Hexagon update #1338

Rot127 · 2021-07-20T09:44:22Z

Your checklist for this pull request

I've read the guidelines for contributing to this repository
I made sure to follow the project's coding style
I've added tests that prove my fix is effective or that my feature works (if possible)
I've updated the documentation and the rizin book with the relevant information (if needed)

Detailed description

This is an update of the hexagon asm and analysis plugin. It used the LLVM source to generate the plugin code.

This pull request only synchronizes the source code with the rz-hexagon repo.
For more details please refer to the pull request over there: rizinorg/rz-hexagon#4

Test plan

asm tests
The tests for the asm plugin are updated as well, since some of the old ones where incorrect.
The asm tests in this pull requests were written and disassembled with the Hexagon IDE tools.

analysis tests
Those tests got not updated (unfortunately my dev time is up for this month) and fail at the moment. I confirmed the correct working of the hardware loops, jumps and calls manually.

Closing issues
closes rizinorg/rz-hexagon#13

None

librz/analysis/p/analysis_hexagon.c

XVilka · 2021-07-21T04:30:25Z

Failed test:

[XX] db/analysis/hexagon hexagon jumps
RZ_NOPLUGINS=1 rizin -escr.utf8=0 -escr.color=0 -escr.interactive=0 -N -Qc 's sym.main
af
afx
pifc
' bins/elf/analysis/hexagon-hello-loop
-- stdout
--- expected
+++ actual
@@ -1,8 +1,11 @@
-c 0x00005124 -> 0x00005128 jump 0x5128
-c 0x00005134 -> 0x00005138 jump 0x5138
-C 0x00005138 -> 0x000050e0 call sym.pHello
-C 0x0000513c -> 0x000050f8 call sym.pWorld
-c 0x00005140 -> 0x00005144 jump 0x5144
-c 0x00005150 -> 0x00005128 jump 0x5128
-call sym.pHello
-call sym.pWorld
+c 0x00005124 -> 0x00005128 [     jump 0x5128 
+c 0x00005134 -> 0x00005138 [     jump 0x5138 
+C 0x00005138 -> 0x000050e0 [     call sym.pHello 
+C 0x0000513c -> 0x000050f8 [     call sym.pWorld 
+c 0x00005140 -> 0x00005144 [     jump 0x5144 
+c 0x00005150 -> 0x00005128 [     jump 0x5128 
+c 0x00005168 -> 0x00005170 [     jump sym.thread_create_extended 
+C 0x000051c8 -> 0x000062e6 / call sym.free 
+\ call sym.pHello 
+[     call 0x50f8 
+/ call sym.free 

-- stderr
Cannot determine entrypoint, using 0x00005000.
WARNING: No calling convention defined for this file, analysis may be inaccurate.

Would be awesome to not show the block start in case of only one pi instruction, I think. Not sure if possible though.

Rot127 · 2021-08-03T12:45:22Z

@XVilka Just to clarify. Do you mean:

A

/     call sym.free
\     call sym.pHello 
[     call 0x50f8 
/     call sym.free

should be printed as

/     call sym.free
\     call sym.pHello 
      call 0x50f8 
/     call sym.free

This wouldn't be a problem. And now that I see it I like it even more.

Or do you mean:

B

/     call sym.free
\     call sym.pHello 
[     call 0x50f8 
/     call sym.free 
>>> Disassembly ends <<<

should be printed as:

/     call sym.free
\     call sym.pHello 
[     call 0x50f8 
      call sym.free 
>>> Disassembly ends <<<

Off the top of my hat I would say this is harder to implement. Since the plugin needs to track which is the last instruction currently disassembled.

XVilka · 2021-08-13T06:57:03Z

@Rot127 sorry, didn't notice your question before. What I meant, it would be nice not to show block boundaries depending if it's only one instruction instead of multiple.

Rot127 · 2021-08-16T16:34:43Z

@XVilka Unfortunately this is probably a bit too much of a hustle. hex_set_pkt_info() does not know whether it disassembles only a single instruction or an instruction packet.

