1NAME=got switch cases 2FILE=bins/elf/fedora_32_bin_ls 3CMDS=<<EOF 4aap 5aflc 6EOF 7EXPECT=<<EOF 8440 9EOF 10RUN 11 12NAME=got switch cases 13FILE=bins/elf/game_of_thrones 14CMDS=<<EOF 15s main 16aa > /dev/null 17pdsf~case 18EOF 19EXPECT=<<EOF 200x00401125 switch table (7 cases) at 0x4013e4 21EOF 22RUN 23 24NAME=anal.ijmp missing branch bug 25FILE=- 26CMDS=<<EOF 27e asm.arch=x86 28e asm.bits=64 29wx 564155415453504989ff8b1f8b7f0889de83e61fe851010000418b7f1089dec1ee1083e61fe84001000085db0f8915010000458b77184585f60f84080100004983c71c31db4c8d250a0100004c8d2d07dacd29418b470889c1c1e91880f9040f87d700000049630c8c4c01e1ffe1418b3fc1e8100fb6f0e8ee0000004983c70ce9b700000084c00f84ab000000418b570c4885d2756de99d00000041837f0c000f84920000004d8b2f418b7d00c1e8100fb6f0e8b2000000418b470c83f802722141bc01000000410fb6770a438b7ca500e894000000418b470c49ffc44139c472e585c04c8d256b0000004c8d2d68d9cd297444410fb64f0885c9743b89c248c1e202498b37418b7d00e86d0e0000eb27a8027514418b7d00418b770c498b17e8fefc0000418b4708418b7f0cc1e8100fb6f0e8320000004983c710ffc34439f30f850cffffff4883c4085b415c415d415e415f5dc3 30af 31afb 32EOF 33EXPECT=<<EOF 340x00000000 0x00000032 00:0000 50 j 0x00000147 f 0x00000032 350x00000032 0x0000003f 00:0000 13 j 0x00000147 f 0x0000003f 360x0000003f 0x00000053 00:0000 20 j 0x00000053 370x00000053 0x00000065 00:0000 18 j 0x0000013c f 0x00000065 380x00000065 0x0000006e 00:0000 9 390x0000013c 0x00000147 00:0000 11 j 0x00000053 f 0x00000147 400x00000147 0x00000156 00:0000 15 41EOF 42RUN 43 44NAME=x86_64 getenv this maybe & jmp noret fix 45FILE=bins/elf/ls.odd 46CMDS=<<EOF 47aaa 48s 0x4901 49afb~4901 50?e 51e asm.bytes=false 52s main+98 53pd 3 54EOF 55EXPECT=<<EOF 560x000048f4 0x00004901 00:0000 13 j 0x000045b1 f 0x00004901 570x00004901 0x0000491a 00:0000 25 j 0x000045ba f 0x0000491a 58 59| 0x000039c2 mov dword [0x0021f558], 2 ; [0x21f558:4]=1 60| 0x000039cc call fcn.00015960 61| 0x000039d1 mov byte [0x00220618], 1 ; [0x220618:1]=0 62EOF 63RUN 64 65NAME=x86_64 getenv this maybe 66FILE=bins/mach0/ls-osx-x86_64 67CMDS=<<EOF 68af 69aCe 0x10000143e 70EOF 71EXPECT=<<EOF 72char *getenv("COLUMNS") 73EOF 74RUN 75 76NAME=x86_64 socket syscall 77FILE=bins/elf/socket-syscall 78CMDS=<<EOF 79aa 80aae 81s main 82pd 1 @0x00001140 83aei 84aeim 85aecu 0x00001140 86as 87EOF 88EXPECT=<<EOF 89| ;-- syscall.socket: 90| 0x00001140 0f05 syscall 9141 = socket (0x00000001, 0x00000002, 0x00000003) 92EOF 93RUN 94 95NAME=x86_64 jmptbl -O0 96FILE=bins/mach0/FMS.uu 97CMDS=<<EOF 98s sym._checkinput 99af 100afi* 101EOF 102EXPECT=<<EOF 103"f sym._checkinput 288 0x100000da0" 104"af+ 0x100000da0 sym._checkinput f n" 105afb+ 0x100000da0 0x100000da0 22 0x100000db6 0xffffffffffffffff 106afb+ 0x100000da0 0x100000e99 5 0x100000e9e 0xffffffffffffffff 107afb+ 0x100000da0 0x100000e9e 24 0x100000db6 0x100000eb6 108afb+ 0x100000da0 0x100000db6 26 0x100000e99 0x100000dd0 109afb+ 0x100000da0 0x100000eb6 4 0x100000eba 0xffffffffffffffff 110afb+ 0x100000da0 0x100000dd0 20 0xffffffffffffffff 0xffffffffffffffff 111afb+ 0x100000da0 0x100000de4 16 0x100000dfb 0x100000df4 112afb+ 0x100000da0 0x100000dfb 5 0x100000e99 0xffffffffffffffff 113afb+ 0x100000da0 0x100000df4 7 0x100000dfb 0xffffffffffffffff 114afb+ 0x100000da0 0x100000e00 16 0x100000e1c 0x100000e10 115afb+ 0x100000da0 0x100000e1c 9 0x100000eba 0xffffffffffffffff 116afb+ 0x100000da0 0x100000eba 6 0xffffffffffffffff 0xffffffffffffffff 117afb+ 0x100000da0 0x100000e10 12 0x100000e25 0xffffffffffffffff 118afb+ 0x100000da0 0x100000e25 5 0x100000e99 0xffffffffffffffff 119afb+ 0x100000da0 0x100000e2a 16 0x100000e46 0x100000e3a 120afb+ 0x100000da0 0x100000e46 9 0x100000eba 0xffffffffffffffff 121afb+ 0x100000da0 0x100000e3a 12 0x100000e4f 0xffffffffffffffff 122afb+ 0x100000da0 0x100000e4f 5 0x100000e99 0xffffffffffffffff 123afb+ 0x100000da0 0x100000e54 16 0x100000e82 0x100000e64 124afb+ 0x100000da0 0x100000e82 9 0x100000eba 0xffffffffffffffff 125afb+ 0x100000da0 0x100000e64 16 0x100000e82 0x100000e74 126afb+ 0x100000da0 0x100000e74 14 0x100000e8b 0xffffffffffffffff 127afb+ 0x100000da0 0x100000e8b 5 0x100000e99 0xffffffffffffffff 128afb+ 0x100000da0 0x100000e90 9 0x100000eba 0xffffffffffffffff 129afB 64 @ 0x100000da0 130afc amd64 @ 0x100000da0 131afvb -40 var_28h int64_t @ 0x100000da0 132afvb -32 var_20h int64_t @ 0x100000da0 133afvb -24 var_18h int64_t @ 0x100000da0 134afvb -20 var_14h int64_t @ 0x100000da0 135afvb -16 var_10h int64_t @ 0x100000da0 136afvb -1 var_1h int64_t @ 0x100000da0 137afvr rdi arg1 int64_t @ 0x100000da0 138axd 0x100000ec0 0x100000dd0 139axc 0x100000de4 0x100000de2 140axc 0x100000e00 0x100000de2 141axc 0x100000e2a 0x100000de2 142axc 0x100000e54 0x100000de2 143axc 0x100000e90 0x100000de2 144axc 0x100000e99 0x100000dfb 145axc 0x100000e25 0x100000e17 146axc 0x100000eba 0x100000e20 147axc 0x100000e99 0x100000e25 148axc 0x100000e4f 0x100000e41 149axc 0x100000eba 0x100000e4a 150axc 0x100000e99 0x100000e4f 151axc 0x100000e8b 0x100000e7d 152axc 0x100000eba 0x100000e86 153axc 0x100000e99 0x100000e8b 154axc 0x100000eba 0x100000e94 155axc 0x100000e9e 0x100000e99 156afS 8 @ 0x100000da0 157 158EOF 159RUN 160 161NAME=x86_64 main() jmptbl in bins/elf/ls.odd 162FILE=bins/elf/ls.odd 163CMDS=<<EOF 164e anal.jmp.tbl=true 165s main 166aF 167afb 168EOF 169EXPECT=<<EOF 1700x00003960 0x00003a1f 00:0000 191 j 0x000047a7 f 0x00003a1f 1710x00003a1f 0x00003a24 00:0000 5 j 0x00003a32 f 0x00003a24 1720x00003a24 0x00003a2d 00:0000 9 j 0x0000431a f 0x00003a2d 1730x00003a2d 0x00003a32 00:0000 5 1740x00003a32 0x00003a48 00:0000 22 j 0x00003a48 1750x00003a48 0x00003ad5 00:0000 141 j 0x00003b0b f 0x00003ad5 1760x00003ad5 0x00003af8 00:0000 35 j 0x000047c2 f 0x00003af8 1770x00003af8 0x00003b0b 00:0000 19 j 0x00003b0b 1780x00003b0b 0x00003b2a 00:0000 31 j 0x00003b33 f 0x00003b2a 1790x00003b2a 0x00003b33 00:0000 9 j 0x000047fd f 0x00003b33 1800x00003b33 0x00003b51 00:0000 30 j 0x00003b62 f 0x00003b51 1810x00003b51 0x00003b5b 00:0000 10 j 0x00003b62 f 0x00003b5b 1820x00003b5b 0x00003b62 00:0000 7 j 0x00003b62 1830x00003b62 0x00003b81 00:0000 31 j 0x00003ba7 f 0x00003b81 1840x00003b81 0x00003b9b 00:0000 26 j 0x00004caf f 0x00003b9b 1850x00003b9b 0x00003ba7 00:0000 12 j 0x00003ba7 1860x00003ba7 0x00003bc8 00:0000 33 j 0x00003bc8 1870x00003bc8 