Improve realname support for symbols #15702

ITAYC0HEN · 2019-12-24T18:28:12Z

These changes aim to modify the way symbols are structured and look on the disassembly and across different places. More specifically, when asm.flags.real is set to true.

For example, this PR is aimed to change this:

call  dword   [sym.imp.user32.dll_CreateWindowExA]

To this:

call  dword  [CreateWindowExA]

In addition, it also adds the "libname" to each import. In general, it improves consistency across symbols in r2.

ITAYC0HEN · 2019-12-24T19:30:08Z

Current status

Disassembly:
Full flag looks like this: imp.<libname>.<funcname>
Realflag looks like this: <funcname>

Imports (iij)
"name" reduced to the function name. "libname" member was added to describe the library. This will later be used to differentiate between imports of the same name from different libraries.

Flags
The flag shows the full symbol name with library and symbol type. The real name is set only to the function name

XVilka · 2019-12-27T09:04:42Z

Could you please also add a few tests?

ITAYC0HEN · 2019-12-31T15:06:58Z

What do you think of this direction? before we start the work on all plugins

pelijah · 2020-01-01T19:14:06Z

libr/bin/p/bin_pe.inc

@@ -227,7 +228,8 @@ static RList* symbols(RBinFile *bf) {
 				break;
 			}
 			//strncpy (ptr->name, (char*)symbols[i].name, R_BIN_SIZEOF_STRINGS);
-			ptr->name = r_str_newf ("imp.%s", imports[i].name);
+			ptr->name = r_str_newf ("%s", imports[i].name);


ret2libc · 2020-01-02T14:36:01Z

I’m very in favor of this change! I like it

ITAYC0HEN · 2020-01-02T14:52:21Z

If the user will see call LoadLibraryA we need to find a way to let users know how to navigate to this because s LoadLibraryA won't work. What do you think?

A suggested seek mechanism can be found below:

If only one flag contains this substring (e.g. only imp.kernel32_dll.LoadLibraryA will contain LoadLibraryA), then the seek will be to this address.

If there are more then one option, then r2 will show:

Multiple flags matched 'LoadLibraryA'. Did you mean to one of the following flags that contain this substring:
0x4001234    imp.kernel32_dll.LoadLibraryA
0x7e01133    imp.someOther_dll.LoadLibraryA

radare · 2020-01-03T00:01:29Z

iij should contain flagname

radare · 2020-01-03T10:11:55Z

pls rebase

radare · 2020-01-03T10:31:33Z

+1 for this

…

On 2 Jan 2020, at 15:52, Itay Cohen ***@***.***> wrote: If the user will see call LoadLibraryA we need to find a way to let users know how to navigate to this because s LoadLibraryA won't work. What do you think? A suggested seek mechanism can be found below: If only one flag contains this substring (e.g. only imp.kernel32_dll.LoadLibraryA will contain LoadLibraryA), then the seek will be to this address. If there are more then one option, then r2 will show: The flag 'LoadLibraryA' wasn't found. Did you mean to one of the following flags that contain this substring: 0x4001234 imp.kernel32_dll.LoadLibraryA 0x7e01133 imp.someOther_dll.LoadLibraryA — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

radare · 2020-01-07T22:17:44Z

some of the failing tests.. this doesnt looks good to me, but the idea to have an option to shorten those symbol names lgtm, about navigation, just use hotkeys

ITAYC0HEN · 2020-01-08T20:42:45Z

libr/core/cbin.c

@@ -1704,12 +1709,12 @@ static int bin_relocs(RCore *r, int mode, int va) {
 }

 #define MYDB 1
-/* this is a hacky workaround that needs proper refactoring in Rbin to use Sdb */
+/* this is a VERY VERY VERY hacky and bad workaround that needs proper refactoring in Rbin to use Sdb */


thestr4ng3r · 2020-01-09T18:09:28Z

There is a slight difference in flagnames with demangling currently:
master:

name (bin.demangle=false): sym.imp.MSVCP100.dll___Osfx___basic_ostream_DU__char_traits_D_std___std__QAEXXZ
name (bin.demangle=true): sym.public:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::_Osfx_void

this pr:

name (bin.demangle=false): sym.imp.MSVCP100.dll___Osfx___basic_ostream_DU__char_traits_D_std___std__QAEXXZ
name (bin.demangle=true): sym.imp.MSVCP100.dll_public:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::_Osfx_void

Note that the imp.MSVCP100.dll_ part is missing on master. I think the new behavior makes much more sense since demangling should have no influence on what prefixes there are. This is important to understand regarding the test updates.

ITAYC0HEN · 2020-01-09T18:27:43Z

Note that the imp.MSVCP100.dll_ part is missing on master. I think the new behavior makes much more sense since demangling should have no influence on what prefixes there are. This is important to understand regarding the test updates.

