	pf	.1	.449	0\n"
+		"flg	af	.1	.450	0\n"
+		"gpr	zf	.1	.451	0\n"
+		"gpr	sf	.1	.452	0\n"
+		"flg	tf	.1	.453	0\n"
+		"flg	if	.1	.454	0\n"
+		"flg	df	.1	.455	0\n"
+		"flg	of	.1	.456	0\n"
+		"flg	flag_r	.1	.457	0\n";
+#if 0
+		"drx	dr0	.32	0	0\n"
+		"drx	dr1	.32	4	0\n"
+		"drx	dr2	.32	8	0\n"
+		"drx	dr3	.32	12	0\n"
+		//"drx	dr4	.32	16	0\n"
+		//"drx	dr5	.32	20	0\n"
+		"drx	dr6	.32	24	0\n"
+		"drx	dr7	.32	28	0\n"
+#endif
+		break;
+	case 32: p =
+		"=PC	eip\n"
+		"=SP	esp\n"
+		"=BP	ebp\n"
+		"=A0	eax\n"
+		"=A1	ebx\n"
+		"=A2	ecx\n"
+		"=A3	edi\n"
+		"gpr	eip	.32	48	0\n"
+		"gpr	ip	.16	48	0\n"
+		"gpr	oeax	.32	44	0\n"
+		"gpr	eax	.32	24	0\n"
+		"gpr	ax	.16	24	0\n"
+		"gpr	ah	.8	24	0\n"
+		"gpr	al	.8	25	0\n"
+		"gpr	ebx	.32	0	0\n"
+		"gpr	bx	.16	0	0\n"
+		"gpr	bh	.8	1	0\n"
+		"gpr	bl	.8	0	0\n"
+		"gpr	ecx	.32	4	0\n"
+		"gpr	cx	.16	4	0\n"
+		"gpr	ch	.8	5	0\n"
+		"gpr	cl	.8	4	0\n"
+		"gpr	edx	.32	8	0\n"
+		"gpr	dx	.16	8	0\n"
+		"gpr	dh	.8	9	0\n"
+		"gpr	dl	.8	8	0\n"
+		"gpr	esp	.32	60	0\n"
+		"gpr	sp	.16	60	0\n"
+		"gpr	ebp	.32	20	0\n"
+		"gpr	bp	.16	20	0\n"
+		"gpr	esi	.32	12	0\n"
+		"gpr	si	.16	12	0\n"
+		"gpr	edi	.32	16	0\n"
+		"gpr	di	.16	16	0\n"
+		"seg	xfs	.32	36	0\n"
+		"seg	xgs	.32	40	0\n"
+		"seg	xcs	.32	52	0\n"
+		"seg	cs	.16	52	0\n"
+		"seg	xss	.32	52	0\n"
+		"gpr	eflags	.32	56	0	c1p.a.zstido.n.rv\n"
+		"gpr	flags	.16	56	0\n"
+		"gpr	cf	.1	.448	0\n"
+		"flg	flag_p	.1	.449	0\n"
+		"flg	flag_a	.1	.450	0\n"
+		"gpr	zf	.1	.451	0\n"
+		"gpr	sf	.1	.452	0\n"
+		"flg	flag_t	.1	.453	0\n"
+		"flg	flag_i	.1	.454	0\n"
+		"flg	flag_d	.1	.455	0\n"
+		"flg	of	.1	.456	0\n"
+		"flg	flag_r	.1	.457	0\n"
+		"drx	dr0	.32	0	0\n"
+		"drx	dr1	.32	4	0\n"
+		"drx	dr2	.32	8	0\n"
+		"drx	dr3	.32	12	0\n"
+		//"drx	dr4	.32	16	0\n"
+		//"drx	dr5	.32	20	0\n"
+		"drx	dr6	.32	24	0\n"
+		"drx	dr7	.32	28	0\n";
+		 break;
+	default: p =
+		 "=PC	rip\n"
+		 "=SP	rsp\n"
+		 "=BP	rbp\n"
+		 "=A0	rax\n"
+		 "=A1	rbx\n"
+		 "=A2	rcx\n"
+		 "=A3	rdx\n"
+		 "# no profile defined for x86-64\n"
+		 "gpr	r15	.64	0	0\n"
+		 "gpr	r15d	.32	0	0\n"
+		 "gpr	r15w	.16	0	0\n"
+		 "gpr	r15b	.8	0	0\n"
+		 "gpr	r14	.64	8	0\n"
+		 "gpr	r14d	.32	8	0\n"
+		 "gpr	r14w	.16	8	0\n"
+		 "gpr	r14b	.8	8	0\n"
+		 "gpr	r13	.64	16	0\n"
+		 "gpr	r13d	.32	16	0\n"
+		 "gpr	r13w	.16	16	0\n"