0x00003bf4 00:0000 44 j 0x0000437b f 0x00003bf4 1880x00003bf4 0x00003c04 00:0000 16 j 0x00005159 f 0x00003c04 1890x00003c04 0x00003c0e 00:0000 10 s 0x00003eae s 0x000050bf s 0x00005159 s 0x00003e92 s 0x00003e83 s 0x00003e32 s 0x00003e23 s 0x00003e17 s 0x00003e08 s 0x00003dfc s 0x00003ded s 0x00003db8 s 0x00003da9 s 0x00003d9b s 0x00003d8a s 0x00003d7e s 0x00003d6a s 0x00003d25 s 0x00003d11 s 0x00003cfd s 0x00003cf1 s 0x00003ce2 s 0x00003cd1 s 0x00003cc2 s 0x00003cb6 s 0x00003c76 s 0x00003c60 s 0x00003c31 s 0x00003c28 s 0x00003c21 s 0x00003c15 s 0x0000427c s 0x00003c0e s 0x00004266 s 0x00004257 s 0x0000424b s 0x0000423f s 0x00004233 s 0x0000421f s 0x000042ff s 0x000042eb s 0x0000429a s 0x0000428b s 0x0000430e s 0x000041de s 0x0000417f s 0x00004170 s 0x00004161 s 0x0000411e s 0x00004108 s 0x000040fc s 0x000040d1 s 0x00004065 s 0x00004022 s 0x00003fde s 0x00003fd2 s 0x00003fa3 s 0x00003f5b s 0x00003f18 s 0x00003f0c 1900x00003c0e 0x00003c15 00:0000 7 j 0x00003c15 1910x00003c15 0x00003c21 00:0000 12 j 0x00003bc8 1920x00003c21 0x00003c28 00:0000 7 j 0x00003bc8 1930x00003c28 0x00003c31 00:0000 9 j 0x00003bc8 1940x00003c31 0x00003c60 00:0000 47 j 0x00003bc8 1950x00003c60 0x00003c76 00:0000 22 j 0x00003bc8 1960x00003c76 0x00003c97 00:0000 33 j 0x00004d9d f 0x00003c97 1970x00003c97 0x00003cb6 00:0000 31 j 0x00003bc8 1980x00003cb6 0x00003cc2 00:0000 12 j 0x00003bc8 1990x00003cc2 0x00003cd1 00:0000 15 j 0x00003bc8 2000x00003cd1 0x00003ce2 00:0000 17 j 0x00003bc8 2010x00003ce2 0x00003cf1 00:0000 15 j 0x00003bc8 2020x00003cf1 0x00003cfd 00:0000 12 j 0x00003bc8 2030x00003cfd 0x00003d11 00:0000 20 j 0x00003bc8 2040x00003d11 0x00003d25 00:0000 20 j 0x00003bc8 2050x00003d25 0x00003d6a 00:0000 69 j 0x00003bc8 2060x00003d6a 0x00003d7e 00:0000 20 j 0x00003bc8 2070x00003d7e 0x00003d8a 00:0000 12 j 0x00003bc8 2080x00003d8a 0x00003d9b 00:0000 17 j 0x00003bc8 2090x00003d9b 0x00003da9 00:0000 14 j 0x00003bc8 2100x00003da9 0x00003db8 00:0000 15 j 0x00003bc8 2110x00003db8 0x00003ded 00:0000 53 j 0x00003bc8 2120x00003ded 0x00003dfc 00:0000 15 j 0x00003bc8 2130x00003dfc 0x00003e08 00:0000 12 j 0x00003bc8 2140x00003e08 0x00003e17 00:0000 15 j 0x00003bc8 2150x00003e17 0x00003e23 00:0000 12 j 0x00003bc8 2160x00003e23 0x00003e32 00:0000 15 j 0x00003bc8 2170x00003e32 0x00003e83 00:0000 81 j 0x00003bc8 2180x00003e83 0x00003e92 00:0000 15 j 0x00003bc8 2190x00003e92 0x00003e9f 00:0000 13 j 0x00003bc8 f 0x00003e9f 2200x00003e9f 0x00003eae 00:0000 15 j 0x00003bc8 2210x00003eae 0x00003ec7 00:0000 25 j 0x00003edc f 0x00003ec7 2220x00003ec7 0x00003edc 00:0000 21 j 0x00003edc 2230x00003edc 0x00003f0c 00:0000 48 2240x00003f0c 0x00003f18 00:0000 12 j 0x00003bc8 2250x00003f18 0x00003f5b 00:0000 67 j 0x00003bc8 2260x00003f5b 0x00003fa3 00:0000 72 j 0x00003bc8 2270x00003fa3 0x00003fd2 00:0000 47 j 0x00003bc8 2280x00003fd2 0x00003fde 00:0000 12 j 0x00003bc8 2290x00003fde 0x00004022 00:0000 68 j 0x00003bc8 2300x00004022 0x00004065 00:0000 67 j 0x00003bc8 2310x00004065 0x00004075 00:0000 16 j 0x00004364 f 0x00004075 2320x00004075 0x000040af 00:0000 58 j 0x00004364 f 0x000040af 2330x000040af 0x000040ba 00:0000 11 j 0x00004369 f 0x000040ba 2340x000040ba 0x000040d1 00:0000 23 j 0x00004369 2350x000040d1 0x000040fc 00:0000 43 j 0x00003bc8 2360x000040fc 0x00004108 00:0000 12 j 0x00003bc8 2370x00004108 0x0000411e 00:0000 22 j 0x00003bc8 2380x0000411e 0x00004161 00:0000 67 j 0x00003bc8 2390x00004161 0x00004170 00:0000 15 j 0x00003bc8 2400x00004170 0x0000417f 00:0000 15 j 0x00003bc8 2410x0000417f 0x0000418f 00:0000 16 j 0x0000434d f 0x0000418f 2420x0000418f 0x000041c9 00:0000 58 j 0x0000434d f 0x000041c9 2430x000041c9 0x000041d2 00:0000 9 j 0x0000433b f 0x000041d2 2440x000041d2 0x000041de 00:0000 12 j 0x00003bc8 2450x000041de 0x00004200 00:0000 34 j 0x00005289 f 0x00004200 2460x00004200 0x0000421f 00:0000 31 j 0x00003bc8 2470x0000421f 0x00004233 00:0000 20 j 0x00003bc8 2480x00004233 0x0000423f 00:0000 12 j 0x00003bc8 2490x0000423f 0x0000424b 00:0000 12 j 0x00003bc8 2500x0000424b 0x00004257 00:0000 12 j 0x00003bc8 2510x00004257 0x00004266 00:0000 15 j 0x00003bc8 2520x00004266 0x0000427c 00:0000 22 j 0x00003bc8 2530x0000427c 0x0000428b 00:0000 15 j 0x00003bc8 2540x0000428b 0x0000429a 00:0000 15 j 0x00003bc8 2550x0000429a 0x000042ae 00:0000 20 j 0x00003bc8 f 0x000042ae 2560x000042ae 0x000042eb 00:0000 61 j 0x000042eb 2570x000042eb 0x000042ff 00:0000 20 j 0x00003bc8 2580x000042ff 0x0000430e 00:0000 15 j 0x00003bc8 2590x0000430e 0x0000431a 00:0000 12 j 0x00003bc8 2600x0000431a 0x0000432c 00:0000 18 j 0x00004dd1 f 0x0000432c 2610x0000432c 0x0000433b 00:0000 15 j 0x00003a48 2620x0000433b 0x0000434d 00:0000 18 j 0x000041d2 f 0x0000434d 2630x0000434d 0x00004364 00:0000 23 j 0x00003bc8 2640x00004364 0x00004369 00:0000 5 j 0x00004369 2650x00004369 0x0000437b 00:0000 18 j 0x00003bc8 2660x0000437b 0x00004389 00:0000 14 j 0x0000499b f 0x00004389 2670x00004389 0x000043c6 00:0000 61 j 0x000047f6 f 0x000043c6 2680x000043c6 0x000043cf 00:0000 9 j 0x000047f6 f 0x000043cf 2690x000043cf 0x000043d9 00:0000 10 j 0x000043df f 0x000043d9 2700x000043d9 0x000043df 00:0000 6 j 0x000043f7 f 0x000043df 2710x000043df 0x000043f7 00:0000 24 j 0x000043f7 2720x000043f7 0x0000441c 00:0000 37 j 0x00004dba f 0x0000441c 2730x0000441c 0x00004427 00:0000 11 j 0x0000445f f 0x00004427 2740x00004427 0x0000443e 00:0000 23 j 0x0000445f f 0x0000443e 2750x0000443e 0x00004440 00:0000 2 j 0x00004440 2760x00004440 0x0000445f 00:0000 31 j 0x00004440 f 0x0000445f 2770x0000445f 0x00004488 00:0000 41 j 0x0000449c f 0x00004488 2780x00004488 0x00004495 00:0000 13 j 0x00004940 f 0x00004495 2790x00004495 0x0000449c 00:0000 7 j 0x0000449c 2800x0000449c 0x000044b0 00:0000 20 j 0x000044bb f 0x000044b0 2810x000044b0 0x000044bb 00:0000 11 j 0x00004df3 f 0x000044bb 2820x000044bb 0x000044bf 00:0000 4 j 0x00004502 f 0x000044bf 2830x000044bf 0x000044c8 00:0000 9 j 0x00004e27 f 0x000044c8 2840x000044c8 0x000044d1 00:0000 9 j 0x000044dc 2850x000044d8 0x000044dc 00:0000 4 j 0x000044dc 2860x000044dc 0x000044f4 00:0000 24 j 0x00004d03 f 0x000044f4 2870x000044f4 0x00004502 00:0000 14 j 0x000044d8 f 0x00004502 2880x00004502 0x00004516 00:0000 20 j 0x00004b81 f 0x00004516 2890x00004516 0x00004523 00:0000 13 j 0x0000496a f 0x00004523 