If you know any way to pass the current block size to the plugin, we could check in hex_set_pkt_info() whether the block size is currently 1 and omit the prefix.
(Besides: is my assumption correct that the block size is one if I execute pi 1 in rizin?)

wargio · 2021-08-16T19:21:21Z

you can keep a context structure, if needed.

Rot127 · 2021-08-17T09:39:57Z

@XVilka @wargio After looking into it a bit, I would add this feature not now. The current way of identifying instructions packets (and prepend the prefix to the assembly) is a little buggy anyways (rizinorg/rz-hexagon#18).

So I would like to focus more at things like rizinorg/rz-hexagon#14, rizinorg/rz-hexagon#13 or rizinorg/rz-hexagon#5 at the moment. They promise more of the basic functionality.

XVilka · 2021-08-17T09:48:42Z

@Rot127 ok, fine for me. As long as it's tracked in the issue, we can postpone.

wargio · 2021-08-17T12:00:58Z

ok for me too

wargio · 2021-08-19T12:07:05Z

i have a small request. can you please split the main function in hexagon_disas.c into a function having a switch case calling another function? this will fix ASAN building issues.

Rot127 · 2021-08-25T11:25:50Z

What binary are you testing?

wargio · 2021-08-25T11:32:40Z

[XX] db/analysis/hexagon hexagon jumps
RZ_NOPLUGINS=1 rizin -escr.utf8=0 -escr.color=0 -escr.interactive=0 -N -Qc 's sym.main
af
aar
afx
s 0x000050e4
pi 2
s 0x0000539c
pi 4
/ai 0xdead
/ai 0xbeef
/ai 0xfffffff8
/ai 0x1c00
' bins/elf/analysis/hexagon-hello-loop
-- stdout
--- expected
+++ actual
@@ -14,34 +14,34 @@
 0x00000b80   # 4: [     R0.h = #0xdead 
 0x00000b84   # 4: [     R0.l = #0xbeef 
 0x00001e68   # 4: [     R4.l = #0xbeef 
+0x0000342c   # 4: | if (!R23) memh(P3++#-0x8) = R11.h 
+0x0000342e   # 4: | if (!R7) memw(P3++#-0x8) = R11 
 0x00005128   # 4: [     R2 = memw(R30+##-0x8) 
 0x00005144   # 4: [     R2 = memw(R30+##-0x8) 
 0x0000514c   # 4: [     memw(R30+##-0x8) = R2 
 0x0000564c   # 4: [     R2 = memw(R0+##-0x8) 
 0x00005654   # 4: [     if (R17.new) P0 = add(R16,##-0x8) 
 0x00005740   # 4: [     R17 = and(R2,##-0x8) 
-0x00005840   # 4: / R4 = add(R2,##-0x8) 
-0x00005970   # 4: \ if (R2.new) P2 = add(R2,##-0x8) 
+0x00005840   # 4: | R4 = add(R2,##-0x8) 
+0x00005970   # 4: [     if (R2.new) P2 = add(R2,##-0x8) 
 0x000059d0   # 4: [     R1 = and(R1,##-0x8) 
 0x00006394   # 4: [     R4 = and(R4,##-0x8) 
 0x000063f8   # 4: [     R4 = and(R4,##-0x8) 
 0x0000641c   # 4: [     R4 = and(R4,##-0x8) 
 0x00006510   # 4: [     R4 = and(R4,##-0x8) 
 0x00006534   # 4: [     R4 = and(R4,##-0x8) 
-0x00007134   # 4: / R3 = mux(P0,#-0x8,#-0x8) 
+0x00007134   # 4: | R3 = mux(P0,#-0x8,#-0x8) 
 0x00007b4e   # 4: | R0 = add(R2,##-0x8) 
 0x00007eae   # 4: | R0 = add(R2,##-0x8) 
 0x00007ee0   # 4: | R17 = add(R17,##-0x8) 
-0x00008484   # 4: \ R2 = add(R16,add(R2,##-0x8)) 
-0x0000848c   # 4: / R2 = add(R2,##-0x8) 
-0x00008598   # 4: \ memd(R2+##-0x8) = R1:0  < endloop0
+0x00008484   # 4: [     R2 = add(R16,add(R2,##-0x8)) 
+0x0000848c   # 4: | R2 = add(R2,##-0x8) 
+0x00008598   # 4: [     memd(R2+##-0x8) = R1:0 
 0x000087b8   # 4: [     memd(R3+##-0x8) = R1:0 
 0x00009b64   # 4: [     R2 = memw(R18+##-0x8) 
-0x0000342c   # 4: / if (!R23) memh(P3++#-0x8) = R11.h 
-0x0000342e   # 4: | if (!R7) memw(P3++#-0x8) = R11 
+0x00000aac   # 4: | immext(##0x1c00) 
+0x00000ab4   # 4: | immext(##0x1c00) 
+0x00000b44   # 4: | immext(##0x1c00) 
 0x00005170   # 4: | immext(##0x1c00) 
 0x00005178   # 4: | immext(##0x1c00) 
 0x00005180   # 4: | immext(##0x1c00) 
-0x00000aac   # 4: | immext(##0x1c00) 
-0x00000ab4   # 4: | immext(##0x1c00) 
-0x00000b44   # 4: | immext(##0x1c00) 