+		 "gpr	r13b	.8	16	0\n"
+		 "gpr	r12	.64	24	0\n"
+		 "gpr	r12d	.32	24	0\n"
+		 "gpr	r12w	.16	24	0\n"
+		 "gpr	r12b	.8	24	0\n"
+		 "gpr	rbp	.64	32	0\n"
+		 "gpr	ebp	.32	32	0\n"
+		 "gpr	bp	.16	32	0\n"
+		 "gpr	bpl	.8	32	0\n"
+		 "gpr	rbx	.64	40	0\n"
+		 "gpr	ebx	.32	40	0\n"
+		 "gpr	bx	.16	40	0\n"
+		 "gpr	bl	.8	40	0\n"
+		 "gpr	r11	.64	48	0\n"
+		 "gpr	r11d	.32	48	0\n"
+		 "gpr	r11w	.16	48	0\n"
+		 "gpr	r11b	.8	48	0\n"
+		 "gpr	r10	.64	56	0\n"
+		 "gpr	r10d	.32	56	0\n"
+		 "gpr	r10w	.16	56	0\n"
+		 "gpr	r10b	.8	56	0\n"
+		 "gpr	r9	.64	64	0\n"
+		 "gpr	r9d	.32	64	0\n"
+		 "gpr	r9w	.16	64	0\n"
+		 "gpr	r9b	.8	64	0\n"
+		 "gpr	r8	.64	72	0\n"
+		 "gpr	r8d	.32	72	0\n"
+		 "gpr	r8w	.16	72	0\n"
+		 "gpr	r8b	.8	72	0\n"
+		 "gpr	rax	.64	80	0\n"
+		 "gpr	eax	.32	80	0\n"
+		 "gpr	ax	.16	80	0\n"
+		 "gpr	al	.8	80	0\n"
+		 "gpr	rcx	.64	88	0\n"
+		 "gpr	ecx	.32	88	0\n"
+		 "gpr	cx	.16	88	0\n"
+		 "gpr	cl	.8	88	0\n"
+		 "gpr	rdx	.64	96	0\n"
+		 "gpr	edx	.32	96	0\n"
+		 "gpr	dx	.16	96	0\n"
+		 "gpr	dl	.8	96	0\n"
+		 "gpr	rsi	.64	104	0\n"
+		 "gpr	esi	.32	104	0\n"
+		 "gpr	si	.16	104	0\n"
+		 "gpr	sil	.8	104	0\n"
+		 "gpr	rdi	.64	112	0\n"
+		 "gpr	edi	.32	112	0\n"
+		 "gpr	di	.16	112	0\n"
+		 "gpr	dil	.8	112	0\n"
+		 "gpr	oeax	.64	120	0\n"
+		 "gpr	rip	.64	128	0\n"
+		 "seg	cs	.64	136	0\n"
+		 //"flg	eflags	.64	144	0\n"
+		 "gpr	eflags	.32	144	0	c1p.a.zstido.n.rv\n"
+		 "gpr	cf	.1	.1152	0\n"
+		 "flg	flag_p	.1	.1153	0\n"
+		 "flg	flag_a	.1	.1154	0\n"
+		 "gpr	zf	.1	.1155	0\n"
+		 "gpr	sf	.1	.1156	0\n"
+		 "flg	flag_t	.1	.1157	0\n"
+		 "flg	flag_i	.1	.1158	0\n"
+		 "flg	flag_d	.1	.1159	0\n"
+		 "flg	of	.1	.1160	0\n"
+		 "flg	flag_r	.1	.1161	0\n"
+		 "gpr	rsp	.64	152	0\n"
+		 "seg	ss	.64	160	0\n"
+		 "seg	fs_base	.64	168	0\n"
+		 "seg	gs_base	.64	176	0\n"
+		 "seg	ds	.64	184	0\n"
+		 "seg	es	.64	192	0\n"
+		 "seg	fs	.64	200	0\n"
+		 "seg	gs	.64	208	0\n"
+		 "drx	dr0	.32	0	0\n"
+		 "drx	dr1	.32	4	0\n"
+		 "drx	dr2	.32	8	0\n"
+		 "drx	dr3	.32	12	0\n"
+		 "drx	dr6	.32	24	0\n"
+		 "drx	dr7	.32	28	0\n";
+		 break;
+	}
+	return r_reg_set_profile_string (anal->reg, p);
+}
+
+RAnalPlugin r_anal_plugin_x86_udis = {
+	.name = "x86.udis",
+	.desc = "X86 analysis plugin (udis86 backend)",
+	.license = "LGPL3",
+	.arch = "x86",
+	.esil = true,