2900x00004523 0x0000452c 00:0000 9 j 0x0000457b f 0x0000452c 2910x0000452c 0x0000455d 00:0000 49 j 0x00005306 f 0x0000455d 2920x0000455d 0x0000457b 00:0000 30 j 0x0000457b 2930x0000457b 0x000045a4 00:0000 41 j 0x000045b1 f 0x000045a4 2940x000045a4 0x000045b1 00:0000 13 j 0x000048e7 f 0x000045b1 2950x000045b1 0x000045ba 00:0000 9 j 0x000045ba 2960x000045ba 0x000045d4 00:0000 26 j 0x00004a84 f 0x000045d4 2970x000045d4 0x000045e1 00:0000 13 j 0x00004a08 f 0x000045e1 2980x000045e1 0x00004623 00:0000 66 j 0x00004841 f 0x00004623 2990x00004623 0x00004628 00:0000 5 j 0x00004628 3000x00004628 0x00004644 00:0000 28 j 0x00004628 f 0x00004644 3010x00004644 0x00004652 00:0000 14 j 0x00004ac3 f 0x00004652 3020x00004652 0x0000465f 00:0000 13 j 0x0000469c f 0x0000465f 3030x0000465f 0x00004664 00:0000 5 j 0x00004ce3 3040x00004668 0x00004695 00:0000 45 j 0x00004695 3050x00004695 0x0000469c 00:0000 7 j 0x0000469c 3060x0000469c 0x000046a5 00:0000 9 j 0x00004736 f 0x000046a5 3070x000046a5 0x000046bf 00:0000 26 j 0x00004668 f 0x000046bf 3080x000046bf 0x000046c4 00:0000 5 j 0x00004668 f 0x000046c4 3090x000046c4 0x000046df 00:0000 27 j 0x000052a4 f 0x000046df 3100x000046df 0x00004710 00:0000 49 j 0x000052c3 f 0x00004710 3110x00004710 0x00004736 00:0000 38 j 0x00004695 3120x00004736 0x0000473f 00:0000 9 j 0x0000474c f 0x0000473f 3130x0000473f 0x0000474c 00:0000 13 j 0x0000486c f 0x0000474c 3140x0000474c 0x00004759 00:0000 13 j 0x00004b2a f 0x00004759 3150x00004759 0x00004765 00:0000 12 j 0x0000477e f 0x00004765 3160x00004765 0x00004776 00:0000 17 j 0x000052e2 f 0x00004776 3170x00004776 0x0000477e 00:0000 8 j 0x0000477e 3180x0000477e 0x00004798 00:0000 26 j 0x00005301 f 0x00004798 3190x00004798 0x000047a7 00:0000 15 3200x000047a7 0x000047c2 00:0000 27 j 0x00003a48 3210x000047c2 0x000047f6 00:0000 52 j 0x00003b0b 3220x000047f6 0x000047fd 00:0000 7 j 0x000043f7 3230x000047fd 0x0000480d 00:0000 16 j 0x00003b33 f 0x0000480d 3240x0000480d 0x00004841 00:0000 52 j 0x00003b33 3250x00004841 0x0000484e 00:0000 13 j 0x00004952 f 0x0000484e 3260x0000484e 0x0000486c 00:0000 30 j 0x00004644 3270x0000486c 0x00004876 00:0000 10 j 0x00004888 f 0x00004876 3280x00004876 0x00004888 00:0000 18 j 0x00005015 f 0x00004888 3290x00004888 0x000048a0 00:0000 24 j 0x000048a0 3300x000048a0 0x000048bd 00:0000 29 j 0x000048cf f 0x000048bd 3310x000048bd 0x000048c0 00:0000 3 j 0x000048c0 3320x000048c0 0x000048cf 00:0000 15 j 0x000048c0 f 0x000048cf 3330x000048cf 0x000048dd 00:0000 14 j 0x0000474c f 0x000048dd 3340x000048dd 0x000048e7 00:0000 10 j 0x0000474c 3350x000048e7 0x000048f4 00:0000 13 j 0x000045b1 f 0x000048f4 3360x000048f4 0x00004901 00:0000 13 j 0x000045b1 f 0x00004901 3370x00004901 0x0000491a 00:0000 25 j 0x000045ba f 0x0000491a 3380x0000491a 0x00004927 00:0000 13 j 0x000045ba f 0x00004927 3390x00004927 0x00004934 00:0000 13 j 0x000045ba f 0x00004934 3400x00004934 0x00004940 00:0000 12 j 0x000045ba 3410x00004940 0x0000494d 00:0000 13 j 0x000044bf f 0x0000494d 3420x0000494d 0x00004952 00:0000 5 j 0x00004495 3430x00004952 0x0000496a 00:0000 24 j 0x00004644 3440x0000496a 0x00004978 00:0000 14 j 0x00004990 f 0x00004978 3450x00004978 0x00004981 00:0000 9 j 0x00004990 f 0x00004981 3460x00004981 0x00004990 00:0000 15 j 0x00004990 3470x00004990 0x0000499b 00:0000 11 j 0x00004523 3480x0000499b 0x000049c9 00:0000 46 j 0x000051d7 f 0x000049c9 3490x000049c9 0x000049e3 00:0000 26 j 0x000049e3 3500x000049e3 0x000049ee 00:0000 11 j 0x00004389 f 0x000049ee 3510x000049ee 0x00004a08 00:0000 26 j 0x00004389 3520x00004a08 0x00004a13 00:0000 11 j 0x00004a48 3530x00004a18 0x00004a1d 00:0000 5 j 0x00004a55 f 0x00004a1d 3540x00004a1d 0x00004a25 00:0000 8 j 0x00004a55 f 0x00004a25 3550x00004a25 0x00004a2d 00:0000 8 j 0x00004a55 f 0x00004a2d 3560x00004a2d 0x00004a32 00:0000 5 j 0x00004a55 f 0x00004a32 3570x00004a32 0x00004a48 00:0000 22 j 0x00004a6a f 0x00004a48 3580x00004a48 0x00004a4d 00:0000 5 j 0x00004a18 f 0x00004a4d 3590x00004a4d 0x00004a55 00:0000 8 j 0x00004a25 f 0x00004a55 3600x00004a55 0x00004a6a 00:0000 21 j 0x00004a48 f 0x00004a6a 3610x00004a6a 0x00004a78 00:0000 14 j 0x00004e1b f 0x00004a78 3620x00004a78 0x00004a84 00:0000 12 j 0x000045e1 3630x00004a84 0x00004ac3 00:0000 63 j 0x000045d4 3640x00004ac3 0x00004ad5 00:0000 18 j 0x00004e0a f 0x00004ad5 3650x00004ad5 0x00004ae3 00:0000 14 j 0x00004652 f 0x00004ae3 3660x00004ae3 0x00004af6 00:0000 19 j 0x00004736 f 0x00004af6 3670x00004af6 0x00004b0b 00:0000 21 j 0x0000522c f 0x00004b0b 3680x00004b0b 0x00004b16 00:0000 11 j 0x00004b16 3690x00004b16 0x00004b2a 00:0000 20 j 0x0000469c 3700x00004b2a 0x00004b81 00:0000 87 j 0x00004759 3710x00004b81 0x00004b97 00:0000 22 j 0x00004ba0 f 0x00004b97 3720x00004b97 0x00004ba0 00:0000 9 j 0x00004e9a f 0x00004ba0 3730x00004ba0 0x00004bb1 00:0000 17 j 0x00004bba f 0x00004bb1 3740x00004bb1 0x00004bba 00:0000 9 j 0x00004c52 f 0x00004bba 3750x00004bba 0x00004bd0 00:0000 22 j 0x00004c4b f 0x00004bd0 3760x00004bd0 0x00004bda 00:0000 10 j 0x00004c4b f 0x00004bda 3770x00004bda 0x00004bef 00:0000 21 j 0x00004c03 3780x00004bef 0x00004c03 00:0000 20 j 0x00004c03 3790x00004c03 0x00004c11 00:0000 14 j 0x00004c45 f 0x00004c11 3800x00004c11 0x00004c29 00:0000 24 j 0x00004bef f 0x00004c29 3810x00004c29 0x00004c3d 00:0000 20 j 0x00004bef f 0x00004c3d 3820x00004c3d 0x00004c45 00:0000 8 j 0x00004c52 3830x00004c45 0x00004c4b 00:0000 6 j 0x00004c4b 3840x00004c4b 0x00004c52 00:0000 7 j 0x00004c52 3850x00004c52 0x00004c5f 00:0000 13 j 0x00004516 f 0x00004c5f 3860x00004c5f 0x00004c6d 00:0000 14 j 0x00004ca3 f 0x00004c6d 3870x00004c6d 0x00004c7b 00:0000 14 j 0x00004c84 f 0x00004c7b 3880x00004c7b 0x00004c84 00:0000 9 j 0x00004ca3 f 0x00004c84 3890x00004c84 0x00004c96 00:0000 18 j 0x00004516 f 0x00004c96 3900x00004c96 0x00004ca3 00:0000 13 j 0x00004516 f 0x00004ca3 3910x00004ca3 0x00004caf 00:0000 12 j 0x00004516 3920x00004caf 0x00004ce3 00:0000 52 j 0x00003ba7 3930x00004ce3 0x00004cec 00:0000 9 j 0x00004736 f 0x00004cec 3940x00004cec 0x00004cf7 00:0000 11 j 0x0000469c f 0x00004cf7 3950x00004cf7 0x00004d03 00:0000 12 j 0x0000469c 3960x00004d03 0x00004d0d 00:0000 10 j 0x00004e4b f 0x00004d0d 3970x00004d0d 0x00004d31 00:0000 36 j 0x000050c6 f 0x00004d31 3980x00004d31 0x00004d3b 00:0000 10 j 0x000051f1 f 