/
cmd_anal.c
12050 lines (11668 loc) · 331 KB
/
cmd_anal.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
/* radare - LGPL - Copyright 2009-2022 - pancake, maijin */
#include <r_core.h>
#include <r_util/r_graph_drawable.h>
#define SLOW_ANALYSIS 1
#define MAX_SCAN_SIZE 0x7ffffff
// should be 1 unless it makes the CI sad
static const char *help_msg_af_plus[] = {
"Usage:", "af+", " [addr] ([name] ([type] [diff]))",
"af+", "$$", "add a raw function element. See afb+ to add basic blocks to it",
"af+", "$$ main", "add new function in current offset with 'main' as name",
NULL
};
static const char *help_msg_a[] = {
"Usage:", "a", "[abdefFghoprxstc] [...]",
"a", "", "alias for aai - analysis information",
"a*", "", "same as afl*;ah*;ax*",
"aa", "[?]", "analyze all (fcns + bbs) (aa0 to avoid sub renaming)",
"a8", " [hexpairs]", "analyze bytes",
"ab", "[?]", "analyze basic block",
"ac", "[?]", "manage classes",
"aC", "[?]", "analyze function call",
"ad", "[?]", "analyze data trampoline (wip)",
"ad", " [from] [to]", "analyze data pointers to (from-to)",
"ae", "[?] [expr]", "analyze opcode eval expression (see ao)",
"af", "[?]", "analyze functions",
"aF", "", "same as above, but using anal.depth=1",
"ag", "[?] [options]", "draw graphs in various formats",
"ah", "[?]", "analysis hints (force opcode size, ...)",
"ai", " [addr]", "address information (show perms, stack, heap, ...)",
"aj", "", "same as a* but in json (aflj)",
"aL", "", "list all asm/anal plugins (e asm.arch=?)",
"an", "[?] [name]", "show/rename/create whatever var/flag/function is used in current instruction",
"ao", "[?] [len]", "analyze Opcodes (or emulate it)",
"aO", "[?] [len]", "Analyze N instructions in M bytes",
"ap", "", "find prelude for current offset",
"ar", "[?]", "like 'dr' but for the esil vm. (registers)",
"as", "[?] [num]", "analyze syscall using dbg.reg",
"av", "[?] [.]", "show vtables",
"avg", "[?] [.]", "manage global variables",
"ax", "[?]", "manage refs/xrefs (see also afx?)",
NULL
};
static const char *help_msg_afna[] = {
"Usage:", "afna", " # construct a function name and rename the function for the current offset.",
"", "", "Based on flags or methods calls found inside that function.",
NULL
};
static const char *help_msg_afu[] = {
"Usage:", "afu", "[addr] # resize and analyze function from current address until addr.",
"afu", " 0x100004093", "Resize and analyze function from current address until 0x100004093",
NULL
};
static const char *help_msg_aan[] = {
"Usage:", "aan", "[rg] # automatically name functions.",
"aan", "", "autoname all functions",
"aang", "", "autoname all golang functions",
"aanr", "", "auto-noreturn propagation",
NULL
};
static const char *help_msg_afm[] = {
"Usage:", "afm", "[name] # merge two functions.",
"afm", " sym.func.100003d74", "Merge current function into 0x100003d74",
NULL
};
static const char *help_msg_aF[] = {
"Usage:", "aF", " # analyze a function, but using anal.depth=1",
"aF", "", "Check af? for more options and information.",
NULL
};
static const char *help_msg_an[] = {
"Usage:", "an", " # analyze name for the current address",
"an", "", "Show flag/function/symbol name",
"an*", "", "Same as above but in r2 commands",
"anj", "", "Same as above but in json",
NULL
};
static const char *help_msg_a8[] = {
"Usage:", "a8", "[hexpairs] # analyze the byte array given as input",
"a8 ", "5548", "analyzes 5548 byte array",
NULL
};
static const char *help_msg_ap[] = {
"Usage:", "ap[?]", " # analyze prelude in current offset",
"ap", "", "check if current offset contains a function prelude",
NULL
};
static const char *help_msg_avg[] = {
"Usage:", "avg", " # analyze variable global",
"avg", "", "Use ESIL emulation to find out arguments of a call (uses 'abte')",
"avg", " [type] [name]", "add global",
"avg-", "", "delete global",
NULL
};
static const char *help_msg_aC[] = {
"Usage:", "aC[fej] [addr-of-call]", " # analyze call args",
"aCe", "", "Use ESIL emulation to find out arguments of a call (uses 'abte')",
"aCf", "", "Same as .aCe* $$ @@=`pdr~call`",
NULL
};
static const char *help_msg_aaf[] = {
"Usage:", "aaf[efrt?]", " # analyse all functionsee also 'af' and 'afna'",
"aaf", "", "same as afr@@c:isq",
"aafe", " ", "same as aef@@F",
"aaff", "", "set a flag for every function",
"aafr", " [len]", "consecutive function analysis (e anal.hasnext=1;afr@@c:isq)",
"aaft", "", "recursive type matching across all functions",
"aafs", "", "single basic block function analysis",
NULL
};
static const char *help_msg_aaa[] = {
"Usage:", "aa[a[a[a]]]", " # automatically analyze the whole program",
"aa", " ", "alias for 'af@@ sym.*;af@entry0;afva'",
"aaa", "", "perform deeper analysis, most common use",
"aaaa", "", "same as aaa but adds a bunch of experimental iterations",
NULL
};
static const char *help_msg_aa[] = {
"Usage:", "aa[0*?]", " # see also 'af' and 'afna'",
"aa", " ", "alias for 'af@@ sym.*;af@entry0;afva'", //;.afna @@ fcn.*'",
"aaa", "[?]", "autoname functions after aa (see afna)",
"aab", "", "abb across bin.sections.rx",
"aac", " [len]", "analyze function calls (af @@ `pi len~call[1]`)",