+	.bits = 16|32|64,
+	.op = &x86_udis86_op,
+	.set_reg_profile = &set_reg_profile,
+};
+
+#ifndef CORELIB
+RLibStruct radare_plugin = {
+	.type = R_LIB_TYPE_ANAL,
+	.data = &r_anal_plugin_x86_udis,
+	.version = R2_VERSION
+};
+#endif

libr/anal/p/atombios.mk

@@ -0,0 +1,10 @@
+OBJ_ATOMBIOS=anal_atombios.o
+OBJ_ATOMBIOS+=../../asm/arch/atombios/atombios.o
+
+STATIC_OBJ+=${OBJ_ATOMBIOS}
+TARGET_ATOMBIOS=anal_atombios.${LIBEXT}
+
+ALL_TARGETS+=${TARGET_ATOMBIOS}
+
+${TARGET_ATOMBIOS}: ${OBJ_ATOMBIOS}
+	${CC} -g $(call libname,anal_atombios) ${LDFLAGS} ${CFLAGS} -o anal_atombios.${LIBEXT} ${OBJ_ATOMBIOS}

libr/anal/p/esil_x86_udis.c

@@ -0,0 +1,262 @@
+/* radare - LGPL - Copyright 2013-2018 - batchdrake */
+
+#include <r_lib.h>
+#include <r_types.h>
+#include <r_anal.h>
+#include <r_util.h>
+
+#include "udis86/types.h"
+#include "udis86/extern.h"
+#include "esil_x86_udis.h"
+
+#define RPN 
+
+RPN UDIS86_ESIL (nop,   ",");
+RPN UDIS86_ESIL (jo,    "of,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jno,   "of,!,?{,%s,%s,}", dst, info->pc);
+RPN UDIS86_ESIL (jb,    "cf,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jae,   "cf,?{,%s,%s,=,}", dst, info->pc);
+
+//  UDIS86_ESIL (je,    "?zf,%s=%s", info->pc, dst);
+RPN UDIS86_ESIL (je,    "zf,?{,%s,%s,=,}", dst, info->pc);
+
+//  UDIS86_ESIL (jne,   "?!zf,%s=%s", info->pc, dst);
+RPN UDIS86_ESIL (jne,   "zf,!,?{,%s,%s,=,}", dst, info->pc);
+
+RPN UDIS86_ESIL (ja,    "cf,!,zf,!,&,?{,%s,%s,}",dst, info->pc);
+RPN UDIS86_ESIL (jbe,   "zf,cf,&,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (js,    "sf,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jns,   "sf,!,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jp,    "pf,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jnp,   "pf,!,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jl,    "of,sf,^,?{,%s,%s,}", dst, info->pc);
+RPN UDIS86_ESIL (jge,   "of,!,sf,^,?{,%s,%s,}", dst, info->pc);
+RPN UDIS86_ESIL (jle,   "of,sf,^,zf,|,%s,%s,=", dst, info->pc);
+RPN UDIS86_ESIL (jg,    "sf,of,!,^,zf,!,&,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jcxz,  "cx,!,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jecxz, "ecx,!,?{,%s,%s,=,}", dst, info->pc);
+RPN UDIS86_ESIL (jrcxz, "rcx,!,?{,%s,%s,=,}", dst, info->pc);