0x00004d3b 3990x00004d3b 0x00004d41 00:0000 6 j 0x00005038 f 0x00004d41 4000x00004d41 0x00004d4b 00:0000 10 j 0x0000520b f 0x00004d4b 4010x00004d4b 0x00004d51 00:0000 6 j 0x00004d93 f 0x00004d51 4020x00004d51 0x00004d5f 00:0000 14 j 0x00004d93 f 0x00004d5f 4030x00004d5f 0x00004d93 00:0000 52 j 0x00004d93 4040x00004d93 0x00004d9d 00:0000 10 j 0x00004502 4050x00004d9d 0x00004dba 00:0000 29 j 0x00003c97 4060x00004dba 0x00004dd1 00:0000 23 j 0x0000441c 4070x00004dd1 0x00004df3 00:0000 34 j 0x00003a48 4080x00004df3 0x00004dfb 00:0000 8 j 0x000044bf f 0x00004dfb 4090x00004dfb 0x00004e0a 00:0000 15 j 0x00004502 4100x00004e0a 0x00004e1b 00:0000 17 j 0x00004ad5 4110x00004e1b 0x00004e27 00:0000 12 j 0x00004a78 4120x00004e27 0x00004e3f 00:0000 24 j 0x000044c8 f 0x00004e3f 4130x00004e3f 0x00004e4b 00:0000 12 j 0x00004d0d 4140x00004e4b 0x00004e68 00:0000 29 j 0x0000505b f 0x00004e68 4150x00004e68 0x00004e82 00:0000 26 j 0x00005257 f 0x00004e82 4160x00004e82 0x00004e87 00:0000 5 j 0x00004e87 4170x00004e87 0x00004e9a 00:0000 19 j 0x00004d93 4180x00004e9a 0x00004eca 00:0000 48 j 0x00004eca 4190x00004eca 0x00004edb 00:0000 17 j 0x00005063 f 0x00004edb 4200x00004edb 0x00004ee4 00:0000 9 j 0x0000523b f 0x00004ee4 4210x00004ee4 0x00004eec 00:0000 8 j 0x00005249 f 0x00004eec 4220x00004eec 0x00004f06 00:0000 26 j 0x000050b1 f 0x00004f06 4230x00004f06 0x00004f2a 00:0000 36 j 0x000050b1 f 0x00004f2a 4240x00004f2a 0x00004f38 00:0000 14 j 0x00004f38 4250x00004f38 0x00004f48 00:0000 16 j 0x000051a1 f 0x00004f48 4260x00004f48 0x00004f55 00:0000 13 j 0x00004f38 f 0x00004f55 4270x00004f55 0x00004f8d 00:0000 56 j 0x00004f8d 4280x00004f8d 0x00004fc3 00:0000 54 j 0x00004fcf 4290x00004fc3 0x00004fcf 00:0000 12 j 0x00004fcf 4300x00004fcf 0x00004fd4 00:0000 5 j 0x00004fc3 f 0x00004fd4 4310x00004fd4 0x00004fdb 00:0000 7 j 0x00004fdb 4320x00004fdb 0x00004fe9 00:0000 14 j 0x00004c52 f 0x00004fe9 4330x00004fe9 0x00005009 00:0000 32 j 0x00004c52 f 0x00005009 4340x00005009 0x00005015 00:0000 12 j 0x00004c52 4350x00005015 0x00005023 00:0000 14 j 0x00004888 f 0x00005023 4360x00005023 0x00005033 00:0000 16 j 0x00004888 f 0x00005033 4370x00005033 0x00005038 00:0000 5 j 0x000048a0 4380x00005038 0x00005041 00:0000 9 j 0x00004d93 f 0x00005041 4390x00005041 0x0000505b 00:0000 26 j 0x00004d93 4400x0000505b 0x00005063 00:0000 8 j 0x00004e87 4410x00005063 0x000050b1 00:0000 78 j 0x00005163 f 0x000050b1 4420x000050b1 0x000050bf 00:0000 14 j 0x00004f8d 4430x000050bf 0x000050c6 00:0000 7 j 0x000050c6 4440x000050c6 0x00005112 00:0000 76 j 0x00005112 4450x00005112 0x00005134 00:0000 34 j 0x00005112 f 0x00005134 4460x00005134 0x00005159 00:0000 37 j 0x00005159 4470x00005159 0x00005163 00:0000 10 j 0x00005163 4480x00005163 0x0000517a 00:0000 23 j 0x000050b1 f 0x0000517a 4490x0000517a 0x0000519c 00:0000 34 j 0x00004eca f 0x0000519c 4500x0000519c 0x000051a1 00:0000 5 j 0x000050b1 4510x000051a1 0x000051d2 00:0000 49 j 0x00004eca f 0x000051d2 4520x000051d2 0x000051d7 00:0000 5 j 0x00004f55 4530x000051d7 0x000051ec 00:0000 21 j 0x000049c9 f 0x000051ec 4540x000051ec 0x000051f1 00:0000 5 j 0x000049e3 4550x000051f1 0x0000520b 00:0000 26 j 0x00004d93 4560x0000520b 0x0000522c 00:0000 33 j 0x00004d93 4570x0000522c 0x0000523b 00:0000 15 j 0x00004b16 4580x0000523b 0x00005249 00:0000 14 j 0x00004eca 4590x00005249 0x00005257 00:0000 14 j 0x00004fdb 4600x00005257 0x00005289 00:0000 50 j 0x00005289 4610x00005289 0x000052a4 00:0000 27 j 0x000052a4 4620x000052a4 0x000052c3 00:0000 31 4630x000052c3 0x000052e2 00:0000 31 4640x000052e2 0x00005301 00:0000 31 4650x00005301 0x00005306 00:0000 5 4660x00005306 0x0000533a 00:0000 52 467EOF 468RUN 469 470NAME=x86_64 main() jmptbl in bins/elf/analysis/ls-alxchk 471FILE=bins/elf/analysis/ls-alxchk 472CMDS=<<EOF 473e asm.bytes=false 474e anal.jmp.tbl=true 475s main 476aF 477pd 3 @ 0x3ec1 478EOF 479EXPECT=<<EOF 480| 0x00003ec1 add rax, rbx 481| ;-- switch 482| 0x00003ec4 jmp rax ; switch table (275 cases) at 0x172d8 483| ; CODE XREF from main @ 0x3ec4 484| ;-- case 241: ; from 0x3ec4 485| 0x00003ec6 mov byte [0x00021260], 1 ; [0x21260:1]=0 486EOF 487RUN 488 489NAME=aac pe trampoline fcn name 64bit 490FILE=bins/pe/testx64.exe 491CMDS=<<EOF 492e anal.autoname=false 493aac 494pd 1 @ 0x140001970 495EOF 496EXPECT=<<EOF 497| 0x140001970 e8d1040000 call sub.KERNEL32.dll_IsProcessorFeaturePresent ; BOOL IsProcessorFeaturePresent(DWORD ProcessorFeature) 498EOF 499RUN 500 501NAME=block takeover 502FILE=bins/elf/static-glibc-2.27 503CMDS=<<EOF 504e asm.comments=false 505e asm.var=false 506aac 507pdr @ 0x00487350 508s 0x0040f710 509afvx 510aei 511aeim 512dr rsi=0x1111111111111111 51311ds 514afvd 515EOF 516EXPECT=<<EOF 517/ 114: fcn.00487350 (); 518| 0x00487350 8b8710030000 mov eax, dword [rdi + 0x310] 519| 0x00487356 48b900000000. movabs rcx, 0x200000000 520| 0x00487360 8d50ff lea edx, [rax - 1] 521| 0x00487363 48b8ffffffff. movabs rax, 0x3ffffffff 522| 0x0048736d 899710030000 mov dword [rdi + 0x310], edx 523| 0x00487373 482387100300. and rax, qword [rdi + 0x310] 524| 0x0048737a 4839c8 cmp rax, rcx 525| 0x0048737d 7411 je 0x487390 526| ----------- true: 0x00487390 false: 0x0048737f 527| 0x0048737f f605d2542300. test byte [0x006bc858], 0x40 528| 0x00487386 7525 jne 0x4873ad 529| ----------- true: 0x004873ad false: 0x00487388 530| 0x00487388 f3c3 ret 531 532| 0x00487390 8b05ea4d2300 mov eax, dword [0x006bc180] 533| 0x00487396 85c0 test eax, eax 534| 0x00487398 7426 je 0x4873c0 535| ----------- true: 0x004873c0 false: 0x0048739a 536| 0x0048739a f605b7542300. test byte [0x006bc858], 0x40 537| 0x004873a1 c705d54d2300. mov dword [0x006bc180], 2 538| 0x004873ab 74db je 0x487388 539| ----------- true: 0x00487388 false: 0x004873ad 540| 0x004873ad 488b7708 mov rsi, qword [rdi + 8] 541| 0x004873b1 488d3dd03502. lea rdi, str._nclosing_file_s__direct_opencount_u_n 542| 0x004873b8 31c0 xor eax, eax 543| 0x004873ba e9b16cffff jmp fcn.0047e070 544| ----------- true: 0x0047e070 545| 0x004873c0 400fb6f6 movzx esi, sil 546\ 0x004873c4 e937f1ffff jmp fcn.00486500 547| ----------- true: 0x00486500 548afvR 549var_bp_38h 0x40f790,0x40f839 550 var_28h 0x40f7c1 551var_bp_30h 0x40f78c,0x40f835 552 var_3ch 0x40f86e 553var_bp_20h 0x40f7d4 554 var_fh 0x40f7a6 555afvW 556var_bp_38h 0x40f728 557 var_28h 0x40f735 558var_bp_30h 0x40f79b,0x40f843 559 var_3ch 0x40f866 560var_bp_20h 561 var_fh 562var var_bp_38h = 0x00177fc0 = (qword)0x1111111111111111 563var var_28h = 0x00177fd0 = (qword)0x0000000000000000 564var var_bp_30h = 0x00177fc8 = (qword)0x0000000000000000 565var var_3ch = 0x00177fbc = (qword)0x1111111100000000 566var var_bp_20h = 0x00177fd8 = (qword)0x0000000000000000 567var var_fh = 0x00177fc7 = (qword)0x0000000000000011 568EOF 569RUN 570 571NAME=a2f jmp after ret 572FILE=malloc://512 573CMDS=<<EOF 574e anal.hasnext=0 575e asm.arch=x86 576e asm.bits=64 577wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3 578a2f 579afl~? 