/
canal.c
6062 lines (5773 loc) · 165 KB
/
canal.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* radare - LGPL - Copyright 2009-2021 - pancake, nibble */
#include <r_types.h>
#include <r_list.h>
#include <r_flag.h>
#include <r_core.h>
#include <r_bin.h>
#include <ht_uu.h>
#include <r_util/r_graph_drawable.h>
#include <string.h>
HEAPTYPE (ut64);
// used to speedup strcmp with rconfig.get in loops
enum {
R2_ARCH_THUMB,
R2_ARCH_ARM32,
R2_ARCH_ARM64,
R2_ARCH_MIPS
};
// 128M
#define MAX_SCAN_SIZE 0x7ffffff
static void loganal(ut64 from, ut64 to, int depth) {
r_cons_clear_line (1);
eprintf ("0x%08"PFMT64x" > 0x%08"PFMT64x" %d\r", from, to, depth);
}
static int cmpsize(const void *a, const void *b) {
ut64 as = r_anal_function_linear_size ((RAnalFunction *) a);
ut64 bs = r_anal_function_linear_size ((RAnalFunction *) b);
return (as> bs)? 1: (as< bs)? -1: 0;
}
static int cmpfcncc(const void *_a, const void *_b) {
RAnalFunction *a = (RAnalFunction *)_a;
RAnalFunction *b = (RAnalFunction *)_b;
ut64 as = r_anal_function_complexity (a);
ut64 bs = r_anal_function_complexity (b);
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpedges(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int as, bs;
r_anal_function_count_edges (a, &as);
r_anal_function_count_edges (b, &bs);
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpframe(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int as = a->maxstack;
int bs = b->maxstack;
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpxrefs(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int as = a->meta.numrefs;
int bs = b->meta.numrefs;
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpname(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int as = strcmp (a->name, b->name);
int bs = strcmp (b->name, a->name);
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpcalls(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int as = a->meta.numcallrefs;
int bs = b->meta.numcallrefs;
return (as > bs)? 1: (as < bs)? -1: 0;
}
static int cmpnbbs(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
ut64 as = r_list_length (a->bbs);
ut64 bs = r_list_length (b->bbs);
return (as> bs)? 1: (as< bs)? -1: 0;
}
static int cmpaddr(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
return (a->addr > b->addr)? 1: (a->addr < b->addr)? -1: 0;
}
static char *get_function_name(RCore *core, ut64 addr) {
RBinFile *bf = r_bin_cur (core->bin);
if (bf && bf->o) {
RBinSymbol *sym = ht_up_find (bf->o->addr2klassmethod, addr, NULL);
if (sym && sym->classname && sym->name) {
return r_str_newf ("method.%s.%s", sym->classname, sym->name);
}
}
RFlagItem *flag = r_core_flag_get_by_spaces (core->flags, addr);
return (flag && flag->name) ? strdup (flag->name) : NULL;
}
static RCore *mycore = NULL;
// XXX: copypaste from anal/data.c
#define MINLEN 1
static int is_string(const ut8 *buf, int size, int *len) {
int i, fakeLen = 0;
if (size < 1) {
return 0;
}
if (!len) {
len = &fakeLen;
}
if (size > 3 && buf[0] && !buf[1] && buf[2] && !buf[3]) {
*len = 1; // XXX: TODO: Measure wide string length
return 2; // is wide
}
for (i = 0; i < size; i++) {
if (!buf[i] && i > MINLEN) {
*len = i;
return 1;
}
if (buf[i] == 10 || buf[i] == 13 || buf[i] == 9) {
continue;
}
if (buf[i] < 32 || buf[i] > 127) {
// not ascii text
return 0;
}
if (!IS_PRINTABLE (buf[i])) {
*len = i;
