fix printf args on arm darwin, add assign_sim, other changes a while ago prolly

examples/statically-linked/src/main.rs

@@ -1,4 +1,3 @@
-use radius2::sims::{libc, make_sim};
 use radius2::{vc, Radius, RadiusOption};
 
 fn main() {
@@ -8,7 +7,7 @@ fn main() {
     );
 
     // Hooking library functions can save a lot of time
-    radius.simulate(0x40145e, make_sim("strcmp", libc::strcmp, 2));
+    radius.assign_sim(0x40145e, "strcmp");
 
     let mut state = radius.call_state(0x40102b); // start at main
     let flag = state.symbolic_value("flag", 15 * 8); // flag is 15 bytes long

radius/src/processor.rs

@@ -778,7 +778,6 @@ impl Processor {
         }
 
         let new_pc = state.registers.get_pc();
-        //let pcs;
 
         if self.force && !state.esil.pcs.is_empty() {
             // we just use the pcs in state.esil.pcs

radius/src/r2_api.rs

@@ -210,6 +210,22 @@ pub struct SearchResult {
     pub data: String,
 }
 
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DisasmSearchResult {
+    pub addr: u64,
+    pub size: u64,
+    pub opstr: String,
+    pub r#type: String
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DisasmSearchResults {
+    pub cmd: String,
+    pub arg: String,
+    pub result: Vec<DisasmSearchResult>
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CrossRef {
     pub addr: u64,
@@ -1013,6 +1029,12 @@ impl R2Api {
         r2_result(serde_json::from_str(json.as_str()))
     }
 
+    pub fn search_disasm(&mut self, opcode: &str) -> R2Result<DisasmSearchResults> {
+        let cmd = format!("/amj {}", opcode);
+        let json = self.ccmd(cmd.as_str())?;
+        r2_result(serde_json::from_str(json.as_str()))
+    }
+
     pub fn assemble(&mut self, instruction: &str) -> R2Result<Vec<u8>> {
         let cmd = format!("pa {}", instruction);
         let hexpairs = self.ccmd(cmd.as_str())?;

radius/src/radius.rs

@@ -504,6 +504,15 @@ impl Radius {
         self.processor.sims.insert(addr, sim);
     }
 
+    /// assign an existing sim to an address (for static binaries)
+    pub fn assign_sim(&mut self, addr: u64, name: &str) {
+        // TODO: get_sims should return a HashMap idk why it doesnt
+        get_sims()
+            .into_iter()
+            .find(|s| s.symbol == name)
+            .map(|s| self.simulate(addr, s));
+    }
+
     /// Add a breakpoint at the provided address.
     /// This is where execution will stop after `run` is called
     pub fn breakpoint(&mut self, addr: u64) {

radius/src/sims/format.rs

@@ -12,7 +12,8 @@ const NONUINTS: [char; 15] = [
 ];
 
 // the value returned is the formatted string
-pub fn format(state: &mut State, args: &[Value]) -> Vec<Value> {
+pub fn format(state: &mut State, vargs: &[Value]) -> Vec<Value> {
+    let args = get_fmt_args(state, vargs);
     let length = state.memory_strlen(&args[0], &vc(MAXLEN as u64));
     let mut formatstr = state.memory_read(&args[0], &length);
     let mut result = Vec::with_capacity(MAXLEN);
@@ -60,6 +61,26 @@ pub fn must_be_formats(state: &mut State, c: &Value, formats: &[char]) {
     }
 }
 
+// get format args (from x9 on *OS)
+pub fn get_fmt_args(state: &mut State, args: &[Value]) -> Vec<Value> {
+    // this is dumb, we need to fix the calling convention stuff in r2
+    if state.info.bin.bintype == "mach0" && state.info.bin.arch == "arm" {
+        let mut newargs = args[..1].to_owned();
+        // read args from stack?
+        let mut argp = state.registers.get("x9");
+        let length = state.memory.bits as usize / 8;
+
+        for _ in 0..8 { // do 8 idk
+            let value = state.memory_read_value(&argp, length);
+            argp = argp + vc(length as u64);
+            newargs.push(value);
+        }
+        newargs
+    } else {
+        args.to_owned()
+    }
+}
+
 // do one format string, "%10s", "%03x", etc
 // count is just for %n
 pub fn format_one(
@@ -196,7 +217,8 @@ fn format_string(state: &mut State, _c: &Value, arg: &Value, pre: &str) -> Vec<V
     result
 }
 
-pub fn scan(state: &mut State, args: &[Value]) -> Value {
+pub fn scan(state: &mut State, vargs: &[Value]) -> Value {
+    let args = get_fmt_args(state, vargs);
     let flength = state.memory_strlen(&args[1], &vc(MAXLEN as u64));
     let mut formatstr = state.memory_read(&args[1], &(flength + vc(1)));
     let mut data = args[0].to_owned();

radius/src/sims/libc.rs

@@ -72,7 +72,7 @@ pub fn getchar(state: &mut State, _args: &[Value]) -> Value {
 pub fn fprintf(state: &mut State, args: &[Value]) -> Value {
     let fd = fileno(state, &args[0..1]);
     let fdn = state.solver.evalcon_to_u64(&fd).unwrap_or(1);
-    let formatted = format::format(state, args);
+    let formatted = format::format(state, &args[1..]);
     let ret = vc(formatted.len() as u64);
     state.filesystem.write(fdn as usize, formatted);
     ret
@@ -688,16 +688,17 @@ pub fn zero(_state: &mut State, _args: &[Value]) -> Value {
 }
 
 pub fn rand(state: &mut State, _args: &[Value]) -> Value {
-    let r = rand::thread_rng().gen::<u64>();
-    let rand = state.symbolic_value(&format!("rand_{}", r), 64);
+    // let r = rand::thread_rng().gen::<u64>();
+    // let rand = state.symbolic_value(&format!("rand_{}", r), 64);
 
-    let rand_vec = &mut state
-        .context
-        .entry("rand".to_string())
-        .or_insert_with(Vec::new);
+    // let rand_vec = &mut state
+    //     .context
+    //     .entry("rand".to_string())
+    //     .or_insert_with(Vec::new);
 
-    rand_vec.push(rand.clone());
-    rand
+    // rand_vec.push(rand.clone());
+    // rand
+    vc(4) // https://xkcd.com/221
 }
 
 pub fn srand(_state: &mut State, _args: &[Value]) -> Value {