+
+//  UDIS86_ESIL (jmp,   "%s=%s", info->pc, dst);
+RPN UDIS86_ESIL (jmp,   "%s,%s,=", dst, info->pc);
+
+RPN UDIS86_ESIL (call,
+	"%d,%s,+,"
+	"%d,%s,-=,%s,"
+	"=[],"
+	"%s,%s,=",
+	5, info->pc,
+	info->regsz, info->sp, info->sp,
+	dst, info->pc);
+    
+RPN UDIS86_ESIL (hlt, "hlt,TODO");
+RPN UDIS86_ESIL (shl, "%s,%s,<<=,cz,$z,zf,=", src, dst);
+RPN UDIS86_ESIL (shr, "%s,%s,>>=,cz,$z,zf,=", src, dst);
+RPN UDIS86_ESIL (salc, "%s,%s,<<=,$z,zf,=", src, dst);
+RPN UDIS86_ESIL (sar, "%s,%s,>>=,$z,zf,=", src, dst);
+RPN UDIS86_ESIL (rol, "%s,%s,<<<=", src, dst);
+RPN UDIS86_ESIL (ror, "%s,%s,>>>=", src, dst);
+#if 0
+RPN UDIS86_ESIL (rol, "%s,1,<<,%s,&,cf,=,%s,%s,>>=,%s,zf,=", src, dst, src, dst, dst)
+RPN UDIS86_ESIL (ror, "%s,%d,-,1,<<,%s,&,cf,=,%s,%s,>>=,%s,zf,=", src, info->regsz*8, dst, src, dst, dst)
+//  UDIS86_ESIL (rol, "cf=%s&(1<<%s),%s>>=%s,zf=%s==0", dst, src, dst, src, dst);
+    UDIS86_ESIL (ror, "cf=%s&(1<<%d-%s),%s<<<=%s,zf=%s==0", dst, info->regsz * 8, src, dst, src, dst);
+#endif
+//    UDIS86_ESIL (add,   "cf=%s<=-%s&%s!=0,of=!((%s^%s)>>%d)&(((%s+%s)^%s)>>%d),%s+=%s,zf=%s==0,sf=%s>>%d", dst, src, src, dst, src, info->bits - 1, dst, src, src, info->bits - 1, dst, src, dst, dst, info->bits - 1);
+// XXX: this is wrong coz add [rax], al -> al,[rax+0],= ;;; this is not valid esil
+RPN UDIS86_ESIL (add, "%s,%s,+=", src, dst); //cf=%s<=-%s&%s!=0,of=!((%s^%s)>>%d)&(((%s+%s)^%s)>>%d),%s+=%s,zf=%s==0,sf=%s>>%d", dst, src, src, dst, src, info->bits - 1, dst, src, src, info->bits - 1, dst, src, dst, dst, info->bits - 1);
+RPN UDIS86_ESIL (inc, "1,%s,+=,z,$z,zf,=", dst);
+RPN UDIS86_ESIL (dec, "1,%s,-=,$z,zf,=,$o,of,=,$s,sf,=", dst);
+//    UDIS86_ESIL (inc,   "of=(%s^(%s+1))>>%d,%s++,zf=%s==0,sf=%s>>%d", dst, dst, info->bits - 1, dst, dst, dst, info->bits - 1);
+//  UDIS86_ESIL (sub,   "cf=%s<%s,of=!((%s^%s)>>%d)&(((%s+%s)^%s)>>%d),%s-=%s,zf=%s==0,sf=%s>>%d", dst, src, dst, src, info->bits - 1, dst, src, src, info->bits - 1, dst, src, dst, dst, info->bits - 1);
+RPN UDIS86_ESIL (sub,   "%s,%s,-=,$c,cf,=,$z,zf,=,$s,sf,=,$o,of,=", src, dst); // TODO: update flags
+   // UDIS86_ESIL (dec,   "of=(%s^(%s-1))>>%d,%s--,zf=%s==0,sf=%s>>%d", dst, dst, info->bits - 1, dst, dst, dst, info->bits - 1);