return 0;
}
}
*len = i;
return 1;
}
static char *is_string_at(RCore *core, ut64 addr, int *olen) {
ut8 rstr[128] = {0};
int ret = 0, len = 0;
ut8 *str = calloc (256, 1);
if (!str) {
if (olen) {
*olen = 0;
}
return NULL;
}
r_io_read_at (core->io, addr, str, 255);
str[255] = 0;
if (is_string (str, 256, &len)) {
if (olen) {
*olen = len;
}
return (char*) str;
}
ut64 *cstr = (ut64*)str;
ut64 lowptr = cstr[0];
if (lowptr >> 32) { // must be pa mode only
lowptr &= UT32_MAX;
}
// cstring
if (cstr[0] == 0 && cstr[1] < 0x1000) {
ut64 ptr = cstr[2];
if (ptr >> 32) { // must be pa mode only
ptr &= UT32_MAX;
}
if (ptr) {
r_io_read_at (core->io, ptr, rstr, sizeof (rstr));
rstr[127] = 0;
ret = is_string (rstr, 128, &len);
if (ret) {
strcpy ((char*) str, (char*) rstr);
if (olen) {
*olen = len;
}
return (char*) str;
}
}
} else {
// pstring
r_io_read_at (core->io, lowptr, rstr, sizeof (rstr));
rstr[127] = 0;
ret = is_string (rstr, sizeof (rstr), &len);
if (ret) {
strcpy ((char*) str, (char*) rstr);
if (olen) {
*olen = len;
}
return (char*) str;
}
}
// check if current section have no exec bit
if (len < 1) {
ret = 0;
free (str);
len = -1;
} else if (olen) {
*olen = len;
}
// NOTE: coverity says that ret is always 0 here, so str is dead code
return ret? (char *)str: NULL;
}
/* returns the R_ANAL_ADDR_TYPE_* of the address 'addr' */
R_API ut64 r_core_anal_address(RCore *core, ut64 addr) {
ut64 types = 0;
RRegSet *rs = NULL;
if (!core) {
return 0;
}
if (core->dbg && core->dbg->reg) {
rs = r_reg_regset_get (core->dbg->reg, R_REG_TYPE_GPR);
}
if (rs) {
RRegItem *r;
RListIter *iter;
r_list_foreach (rs->regs, iter, r) {
if (r->type == R_REG_TYPE_GPR) {
ut64 val = r_reg_getv(core->dbg->reg, r->name);
if (addr == val) {
types |= R_ANAL_ADDR_TYPE_REG;
break;
}
}
}
}
if (r_flag_get_i (core->flags, addr)) {
types |= R_ANAL_ADDR_TYPE_FLAG;
}
if (r_anal_get_fcn_in (core->anal, addr, 0)) {
types |= R_ANAL_ADDR_TYPE_FUNC;
}
// check registers
if (core->bin && core->dbg && r_config_get_b (core->config, "cfg.debug")) {
RDebugMap *map;
RListIter *iter;
// use 'dm'
// XXX: this line makes r2 debugging MUCH slower
// r_debug_map_sync (core->dbg);
r_list_foreach (core->dbg->maps, iter, map) {
if (addr >= map->addr && addr < map->addr_end) {
if (map->name && map->name[0] == '/') {
if (core->io && core->io->desc &&
core->io->desc->name &&
!strcmp (map->name,
core->io->desc->name)) {
types |= R_ANAL_ADDR_TYPE_PROGRAM;
} else {
types |= R_ANAL_ADDR_TYPE_LIBRARY;
}
}
if (map->perm & R_PERM_X) {
types |= R_ANAL_ADDR_TYPE_EXEC;
}
if (map->perm & R_PERM_R) {
types |= R_ANAL_ADDR_TYPE_READ;
}
if (map->perm & R_PERM_W) {
types |= R_ANAL_ADDR_TYPE_WRITE;
}
// find function
if (map->name && strstr (map->name, "heap")) {
types |= R_ANAL_ADDR_TYPE_HEAP;
}
if (map->name && strstr (map->name, "stack")) {
types |= R_ANAL_ADDR_TYPE_STACK;
}
break;
}
}
} else {
int _perm = -1;
if (core->io) {
// sections
RIOBank *bank = r_io_bank_get (core->io, core->io->bank);
if (bank) {
RIOMapRef *mapref;
RListIter *iter;
r_list_foreach (bank->maprefs, iter, mapref) {
RIOMap *s = r_io_map_get (core->io, mapref->id);
if (addr >= s->itv.addr && addr < (s->itv.addr + s->itv.size)) {
// sections overlap, so we want to get the one with lower perms
_perm = (_perm != -1) ? R_MIN (_perm, s->perm) : s->perm;
// TODO: we should identify which maps come from the program or other