580EOF 581EXPECT=<<EOF 5821 583EOF 584RUN 585 586NAME=a2f jmp after ret - _size (symsize) 587FILE=malloc://512 588CMDS=<<EOF 589e anal.hasnext=0 590e asm.arch=x86 591e asm.bits=64 592wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3 593a2f 594afl~? 595afl~[2] 596EOF 597EXPECT=<<EOF 5981 59960 600EOF 601RUN 602 603NAME=a2f jmp after ret - realsize (bbs_sum) 604FILE=malloc://512 605CMDS=<<EOF 606e anal.hasnext=0 607e asm.arch=x86 608e asm.bits=64 609wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3 610a2f 611afl~? 612afl~[2] 613EOF 614EXPECT=<<EOF 6151 61660 617EOF 618RUN 619 620NAME=aaa with avra 621FILE=bins/elf/class_test 622CMDS=<<EOF 623aaa 624avra 625EOF 626EXPECT=<<EOF 627Type Info at 0x08048f4c: 628 Type Info type: __vmi_class_type_info 629 Belongs to class vtable: 0x08048edc 630 Reference to RTTI's type class: 0x0804b140 631 Reference to type's name: 0x08048f6c 632 Type Name: Bat 633 Name unique: true 634 Flags: 0x0 635 Count of base classes: 0x2 636 Base class type descriptor address: 0x08048f74 637 Base class flags: 0x2 638 Base class type descriptor address: 0x08048fac 639 Base class flags: 0x402 640 641Type Info at 0x08048f4c: 642 Type Info type: __vmi_class_type_info 643 Belongs to class vtable: 0x08048ef0 644 Reference to RTTI's type class: 0x0804b140 645 Reference to type's name: 0x08048f6c 646 Type Name: Bat 647 Name unique: true 648 Flags: 0x0 649 Count of base classes: 0x2 650 Base class type descriptor address: 0x08048f74 651 Base class flags: 0x2 652 Base class type descriptor address: 0x08048fac 653 Base class flags: 0x402 654 655Type Info at 0x08048f74: 656 Type Info type: __class_type_info 657 Belongs to class vtable: 0x08048f04 658 Reference to RTTI's type class: 0x0804b048 659 Reference to type's name: 0x08048f7c 660 Type Name: Bird 661 Name unique: true 662 663Type Info at 0x08048f84: 664 Type Info type: __si_class_type_info 665 Belongs to class vtable: 0x08048f18 666 Reference to RTTI's type class: 0x0804b114 667 Reference to type's name: 0x08048f90 668 Type Name: Dog 669 Name unique: true 670 Reference to parent's type info: 0x08048fac 671 672Type Info at 0x08048f98: 673 Type Info type: __si_class_type_info 674 Belongs to class vtable: 0x08048f2c 675 Reference to RTTI's type class: 0x0804b114 676 Reference to type's name: 0x08048fa4 677 Type Name: Cat 678 Name unique: true 679 Reference to parent's type info: 0x08048fac 680 681Type Info at 0x08048fac: 682 Type Info type: __class_type_info 683 Belongs to class vtable: 0x08048f40 684 Reference to RTTI's type class: 0x0804b048 685 Reference to type's name: 0x08048fb4 686 Type Name: Mammal 687 Name unique: true 688 689EOF 690RUN 691 692NAME=aac on mips be 693FILE=bins/elf/analysis/mipsbe-busybox 694CMDS=<<EOF 695aac 696afl~? 697EOF 698EXPECT=<<EOF 6991268 700EOF 701RUN 702 703NAME=raw aac with maps (less because of wrong map address) 704FILE=bins/elf/analysis/mipsbe-busybox 705ARGS=-n -m 0x80000 -a mips -b32 -e cfg.bigendian=true 706CMDS=<<EOF 707aac 708afl~? 709EOF 710EXPECT=<<EOF 7114 712EOF 713RUN 714 715NAME=raw aac (using a PIC bin) 716FILE=bins/elf/libmagic.so 717CMDS=<<EOF 718aac 719afl~? 720EOF 721EXPECT=<<EOF 722199 723EOF 724RUN 725 726NAME=raw aac with maps (using a PIC bin) 727FILE=bins/elf/libmagic.so 728ARGS=-n -m 0x80000 -a arm -b 16 -e cfg.bigendian=false 729CMDS=<<EOF 730aac 731e search.in=io.maps 732afl~? 733EOF 734EXPECT=<<EOF 73594 736EOF 737RUN 738 739NAME=aav without vinfun 740FILE=bins/elf/analysis/mipsbe-busybox 741CMDS=<<EOF 742af @ 0x0040dea4 743e anal.vinfun=false 744aav 745pd 1 @ 0x0040decc~?andi 746EOF 747EXPECT=<<EOF 7481 749EOF 750RUN 751 752NAME=aav with vinfun 753FILE=bins/elf/analysis/mipsbe-busybox 754CMDS=<<EOF 755af @ 0x0040dea4 756e anal.vinfun=true 757aav 758pd 1 @ 0x0040decc~?dword 759EOF 760EXPECT=<<EOF 7611 762EOF 763RUN 764 765NAME=aav thumb detection 766FILE=bins/firmware/armthumb.bin 767ARGS=-aarm -b32 768CMDS=<<EOF 769aav 770f 771EOF 772EXPECT=<<EOF 7730x0000000d 4 aav.0x0000000d 774EOF 775RUN 776 777 778NAME=sym is not fcn 779FILE=bins/mach0/mach0-i386 780CMDS=<<EOF 781aa > /dev/null 782afl~sym.__mh_execute_header[0] 783EOF 784EXPECT=<<EOF 785EOF 786RUN 787 788 789NAME=call-convention 790FILE=bins/elf/analysis/x86-simple 791CMDS=<<EOF 792aa 793s entry0 794afc stdcall 795afi~call-convention 796EOF 797EXPECT=<<EOF 798call-convention: stdcall 799EOF 800RUN 801 802NAME=function address 803FILE=bins/mach0/mach0-i386 804CMDS=<<EOF 805e anal.hasnext=0 806aa 807afo sym._foo 808afo sym._bar 809EOF 810EXPECT=<<EOF 8110x00001f50 8120x00001f00 813EOF 814RUN 815 816NAME=afr 817FILE=bins/mach0/mach0-i386 818CMDS=<<EOF 819e anal.hasnext=0 820afr 821afl 822EOF 823EXPECT=<<EOF 8240x00001f80 1 41 main 8250x00001f50 1 47 sym._foo 8260x00001f00 4 73 sym._bar 827EOF 828RUN 829 830NAME=aF 831FILE=bins/mach0/mach0-i386 832CMDS=<<EOF 833e anal.hasnext=0 834aF 835afl 836EOF 837EXPECT=<<EOF 8380x00001f80 1 41 main 839EOF 840RUN 841 842NAME=function prelude offsets 843FILE=bins/mach0/mach0-i386 844CMDS=<<EOF 845s 0x1000 846aap 847afl~[0] 848EOF 849EXPECT=<<EOF 8500x00001f00 8510x00001f50 8520x00001f80 853EOF 854RUN 855 856NAME=function preludes symbol names 857FILE=bins/mach0/mach0-i386 858CMDS=<<EOF 859s 0x1000 860aap 861afl 862EOF 863EXPECT=<<EOF 8640x00001f00 4 73 sym._bar 8650x00001f50 1 47 sym._foo 8660x00001f80 1 41 main 867EOF 868RUN 869 870 871NAME=af-* 872FILE=bins/elf/analysis/main 873CMDS=<<EOF 874aa 875af-* 876afl 877EOF 878EXPECT=<<EOF 879EOF 880RUN 881 882NAME=iS. and iSj. implementation 883FILE=bins/elf/lab1B 884CMDS=<<EOF 885s 0x188 