+//  UDIS86_ESIL (cmp,   "cf=%s<%s,zf=%s==%s", dst, src, dst, src);
+RPN UDIS86_ESIL (cmp,  "%s,%s,==,$z,zf,=", dst, src);
+//  UDIS86_ESIL (xor,   "%s^=%s,zf=%s==0,sf=%s>>%d,cf=0,of=0", dst, src, dst, dst, info->bits - 1);
+RPN UDIS86_ESIL (xor,   "%s,%s,^=", dst, src);
+//  UDIS86_ESIL (or,    "%s|=%s,zf=%s==0,sf=%s>>%d,cf=0,of=0", dst, src, dst, dst, info->bits - 1);
+RPN UDIS86_ESIL (or,    "%s,%s,|=", src, dst);
+//    UDIS86_ESIL (and,   "%s&=%s,zf=%s==0,sf=%s>>%d,cf=0,of=0", dst, src, dst, dst, info->bits - 1);
+RPN UDIS86_ESIL (and,   "%s,%s,&=", src, dst);
+#if 0
+RPN UDIS86_ESIL (and,   "%s,%s,&=,%s,!,zf,%s,%d,>>,sf,=,0,cf,=,0,of,=",
+			src, dst, dst, dst, info->bits-1);
+#endif
+    // UDIS86_ESIL (test,  "zf=%s&%s==0,sf=%s>>%d,cf=0,of=0", dst, src, dst, info->bits - 1);
+RPN UDIS86_ESIL (test,  "%s,%s,==,$z,zf,=", dst, src);
+
+//  UDIS86_ESIL (syscall, "$");
+RPN UDIS86_ESIL (syscall, "$");
+//  UDIS86_ESIL (int3,  "$3");
+RPN UDIS86_ESIL (int3,  "3,$");
+//  UDIS86_ESIL (int,   "$0x%"PFMT64x, info->n);
+RPN UDIS86_ESIL (int,   "0x%"PFMT64x",$", info->n);
+
+RPN UDIS86_ESIL (lea,   "%s,%s,=", src, dst);
+RPN UDIS86_ESIL (movzx, "%s,%s,=", src, dst); // not working? try 0fb63d55380000
+RPN UDIS86_ESIL (mov,   "%s,%s,=", src, dst);
+//  UDIS86_ESIL (push,  "%s-=%d,%d[%s]=%s", info->sp, info->regsz, info->regsz, info->sp, dst);
+RPN UDIS86_ESIL (push,  "%s,%d,%s,-=,%s,=[%d]", dst, info->regsz, info->sp, info->sp, info->regsz);
+
+//  UDIS86_ESIL (pop,   "%s=%d[%s],%s+=%d", dst, info->regsz, info->sp, info->sp, info->regsz);
+RPN UDIS86_ESIL (pop,   "%s,[%d],%s,=,%d,%s,+=",
+	info->sp, info->regsz, dst, info->regsz, info->sp);
+RPN UDIS86_ESIL (leave, "%s,%s,=,%s,[%d],%s,%d,%s,-=",
+	info->bp, info->sp, info->sp, info->regsz, info->bp, info->regsz, info->sp);
+
+RPN UDIS86_ESIL (ret,   "%s,[%d],%s,=,%d,%s,+=", info->sp, info->regsz, info->pc, info->regsz, info->sp);
+RPN UDIS86_ESIL (iretf,   "%s,[%d],%s,=,%d,%s,+=", info->sp, info->regsz, info->pc, info->regsz, info->sp);
+RPN UDIS86_ESIL (iretd,   "%s,[%d],%s,=,%d,%s,+=", info->sp, info->regsz, info->pc, info->regsz, info->sp);
+
+//    UDIS86_ESIL (xchg,  "%s^=%s,%s^=%s,%s^=%s", dst, src, src, dst, dst, src);
+// TODO: add support for rpnesil tmp regs?