//types |= R_ANAL_ADDR_TYPE_PROGRAM;
// find function those sections should be created by hand or esil init
if (s->name && strstr (s->name, "heap")) {
types |= R_ANAL_ADDR_TYPE_HEAP;
}
if (s->name && strstr (s->name, "stack")) {
types |= R_ANAL_ADDR_TYPE_STACK;
}
}
}
}
}
if (_perm != -1) {
if (_perm & R_PERM_X) {
types |= R_ANAL_ADDR_TYPE_EXEC;
}
if (_perm & R_PERM_R) {
types |= R_ANAL_ADDR_TYPE_READ;
}
if (_perm & R_PERM_W) {
types |= R_ANAL_ADDR_TYPE_WRITE;
}
}
}
// check if it's ascii
if (addr != 0) {
int not_ascii = 0;
int i, failed_sequence, dir, on;
for (i = 0; i < 8; i++) {
ut8 n = (addr >> (i * 8)) & 0xff;
if (n && !IS_PRINTABLE (n)) {
not_ascii = 1;
}
}
if (!not_ascii) {
types |= R_ANAL_ADDR_TYPE_ASCII;
}
failed_sequence = 0;
dir = on = -1;
for (i = 0; i < 8; i++) {
ut8 n = (addr >> (i * 8)) & 0xff;
if (on != -1) {
if (dir == -1) {
dir = (n > on)? 1: -1;
}
if (n == on + dir) {
// ok
} else {
failed_sequence = 1;
break;
}
}
on = n;
}
if (!failed_sequence) {
types |= R_ANAL_ADDR_TYPE_SEQUENCE;
}
}
return types;
}
static bool blacklisted_word(char* name) {
const char * list[] = {
"__stack_chk_guard",
"__stderrp",
"__stdinp",
"__stdoutp",
"_DefaultRuneLocale"
};
int i;
for (i = 0; i < sizeof (list) / sizeof (list[0]); i++) {
if (strstr (name, list[i])) { return true; }
}
return false;
}
static char *anal_fcn_autoname(RCore *core, RAnalFunction *fcn, int dump, int mode) {
int use_getopt = 0;
int use_isatty = 0;
PJ *pj = NULL;
char *do_call = NULL;
RAnalRef *ref;
RListIter *iter;
RList *refs = r_anal_function_get_refs (fcn);
if (mode == 'j') {
// start a new JSON object
pj = r_core_pj_new (core);
pj_a (pj);
}
if (refs) {
r_list_foreach (refs, iter, ref) {
RFlagItem *f = r_flag_get_i (core->flags, ref->addr);
if (f) {
// If dump is true, print all strings referenced by the function
if (dump) {
// take only strings flags
if (!strncmp (f->name, "str.", 4)) {
if (mode == 'j') {
// add new json item
pj_o (pj);
pj_kn (pj, "addr", ref->at);
pj_kn (pj, "ref", ref->addr);
pj_ks (pj, "flag", f->name);
pj_end (pj);
} else {
r_cons_printf ("0x%08"PFMT64x" 0x%08"PFMT64x" %s\n", ref->at, ref->addr, f->name);
}
}
} else if (do_call) { // break if a proper autoname found and not in dump mode
break;
}
// enter only if a candidate name hasn't found yet
if (!do_call) {
if (blacklisted_word (f->name)) {
continue;
}
if (strstr (f->name, ".isatty")) {
use_isatty = 1;
}
if (strstr (f->name, ".getopt")) {
use_getopt = 1;
}
if (!strncmp (f->name, "method.", 7)) {
free (do_call);
do_call = strdup (f->name + 7);
continue;
}
if (!strncmp (f->name, "str.", 4)) {
free (do_call);
do_call = strdup (f->name + 4);
continue;
}
if (!strncmp (f->name, "dbg.", 4)) {
free (do_call);
do_call = strdup (f->name + 4);
continue;
}
if (!strncmp (f->name, "sym.imp.", 8)) {
free (do_call);
do_call = strdup (f->name + 8);
continue;
}
if (!strncmp (f->name, "reloc.", 6)) {
free (do_call);
do_call = strdup (f->name + 6);
continue;
}
}
}
}
r_list_free (refs);
}
if (mode == 'j') {
pj_end (pj);
}
if (pj) {
r_cons_printf ("%s\n", pj_string (pj));
pj_free (pj);
}
// TODO: append counter if name already exists
if (use_getopt) {
RFlagItem *item = r_flag_get (core->flags, "main");
free (do_call);
// if referenced from entrypoint. this should be main
if (item && item->offset == fcn->addr) {
return strdup ("main"); // main?