"aac*", " [len]", "flag function calls without performing a complete analysis",
"aad", " [len]", "analyze data references to code",
"aae", " [len] ([addr])", "analyze references with ESIL (optionally to address)",
"aaef", "", "analyze references with ESIL in all functions",
"aaf", "[?][efrt] ", "analyze all functions relationships with flags, type matching and consecutive",
"aaF", " [sym*]", "set anal.in=block for all the spaces between flags matching glob",
"aaFa", " [sym*]", "same as aaF but uses af/a2f instead of af+/afb+ (slower but more accurate)",
"aai", "[j]", "show info of all analysis parameters",
"aan", "[?][gr]", "autoname functions (aang = golang, aanr = noreturn propagation)",
"aao", "", "analyze all objc references",
"aap", "", "find and analyze function preludes",
"aar", "[?] [len]", "analyze len bytes of instructions for references",
"aas", " [len]", "analyze symbols (af @@= `isq~[0]`)",
"aaS", "", "analyze all flags starting with sym. (af @@ sym.*)",
"aat", " [fcn]", "Analyze all/given function to convert immediate to linked structure offsets (see tl?)",
"aaT", " [len]", "analyze code after trap-sleds",
"aau", " [len]", "list mem areas (larger than len bytes) not covered by functions",
"aav", " [sat]", "find values referencing a specific section or map",
"aaw", "", "analyze all meta words (Cd) and add r. named flags for referenced pointers",
NULL
};
static const char *help_msg_afls[] = {
"Usage:", "afls", "[afls] # sort function list",
"afls", "", "same as aflsa",
"aflsa", "", "sort by address (same as afls)",
"aflss", "", "sort by size",
"aflsn", "", "sort by name",
"aflsb", "", "sort by number of basic blocks",
NULL
};
static const char *help_msg_ai[] = {
"Usage:", "ai", "[j*] [sz] # analysis/address information/imports",
"ai", " @addr", "show address information",
"aii", " [namespace]", "global import (like afii, but global)",
"aii", "-", "delete all global imports",
"aij", " @addr", "show address information in JSON format",
NULL
};
static const char *help_msg_aar[] = {
"Usage:", "aar", "[j*] [sz] # search and analyze xrefs",
"aar", " [sz]", "analyze xrefs in current section or sz bytes of code",
"aar*", " [sz]", "list found xrefs in radare commands format",
"aarj", " [sz]", "list found xrefs in JSON format",
NULL
};
static const char *help_msg_ab[] = {
"Usage:", "ab", "# analyze basic block",
"ab", " [addr]", "show basic block information at given address",
"ab.", "", "same as: ab $$",
"ab-", "[addr]", "delete basic block at given address",
"aba", " [addr]", "analyze esil accesses in basic block (see aea?)",
"abb", " [length]", "analyze N bytes and extract basic blocks",
"abj", " [addr]", "display basic block information in JSON",
"abl", "[?] [.-cqj]", "list all basic blocks",
"abx", " [hexpair-bytes]", "analyze N bytes",
"abt", "[?] [addr] [num]", "find num paths from current offset to addr",
NULL
};
static const char *help_msg_abl[] = {
"Usage:", "abl", "analyzed basicblocks listing",
"abl", "", "list all program-wide basic blocks analyzed",
"abl,", " [table-query]", "render the list using a table",
"ablc", "", "count how many basic blocks are registered",
"ablj", "", "in json format",
"ablq", "", "in quiet format",
NULL
};
static const char *help_msg_abt[] = {
"Usage:", "abt", "[addr] [num] # find num paths from current offset to addr",
"abt", " [addr] [num]", "find num paths from current offset to addr",
"abte", " [addr]", "emulate from beginning of function to the given address",
"abtj", " [addr] [num]", "display paths in JSON",
NULL
};
static const char *help_msg_ac[] = {
"Usage:", "ac", "anal classes commands",
"acl", "[j*]", "list all classes",
"acll", "[j] (class_name)", "list all or single class detailed",
"ac", " [class name]", "add class",
"ac-", " [class name]", "delete class",
"acn", " [class name] [new class name]", "rename class",
"acv", " [class name] [addr] ([offset]) ([size])", "add vtable address to class",
"acvf", " [offset] ([class name])", "lookup function address on vtable offset",
"acv-", " [class name] [vtable id]", "delete vtable by id (from acv [class name])",
"acb", " [class name]", "list bases of class",
"acb", " [class name] [base class name] ([offset])", "add base class",
"acb-", " [class name] [base class id]", "delete base by id (from acb [class name])",
"acm", " [class name] [method name] [offset] ([vtable offset])", "add/edit method",
"acm-", " [class name] [method name]", "delete method",
"acmn", " [class name] [method name] [new name]", "rename method",
"acg", "", "print inheritance ascii graph",
"ac?", "", "show this help",
NULL
};
static const char *help_msg_ad[] = {
"Usage:", "ad", "[kt] [...]",
"ad", " [N] [D]", "analyze N data words at D depth",
"ad4", " [N] [D]", "analyze N data words at D depth (asm.bits=32)",
"ad8", " [N] [D]", "analyze N data words at D depth (asm.bits=64)",
"adf", "", "analyze data in function (use like .adf @@=`afl~[0]`",
"adfg", "", "analyze data in function gaps",
"adt", "", "analyze data trampolines (wip)",
"adk", "", "analyze data kind (code, text, data, invalid, ...)",
NULL
};
static const char *help_msg_aes[] = {
"Usage:", "aes[pbosu]", "esil stepping utilities",