+
+//RPN UDIS86_ESIL (xchg,  "%s,%s,^=,%s,%s,^=,%s,%s,^=", src, dst, src, src, dst, dst);
+RPN UDIS86_ESIL (xchg,  "%s,%s,%s,=,%s,=", dst, src, dst, src);
+    UDIS86_ESIL (xadd,  "%s^=%s,%s^=%s,%s^=%s,cf=%s<=-%s&%s!=0,of=!((%s^%s)>>%d)&(((%s+%s)^%s)>>%d),%s+=%s,zf=%s==0,sf=%s>>%d", dst, src, src, dst, dst, src, dst, src, src, dst, src, info->bits - 1, dst, src, src, info->bits - 1, dst, src, dst, dst, info->bits - 1);
+    UDIS86_ESIL (bt,    "cf=%s&(1<<%d)!=0", dst, (int) info->n);
+    UDIS86_ESIL (btc,   "cf=%s&(1<<%d)!=0,%s^=(1<<%d)",  dst, (int) info->n, dst, (int) info->n);
+    UDIS86_ESIL (bts,   "cf=%s&(1<<%d)!=0,%s|=(1<<%d)",  dst, (int) info->n, dst, (int) info->n);
+    UDIS86_ESIL (btr,   "cf=%s&(1<<%d)!=0,%s&=!(1<<%d)", dst, (int) info->n, dst, (int) info->n);
+//  UDIS86_ESIL (clc,   "cf=0");
+RPN UDIS86_ESIL (clc,   "0,cf,=");
+
+RPN UDIS86_ESIL (sti,   "1,if,="); // interrupt flag
+RPN UDIS86_ESIL (cli,   "0,if,="); // interrupt flag
+//  UDIS86_ESIL (cld,   "df=0");
+RPN UDIS86_ESIL (std,   "1,df,=");
+RPN UDIS86_ESIL (cld,   "0,df,=");
+
+#define IS16 (info->bits==16)
+#define IS32 (info->bits==32)
+#define IS64 (info->bits==64)
+
+#define RSZ (IS32?4:IS64?8:2)
+RPN UDIS86_ESIL (pushad,
+	"%s"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]",
+	IS64? 
+	  "rdi,rsi,rbp,rsp,rbx,rdx,rcx,rax"
+	: "edi,esi,ebp,esp,ebx,edx,ecx,eax",
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp
+	);
+RPN UDIS86_ESIL (pusha,
+	"%s"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]"
+	",$r,%s,-=,%s,=[]",
+	IS64? 
+	  "rdi,rsi,rbp,rsp,rbx,rdx,rcx,rax"
+	: "edi,esi,ebp,esp,ebx,edx,ecx,eax",
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp,
+	info->sp, info->sp
+	);
+
+RPN UDIS86_ESIL (popad,
+	"%s", IS64?