}
return strdup ("parse_args"); // main?
}
if (use_isatty) {
char *ret = r_str_newf ("sub.setup_tty_%s_%"PFMT64x, do_call, fcn->addr);
free (do_call);
return ret;
}
if (do_call) {
char *ret = r_str_newf ("sub.%s_%"PFMT64x, do_call, fcn->addr);
free (do_call);
return ret;
}
return NULL;
}
/*this only autoname those function that start with fcn.* or sym.func.* */
R_API void r_core_anal_autoname_all_fcns(RCore *core) {
RListIter *it;
RAnalFunction *fcn;
r_list_foreach (core->anal->fcns, it, fcn) {
if (!strncmp (fcn->name, "fcn.", 4) || !strncmp (fcn->name, "sym.func.", 9)) {
RFlagItem *item = r_flag_get (core->flags, fcn->name);
if (item) {
char *name = anal_fcn_autoname (core, fcn, 0, 0);
if (name) {
r_flag_rename (core->flags, item, name);
free (fcn->name);
fcn->name = name;
}
} else {
// there should always be a flag for a function
r_warn_if_reached ();
}
}
}
}
/* reads .gopclntab section in go binaries to recover function names
and adds them as sym.go.* flags */
R_API void r_core_anal_autoname_all_golang_fcns(RCore *core) {
RList* section_list = r_bin_get_sections (core->bin);
RListIter *iter;
const char* oldstr = NULL;
RBinSection *section;
ut64 gopclntab = 0;
r_list_foreach (section_list, iter, section) {
if (strstr (section->name, ".gopclntab")) {
gopclntab = section->vaddr;
break;
}
}
if (!gopclntab) {
oldstr = r_print_rowlog (core->print, "Could not find .gopclntab section");
r_print_rowlog_done (core->print, oldstr);
return;
}
int ptr_size = core->anal->bits / 8;
ut64 offset = gopclntab + 2 * ptr_size;
ut64 size_offset = gopclntab + 3 * ptr_size ;
ut8 temp_size[4] = {0};
if (!r_io_nread_at (core->io, size_offset, temp_size, 4)) {
return;
}
ut32 size = r_read_le32 (temp_size);
int num_syms = 0;
//r_cons_print ("[x] Reading .gopclntab...\n");
r_flag_space_push (core->flags, R_FLAGS_FS_SYMBOLS);
while (offset < gopclntab + size) {
ut8 temp_delta[4] = {0};
ut8 temp_func_addr[4] = {0};
ut8 temp_func_name[4] = {0};
if (!r_io_nread_at (core->io, offset + ptr_size, temp_delta, 4)) {
break;
}
ut32 delta = r_read_le32 (temp_delta);
ut64 func_offset = gopclntab + delta;
if (!r_io_nread_at (core->io, func_offset, temp_func_addr, 4) ||
!r_io_nread_at (core->io, func_offset + ptr_size, temp_func_name, 4)) {
break;
}
ut32 func_addr = r_read_le32 (temp_func_addr);
ut32 func_name_offset = r_read_le32 (temp_func_name);
ut8 func_name[64] = {0};
r_io_read_at (core->io, gopclntab + func_name_offset, func_name, 63);
if (func_name[0] == 0xff) {
break;
}
r_name_filter ((char *)func_name, 0);
//r_cons_printf ("[x] Found symbol %s at 0x%x\n", func_name, func_addr);
r_flag_set (core->flags, sdb_fmt ("sym.go.%s", func_name), func_addr, 1);
offset += 2 * ptr_size;
num_syms++;
}
r_flag_space_pop (core->flags);
if (num_syms) {
oldstr = r_print_rowlog (core->print, sdb_fmt ("Found %d symbols and saved them at sym.go.*", num_syms));
r_print_rowlog_done (core->print, oldstr);
} else {
oldstr = r_print_rowlog (core->print, "Found no symbols.");
r_print_rowlog_done (core->print, oldstr);
}
}
/* suggest a name for the function at the address 'addr'.