886iS. 887s 0x08058000 888iS. 889s 0x760 890iSj. 891EOF 892EXPECT=<<EOF 893Current section 894 895nth paddr size vaddr vsize perm name 896------------------------------------------------ 8970 0x00000188 0x24 0x08048188 0x24 -r-- .note.gnu.build-id 898 899Current section 900 901nth paddr size vaddr vsize perm name 902-------------------------------------- 903 904{"name":".plt","size":240,"vsize":240,"perm":"-r-x","paddr":1888,"vaddr":134514528} 905EOF 906RUN 907 908NAME=iE and iE. implementation 909FILE=bins/elf/lab1B 910CMDS=<<EOF 911s 0x080489b9 912iE. 913s 0x080489a6 914s+5 915isj. 916EOF 917EXPECT=<<EOF 918 919nth paddr vaddr bind type size lib name 920--------------------------------------------------- 92122 0x000009b7 0x080489b7 GLOBAL FUNC 189 decrypt 922{"name":"prog_timeout","flagname":"sym.prog_timeout","realname":"prog_timeout","ordinal":35,"bind":"GLOBAL","size":17,"type":"FUNC","vaddr":134515110,"paddr":2470,"is_imported":false} 923EOF 924RUN 925 926NAME=address information 927FILE=bins/mach0/mach0-i386 928CMDS=<<EOF 929s entry0 930ai 931s sym.__mh_execute_header 932ai 933EOF 934EXPECT=<<EOF 935exec 936read 937flag 938exec 939read 940flag 941EOF 942RUN 943 944NAME=af x86-64 945FILE=malloc://16 946CMDS=<<EOF 947e asm.arch=x86 948e asm.bits=64 949wx 662e0f1f840000000000 950ao 1~size[1] 951EOF 952EXPECT=<<EOF 95310 954EOF 955RUN 956 957NAME=anal/fcn_name 958FILE=bins/elf/analysis/main-g 959CMDS=<<EOF 960s 0x0040042c 961af 962pd 1~sym.call_gmon_start:0 963EOF 964EXPECT=<<EOF 965/ 23: sym.call_gmon_start (); 966EOF 967RUN 968 969NAME=anal/fcn_subname 970FILE=bins/elf/analysis/main-g 971CMDS=<<EOF 972s 0x0040042c 973af 974afi~name 975pd 1~sym.call_gmon_start:0 976EOF 977EXPECT=<<EOF 978name: sym.call_gmon_start 979/ 23: sym.call_gmon_start (); 980EOF 981RUN 982 983NAME=anal/name 984FILE=bins/mach0/ls-osx-x86_64 985CMDS=<<EOF 986af 987afi~name 988EOF 989EXPECT=<<EOF 990name: main 991EOF 992RUN 993 994NAME=anal hasnext on main 995FILE=bins/elf/true32 996CMDS=<<EOF 997e anal.hasnext=true 998af@main 999afi@main~size 1000EOF 1001EXPECT=<<EOF 1002size: 261 1003EOF 1004RUN 1005 1006NAME=anal without hasnext on main 1007FILE=bins/elf/true32 1008CMDS=<<EOF 1009e anal.hasnext=false 1010af@main 1011afi@main~size 1012EOF 1013EXPECT=<<EOF 1014size: 261 1015EOF 1016RUN 1017 1018NAME=ahe 1019FILE=malloc://512 1020CMDS=<<EOF 1021e asm.bits=64 1022e asm.arch = x86 1023e anal.arch = x86 1024ao~? 1025ahe test 1026ao~esil 1027EOF 1028EXPECT=<<EOF 102918 1030esilcost: 0 1031esil: test 1032EOF 1033RUN 1034 1035NAME=ahe2 1036FILE=malloc://512 1037CMDS=<<EOF 1038ahe test 1039ao~^esil 1040EOF 1041EXPECT=<<EOF 1042esilcost: 0 1043esil: test 1044EOF 1045RUN 1046 1047NAME=ahe 33,rax,= 1048FILE=malloc://512 1049CMDS=<<EOF 1050e asm.arch=x86 1051e asm.bits=64 1052wx 000000 1053ahe 33,rax,= 1054aes 1055dr?rax 1056EOF 1057EXPECT=<<EOF 10580x00000021 1059EOF 1060RUN 1061 1062NAME=delete memory format with Cf- 1063FILE=bins/dmg/src/Hello 1064CMDS=<<EOF 1065e prj.git=false 1066e asm.arch=x86 1067e asm.bits=64 1068pd 1 1069Cf 1 x 1070pd 1 1071e scr.interactive=false 1072Ps temp_proj 1073Cf- 1074pd 1 1075e scr.interactive=false 1076Ps temp_proj 1077e scr.interactive=false 1078Po temp_proj 1079pd 1 1080EOF 1081EXPECT=<<EOF 1082 0x00000000 57 push rdi 1083 0x00000000 pf x # size=1 10840x00000000 = 0x6c726f57 1085 0x00000000 57 push rdi 1086 0x00000000 57 push rdi 1087EOF 1088RUN 1089 1090 1091 1092 1093NAME=reflines offset 2 (ascii) 1094FILE=bins/elf/analysis/ls-alxchk 1095CMDS=<<EOF 1096e asm.sub.rel=false 1097e asm.bytes=false 1098e asm.leahints=false 1099e scr.utf8=false 1100e scr.color=false 1101s $S 1102aaa >/dev/null 1103s 0x000113bd 1104pd 28 1105EOF 1106EXPECT=<<EOF 1107| ,=< 0x000113bd je 0x1144e 1108| | 0x000113c3 mov esi, 0x2f ; '/' ; int c 1109| | 0x000113c8 call sym.imp.strrchr ; char *strrchr(const char *s, int c) 1110| | 0x000113cd test rax, rax 1111| ,==< 0x000113d0 je 0x11424 1112| || 0x000113d2 lea rdx, [rax + 1] 1113| || 0x000113d6 mov rcx, rdx 1114| || 0x000113d9 sub rcx, rbx 1115| || 0x000113dc cmp rcx, 6 1116| ,===< 0x000113e0 jle 0x11424 1117| ||| 0x000113e2 lea rsi, [rax - 6] 1118| ||| 0x000113e6 mov ecx, 7 1119| ||| 0x000113eb lea rdi, [rip + 0x7ebb] ; str._.libs_ 1120| ||| ; 0x192ad ; "/.libs/" 1121| ||| 0x000113f2 repe cmpsb byte [rsi], byte ptr [rdi] 1122| ,====< 0x000113f4 jne 0x11424 1123| |||| 0x000113f6 mov ecx, 3 1124| |||| 0x000113fb mov rsi, rdx 1125| |||| 0x000113fe mov rbx, rdx 1126| |||| 0x00011401 lea rdi, [rip + 0x7ead] ; "lt-" 1127| |||| ; 0x192b5 1128| |||| 0x00011408 repe cmpsb byte [rsi], byte ptr [rdi] 1129| |||| 0x0001140a seta sil 1130| |||| 0x0001140e setb cl 1131| |||| 0x00011411 cmp sil, cl 1132| ,=====< 0x00011414 jne 0x11424 1133| ||||| 0x00011416 lea rbx, [rax + 4] 1134| ||||| 0x0001141a mov rax, qword [rip + 0xdeaf] ; reloc.program_invocation_short_name 1135| ||||| ; [0x1f2d0:8]=0 1136| ||||| 0x00011421 mov qword [rax], rbx 1137| ||||| ; CODE XREFS from fcn.00011390 @ 0x113d0, 0x113e0, 0x113f4, 0x11414 1138| ````--> 0x00011424 mov rax, qword [rip + 0xde3d] ; [0x1f268:8]=0x21680 1139EOF 1140RUN 1141 1142NAME=reflines offset 3 (ascii) 1143FILE=bins/elf/analysis/ls-alxchk 1144CMDS=<<EOF 1145e asm.sub.rel=false 1146e asm.bytes=false 1147e asm.leahints=false 1148e scr.utf8=false 1149e scr.color=false 1150s $S 1151aaa >/dev/null 1152s 0x00003ca6 1153pd 19 1154EOF 1155EXPECT=<<EOF 1156| 0x00003ca6 cmp eax, 2 1157| ,=< 0x00003ca9 je 0x45ec 1158| | 0x00003caf cmp eax, 3 1159| ,==< 0x00003cb2 je 0x3ce3 1160| || 0x00003cb4 sub eax, 1 1161| ,===< 0x00003cb7 je 0x3cbe 1162| ||| ; CODE XREFS from main @ 0x58bc, 0x58d2 1163| ||| ;-- case 4: ; from 0x58d2 1164| ||| 0x00003cb9 call sym.imp.abort ; void abort(void) 1165| ||| ; CODE XREF from main @ 0x3cb7 1166| `---> 0x00003cbe mov edi, 1 ; int fd 1167| || 0x00003cc3 call sym.imp.isatty ; int isatty(int fd) 1168| || 0x00003cc8 test eax, eax 1169| ,===< 0x00003cca je 0x4c2e 1170| ||| 0x00003cd0 mov dword [rip + 0x1d626], 2 ; [0x21300:4]=0 1171| ||| 0x00003cda mov byte [rip + 0x1d33f], 1 ; [0x21020:1]=0 1172| ,====< 0x00003ce1 jmp 0x3cf9 1173| |||| ; CODE XREF from main @ 0x3cb2 1174| ||`--> 0x00003ce3 mov esi, 5 ; int64_t arg2 1175| || | 0x00003ce8 