+	"rsp,[],rdi,="
+	",8,rsp,+,[],rsi,="
+	",16,rsp,+,[],rbp,="
+	",24,rsp,+,[],rsp,="
+	",32,rsp,+,[],rbx,="
+	",40,rsp,+,[],rdx,="
+	",48,rsp,+,[],rcx,="
+	",56,rsp,+,[],rax,="
+	",64,rsp,+="
+	:
+	"esp,[],edi,="
+	",4,esp,+,[],esi,="
+	",8,esp,+,[],ebp,="
+	",12,esp,+,[],esp,="
+	",16,esp,+,[],ebx,="
+	",20,esp,+,[],edx,="
+	",24,esp,+,[],ecx,="
+	",28,esp,+,[],eax,="
+	",32,esp,+="
+	);
+RPN UDIS86_ESIL (popa,
+	"%s", IS64?
+	"rsp,[],rdi,="
+	",8,rsp,+,[],rsi,="
+	",16,rsp,+,[],rbp,="
+	",24,rsp,+,[],rsp,="
+	",32,rsp,+,[],rbx,="
+	",40,rsp,+,[],rdx,="
+	",48,rsp,+,[],rcx,="
+	",56,rsp,+,[],rax,="
+	",64,rsp,+="
+	:
+	"esp,[],edi,="
+	",4,esp,+,[],esi,="
+	",8,esp,+,[],ebp,="
+	",12,esp,+,[],esp,="
+	",16,esp,+,[],ebx,="
+	",20,esp,+,[],edx,="
+	",24,esp,+,[],ecx,="
+	",28,esp,+,[],eax,="
+	",32,esp,+="
+	);
+
+RPN UDIS86_ESIL (cmc,   "cf,!=");
+RPN UDIS86_ESIL (into,  "of,?{,4,$,}");
+RPN UDIS86_ESIL (lahf,  "%s,ah,=", info->bits == 16 ? "flags" : (info->bits == 32 ? "eflags" : "rflags"));
+RPN UDIS86_ESIL (loop,  "1,%s,-=,!,?{%s,%s,=,}",
+		info->bits == 16 ? "cx" : IS32 ? "ecx" : "rcx",
+		dst, info->pc);
+RPN UDIS86_ESIL (loope, "1,%s,-=,zf,?{,%s,%s,}",
+		info->bits == 16 ? "cx" : IS32 ? "ecx" : "rcx",
+		dst, info->pc);
+RPN UDIS86_ESIL (loopne, "1,%s,-=,zf,!,?{,%s,%s,}",
+		info->bits == 16 ? "cx" : IS32 ? "ecx" : "rcx",
+		dst, info->pc);
+
+#define OP(args, inst) [JOIN (UD_I, inst)] = {args, UDIS86_ESIL_HANDLER (inst)}
+
+/* This is the fastest way I can think about to implement this list of handlers */
+UDis86Esil udis86_esil_callback_table[ UD_MAX_MNEMONIC_CODE ] = {
+	OP (0, nop),  OP (1, jo),   OP (1, jno), OP (1, jb),   OP (1, jae),
+	OP (1, je),   OP (1, jne),  OP (1, ja),  OP (1, jbe),  OP (1, js),
+	OP (1, jns),  OP (1, jp),   OP (1, jnp), OP (1, jl),   OP (1, jge),
+	OP (1, jle),  OP (1, jg),   OP (1, jcxz),OP (1, jecxz),OP (1, jrcxz),
+	OP (1, jmp),  OP (1, call), OP (2, shl), OP (2, rol),  OP (2, ror),
+	OP (2, add),  OP (1, inc),  OP (2, sub), OP (1, dec),  OP (2, cmp),
+	OP (2, xor),  OP (2, or),   OP (2, and), OP (2, test), OP (0, syscall),
+	OP (1, int),  OP (2, lea),  OP (2, mov), OP (1, push), OP (1, pop),
+	OP (0, leave),OP (0, ret),  OP (2, xchg),OP (2, xadd), OP (2, bt),