* If dump is true, every strings associated with the function is printed */
R_API char *r_core_anal_fcn_autoname(RCore *core, ut64 addr, int dump, int mode) {
RAnalFunction *fcn = r_anal_get_fcn_in (core->anal, addr, 0);
if (fcn) {
return anal_fcn_autoname (core, fcn, dump, mode);
}
return NULL;
}
static ut64 *next_append(ut64 *next, int *nexti, ut64 v) {
ut64 *tmp_next = realloc (next, sizeof (ut64) * (1 + *nexti));
if (!tmp_next) {
return NULL;
}
next = tmp_next;
next[*nexti] = v;
(*nexti)++;
return next;
}
static void r_anal_set_stringrefs(RCore *core, RAnalFunction *fcn) {
RListIter *iter;
RAnalRef *ref;
RList *refs = r_anal_function_get_refs (fcn);
r_list_foreach (refs, iter, ref) {
if (ref->type == R_ANAL_REF_TYPE_DATA &&
r_bin_is_string (core->bin, ref->addr)) {
r_anal_xrefs_set (core->anal, ref->at, ref->addr, R_ANAL_REF_TYPE_STRING);
}
}
r_list_free (refs);
}
static bool r_anal_try_get_fcn(RCore *core, RAnalRef *ref, int fcndepth, int refdepth) {
if (!refdepth) {
return false;
}
RIOMap *map = r_io_map_get_at (core->io, ref->addr);
if (!map) {
return false;
}
if (map->perm & R_PERM_X) {
ut8 buf[64];
r_io_read_at (core->io, ref->addr, buf, sizeof (buf));
bool looksLikeAFunction = r_anal_check_fcn (core->anal, buf, sizeof (buf), ref->addr, r_io_map_begin (map),
r_io_map_end (map));
if (looksLikeAFunction) {
if (core->anal->limit) {
if (ref->addr < core->anal->limit->from ||
ref->addr > core->anal->limit->to) {
return 1;
}
}
r_core_anal_fcn (core, ref->addr, ref->at, ref->type, fcndepth - 1);
}
} else {
ut64 offs = 0;
ut64 sz = core->anal->bits >> 3;
RAnalRef ref1;
ref1.type = R_ANAL_REF_TYPE_DATA;
ref1.at = ref->addr;
ref1.addr = 0;
ut32 i32;
ut16 i16;
ut8 i8;
ut64 offe = offs + 1024;
for (offs = 0; offs < offe; offs += sz, ref1.at += sz) {
ut8 bo[8];
r_io_read_at (core->io, ref->addr + offs, bo, R_MIN (sizeof (bo), sz));
bool be = core->anal->big_endian;
switch (sz) {
case 1:
i8 = r_read_ble8 (bo);
ref1.addr = (ut64)i8;
break;
case 2:
i16 = r_read_ble16 (bo, be);
ref1.addr = (ut64)i16;
break;
case 4:
i32 = r_read_ble32 (bo, be);
ref1.addr = (ut64)i32;
break;
case 8:
ref1.addr = r_read_ble64 (bo, be);
break;
}
r_anal_try_get_fcn (core, &ref1, fcndepth, refdepth - 1);
}
}
return 1;
}
static int r_anal_analyze_fcn_refs(RCore *core, RAnalFunction *fcn, int depth) {
RListIter *iter;
RAnalRef *ref;
RList *refs = r_anal_function_get_refs (fcn);
r_list_foreach (refs, iter, ref) {
if (ref->addr == UT64_MAX) {
continue;
}
switch (ref->type) {
case R_ANAL_REF_TYPE_DATA:
if (core->anal->opt.followdatarefs) {
r_anal_try_get_fcn (core, ref, depth, 2);
}
break;
case R_ANAL_REF_TYPE_CODE:
case R_ANAL_REF_TYPE_CALL:
r_core_anal_fcn (core, ref->addr, ref->at, ref->type, depth - 1);
break;
default:
break;
}
// TODO: fix memleak here, fcn not freed even though it is
// added in core->anal->fcns which is freed in r_anal_free()
}
r_list_free (refs);
return 1;