-- stderr
Cannot determine entrypoint, using 0x00005000.
WARNING: No calling convention defined for this file, analysis may be inaccurate.
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
WARNING: (../librz/asm/arch/hexagon/hexagon.c:104):hex_get_double_regs: code should not be reached
...........

Rot127 · 2021-08-25T11:57:37Z

That is weird. The test worked fine for me. Anything I might have done wrong?

Rot127 · 2021-08-25T14:25:25Z

@wargio 2aca254 should remove the warnings.
The failing test is pretty weird. It finds all instructions which have the value -8 in it, but it searches from the lowest to the highest address.
On my machine it doesn't. The instructions are ordered as in the test file.
If it is fine for you I could simply upload the test file again. With the instructions in the correct order.

Rot127 · 2021-08-25T14:38:12Z

Besides fixing the problems with the test I think I won't add any functionality anymore. The pull request is already huge.
Of cause, if you see any "must haves" before merging it I am happy to add them.

wargio · 2021-08-25T14:47:05Z

it is fine for you I could simply upload the test file again. With the instructions in the correct order.

sure

Rot127 · 2021-08-26T10:39:41Z

The tests are currently failing all the time, because each build produces different assembly (see blow).

The instructions are correct, but their assignment to different instruction packages or the endloop1 attribute doesn't work very well at the moment (see issue: rizinorg/rz-hexagon#18).
~~Unfortunately I do not have time to fix this at the moment. Maybe in the next two weeks but I don't want to promise too much.~~

