add babyre example, change jump / fails to i64 as they can be negative

Cargo.toml

@@ -5,5 +5,6 @@ members = [
     "examples/r100",
     "examples/r200",
     "examples/unbreakable",
-    "examples/dex"
+    "examples/dex",
+    "examples/babyre"
 ]

examples/babyre/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "babyre"
+version = "0.1.0"
+authors = ["aemmitt <[email protected]>"]
+edition = "2018"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+
+radius = { path = "../../radius" }

examples/babyre/src/main.rs

@@ -0,0 +1,33 @@
+use radius::radius::{Radius, RadiusOption};
+use radius::state::State;
+use radius::value::Value;
+
+fn scanf_sim(state: &mut State, args: Vec<Value>) -> Value {
+    let input_len = state.context.entry("ints".to_owned()).or_insert(vec!()).len();
+    let new_int = state.symbolic_value(&format!("int{}", input_len), 32);
+    state.memory_write_value(&args[1], &new_int, 4);
+    state.context.get_mut("ints").unwrap().push(new_int);
+    state.concrete_value(1, 64)
+}
+
+fn main() {
+    // runs better without opt and sims
+    let options = vec!(RadiusOption::Optimize(false), RadiusOption::Sims(false));
+    let mut radius = Radius::new_with_options("tests/baby-re", options, None);
+    let main = radius.get_address("main").unwrap();
+    let scanf = radius.get_address("sym.imp.__isoc99_scanf").unwrap();
+    radius.processor.sims.insert(scanf, scanf_sim);
+
+    let state = radius.call_state(main); // start at main
+    let new_state = radius.run_until(state, 0x004028e9, vec!(0x00402941)).unwrap();
+
+    // solving takes the majority of the ~5 sec runtime
+    let mut flag_bytes = vec!(); // the hook writes the flag bytes, collect them
+    for input in new_state.context.get("ints").unwrap() {
+        flag_bytes.push(new_state.solver.eval_to_u64(&input).unwrap() as u8);
+    }
+    let flag = String::from_utf8(flag_bytes).unwrap();
+
+    println!("FLAG: {}", flag);
+    assert_eq!(flag, "Math is hard!");
+}

radius/src/processor.rs

@@ -13,8 +13,8 @@ use std::mem;
 
 const INSTR_NUM: usize = 64;
 
-const CALL_TYPE: u64 = 3;
-const RETN_TYPE: u64 = 5;
+const CALL_TYPE: i64 = 3;
+const RETN_TYPE: i64 = 5;
 
 #[derive(Debug, Clone, PartialEq)]
 pub enum Word {
@@ -28,7 +28,7 @@ pub type HookMethod = fn (&mut State) -> bool;
 
 #[derive(Clone)]
 pub struct Processor {
-    pub pc: Option<usize>,
+    pub pc: Option<usize>, // this still sucks
     pub instructions: HashMap<u64, InstructionEntry>,
     pub hooks: HashMap<u64, Vec<HookMethod>>,
     pub sims: HashMap<u64, SimMethod>,
@@ -487,10 +487,10 @@ impl Processor {
 
         state.esil.pcs.clear();
         if instr.jump != 0 {
-            state.esil.pcs.push(instr.jump);
+            state.esil.pcs.push(instr.jump as u64);
 
             if instr.fail != 0 {
-                state.esil.pcs.push(instr.fail);
+                state.esil.pcs.push(instr.fail as u64);
             }
         } 
 

radius/src/r2_api.rs

@@ -50,13 +50,13 @@ pub struct Instruction {
     pub r#type: String,
 
     #[serde(default="zero")]
-    pub type_num: u64,
+    pub type_num: i64,
 
     #[serde(default="zero")]
-    pub jump: u64,
+    pub jump: i64,
 
     #[serde(default="zero")]
-    pub fail: u64  
+    pub fail: i64  
 }
 
 fn invalid() -> String {
@@ -67,7 +67,7 @@ fn blank() -> String {
     "".to_string()
 }
 
-fn zero() -> u64 {
+fn zero() -> i64 {
     0
 }
 
@@ -208,10 +208,10 @@ pub struct BasicBlock {
     pub traced: bool,
 
     #[serde(default="zero")]
-    pub jump: u64,
+    pub jump: i64,
 
     #[serde(default="zero")]
-    pub fail: u64  
+    pub fail: i64  
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -439,6 +439,7 @@ impl R2Api {
     pub fn disassemble(&mut self, addr: u64, num: usize) -> R2Result<Vec<Instruction>> {
         let cmd = format!("pdj {} @ {}", num, addr);
         let json = self.cmd(cmd.as_str())?;
+        //println!("json: {}", json);
         r2_result(serde_json::from_str(json.as_str()))
     }