xor edi, edi ; int64_t arg1 1176| || | 0x00003cea mov dword [rip + 0x1d60c], 0 ; [0x21300:4]=0 1177| || | 0x00003cf4 call fcn.00012740 1178| || | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38 1179| `----> 0x00003cf9 lea rdi, [rip + 0x14fb4] ; str.QUOTING_STYLE 1180| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name 1181EOF 1182RUN 1183 1184NAME=reflines offset 3 (ascii + wide) 1185FILE=bins/elf/analysis/ls-alxchk 1186CMDS=<<EOF 1187e asm.sub.rel=false 1188e asm.bytes=false 1189e asm.leahints=false 1190e scr.utf8=false 1191e scr.color=false 1192e asm.lines.wide=true 1193s $S 1194aaa >/dev/null 1195s 0x00003ca6 1196pd 19 1197EOF 1198EXPECT=<<EOF 1199| 0x00003ca6 cmp eax, 2 1200| ,==< 0x00003ca9 je 0x45ec 1201| | 0x00003caf cmp eax, 3 1202| ,====< 0x00003cb2 je 0x3ce3 1203| | | 0x00003cb4 sub eax, 1 1204| ,======< 0x00003cb7 je 0x3cbe 1205| | | | ; CODE XREFS from main @ 0x58bc, 0x58d2 1206| | | | ;-- case 4: ; from 0x58d2 1207| | | | 0x00003cb9 call sym.imp.abort ; void abort(void) 1208| | | | ; CODE XREF from main @ 0x3cb7 1209| `------> 0x00003cbe mov edi, 1 ; int fd 1210| | | 0x00003cc3 call sym.imp.isatty ; int isatty(int fd) 1211| | | 0x00003cc8 test eax, eax 1212| ,======< 0x00003cca je 0x4c2e 1213| | | | 0x00003cd0 mov dword [rip + 0x1d626], 2 ; [0x21300:4]=0 1214| | | | 0x00003cda mov byte [rip + 0x1d33f], 1 ; [0x21020:1]=0 1215| ========< 0x00003ce1 jmp 0x3cf9 1216| | | | ; CODE XREF from main @ 0x3cb2 1217| | `----> 0x00003ce3 mov esi, 5 ; int64_t arg2 1218| | | 0x00003ce8 xor edi, edi ; int64_t arg1 1219| | | 0x00003cea mov dword [rip + 0x1d60c], 0 ; [0x21300:4]=0 1220| | | 0x00003cf4 call fcn.00012740 1221| | | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38 1222| --------> 0x00003cf9 lea rdi, [rip + 0x14fb4] ; str.QUOTING_STYLE 1223| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name 1224EOF 1225RUN 1226 1227NAME=reflines offset 4 (ascii + wide) 1228FILE=bins/elf/analysis/ls-alxchk 1229CMDS=<<EOF 1230e asm.sub.rel=false 1231e asm.bytes=false 1232e asm.leahints=false 1233e scr.utf8=false 1234e scr.color=false 1235e asm.lines.wide=true 1236aaa >/dev/null 1237s 0x00003ca6 1238pd 19 1239EOF 1240EXPECT=<<EOF 1241| 0x00003ca6 cmp eax, 2 1242| ,==< 0x00003ca9 je 0x45ec 1243| | 0x00003caf cmp eax, 3 1244| ,====< 0x00003cb2 je 0x3ce3 1245| | | 0x00003cb4 sub eax, 1 1246| ,======< 0x00003cb7 je 0x3cbe 1247| | | | ; CODE XREFS from main @ 0x58bc, 0x58d2 1248| | | | ;-- case 4: ; from 0x58d2 1249| | | | 0x00003cb9 call sym.imp.abort ; void abort(void) 1250| | | | ; CODE XREF from main @ 0x3cb7 1251| `------> 0x00003cbe mov edi, 1 ; int fd 1252| | | 0x00003cc3 call sym.imp.isatty ; int isatty(int fd) 1253| | | 0x00003cc8 test eax, eax 1254| ,======< 0x00003cca je 0x4c2e 1255| | | | 0x00003cd0 mov dword [rip + 0x1d626], 2 ; [0x21300:4]=0 1256| | | | 0x00003cda mov byte [rip + 0x1d33f], 1 ; [0x21020:1]=0 1257| ========< 0x00003ce1 jmp 0x3cf9 1258| | | | ; CODE XREF from main @ 0x3cb2 1259| | `----> 0x00003ce3 mov esi, 5 ; int64_t arg2 1260| | | 0x00003ce8 xor edi, edi ; int64_t arg1 1261| | | 0x00003cea mov dword [rip + 0x1d60c], 0 ; [0x21300:4]=0 1262| | | 0x00003cf4 call fcn.00012740 1263| | | ; CODE XREFS from main @ 0x3ce1, 0x4602, 0x4c38 1264| --------> 0x00003cf9 lea rdi, [rip + 0x14fb4] ; str.QUOTING_STYLE 1265| | | ; 0x18cb4 ; "QUOTING_STYLE" ; const char *name 1266EOF 1267RUN 1268 1269NAME=reflines in noreturn 1270FILE=bins/elf/analysis/ls-alxchk 1271CMDS=<<EOF 1272e asm.sub.rel=false 1273e asm.bytes=false 1274e asm.leahints=false 1275e scr.utf8=false 1276e scr.color=false 1277e asm.lines.wide=true 1278e asm.comments=0 1279aaa >/dev/null 1280s 0x00012740 1281pdf 1282EOF 1283EXPECT=<<EOF 1284/ 76: fcn.00012740 (int64_t arg1, int64_t arg2); 1285| ; var int64_t var_8h @ rbp-0x8 1286| ; arg int64_t arg1 @ rdi 1287| ; arg int64_t arg2 @ rsi 1288| 0x00012740 push rbp 1289| 0x00012741 mov rbp, rsp 1290| 0x00012744 sub rsp, 0x1030 1291| 0x0001274b or qword [rsp], 0 1292| 0x00012750 add rsp, 0x1020 1293| 0x00012757 mov rax, qword fs:[0x28] 1294| 0x00012760 mov qword [var_8h], rax 1295| 0x00012764 xor eax, eax 1296| 0x00012766 lea rax, [rip + 0xf033] 1297| 0x0001276d test rdi, rdi 1298| 0x00012770 cmovne rax, rdi 1299| 0x00012774 mov dword [rax], esi 1300| 0x00012776 mov rax, qword [var_8h] 1301| 0x0001277a xor rax, qword fs:[0x28] 1302| ,==< 0x00012783 jne 0x12787 1303| | 0x00012785 leave 1304| | 0x00012786 ret 1305\ `--> 0x00012787 call sym.imp.__stack_chk_fail 1306EOF 1307RUN 1308 1309NAME=⁝ and XREF cmt 1310FILE=bins/elf/strenc-ctrlchars 1311CMDS=<<EOF 1312e scr.utf8=true 1313e asm.bytes=false 1314s main 1315af 1316s sym.imp.puts 1317?e 1318pd 3 1319EOF 1320EXPECT=<<EOF 1321 1322 ╎ ; CALL XREF from main @ 0x400406 1323┌ 6: int sym.imp.puts (const char *s); 1324└ ╎ 0x004003f0 jmp qword [reloc.puts] ; [0x601018:8]=0x4003f6 1325 ╎ 0x004003f6 push 0 1326 └─< 0x004003fb jmp sym..plt 1327EOF 1328RUN 1329 1330NAME=stackptr 1331FILE=bins/mach0/mac-ls 1332CMDS=<<EOF 1333s 0x1000039b6 1334af 1335e asm.lines.bb=false 1336e asm.lines.fcn=false 1337e asm.stackptr=true 1338pdr~0x100003b27[1] 1339pdf~0x100003b27[1] 1340pdr~0x100003b3d[1] 1341pdr~0x100003b3e[1] 1342pdr~0x100003b40[1] 1343pdr~0x100003b42[1] 1344pdr~0x100003b44[1] 1345pdr~0x100003b46[1] 1346EOF 1347EXPECT=<<EOF 1348104 1349104 135048- 135140- 135232- 135324- 135416- 13558- 1356EOF 1357RUN 1358 1359NAME=auto string memory reference (iopa) 1360FILE=malloc://8096 1361CMDS=<<EOF 1362e asm.sub.rel=false 1363e asm.arch = x86 1364e asm.bits=64 1365e scr.color = false 1366e io.va=0 1367e asm.lines.bb=0 1368e asm.bytes=0 1369e asm.cmt.right=10 1370wx 488b3541100000 1371wv8 0x500 @ 0x1048 1372w Hello @ 0x500 1373pd 1 1374EOF 1375EXPECT=<<EOF 1376 ; [0x1048:8]=0x500 "Hello" 1377 0x00000000 mov rsi, qword [rip + 0x1041] 1378EOF 1379RUN 1380 1381NAME=auto string memory reference (io.va) 1382FILE=malloc://8096 1383CMDS=<<EOF 1384e asm.sub.rel=false 1385e asm.arch = x86 1386e asm.bits=64 1387e scr.color = false 1388e io.va=1 1389e asm.lines.bb=0 1390e asm.bytes=0 1391e asm.cmt.right=10 1392wx 488b3541100000 1393wv8 0x500 @ 0x1048 1394w Hello @ 0x500 1395pd 1 1396EOF 1397EXPECT=<<EOF 1398 ; [0x1048:8]=0x500 "Hello" 1399 0x00000000 mov