"aesp", " [X] [N]", "evaluate N instr from offset X",
"aesb", "", "step back",
"aeso", " ", "step over",
"aesou", " [addr]", "step over until given address",
"aess", " ", "step skip (in case of CALL, just skip, instead of step into)",
"aesu", " [addr]", "step until given address",
"aesue", " [esil]", "step until esil expression match",
"aesuo", " [optype]", "step until given opcode type",
NULL
};
static const char *help_msg_aei[] = {
"Usage:", "aei", "[smp] [...]",
"aei", "", "initialize ESIL VM state (aei- to deinitialize)",
"aeis", " argc [argv] [envp]", "initialize entrypoint stack environment",
"aeim", " [addr] [size] [name]", "initialize ESIL VM stack (aeim- remove)",
"aeip", "", "initialize ESIL program counter to curseek",
NULL
};
static const char *help_msg_ae[] = {
"Usage:", "ae[idesr?] [arg]", "ESIL code emulation",
"ae", " [expr]", "evaluate ESIL expression",
"ae?", "", "show this help",
"ae??", "", "show ESIL help",
"aea", "[f] [count]", "analyse n esil instructions accesses (regs, mem..)",
"aeA", "[f] [count]", "analyse n bytes for their esil accesses (regs, mem..)",
"aeC", "[arg0 arg1..] @ addr", "appcall in esil",
"aec", "[?]", "continue until ^C",
"aef", " [addr]", "emulate function",
"aefa", " [addr]", "emulate function to find out args in given or current offset",
"aeg", " [expr]", "esil data flow graph",
"aegf", " [expr] [register]", "esil data flow graph filter",
"aei", "[?]", "initialize ESIL VM state (aei- to deinitialize)",
"aek", " [query]", "perform sdb query on ESIL.info",
"aek-", "", "resets the ESIL.info sdb instance",
"aeL", "", "list ESIL plugins",
"aep", "[?] [addr]", "manage esil pin hooks (see 'e cmd.esil.pin')",
"aepc", " [addr]", "change esil PC to this address",
"aer", " [..]", "handle ESIL registers like 'ar' or 'dr' does",
"aes", "[?]", "perform emulated debugger step",
#if 0
#endif
"aets", "[?]", "ESIL Trace session",
"aev", " [esil]", "visual esil debugger for the given expression or current instruction",
"aex", " [hex]", "evaluate opcode expression",
NULL
};
static const char *help_detail_ae[] = {
"Examples:", "ESIL", " examples and documentation",
"=", "", "assign updating internal flags",
":=", "", "assign without updating internal flags",
"+=", "", "A+=B => B,A,+=",
"+", "", "A=A+B => B,A,+,A,=",
"++", "", "increment, 2,A,++ == 3 (see rsi,--=[1], ... )",
"--", "", "decrement, 2,A,-- == 1",
"*=", "", "A*=B => B,A,*=",
"/=", "", "A/=B => B,A,/=",
"%=", "", "A%=B => B,A,%=",
"&=", "", "and ax, bx => bx,ax,&=",
"|", "", "or r0, r1, r2 => r2,r1,|,r0,=",
"!=", "", "negate all bits",
"^=", "", "xor ax, bx => bx,ax,^=",
"", "[]", "mov eax,[eax] => eax,[],eax,=",
"=", "[]", "mov [eax+3], 1 => 1,3,eax,+,=[]",
"=", "[1]", "mov byte[eax],1 => 1,eax,=[1]",
"=", "[8]", "mov [rax],1 => 1,rax,=[8]",
"[]", "", "peek from random position",
"[N]", "", "peek word of N bytes from popped address",
"[*]", "", "peek some from random position",
"=", "[*]", "poke some at random position",
"$", "", "int 0x80 => 0x80,$",
"$$", "", "simulate a hardware trap",
"==", "", "pops twice, compare and update esil flags",
"<", "", "compare for smaller",
"<=", "", "compare for smaller or equal",
">", "", "compare for bigger",
">=", "", "compare bigger for or equal",
">>=", "", "shr ax, bx => bx,ax,>>= # shift right",
"<<=", "", "shl ax, bx => bx,ax,<<= # shift left",
">>>=", "", "ror ax, bx => bx,ax,>>>= # rotate right",
"<<<=", "", "rol ax, bx => bx,ax,<<<= # rotate left",
"?{", "", "if popped value != 0 run the block until }",
"POP", "", "drops last element in the esil stack",
"DUP", "", "duplicate last value in stack",
"NUM", "", "evaluate last item in stack to number",
"SWAP", "", "swap last two values in stack",
"TRAP", "", "stop execution",
"BITS", "", "16,BITS # change bits, useful for arm/thumb",
"TODO", "", "the instruction is not yet esilized",
"STACK", "", "show contents of stack",
"CLEAR", "", "clears the esil stack",
"REPEAT", "", "repeat n times",
"BREAK", "", "terminates the string parsing",
"SETJT", "", "set jump target",
"SETJTS", "", "set jump target set",
"SETD", "", "set delay slot",
"GOTO", "", "jump to the Nth word popped from the stack",
"$", "", "esil interrupt",
"$z", "", "internal flag: zero",
"$c", "", "internal flag: carry",
"$b", "", "internal flag: borrow",
"$p", "", "internal flag: parity",
"$s", "", "internal flag: sign",
"$o", "", "internal flag: overflow",
"$ds", "", "internal flag: delay-slot",
"$jt", "", "internal flag: jump-target",
"$js", "", "internal flag: jump-target-set",
// DEPRECATED "$r", "", "internal flag: jump-sign",
"$$", "", "internal flag: pc address",
NULL
};
static const char *help_msg_aea[] = {
"Examples:", "aea", " show regs and memory accesses used in a range",
"aea", " [ops]", "Show regs/memory accesses used in N instructions ",
"aea*", " [ops]", "Create mem.* flags for memory accesses",
"aeab", "", "Show regs used in current basic block",
"aeaf", "", "Show regs used in current function",
"aear", " [ops]", "Show regs read in N instructions",
"aeaw", " [ops]", "Show regs written in N instructions",
"aean", " [ops]", "Show regs not written in N instructions",
