Dumping BIL of raw x86-code binary data doesn't work

[d0c-s4vage]

Either I'm profoundly misunderstanding how to use bap, or it's not working as the documentation describes:

cat <<-EOF > /tmp/test.asm
xor eax,eax
inc eax
mov ecx,eax
EOF
nasm /tmp/test.asm -o /tmp/test
bap /tmp/test -d bil --source-type x86-code --verbose

The final bap command above exits without printing the bil for the bytecode assembled with nasm.

To verify that /tmp/test.asm was assembled correctly with nasm:

bap@a21bc7ec5783:~$ objdump -D -b binary -m i386 /tmp/test

/tmp/test:     file format binary


Disassembly of section .data:

00000000 <.data>:
   0:   66 31 c0                xor    %ax,%ax
   3:   66 40                   inc    %ax
   5:   66 89 c1                mov    %ax,%cx

[ivg]

The problem is that bap doesn't find any functions in that binary (because there are none). The use case of bap is to analyze real programs, that usually have functions.

If you would like to disassemble small chunks of code, you can use bap-mc, e.g.,

echo 66 31 c0 66 40 66 89 c1 | bap-mc --arch=x86 --show-insn=asm
xorw %ax, %ax
incw %ax
movw %ax, %cx

or, for BIL

$ echo 66 31 c0 66 40 66 89 c1 | bap-mc --arch=x86 --show-bil
{
  EAX := extract:31:16[EAX].0
  AF := unknown[AF is undefined after xor]:u1
  ZF := 1
  PF := 1
  OF := 0
  CF := 0
  SF := 0
}
{
  v1 := low:16[low:32[EAX]]
  EAX := extract:31:16[EAX].low:16[low:32[EAX]] + 1
  OF := ~high:1[v1] & (high:1[v1] ^ high:1[low:16[low:32[EAX]]])
  AF := 0x10 = (0x10 & (low:16[low:32[EAX]] ^ v1 ^ 1))
  PF := ~low:1[let v2 = low:16[low:32[EAX]] >> 4 ^ low:16[low:32[EAX]] in
    let v2 = v2 >> 2 ^ v2 in
    v2 >> 1 ^ v2]
  SF := high:1[low:16[low:32[EAX]]]
  ZF := 0 = low:16[low:32[EAX]]
}
{
  ECX := high:16[ECX].low:16[EAX]
}

If you really need to use bap on such file, I would suggest you to provide manually information about function starts, e.g.,

cat > start << EOF                                              
(_start 0 1)
EOF

$ bap ./test -d --source-type=x86-code --read-symbols-from start 
00000013: program
00000012: sub _start()
00000002: 
00000003: EAX := extract:31:16[EAX].0
0000000b: EAX := extract:31:16[EAX].low:16[low:32[EAX]] + 1
00000011: ECX := high:16[ECX].low:16[EAX]

In any case, our disassembler used to default to the first available byte in case if no functions starts were provided, it looks like from this issue, that it is no longer true. I believe that's it is a sane default for such corner cases. @gitoleg, can you please restore this behavior?

[d0c-s4vage]

Thank you for the reply and examples! That makes sense now.