macos-meson-clang-tests

[XX] db/analysis/hexagon hexagon jumps
RZ_NOPLUGINS=1 rizin -escr.utf8=0 -escr.color=0 -escr.interactive=0 -N -Qc 's sym.main
af
aar
afx
s 0x000050e4
pi 2
s 0x0000539c
pi 4
/ai 0xdead
/ai 0xbeef
/ai 0xfffffff8
/ai 0x1c00
' bins/elf/analysis/hexagon-hello-loop
-- stdout
--- expected
+++ actual
@@ -14,9 +14,11 @@
 0x00000b80   # 4: [     R0.h = #0xdead 
 0x00000b84   # 4: [     R0.l = #0xbeef 
 0x00001e68   # 4: [     R4.l = #0xbeef 
+0x00002f05   # 4: [     R2 = add(R2in,##-0x8) ; R2 = memb(R16+#0x7) 
+0x00003005   # 4: [     R18 = add(R18in,##-0x8) ; R18 = memb(R16+#0x7) 
 0x0000342c   # 4: / if (!R23) memh(P3++#-0x8) = R11.h 
 0x0000342e   # 4: | if (!R7) memw(P3++#-0x8) = R11 
-0x00005128   # 4: \ R2 = memw(R30+##-0x8) 
+0x00005128   # 4: \ R2 = memw(R30+##-0x8)  < endloop01
 0x00005144   # 4: [     R2 = memw(R30+##-0x8) 
 0x0000514c   # 4: [     memw(R30+##-0x8) = R2 
 0x0000564c   # 4: [     R2 = memw(R0+##-0x8) 
@@ -36,11 +38,11 @@
 0x00007ee0   # 4: | R17 = add(R17,##-0x8) 
 0x00008484   # 4: \ R2 = add(R16,add(R2,##-0x8)) 
 0x0000848c   # 4: / R2 = add(R2,##-0x8) 
-0x00008598   # 4: \ memd(R2+##-0x8) = R1:0  < endloop0 
+0x00008598   # 4: \ memd(R2+##-0x8) = R1:0  < endloop0
 0x000087b8   # 4: [     memd(R3+##-0x8) = R1:0 
 0x00009b64   # 4: [     R2 = memw(R18+##-0x8) 
-0x00000aac   # 4: | immext(##0x1c00) 
-0x00000ab4   # 4: / immext(##0x1c00) 
+0x00000aac   # 4: / immext(##0x1c00) 
+0x00000ab4   # 4: | immext(##0x1c00) 
 0x00000b44   # 4: | immext(##0x1c00) 
 0x00005170   # 4: | immext(##0x1c00) 
 0x00005178   # 4: | immext(##0x1c00)

ubuntu-tcc-test

[XX] db/analysis/hexagon hexagon jumps
RZ_NOPLUGINS=1 rizin -escr.utf8=0 -escr.color=0 -escr.interactive=0 -N -Qc 's sym.main
af
aar
afx
s 0x000050e4
pi 2
s 0x0000539c
pi 4
/ai 0xdead
/ai 0xbeef
/ai 0xfffffff8
/ai 0x1c00
' bins/elf/analysis/hexagon-hello-loop
-- stdout
--- expected
+++ actual
@@ -14,33 +14,33 @@
 0x00000b80   # 4: [     R0.h = #0xdead 
 0x00000b84   # 4: [     R0.l = #0xbeef 
 0x00001e68   # 4: [     R4.l = #0xbeef 
-0x0000342c   # 4: / if (!R23) memh(P3++#-0x8) = R11.h 
+0x0000342c   # 4: | if (!R23) memh(P3++#-0x8) = R11.h 
 0x0000342e   # 4: | if (!R7) memw(P3++#-0x8) = R11 
-0x00005128   # 4: \ R2 = memw(R30+##-0x8) 
+0x00005128   # 4: [     R2 = memw(R30+##-0x8) 
 0x00005144   # 4: [     R2 = memw(R30+##-0x8) 
 0x0000514c   # 4: [     memw(R30+##-0x8) = R2 
 0x0000564c   # 4: [     R2 = memw(R0+##-0x8) 
 0x00005654   # 4: [     if (R17.new) P0 = add(R16,##-0x8) 
 0x00005740   # 4: [     R17 = and(R2,##-0x8) 
-0x00005840   # 4: / R4 = add(R2,##-0x8) 
-0x00005970   # 4: \ if (R2.new) P2 = add(R2,##-0x8) 
+0x00005840   # 4: | R4 = add(R2,##-0x8) 
+0x00005970   # 4: [     if (R2.new) P2 = add(R2,##-0x8) 
 0x000059d0   # 4: [     R1 = and(R1,##-0x8) 
 0x00006394   # 4: [     R4 = and(R4,##-0x8) 
 0x000063f8   # 4: [     R4 = and(R4,##-0x8) 
 0x0000641c   # 4: [     R4 = and(R4,##-0x8) 
 0x00006510   # 4: [     R4 = and(R4,##-0x8) 
 0x00006534   # 4: [     R4 = and(R4,##-0x8) 
-0x00007134   # 4: / R3 = mux(P0,#-0x8,#-0x8) 
+0x00007134   # 4: | R3 = mux(P0,#-0x8,#-0x8) 
 0x00007b4e   # 4: | R0 = add(R2,##-0x8) 
 0x00007eae   # 4: | R0 = add(R2,##-0x8) 
 0x00007ee0   # 4: | R17 = add(R17,##-0x8) 
-0x00008484   # 4: \ R2 = add(R16,add(R2,##-0x8)) 
-0x0000848c   # 4: / R2 = add(R2,##-0x8) 
-0x00008598   # 4: \ memd(R2+##-0x8) = R1:0  < endloop0 
+0x00008484   # 4: [     R2 = add(R16,add(R2,##-0x8)) 
+0x0000848c   # 4: | R2 = add(R2,##-0x8) 
+0x00008598   # 4: [     memd(R2+##-0x8) = R1:0 
 0x000087b8   # 4: [     memd(R3+##-0x8) = R1:0 
 0x00009b64   # 4: [     R2 = memw(R18+##-0x8) 
 0x00000aac   # 4: | immext(##0x1c00) 
-0x00000ab4   # 4: / immext(##0x1c00) 
+0x00000ab4   # 4: | immext(##0x1c00) 
 0x00000b44   # 4: | immext(##0x1c00) 
 0x00005170   # 4: | immext(##0x1c00) 
 0x00005178   # 4: | immext(##0x1c00)