"aeaj", " [ops]", "Show aea output in JSON format",
"aeA", " [len]", "Show regs used in N bytes (subcommands are the same)",
"Legend:", "", "",
"I", "", "input registers (read before being set)",
"A", "", "all regs accessed",
"R", "", "register values read",
"W", "", "registers written",
"N", "", "read but never written",
"V", "", "values",
"@R", "", "memreads",
"@W", "", "memwrites",
"NOTE:", "", "mem{reads,writes} with PIC only fetch the offset",
NULL
};
static const char *help_msg_aec[] = {
"Examples:", "aec", " continue until ^c",
"aec", "", "Continue until exception",
"aecs", "", "Continue until syscall",
"aecc", "", "Continue until call",
"aecu", "[addr]", "Continue until address",
"aecue", "[addr]", "Continue until esil expression",
NULL
};
static const char *help_msg_aeC[] = {
"Examples:", "aeC", " arg0 arg1 ... @ calladdr",
"aeC", " 1 2 @ sym._add", "Call sym._add(1,2)",
NULL
};
static const char *help_msg_aeg[] = {
"Usage:", "aeg[cfiv*]", " [...]",
"aeg", "", "analyze current instruction as an esil graph",
"aegf", "", "analyze given expression and filter for register",
"aeg*", "", "analyze current instruction as an esil graph",
"aegv", "", "analyse and launch the visual interactive mode (.aeg*;aggv == aegv)",
NULL
};
static const char *help_msg_aep[] = {
"Usage:", "aep[-*c] ", " [...]",
"aepc", " [addr]", "change program counter for esil",
"aep*", "", "list pins in r2 commands",
"aep-", "*", "remove all pins",
"aep-", "[addr]", "remove pin",
"aep", " [name] @ [addr]", "set pin",
"aep", "", "list pins",
NULL
};
static const char *help_msg_aets[] = {
"Usage:", "aets ", " [...]",
"aets+", "", "Start ESIL trace session",
"aets-", "", "Stop ESIL trace session",
NULL
};
static const char *help_msg_af[] = {
"Usage:", "af", "",
"af", " ([name]) ([addr])", "analyze functions (start at addr or $$)",
"afr", " ([name]) ([addr])", "analyze functions recursively",
"af+", " addr name [type] [diff]", "hand craft a function (requires afb+)",
"af-", " [addr]", "clean all function analysis data (or function at addr)",
"afa", "", "analyze function arguments in a call (afal honors dbg.funcarg)",
"afb+", " fcnA bbA sz [j] [f] ([t]( [d]))", "add bb to function @ fcnaddr",
"afb", "[?] [addr]", "List basic blocks of given function",
"afbF", "([0|1])", "Toggle the basic-block 'folded' attribute",
"afB", " 16", "set current function as thumb (change asm.bits)",
"afC[lc]", " ([addr])@[addr]", "calculate the Cycles (afC) or Cyclomatic Complexity (afCc)",
"afc", "[?] type @[addr]", "set calling convention for function",
"afd", "[addr]","show function + delta for given offset",
"afF", "[1|0|]", "fold/unfold/toggle",
"afi", " [addr|fcn.name]", "show function(s) information (verbose afl)",
"afj", " [tableaddr] [elem_sz] [count] [seg]", "analyze function jumptable (adding seg to each elem)",
"afl", "[?] [ls*] [fcn name]", "list functions (addr, size, bbs, name) (see afll)",
"afm", " name", "merge two functions",
"afM", " name", "print functions map",
"afn", "[?] name [addr]", "rename name for function at address (change flag too)",
"afna", "", "suggest automatic name for current offset",
"afo", "[?j] [fcn.name]", "show address for the function name or current offset",
"afs", "[!] ([fcnsign])", "get/set function signature at current address (afs! uses cfg.editor)",
"afS", "[stack_size]", "set stack frame size for function at current address",
"afsr", " [function_name] [new_type]", "change type for given function",
"aft", "[?]", "type matching, type propagation",
"afu", " addr", "resize and analyze function from current address until addr",
"afv[absrx]", "?", "manipulate args, registers and variables in function",
"afx", "[m]", "list function references",
NULL
};
static const char *help_msg_afb[] = {
"Usage:", "afb", " List basic blocks of given function",
".afbr-", "", "Set breakpoint on every return address of the function",
".afbr-*", "", "Remove breakpoint on every return address of the function",
"afb", " [addr]", "list basic blocks of function",
"afb.", " [addr]", "show info of current basic block",
"afb=", "", "display ascii-art bars for basic block regions",
"afb+", " fcn_at bbat bbsz [jump] [fail] ([diff])", "add basic block by hand",
"afbc", " [color] ([addr])", "colorize basic block",
"afbe", " bbfrom bbto", "add basic-block edge for switch-cases",
"afbi", "[j]", "print current basic block information",
"afbj", " [addr]", "show basic blocks information in json",
"afbr", "", "Show addresses of instructions which leave the function",
"afbt", "", "Show basic blocks of current function in a table",
"afB", " [bits]", "define asm.bits for the given function",
NULL
};
static const char *help_msg_afc[] = {
"Usage:", "afc[agl?]", "# see also tcc command to manage all calling conventions",
"afc", " ccname", "Manually set calling convention for current function",
"afc", "", "Show Calling convention for the Current function (same as tcc)",
"afcr", "[j]", "Show register usage for the current function",
"afca", "", "Analyse function for finding the current calling convention",
"afcf", "[j] [name]", "Prints return type function(arg1, arg2...), see afij",