}
static void function_rename(RFlag *flags, RAnalFunction *fcn) {
const char *locname = "loc.";
const size_t locsize = strlen (locname);
char *fcnname = fcn->name;
if (strncmp (fcn->name, locname, locsize) == 0) {
const char *fcnpfx, *restofname;
RFlagItem *f;
fcn->type = R_ANAL_FCN_TYPE_FCN;
fcnpfx = r_anal_fcntype_tostring (fcn->type);
restofname = fcn->name + locsize;
fcn->name = r_str_newf ("%s.%s", fcnpfx, restofname);
f = r_flag_get_i (flags, fcn->addr);
r_flag_rename (flags, f, fcn->name);
free (fcnname);
}
}
static void autoname_imp_trampoline(RCore *core, RAnalFunction *fcn) {
if (r_list_length (fcn->bbs) == 1 && ((RAnalBlock *) r_list_first (fcn->bbs))->ninstr == 1) {
RList *refs = r_anal_function_get_refs (fcn);
if (refs && r_list_length (refs) == 1) {
RAnalRef *ref = r_list_first (refs);
if (ref->type != R_ANAL_REF_TYPE_CALL) { /* Some fcns don't return */
RFlagItem *flg = r_flag_get_i (core->flags, ref->addr);
if (flg && r_str_startswith (flg->name, "sym.imp.")) {
R_FREE (fcn->name);
fcn->name = r_str_newf ("sub.%s", flg->name + 8);
}
}
}
r_list_free (refs);
}
}
static void set_fcn_name_from_flag(RAnalFunction *fcn, RFlagItem *f, const char *fcnpfx) {
bool nameChanged = false;
if (f && f->name) {
if (!strncmp (fcn->name, "loc.", 4) || !strncmp (fcn->name, "fcn.", 4)) {
r_anal_function_rename (fcn, f->name);
nameChanged = true;
} else if (strncmp (f->name, "sect", 4)) {
r_anal_function_rename (fcn, f->name);
nameChanged = true;
}
}
if (!nameChanged) {
r_anal_function_rename (fcn, sdb_fmt ("%s.%08" PFMT64x, fcnpfx, fcn->addr));
}
}
static bool is_entry_flag(RFlagItem *f) {
return f->space && !strcmp (f->space->name, R_FLAGS_FS_SYMBOLS) && r_str_startswith (f->name, "entry.");
}
static bool __core_anal_fcn(RCore *core, ut64 at, ut64 from, int reftype, int depth) {
if (depth < 0) {
// printf ("Too deep for 0x%08"PFMT64x"\n", at);
// r_sys_backtrace ();
return false;
}
int has_next = r_config_get_i (core->config, "anal.hasnext");
RAnalHint *hint = NULL;
int i, nexti = 0;
ut64 *next = NULL;
int fcnlen;
RAnalFunction *fcn = r_anal_function_new (core->anal);
r_warn_if_fail (fcn);
const char *fcnpfx = r_config_get (core->config, "anal.fcnprefix");
if (!fcnpfx) {
fcnpfx = "fcn";
}
const char *cc = r_anal_cc_default (core->anal);
if (!cc) {
if (r_anal_cc_once (core->anal)) {
eprintf ("Warning: set your favourite calling convention in `e anal.cc=?`\n");
}
cc = "reg";
}
fcn->cc = r_str_constpool_get (&core->anal->constpool, cc);
r_warn_if_fail (fcn->cc);
hint = r_anal_hint_get (core->anal, at);
if (hint && hint->bits == 16) {
// expand 16bit for function
fcn->bits = 16;
} else {
fcn->bits = core->anal->bits;
}
fcn->addr = at;
fcn->name = get_function_name (core, at);
if (!fcn->name) {
fcn->name = r_str_newf ("%s.%08"PFMT64x, fcnpfx, at);
}
r_anal_fcn_invalidate_read_ahead_cache ();
do {
RFlagItem *f;
ut64 delta = r_anal_function_linear_size (fcn);