wargio · 2021-08-26T11:53:34Z

make a clean build and run the tests again on your machine

Rot127 · 2021-08-26T13:29:42Z

Implemented the packet tracking. So the tests should pass now.

wargio · 2021-08-26T16:35:39Z

i would highly suggest you to triplecheck that the local variables that are defined in the generated code are always initialized.

wargio · 2021-08-26T16:39:09Z

librz/analysis/p/analysis_hexagon.c

+	op->jump = op->fail = -1;
+	op->ptr = op->val = -1;


Rot127 · 2021-09-01T07:29:04Z

i would highly suggest you to triplecheck that the local variables that are defined in the generated code are always initialized.

Could you give a hint which variable you are speaking of? I looked through the code again and again but couldn't find some not initialized ones. Sorry, I might be at a loss.

wargio · 2021-09-01T12:36:29Z

i would highly suggest you to triplecheck that the local variables that are defined in the generated code are always initialized.

Could you give a hint which variable you are speaking of? I looked through the code again and again but couldn't find some not initialized ones. Sorry, I might be at a loss.

based on the behavior i thought it was a problem related to uninitialized variables.. but if there are none, then i really have no clue..

Rot127 · 2021-09-07T10:23:59Z

Closed in favor of #1614

Rot127 added 2 commits July 10, 2021 13:33

Add generated code

2abd3cc

Sync source code with rz-hexagon.

3ef2a1d

Rot127 requested review from kazarmy, ret2libc, thestr4ng3r, wargio and XVilka as code owners July 20, 2021 09:44

XVilka requested changes Jul 20, 2021

View reviewed changes

librz/analysis/p/analysis_hexagon.c Outdated Show resolved Hide resolved

github-actions bot added the RzAnalysis label Jul 20, 2021

Apply requested change: Use rizin instead of r2 name.

0f83dd4

Rot127 mentioned this pull request Aug 3, 2021

Missing analysis tests rizinorg/rz-hexagon#10

Closed

6 tasks

Rot127 mentioned this pull request Aug 13, 2021

Patches: rizin pull request rizinorg/rz-hexagon#16

Merged

Rot127 added 2 commits August 14, 2021 14:45

Assign additional analysis instr. types.

57732eb

Add analysis tests for jumps/calls, immext(), function recognition.

3df40c9

Rot127 mentioned this pull request Aug 17, 2021

Omit packet prefix if only one instruction is disassembled rizinorg/rz-hexagon#17

Closed

Use RzStrBuf.len instead of deprecated RzAsmOp.size

4674d40

Rot127 added 3 commits August 19, 2021 11:33

Mark R0 as register which holds the systemcall number.

784eec2

Enable immediate operand search via /ai.

c45cc36

Set .val to last immediate of instruction.