"afck", "", "List SDB details of call loaded calling conventions",
"afcl", "", "List all available calling conventions",
"afco", " path", "Open Calling Convention sdb profile from given path",
"afcR", "", "Register telescoping using the calling conventions order",
NULL
};
static const char *help_msg_afC[] = {
"Usage:", "afC", " [addr]",
"afC", "", "function cycles cost",
"afCc", "", "cyclomatic complexity",
"afCl", "", "loop count (backward jumps)",
NULL
};
static const char *help_msg_afi[] = {
"Usage:", "afi[jlp*]", " <addr>",
"afi", "", "show information of the function",
"afii", "[-][import]", "show/add/delete imports used in function",
"afi.", "", "show function name in current offset",
"afi*", "", "function, variables and arguments",
"afij", "", "function info in json format",
"afil", "", "verbose function info",
"afip", "", "show whether the function is pure or not",
"afis", "", "show function stats (opcode, meta)",
NULL
};
static const char *help_msg_afl[] = {
"Usage:", "afl", " List all functions",
"afl", "", "list functions",
"afl.", "", "display function in current offset (see afi.)",
"afl+", "", "display sum all function sizes",
"afl=", "", "display ascii-art bars with function ranges",
"aflc", "", "count of functions",
"aflj", "", "list functions in json",
"aflt", " [query]", "list functions in table format",
"afll", " [column]", "list functions in verbose mode (sorted by column name)",
"afllj", "", "list functions in verbose mode (alias to aflj)",
"aflm", "", "list functions in makefile style (af@@=`aflm~0x`)",
"aflq", "", "list functions in quiet mode",
"aflqj", "", "list functions in json quiet mode",
"afls", "[?asn]", "sort function list by address, size or name",
NULL
};
static const char *help_msg_afll[] = {
"Usage:", "", " List functions in verbose mode",
"", "", "",
"Table fields:", "", "",
"", "", "",
"address", "", "start address",
"size", "", "function size (realsize)",
"nbbs", "", "number of basic blocks",
"edges", "", "number of edges between basic blocks",
"cc", "", "cyclomatic complexity ( cc = edges - blocks + 2 * exit_blocks)",
"cost", "", "cyclomatic cost",
"min bound", "", "minimal address",
"range", "", "function size",
"max bound", "", "maximal address",
"calls", "", "number of caller functions",
"locals", "", "number of local variables",
"args", "", "number of function arguments",
"xref", "", "number of cross references",
"frame", "", "function stack size",
"name", "", "function name",
NULL
};
static const char *help_msg_afn[] = {
"Usage:", "afn[sa]", " Analyze function names",
"afn", " [name]", "rename the function",
"afn", " base64:encodedname", "rename the function",
"afn.", "", "same as afn without arguments. show the function name in current offset",
"afna", "", "construct a function name for the current offset",
"afns", "", "list all strings associated with the current function",
"afnsj", "", "list all strings associated with the current function in JSON format",
NULL
};
static const char *help_msg_afs[] = {
"Usage:", "afs[r]", " Analyze function signatures",
"afs", "[!] ([fcnsign])", "get/set function signature at current address (afs! uses cfg.editor)",
"afs*", " ([signame])", "get function signature in flags",
"afsj", " ([signame])", "get function signature in JSON",
"afsr", " [function_name] [new_type]", "change type for given function",
NULL
};
static const char *help_msg_aft[] = {
"Usage:", "aft", "",
"aft", "", "type matching analysis for current function",
NULL
};
static const char *help_msg_afv[] = {
"Usage:", "afv","[rbs]",
"afv*", "", "output r2 command to add args/locals to flagspace",
"afv-", "([name])", "remove all or given var",
"afv=", "", "list function variables and arguments with disasm refs",
"afva", "", "analyze function arguments/locals",
"afvb", "[?]", "manipulate bp based arguments/locals",
"afvd", " name", "output r2 command for displaying the value of args/locals in the debugger",
"afvf", "", "show BP relative stackframe variables",
"afvn", " [new_name] ([old_name])", "rename argument/local",
"afvr", "[?]", "manipulate register based arguments",
"afvR", " [varname]", "list addresses where vars are accessed (READ)",
"afvs", "[?]", "manipulate sp based arguments/locals",
"afvt", " [name] [new_type]", "change type for given argument/local",
"afvW", " [varname]", "list addresses where vars are accessed (WRITE)",
"afvx", "", "show function variable xrefs (same as afvR+afvW)",
NULL
};
static const char *help_msg_afvb[] = {
"Usage:", "afvb", " [idx] [name] ([type])",
"afvb", "", "list base pointer based arguments, locals",
"afvb*", "", "same as afvb but in r2 commands",
"afvb", " [idx] [name] ([type])", "define base pointer based arguments, locals",
"afvbj", "", "return list of base pointer based arguments, locals in JSON format",
"afvb-", " [name]", "delete argument/locals at the given name",
"afvbg", " [idx] [addr]", "define var get reference",
"afvbs", " [idx] [addr]", "define var set reference",
NULL
};
static const char *help_msg_afvr[] = {
"Usage:", "afvr", " [reg] [type] [name]",
"afvr", "", "list register based arguments",