if (!r_io_is_valid_offset (core->io, at + delta, !core->anal->opt.noncode)) {
goto error;
}
if (r_cons_is_breaked ()) {
break;
}
fcnlen = r_anal_function(core->anal, fcn, at + delta, core->anal->opt.bb_max_size, reftype);
if (core->anal->opt.searchstringrefs) {
r_anal_set_stringrefs (core, fcn);
}
if (fcnlen == 0) {
if (core->anal->verbose) {
eprintf ("Analyzed function size is 0 at 0x%08"PFMT64x"\n", at + delta);
}
goto error;
}
if (fcnlen < 0) {
switch (fcnlen) {
case R_ANAL_RET_ERROR:
case R_ANAL_RET_NEW:
case R_ANAL_RET_DUP:
case R_ANAL_RET_END:
break;
default:
eprintf ("Oops. Negative fcnsize at 0x%08"PFMT64x" (%d)\n", at, fcnlen);
continue;
}
}
f = r_core_flag_get_by_spaces (core->flags, fcn->addr);
set_fcn_name_from_flag (fcn, f, fcnpfx);
if (fcnlen == R_ANAL_RET_ERROR ||
(fcnlen == R_ANAL_RET_END && !r_anal_function_realsize (fcn))) { /* Error analyzing function */
if (core->anal->opt.followbrokenfcnsrefs) {
r_anal_analyze_fcn_refs (core, fcn, depth);
}
goto error;
} else if (fcnlen == R_ANAL_RET_END) { /* Function analysis complete */
f = r_core_flag_get_by_spaces (core->flags, fcn->addr);
if (f && f->name && strncmp (f->name, "sect", 4)) { /* Check if it's already flagged */
char *new_name = strdup (f->name);
if (is_entry_flag (f)) {
RListIter *iter;
RBinSymbol *sym;
const RList *syms = r_bin_get_symbols (core->bin);
ut64 baddr = r_config_get_i (core->config, "bin.baddr");
r_list_foreach (syms, iter, sym) {
if (sym->type && (sym->paddr + baddr) == fcn->addr && !strcmp (sym->type, R_BIN_TYPE_FUNC_STR)) {
free (new_name);
new_name = r_str_newf ("sym.%s", sym->name);
break;
}
}
}
free (fcn->name);
fcn->name = new_name;
} else {
R_FREE (fcn->name);
const char *fcnpfx = r_anal_fcntype_tostring (fcn->type);
if (!fcnpfx || !*fcnpfx || !strcmp (fcnpfx, "fcn")) {
fcnpfx = r_config_get (core->config, "anal.fcnprefix");
}
fcn->name = r_str_newf ("%s.%08"PFMT64x, fcnpfx, fcn->addr);
autoname_imp_trampoline (core, fcn);
/* Add flag */
r_flag_space_push (core->flags, R_FLAGS_FS_FUNCTIONS);
r_flag_set (core->flags, fcn->name, fcn->addr, r_anal_function_linear_size (fcn));
r_flag_space_pop (core->flags);
}
/* New function: Add initial xref */
if (from != UT64_MAX) {
r_anal_xrefs_set (core->anal, from, fcn->addr, reftype);
}
// XXX: this is wrong. See CID 1134565
r_anal_add_function (core->anal, fcn);
if (has_next) {
ut64 addr = r_anal_function_max_addr (fcn);
RIOMap *map = r_io_map_get_at (core->io, addr);
// only get next if found on an executable section
if (!map || (map && map->perm & R_PERM_X)) {
for (i = 0; i < nexti; i++) {
if (next[i] == addr) {
break;
}
}
if (i == nexti) {
ut64 at = r_anal_function_max_addr (fcn);
while (true) {
ut64 size;
RAnalMetaItem *mi = r_meta_get_at (core->anal, at, R_META_TYPE_ANY, &size);
if (!mi) {
break;
}
at += size;
}
// TODO: ensure next address is function after padding (nop or trap or wat)
