TheLibASM

Rafał Leśniak edited this page Apr 23, 2016 · 1 revision

The ERESI Libasm

Libasm is the disassembling engine provided to the ERESI framework. Libasm was started to provide a disassembly output to ELFsh with the intention to provide extended features, such as the support for several architectures, patching of instructions and low-level code analysis. Libasm now provides rich information on the code of binary files loaded in the ERESI framework, such as instruction and operands analysis, semantic attributes for instructions and operands, allowing straight-forward construction of the Control Flow Graph and the Call Graph (among others). Libasm relies on a a modular and extensible handling of instruction formats using the reflective vector data structure provided by libaspect, which lead to a uniform intregration of libasm features into the ERESI framework language.

Libasm can be used in many operations requesting an access to instructions information.

  • Generate listing of instructions for basic blocks or functions on-demand.
  • Helping at building different kind of flow graphs by assigning semantic attributes to instructions and operands.
  • Searching for longuests sequences of valid instruction in a buffer.
  • Searching for push or pop sequences in binary code.
  • Disassembling Sparc opcodes with IA32 engine to check if code may be valid on both architecture.

Portability of libasm

Some libasm features are more portable than others. The current state of portability is as follow:

Architecture INTEL SPARC MIPS ARM
Full disassembling into internal structures Yes Yes YES WIP
Instructions semantic annotations Yes Yes YES No
Operand semantic annotations Yes Yes YES No
Smart operand patching WIP No No No

Unavailable features are the subject of contributions, if someone else has not taken over the implementation of the feature on the bts.

A first example

Here is a simple code wich display instruction operands.

#include <libasm.h>

/* opcodes to disassemble */
char    *opcodes = 
"BBBBBAhHisToldSlde43%:53_+12\"\x03\xde\x01\xd2\x80  ,./';[] [ ] 12 #@#$$";

int     main()
{
  asm_processor proc;
  asm_instr     ins;
  char          buffer[256];
  int           len;
  int           curr;
  
  /* Intialize an asm_processor structure.
  asm_init_arch(&proc, ASM_PROC_IA32);
  curr = 0;

  /* Looping on instructions */
  while (curr < strlen(opcodes))
    {
      /* Disassemble opcodes of one max bytes */      

      len = asm_read_instr(&ins, opcodes + curr, 1, &proc);
      
      if (len > 0)
        {
	  att_dump_operand(&ins, 1, 0, buffer);
          printf("op1 = '%s'\n", buffer);
          memset(buffer, 0, sizeof(buffer));
          att_dump_operand(&ins, 2, 0, buffer);
          printf("op2 = '%s'\n", buffer);
          memset(buffer, 0, sizeof(buffer));
          att_dump_operand(&ins, 3, 0, buffer);
          printf("op3 = '%s'\n", buffer);
	  /* add instruction length to disassembling offset */
          curr += len;
        }
      else
        {
	  /* some error occured. skip byte. */
          curr++;
        }
    }
  return (0);
}

Compile with :

cc -ggdb dump_operand.c -o dump_operand -I ../include/ -L.. -lasm \
-I ../../libaspect/include/ -L ../../libaspect/ -laspect32

This program simply prints instruction operands. It is there to illustrate a simple way to use libasm.

Dependencies

The Libasm library depends on other components from the ERESI framework :

  • libaspect : the types specification library, for exporting its vectors, hash table and profiling API.

Articles featuring libasm

Libasm is one of the oldest component of the ERESI framework and has been widely presented in many articles:

  • Reverse engineering des systemes ELF/INTEL Libasm was firstly introduced in this french paper. IA32 assembly and libasm implementation are described to present control flow graphing and data flow projects.

  • Next Generation Debuggers for Reverse Engineering Libasm instruction annotations are introduced in this article which describe the new components of the ERESI framework related to debugging and code analysis.