+	OP (2, btc),  OP (2, bts),  OP (2, btr), OP (0, clc),  OP (0, cli),
+	OP (0, cld),  OP (0, cmc),  OP (0, int3),OP (0, into), OP (0, lahf),
+	OP (1, loop), OP (1, loope),OP (1, loopne), OP(2,sar), OP (2, salc)
+};
+
+UDis86Esil * udis86_esil_get_handler (enum ud_mnemonic_code code) {
+	if (!udis86_esil_callback_table[code].callback) {
+		return NULL;
+	}
+	return udis86_esil_callback_table + code;
+}

libr/anal/p/esil_x86_udis.h

@@ -0,0 +1,35 @@
+#ifndef _UDIS86_ESIL_H
+#define _UDIS86_ESIL_H
+
+#include "udis86/extern.h"
+/* This may be useful for other architectures */
+#define esilprintf(op, fmt, ...) r_strbuf_setf (&op->esil, fmt, ##__VA_ARGS__)
+
+#define UDIS86_ESIL_ARGUMENTS const UDis86OPInfo *info, RAnalOp *op, const char *dst, const char *src, const char *src2
+
+typedef struct udis86_op_info {
+	ut64 n;
+	int  bits;
+	ut64 bitmask;
+	int  regsz;
+	int  oplen;
+	const char *pc;
+	const char *sp;
+	const char *bp;
+} UDis86OPInfo;
+
+typedef struct udis86_esil_t {
+        int argc;
+        void (*callback) (UDIS86_ESIL_ARGUMENTS);
+} UDis86Esil;
+
+#define _JOIN(a1, a2) a1 ## a2
+#define JOIN(a1, a2) _JOIN (a1, a2)
+
+#define UDIS86_ESIL_HANDLER(name) JOIN (JOIN (__x86_, name), _to_esil)
+#define UDIS86_ESIL_PROTO(name) void UDIS86_ESIL_HANDLER (name) (UDIS86_ESIL_ARGUMENTS)
+#define UDIS86_ESIL(name, fmt, ...) UDIS86_ESIL_PROTO (name) { esilprintf (op, fmt, ##__VA_ARGS__); }
+
+UDis86Esil *udis86_esil_get_handler (enum ud_mnemonic_code);
+
+#endif /* _UDIS86_ESIL_H */

libr/anal/p/evm.mk

@@ -0,0 +1,12 @@
+OBJ_evm=anal_evm.o
+OBJ_evm+=../../asm/arch/evm/evm.o
+CFLAGS+=-I../../asm/arch/evm/
+
+STATIC_OBJ+=${OBJ_evm}
+TARGET_evm=anal_evm.${LIBEXT}
+
+ALL_TARGETS+=${TARGET_evm}
+LINKFLAGS+=-ljansson
+
+${TARGET_evm}: ${OBJ_evm} ${SHARED_OBJ}
+	${CC} $(call libname,anal_evm) ${LDFLAGS} ${CFLAGS} -o ${TARGET_evm} ${OBJ_evm} ${LINKFLAGS}

libr/anal/p/m68k_net.mk

@@ -0,0 +1,11 @@
+OBJ_M68K=anal_m68k_net.o
+
+#include ${CURDIR}capstone.mk
+
+STATIC_OBJ+=${OBJ_M68K}
+TARGET_M68K=anal_m68k_net.${LIBEXT}
+
+ALL_TARGETS+=${TARGET_M68K}
+
+${TARGET_M68K}: ${OBJ_M68K}
+	${CC} $(call libname,anal_m68k) ${LDFLAGS} ${CFLAGS} -o anal_m68k_net.${LIBEXT} ${OBJ_M68K}