// XXX noisy for test cases because we want to clear the stderr
r_cons_clear_line (1);
loganal (fcn->addr, at, 10000 - depth);
next = next_append (next, &nexti, at);
}
}
}
if (!r_anal_analyze_fcn_refs (core, fcn, depth)) {
goto error;
}
}
} while (fcnlen != R_ANAL_RET_END);
r_list_free (core->anal->leaddrs);
core->anal->leaddrs = NULL;
if (has_next) {
for (i = 0; i < nexti; i++) {
if (!next[i] || r_anal_get_fcn_in (core->anal, next[i], 0)) {
continue;
}
r_core_anal_fcn (core, next[i], from, 0, depth - 1);
}
free (next);
}
if (core->anal->cur && core->anal->cur->arch && !strcmp (core->anal->cur->arch, "x86")) {
r_anal_function_check_bp_use (fcn);
if (fcn && !fcn->bp_frame) {
r_anal_function_delete_vars_by_kind (fcn, R_ANAL_VAR_KIND_BPV);
}
}
r_anal_hint_free (hint);
return true;
error:
r_list_free (core->anal->leaddrs);
core->anal->leaddrs = NULL;
// ugly hack to free fcn
if (fcn) {
if (!r_anal_function_realsize (fcn) || fcn->addr == UT64_MAX) {
r_anal_function_free (fcn);
fcn = NULL;
} else {
// TODO: mark this function as not properly analyzed
if (!fcn->name) {
// XXX dupped code.
fcn->name = r_str_newf (
"%s.%08" PFMT64x,
r_anal_fcntype_tostring (fcn->type),
at);
/* Add flag */
r_flag_space_push (core->flags, R_FLAGS_FS_FUNCTIONS);
r_flag_set (core->flags, fcn->name, at, r_anal_function_linear_size (fcn));
r_flag_space_pop (core->flags);
}
r_anal_add_function (core->anal, fcn);
}
if (fcn && has_next) {
ut64 newaddr = r_anal_function_max_addr (fcn);
RIOMap *map = r_io_map_get_at (core->io, newaddr);
if (!map || (map && (map->perm & R_PERM_X))) {
next = next_append (next, &nexti, newaddr);
for (i = 0; i < nexti; i++) {
if (!next[i]) {
continue;
}
r_core_anal_fcn (core, next[i], next[i], 0, depth - 1);
}
free (next);
}
}
}
if (fcn && core->anal->cur && core->anal->cur->arch && !strcmp (core->anal->cur->arch, "x86")) {
r_anal_function_check_bp_use (fcn);
if (!fcn->bp_frame) {
r_anal_function_delete_vars_by_kind (fcn, R_ANAL_VAR_KIND_BPV);
}
}
r_anal_hint_free (hint);
return false;
}
static char *get_title(ut64 addr) {
return r_str_newf ("0x%"PFMT64x, addr);
}
/* decode and return the RAnalOp at the address addr */
R_API RAnalOp* r_core_anal_op(RCore *core, ut64 addr, int mask) {
int len;
ut8 buf[32];
ut8 *ptr;
r_return_val_if_fail (core, NULL);
if (addr == UT64_MAX) {
return NULL;
}
RAnalOp *op = R_NEW0 (RAnalOp);
if (!op) {
return NULL;
}
int delta = (addr - core->offset);
int minopsz = 8;
if (delta > 0 && delta + minopsz < core->blocksize && addr >= core->offset && addr + 16 < core->offset + core->blocksize) {
ptr = core->block + delta;
len = core->blocksize - delta;
if (len < 1) {
goto err_op;
}
} else {
if (!r_io_read_at (core->io, addr, buf, sizeof (buf))) {
goto err_op;
}
ptr = buf;
len = sizeof (buf);
}
if (r_anal_op (core->anal, op, addr, ptr, len, mask) < 1) {
goto err_op;
}
// TODO This code block must be deleted when all the anal plugs support disasm