"afvr*", "", "same as afvr but in r2 commands",
"afvr", " [reg] [name] ([type])", "define register arguments",
"afvrj", "", "return list of register arguments in JSON format",
"afvr-", " [name]", "delete register arguments at the given index",
"afvrg", " [reg] [addr]", "define argument get reference",
"afvrs", " [reg] [addr]", "define argument set reference",
NULL
};
static const char *help_msg_afvs[] = {
"Usage:", "afvs", " [idx] [type] [name]",
"afvs", "", "list stack based arguments and locals",
"afvs*", "", "same as afvs but in r2 commands",
"afvs", " [idx] [name] [type]", "define stack based arguments,locals",
"afvsj", "", "return list of stack based arguments and locals in JSON format",
"afvs-", " [name]", "delete stack based argument or locals with the given name",
"afvsg", " [idx] [addr]", "define var get reference",
"afvss", " [idx] [addr]", "define var set reference",
NULL
};
static const char *help_msg_ag[] = {
"Usage:", "ag<graphtype><format> [addr]", "",
"Graph commands:", "", "",
"aga", "[format]", "Data references graph",
"agA", "[format]", "Global data references graph",
"agc", "[format]", "Function callgraph",
"agC", "[format]", "Global callgraph",
"agd", "[format] [fcn addr]", "Diff graph",
"agf", "[format]", "Basic blocks function graph",
"agi", "[format]", "Imports graph",
"agr", "[format]", "References graph",
"agR", "[format]", "Global references graph",
"agx", "[format]", "Cross references graph",
"agg", "[format]", "Custom graph",
"ag-", "", "Clear the custom graph",
"agn", "[?] title body", "Add a node to the custom graph",
"age", "[?] title1 title2", "Add an edge to the custom graph",
"","","",
"Output formats:", "", "",
"<blank>", "", "Ascii art",
"*", "", "r2 commands",
"b", "", "Braile art rendering (agfb)",
"d", "", "Graphviz dot",
"g", "", "Graph Modelling Language (gml)",
"j", "", "json ('J' for formatted disassembly)",
"k", "", "SDB key-value",
"t", "", "Tiny ascii art",
"v", "", "Interactive ascii art",
"w", " [path]", "Write to path or display graph image (see graph.gv.format and graph.web)",
NULL
};
static const char *help_msg_age[] = {
"Usage:", "age [title1] [title2]", "",
"Examples:", "", "",
"age", " title1 title2", "Add an edge from the node with \"title1\" as title to the one with title \"title2\"",
"age", " \"title1 with spaces\" title2", "Add an edge from node \"title1 with spaces\" to node \"title2\"",
"age-", " title1 title2", "Remove an edge from the node with \"title1\" as title to the one with title \"title2\"",
"ageh", "", "List all the highlighted edges",
"ageh", " nodeA nodeB", "Highlight edge between nodeA and nodeB",
"ageh-", " nodeA nodeB", "Highlight edge between nodeA and nodeB",
"age?", "", "Show this help",
NULL
};
static const char *help_msg_agn[] = {
"Usage:", "agn [title] [body]", "",
"Examples:", "", "",
"agn", " title1 body1", "Add a node with title \"title1\" and body \"body1\"",
"agn", " \"title with space\" \"body with space\"", "Add a node with spaces in the title and in the body",
"agn", " title1 base64:Ym9keTE=", "Add a node with the body specified as base64",
"agn-", " title1", "Remove a node with title \"title1\"",
"agn?", "", "Show this help",
NULL
};
static const char *help_msg_ah[] = {
"Usage:", "ah[lba-]", "Analysis Hints",
"ah?", "", "show this help",
"ah?", " offset", "show hint of given offset",
"ah", "", "list hints in human-readable format",
"ah.", "", "list hints in human-readable format from current offset",
"ah-", "", "remove all hints",
"ah-", " offset [size]", "remove hints at given offset",
"ah*", " offset", "list hints in radare commands format",
"aha", " ppc @ 0x42", "force arch ppc for all addrs >= 0x42 or until the next hint",
"aha", " 0 @ 0x84", "disable the effect of arch hints for all addrs >= 0x84 or until the next hint",
"ahb", "[-*] [8,16,32,64] @ 0x42", "get/set asm.bits for given address and beyond",
"ahc", " 0x804804", "override call/jump address",
"ahd", " foo a0,33", "replace opcode string",
"ahe", " 3,eax,+=", "set vm analysis string",
"ahf", " 0x804840", "override fallback address for call",
"ahF", " 0x10", "set stackframe size at current offset",
"ahh", " 0x804840", "highlight this address offset in disasm",
"ahi", "[?] 10", "define numeric base for immediates (2, 8, 10, 10u, 16, i, p, S, s)",
"ahj", "", "list hints in JSON",
"aho", " call", "change opcode type (see aho?) (deprecated, moved to \"ahd\")",
"ahp", " addr", "set pointer hint",
"ahr", " val", "set hint for return value of a function",
"ahs", " 4", "set opcode size=4",
"ahS", " jz", "set asm.syntax=jz for this opcode",
"aht", "[s][?] <type>", "Mark immediate as a type offset (deprecated, moved to \"aho\")",
"ahv", " val", "change opcode's val field (useful to set jmptbl sizes in jmp rax)",
NULL
};
static const char *help_msg_aho[] = {
"Usage:", "aho [optype] [@ addr]", " Define opcode type hint",
"aho", " nop", "change the opcode type in current address to be considered a NOP",
"aho", "", "show the current opcode hint if any",
"aho-", "$$", "delete hints in current offset",
"aho*", "", "same as above but in r2 commands syntax",
NULL
};