5576e7d

Rot127 added 2 commits August 24, 2021 19:10

Replace ifs with else ifs to reduce comparisions.

c9fab0a

Fix ASAN errors by moving code into functions.

515ff31

Rot127 added 3 commits August 25, 2021 15:48

Add HVX calling convention.

9717087

Print up to 5 argument registers in retrieved CC.

f73ab8c

Remove waring if non existing registers shall be decoded.

2aca254

Rot127 added 3 commits August 25, 2021 17:02

Order instructions from low to high address to fix test.

316b768

Set correct packet prefix in tests.

9e4fac7

Add more detected registers in test cases.

02797af

Track instr.<->packet membership relative to last instr.

47ebbe8

Sort test cases again...

75f0b17

wargio reviewed Aug 26, 2021

View reviewed changes

-1 to UT64_MAX, Spelling, remove condition with no effect.

faa8681

Rot127 and others added 3 commits September 6, 2021 15:25

ESIL is not supported yet.

4eaf977

Add Hexagon relocation formulars.

b4f266c

Merge branch 'dev' into hexagon-update

908a907

github-actions bot added the RzBin label Sep 6, 2021

Rot127 mentioned this pull request Sep 7, 2021

Update Hexagon asm and analysis plugins #1614

Merged

4 tasks

Rot127 closed this Sep 7, 2021

Rot127 deleted the hexagon-update branch May 21, 2023 13:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Hexagon update #1338

Hexagon update #1338

Rot127 commented Jul 20, 2021 •

edited

XVilka commented Jul 21, 2021 •

edited

Rot127 commented Aug 3, 2021 •

edited

XVilka commented Aug 13, 2021

Rot127 commented Aug 16, 2021 •

edited

wargio commented Aug 16, 2021

Rot127 commented Aug 17, 2021

XVilka commented Aug 17, 2021

wargio commented Aug 17, 2021

wargio commented Aug 19, 2021

Rot127 commented Aug 25, 2021 •

edited

wargio commented Aug 25, 2021

Rot127 commented Aug 25, 2021 •

edited

Rot127 commented Aug 25, 2021 •

edited

Rot127 commented Aug 25, 2021

wargio commented Aug 25, 2021

Rot127 commented Aug 26, 2021 •

edited

wargio commented Aug 26, 2021

Rot127 commented Aug 26, 2021

wargio commented Aug 26, 2021

wargio Aug 26, 2021

Rot127 commented Sep 1, 2021

wargio commented Sep 1, 2021

Rot127 commented Sep 7, 2021

Hexagon update #1338

Hexagon update #1338

Conversation

Rot127 commented Jul 20, 2021 • edited

XVilka commented Jul 21, 2021 • edited

Rot127 commented Aug 3, 2021 • edited

XVilka commented Aug 13, 2021

Rot127 commented Aug 16, 2021 • edited

wargio commented Aug 16, 2021

Rot127 commented Aug 17, 2021

XVilka commented Aug 17, 2021

wargio commented Aug 17, 2021

wargio commented Aug 19, 2021

Rot127 commented Aug 25, 2021 • edited

wargio commented Aug 25, 2021

Rot127 commented Aug 25, 2021 • edited

Rot127 commented Aug 25, 2021 • edited

Rot127 commented Aug 25, 2021

wargio commented Aug 25, 2021

Rot127 commented Aug 26, 2021 • edited

wargio commented Aug 26, 2021

Rot127 commented Aug 26, 2021

wargio commented Aug 26, 2021

wargio Aug 26, 2021

Choose a reason for hiding this comment

Rot127 commented Sep 1, 2021

wargio commented Sep 1, 2021

Rot127 commented Sep 7, 2021

Rot127 commented Jul 20, 2021 •

edited

XVilka commented Jul 21, 2021 •

edited

Rot127 commented Aug 3, 2021 •

edited

Rot127 commented Aug 16, 2021 •

edited

Rot127 commented Aug 25, 2021 •

edited

Rot127 commented Aug 25, 2021 •

edited

Rot127 commented Aug 25, 2021 •

edited

Rot127 commented Aug 26, 2021 •

edited