I completely agree :)

XVilka · 2020-01-10T14:16:49Z

Please rebase on top of the currently green master, thanks!

github-actions bot added the RBin label Dec 24, 2019

thestr4ng3r self-assigned this Dec 25, 2019

XVilka added the test-required label Dec 27, 2019

XVilka added this to the 4.2.0 (Arctic World Archive) milestone Dec 27, 2019

radare changed the title ~~[WIP] Improve realname support for symbols~~ WIP: Improve realname support for symbols Dec 29, 2019

pelijah reviewed Jan 1, 2020

View reviewed changes

ITAYC0HEN mentioned this pull request Jan 2, 2020

Smart correction of flags usage #15747

Open

thestr4ng3r force-pushed the realName2 branch from 19dc3e6 to 4c5e0cf Compare January 8, 2020 17:45

ITAYC0HEN commented Jan 8, 2020

View reviewed changes

thestr4ng3r force-pushed the realName2 branch from 3fbf49f to 3833c36 Compare January 9, 2020 06:51

ITAYC0HEN marked this pull request as ready for review January 9, 2020 06:56

thestr4ng3r force-pushed the realName2 branch from 2cdb389 to 373cb8a Compare January 10, 2020 09:34

thestr4ng3r force-pushed the realName2 branch from bcb135e to e2a89f6 Compare January 10, 2020 14:50

ITAYC0HEN force-pushed the realName2 branch from e2a89f6 to 0127c04 Compare January 10, 2020 15:04

ITAYC0HEN and others added 4 commits January 10, 2020 16:37

Initial implementation of libname for flags in imports

8574328

Initial support for PE and real flag

95b2b26

Fix Segfaults

4657ffe

Read libname for PE exports

4b588e4

thestr4ng3r and others added 14 commits January 10, 2020 16:37

Fix more tests

115c463

Fix more tests

79705cb

Fix more

3416dce

Fix even more

a0fa178

Fix more tests

0b7ec12

Update Tests for Demangling Change

7c0ea19

Fix Export Check

3ec1a4e

Fix shitty import check in disasm.c

91fab5e

Fix reloc names (need refactoring)

5c8fe1b

Fix some imp. checks and reloc meta

5a516f4

Fix another imp. check

8008c1b

Fix r_bin_filter_sym() for imports

f18c2ad

Use realname for noreturn check

ab4d8af

add tests

b29da94

thestr4ng3r force-pushed the realName2 branch from 0127c04 to b29da94 Compare January 10, 2020 15:38

thestr4ng3r added 4 commits January 10, 2020 17:28

Fix asm.flags.real for direct calls

5f04292

Fix realname for direct calls with fcn

c1d2d55

Refactor reloc naming

d222b9c

Fix resolving names from ordinal

0452d8f

ITAYC0HEN changed the title ~~WIP: Improve realname support for symbols~~ Improve realname support for symbols Jan 10, 2020

thestr4ng3r removed the test-required label Jan 11, 2020

thestr4ng3r added 3 commits January 11, 2020 12:55

Fix a libname initialization

eb20a60

Fix a leak

c4fb56c

strdup

0d2d257

thestr4ng3r requested review from radare, ret2libc and XVilka January 11, 2020 12:01

radare merged commit 29c1344 into radareorg:master Jan 12, 2020

ITAYC0HEN mentioned this pull request Jan 13, 2020

Add asm.flags.real to preferences and enable by default rizinorg/cutter#2013

Closed

ITAYC0HEN mentioned this pull request Oct 20, 2020

Smart correction of flags usage rizinorg/rizin#46

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve realname support for symbols #15702

Improve realname support for symbols #15702

ITAYC0HEN commented Dec 24, 2019 •

edited

Loading

ITAYC0HEN commented Dec 24, 2019

XVilka commented Dec 27, 2019

ITAYC0HEN commented Dec 31, 2019

pelijah Jan 1, 2020

ret2libc commented Jan 2, 2020

ITAYC0HEN commented Jan 2, 2020 •

edited

Loading

radare commented Jan 3, 2020

radare commented Jan 3, 2020

radare commented Jan 3, 2020 via email

radare commented Jan 7, 2020

ITAYC0HEN Jan 8, 2020

thestr4ng3r commented Jan 9, 2020

ITAYC0HEN commented Jan 9, 2020

XVilka commented Jan 10, 2020

Improve realname support for symbols #15702

Improve realname support for symbols #15702

Conversation

ITAYC0HEN commented Dec 24, 2019 • edited Loading

ITAYC0HEN commented Dec 24, 2019

Current status

XVilka commented Dec 27, 2019

ITAYC0HEN commented Dec 31, 2019

pelijah Jan 1, 2020

Choose a reason for hiding this comment

ret2libc commented Jan 2, 2020

ITAYC0HEN commented Jan 2, 2020 • edited Loading

radare commented Jan 3, 2020

radare commented Jan 3, 2020

radare commented Jan 3, 2020 via email

radare commented Jan 7, 2020

ITAYC0HEN Jan 8, 2020

Choose a reason for hiding this comment

thestr4ng3r commented Jan 9, 2020

ITAYC0HEN commented Jan 9, 2020

XVilka commented Jan 10, 2020

ITAYC0HEN commented Dec 24, 2019 •

edited

Loading

ITAYC0HEN commented Jan 2, 2020 •

edited

Loading