static const char *help_msg_ahb[] = {
"Usage:", "ahb [8|16|32|64] [@ addr]", " Define asm.bits hint at given address",
"ahb", " 16", "set asm.bits=16 in the given address",
"ahb", "", "get asm.bits used in given addr (current seek)",
"ahb", "-$$", "delete all the hints in the given address",
"ahb*", "", "show defined bits hints as r2 commands",
NULL
};
static const char *help_msg_ahr[] = {
"Usage:", "ahr addr", " Set instruction as return type (similar to 'aho ret'?)",
"ahr", " $$", "current instruction may be considered as the end of a function",
NULL
};
static const char *help_msg_ahi[] = {
"Usage:", "ahi [2|8|10|10u|16|bodhipSs] [@ offset]", " Define numeric base",
"ahi", " <base>", "set numeric base (2, 8, 10, 16)",
"ahi", " 10|d", "set base to signed decimal (10), sign bit should depend on receiver size",
"ahi", " 10u|du", "set base to unsigned decimal (11)",
"ahi", " b", "set base to binary (2)",
"ahi", " o", "set base to octal (8)",
"ahi", " h", "set base to hexadecimal (16)",
"ahi", " i", "set base to IP address (32)",
"ahi", " p", "set base to htons(port) (3)",
"ahi", " S", "set base to syscall (80)",
"ahi", " s", "set base to string (1)",
"ahi1", " 10", "set base of argument 1 to base 10 (same as ahi1 d)",
NULL
};
static const char *help_msg_aht[] = {
"Usage:", "aht[s] [addr|type]", "Mark immediate as type offset (moved to aho)",
"ahts", " <offset>", "List all matching structure offsets",
"aht", " <struct.member>", "Change immediate to structure offset",
"aht?", "", "show this help",
NULL
};
static const char *help_msg_aot[] = {
"Usage:", "aot[l]", "list opcode types",
"aot", "", "show type of the current instruction",
"aotl", "", "list all possible opcode types (See /atl)",
NULL
};
static const char *help_msg_aom[] = {
"Usage:", "aom[ljd] [arg]", "List opcode mnemonics",
"aom", "", "show instruction mnemonic",
"aom.", "", "show instruction mnemonic in current address",
"aoml", "", "list all mnemonics",
"aomj", "", "list in json format (TODO: add instruction description too?)",
"aomd", "", "verbose mnemonic listing with instruction description",
NULL
};
static const char *help_msg_ao[] = {
"Usage:", "ao[e?] [len]", "Analyze Opcodes",
"aoj", " N", "display opcode analysis information in JSON for N opcodes",
"aoe", " N", "display esil form for N opcodes",
"aoeq", " N", "display only the esil expression of N opcodes",
"aoef", " expr", "filter esil expression of opcode by given output",
"aos", " N", "display size of N opcodes",
"aom", "[?] [id]", "list current or all mnemonics for current arch",
"aod", " [mnemonic]", "describe opcode for asm.arch",
"aoda", "", "show all mnemonic descriptions",
"aoc", " [cycles]", "analyze which op could be executed in [cycles]",
"aot", "[?]", "list all opcode types",
"ao", " 5", "display opcode analysis of 5 opcodes",
"ao*", "", "display opcode in r commands",
NULL
};
static const char *help_msg_ar[] = {
"Usage: ar", "", "# Analysis Registers",
"ar", "", "Show 'gpr' registers",
"ar.", ">$snapshot", "Show r2 commands to set register values to the current state",
"ar,", "", "Show registers in table format (see dr,)",
".ar*", "", "Import register values as flags",
".ar-", "", "Unflag all registers",
"ar0", "", "Reset register arenas to 0",
"ara", "[?]", "Manage register arenas",
"arj", "", "Show 'gpr' registers in JSON format",
"arA", "", "Show values of function argument calls (A0, A1, A2, ..)",
"ar", " 16", "Show 16 bit registers",
"ar", " 32", "Show 32 bit registers",
"ar", " all", "Show all bit registers",
"ar", " <type>", "Show all registers of given type",
"arC", "", "Display register profile comments",
"arr", "", "Show register references (telescoping)",
"arrj", "", "Show register references (telescoping) in JSON format",
"ar=", "([size])(:[regs])", "Show register values in columns",
"ar?", " <reg>", "Show register value",
"arb", " <type>", "Display hexdump of the given arena",
"arc", "[cq=] <name>", "Conditional flag registers",
"arcc", "", "Derive calling convention from the register profile",
"ard", " <name>", "Show only different registers",
"arn", " <regalias>", "Get regname for pc,sp,bp,a0-3,zf,cf,of,sg",
"aro", "", "Show old (previous) register values",
"arp", "[?] <file>", "Load register profile from file",
"ars", "", "Stack register state",
"arS", "", "Show the size of the register profile",
"art", "", "List all register types",
"arw", " <hexnum>", "Set contents of the register arena",
NULL
};
static const char *help_msg_ara[] = {
"Usage:", "ara[+-s]", "Register Arena Push/Pop/Swap",
"ara", "", "show all register arenas allocated",
"ara", "+", "push a new register arena for each type",
"ara", "-", "pop last register arena",
"aras", "", "swap last two register arenas",
NULL
};
static const char *help_msg_arw[] = {
"Usage:", "arw ", "# Set contents of the register arena",
"arw", " <hexnum>", "Set contents of the register arena",
NULL
};
static const char *help_msg_as[] = {
"Usage: as[ljk?]", "", "syscall name <-> number utility",
"as", "", "show current syscall and arguments",
"as", " 4", "show syscall 4 based on asm.os and current regs/mem",
"asc[a]", " 4", "dump syscall info in .asm or .h",
"asj", "", "list of syscalls in JSON",
"asl", "", "list of syscalls by asm.os and asm.arch",
"asl", " close", "returns the syscall number for close",
"asl", " 4", "returns the name of the syscall number 4",
"ask", " [query]", "perform syscall/ queries",
NULL
};
static const char *help_msg_av[] = {
"Usage:", "av[?jr*]", " C++ vtables and RTTI",
"av", "", "search for vtables in data sections and show results",
"avj", "", "like av, but as json",
"av*", "", "like av, but as r2 commands",
"avr", "[j@addr]", "try to parse RTTI at vtable addr (see anal.cpp.abi)",
"avra", "[j]", "search for vtables and try to parse RTTI at each of them",
"avrr", "", "recover class info from all findable RTTI (see ac)",
"avrD", " [classname]", "demangle a class name from RTTI",
NULL
};
static const char *help_msg_ax[] = {
"Usage:", "ax[?d-l*]", " # see also 'afx?'",
"ax", "", "list refs",
"ax*", "", "output radare commands",
"ax", " addr [at]", "add code ref pointing to addr (from curseek)",
"ax-", " [at]", "clean all refs/refs from addr",
"ax-*", "", "clean all refs/refs",
"axc", " addr [at]", "add generic code ref",
"axC", " addr [at]", "add code call ref",
"axg", " [addr]", "show xrefs graph to reach current function",
"axg*", " [addr]", "show xrefs graph to given address, use .axg*;aggv",
"axgj", " [addr]", "show xrefs graph to reach current function in json format",
"axd", " addr [at]", "add data ref",
"axq", "", "list refs in quiet/human-readable format",
"axj", "", "list refs in json format",
"axF", " [flg-glob]", "find data/code references of flags",
"axm", " addr [at]", "copy data/code references pointing to addr to also point to curseek (or at)",
"axt", "[?] [addr]", "find data/code references to this address",
"axl", "[cq]", "list xrefs (axlc = count, axlq = quiet)",
"axf", "[?] [addr]", "find data/code references from this address",
"axv", "[?] [addr]", "list local variables read-write-exec references",
"ax.", " [addr]", "find data/code references from and to this address",
"axff[j]", " [addr]", "find data/code references from this function",
"axs", " addr [at]", "add string ref",
NULL
};
static const char *help_msg_axl[]= {
"Usage:", "axl[cq]", "show global xrefs",
"axl", "", "list all xrefs",
"axlc", "", "count how many xrefs are registered",
"axlq", "", "list xrefs in quiet mode (axq)",
NULL
};
static const char *help_msg_axv[]= {
"Usage:", "axv[?j]", "show xrefs to local variables in current function",
"axv", " ([addr])", "optionally you can specify address instead of current seek",
"axvj", " ([addr])", "show in json",
NULL
};
static const char *help_msg_axt[]= {
"Usage:", "axt[?gq*]", "find data/code references to this address",
"axtj", " [addr]", "find data/code references to this address and print in json format",
"axtg", " [addr]", "display commands to generate graphs according to the xrefs",
"axtq", " [addr]", "find and list the data/code references in quiet mode",
"axtm", " [addr]", "show xrefs to in 'make' syntax (see aflm and axfm)",
"axt*", " [addr]", "same as axt, but prints as r2 commands",
NULL
};
static const char *help_msg_axf[]= {
"Usage:", "axf[?gq*]", "find data/code references from this address",
"axfj", " [addr]", "find data/code references to this address and print in json format",
"axfg", " [addr]", "display commands to generate graphs according to the xrefs",
"axfq", " [addr]", "find and list the data/code references in quiet mode",
"axfm", " [addr]", "show refs to in 'make' syntax (see aflm and axtm)",
"axf*", " [addr]", "same as axt, but prints as r2 commands",
NULL
};
static int cmpname(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
return (int)strcmp (a->name, b->name);
}
static int cmpsize(const void *a, const void *b) {
ut64 sa = (int) r_anal_function_linear_size ((RAnalFunction *) a);
ut64 sb = (int) r_anal_function_linear_size ((RAnalFunction *) b);
return (sa > sb)? -1: (sa < sb)? 1 : 0;
}
static int cmpbbs(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
int la = (int)r_list_length (a->bbs);
int lb = (int)r_list_length (b->bbs);
return (la > lb)? -1: (la < lb)? 1 : 0;
}
static int cmpaddr(const void *_a, const void *_b) {
const RAnalFunction *a = _a, *b = _b;
return (a->addr > b->addr)? 1: (a->addr < b->addr)? -1: 0;
}
static bool listOpDescriptions(void *_core, const char *k, const char *v) {
r_cons_printf ("%s=%s\n", k, v);
return true;
}
/* better aac for windows-x86-32 */
#define JAYRO_03 0
#if JAYRO_03
static bool anal_is_bad_call(RCore *core, ut64 from, ut64 to, ut64 addr, ut8 *buf, int bufi) {
ut64 align = R_ABS (addr % PE_ALIGN);
ut32 call_bytes;
// XXX this is x86 specific
if (align == 0) {
call_bytes = (ut32)((ut8*)buf)[bufi + 3] << 24;
call_bytes |= (ut32)((ut8*)buf)[bufi + 2] << 16;
call_bytes |= (ut32)((ut8*)buf)[bufi + 1] << 8;
call_bytes |= (ut32)((ut8*)buf)[bufi];
} else {
call_bytes = (ut32)((ut8*)buf)[bufi - align + 3] << 24;
call_bytes |= (ut32)((ut8*)buf)[bufi - align + 2] << 16;
call_bytes |= (ut32)((ut8*)buf)[bufi - align + 1] << 8;
call_bytes |= (ut32)((ut8*)buf)[bufi - align];
}
if (call_bytes >= from && call_bytes <= to) {
return true;