rsi, qword [rip + 0x1041] 1400EOF 1401RUN 1402 1403 1404NAME=no string on cbz 1405FILE=malloc://8096 1406CMDS=<<EOF 1407e asm.arch=arm 1408e asm.bits=64 1409e cfg.bigendian=false 1410e emu.str=true 1411wv 0x52800015 1412wv 0x340000b5 @ 4 1413w hello @ 0x18 1414pd 2 1415EOF 1416EXPECT=<<EOF 1417 0x00000000 15008052 movz w21, 0 1418 ,=< 0x00000004 b5000034 cbz w21, 0x18 ; likely 1419EOF 1420RUN 1421 1422NAME=No function 1423FILE=malloc://0x50 1424CMDS=aftm 1425EXPECT=<<EOF 1426EOF 1427RUN 1428 1429NAME=Basic type Matching 1430FILE=bins/elf/analysis/x86-helloworld-gcc 1431CMDS=<<EOF 1432s sym.main 1433aa 1434aei 1435aeim 1436td int puts(char *s); 1437aft 1438s 0x08048409 1439pd 1~char *s? 1440EOF 1441EXPECT=<<EOF 14421 1443EOF 1444RUN 1445 1446NAME=Mixed reg/stack callee arguments type matching 1447FILE=bins/pe/testapp-msvc64.exe 1448CMDS=<<EOF 1449s 0x14000b54c 1450aei 1451aeim 1452af 1453aft 1454pdf 1455EOF 1456EXPECT=<<EOF 1457 ;-- rip: 1458/ 59: fcn.14000b54c (); 1459| ; var DWORD dwCreationDisposition @ rsp+0x20 1460| ; var DWORD dwFlagsAndAttributes @ rsp+0x28 1461| ; var HANDLE hTemplateFile @ rsp+0x30 1462| 0x14000b54c 4883ec48 sub rsp, 0x48 1463| 0x14000b550 488364243000 and qword [hTemplateFile], 0 ; HANDLE hTemplateFile 1464| 0x14000b556 488d0da37300. lea rcx, str.CONOUT_ ; 0x140012900 ; u"CONOUT$" ; LPCWSTR lpFileName 1465| 0x14000b55d 8364242800 and dword [dwFlagsAndAttributes], 0 ; DWORD dwFlagsAndAttributes 1466| 0x14000b562 41b803000000 mov r8d, 3 ; DWORD dwShareMode 1467| 0x14000b568 4533c9 xor r9d, r9d ; LPSECURITY_ATTRIBUTES lpSecurityAttributes 1468| 0x14000b56b 4489442420 mov dword [dwCreationDisposition], r8d ; DWORD dwCreationDisposition 1469| 0x14000b570 ba00000040 mov edx, 0x40000000 ; DWORD dwDesiredAccess 1470| 0x14000b575 ff158d1c0000 call qword [sym.imp.KERNEL32.dll_CreateFileW] ; [0x14000d208:8]=0x1579e reloc.KERNEL32.dll_CreateFileW ; HANDLE CreateFileW(LPCWSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) 1471| 0x14000b57b 4889057eb400. mov qword [0x140016a00], rax ; [0x140016a00:8]=-2 1472| 0x14000b582 4883c448 add rsp, 0x48 1473\ 0x14000b586 c3 ret 1474EOF 1475RUN 1476 1477NAME=call not function 1478FILE=bins/pe/crackme0x00.exe 1479CMDS=<<EOF 1480aa 1481s sym._main 1482aei 1483aeim 1484td int strcmp(char *s1, char *s2); 1485tk func.strcmp.cc=stdcall 1486aft 1487s 0x00401370 1488pd 1~char *s1? 1489s 0x00401368 1490pd 1~char *s2? 1491EOF 1492EXPECT=<<EOF 14931 14941 1495EOF 1496RUN 1497 1498NAME=Settings global calling convention 1499FILE=bins/pe/msvcfindmain.exe 1500CMDS=<<EOF 1501e anal.cc=pascal 1502aaa 1503afi @@@F~?pascal 1504EOF 1505EXPECT=<<EOF 150665 1507EOF 1508RUN 1509 1510NAME=1: Wrong calling convention 1511FILE=bins/pe/crackme0x00.exe 1512CMDS=<<EOF 1513s entry0 1514af 1515tk CRTStartup=func 1516tk func.CRTStartup.args=1 1517tk func.CRTStartup.arg0= int,who_cares 1518tk func.CRTStartup.cc=THE_CC_THAT_NEVER_EXISTED 1519tk func.CRTStartup.ret=eax 1520aei 1521aeim 1522aftm 1523EOF 1524EXPECT=<<EOF 1525EOF 1526RUN 1527 1528NAME=2: Wrong calling convention 1529FILE=bins/mach0/ls-osx-x86_64 1530CMDS=<<EOF 1531s entry0 1532aaa 1533afta 1534Ct. @ 0x100001413 1535Ct. @ 0x10000145b 1536Ct. @ 0x100001460 1537EOF 1538EXPECT=<<EOF 1539int category 1540int fd 1541unsigned long request 1542EOF 1543RUN 1544 1545NAME=Function definition 1546FILE=bins/elf/arm1.bin 1547CMDS=<<EOF 1548afr @ main 1549s 0x000082cc 1550pd 1~?*xmalloc 1551EOF 1552EXPECT=<<EOF 15531 1554EOF 1555RUN 1556 1557NAME=Function definition (autorename) 1558FILE=bins/pe/hello-mingw32 1559CMDS=<<EOF 1560aaa 1561s 0x00401255 1562pd 1~?ExitProcess\(UINT 1563EOF 1564EXPECT=<<EOF 15651 1566EOF 1567RUN 1568 1569NAME=Function definition indirect calls 1570FILE=bins/pe/msvcfindmain.exe 1571BROKEN=1 1572CMDS=<<EOF 1573aaa 1574pd 1 @ 0x004012c0 ~?DWORD 1575EOF 1576EXPECT=<<EOF 15771 1578EOF 1579RUN 1580 1581NAME=Function definition 1582FILE=bins/elf/ioli/crackme0x00 1583CMDS=<<EOF 1584aaa 1585s 0x08048469 1586pd 1~?strcmp\(const 1587EOF 1588EXPECT=<<EOF 15891 1590EOF 1591RUN 1592 1593NAME=afvt 1594FILE=bins/mach0/arg 1595CMDS=<<EOF 1596s sym._call 1597af 1598afv 1599EOF 1600EXPECT=<<EOF 1601var int64_t var_14h @ rbp-0x14 1602var int64_t var_10h @ rbp-0x10 1603var int64_t var_8h @ rbp-0x8 1604arg int64_t arg2 @ rsi 1605arg int64_t arg1 @ rdi 1606EOF 1607RUN 1608 1609NAME=afvt 1610FILE=bins/mach0/macho 1611CMDS=<<EOF 1612s 0x100000b60 1613af 1614afv~var_30h 1615afvt var_30h char 1616afv~var_30h 1617EOF 1618EXPECT=<<EOF 1619var int64_t var_30h @ rbp-0x30 1620var char var_30h @ rbp-0x30 1621EOF 1622RUN 1623 1624NAME=afvn 1625FILE=bins/mach0/macho 1626CMDS=<<EOF 1627s 0x100000b60 1628af 1629afv~var_30h 1630afvn mylocal var_30h 1631afv~mylocal 1632EOF 1633EXPECT=<<EOF 1634var int64_t var_30h @ rbp-0x30 1635var int64_t mylocal @ rbp-0x30 1636EOF 1637RUN 1638 1639NAME=afvn + afvn 1640FILE=bins/mach0/macho 1641CMDS=<<EOF 1642s 0x100000b60 1643af 1644afv~var_30h 1645afvn mylocal var_30h 1646afvn var_30h mylocal 1647afv~var_30h 1648EOF 1649EXPECT=<<EOF 1650var int64_t var_30h @ rbp-0x30 1651var int64_t var_30h @ rbp-0x30 1652EOF 1653RUN 1654 1655NAME=afvt + afvn 1656FILE=bins/mach0/macho 1657CMDS=<<EOF 1658s 0x100000b60 1659af 1660afv~var_30h 1661afvn mylocal var_30h 1662afvt mylocal char 1663afv~mylocal 1664EOF 1665EXPECT=<<EOF 1666var int64_t var_30h @ rbp-0x30 1667var char mylocal @ rbp-0x30 1668EOF 1669RUN 1670 1671NAME=afvn + afvt 1672FILE=bins/mach0/macho 1673CMDS=<<EOF 1674s 0x100000b60 1675af 1676afv~var_30h 1677afvt var_30h char 1678afvn mylocal var_30h 1679afv~mylocal 1680EOF 1681EXPECT=<<EOF 1682var int64_t var_30h @ rbp-0x30 1683var char mylocal @ rbp-0x30 1684EOF 1685RUN 1686 1687NAME=afvt + afvt 1688FILE=bins/mach0/macho 1689CMDS=<<EOF 1690s 0x100000b60 1691af 1692afv~var_30h 1693afvt var_30h char 1694afvt var_30h int 1695afv~var_30h 1696EOF 1697EXPECT=<<EOF 1698var int64_t var_30h @ rbp-0x30 1699var int var_30h @ rbp-0x30 1700EOF 1701RUN 1702 1703 1704NAME=afva for fastcall with no esp vars 1705FILE=bins/elf/analysis/fast 1706CMDS=<<EOF 1707aa 1708s sym.fastcaslled 1709afc fastcall 1710afc 1711afva 1712pdf 1713EOF 1714EXPECT=<<EOF 1715fastcall 1716 ; CALL XREF from main @ 0x80484c7 1717/ 59: sym.fastcaslled (int32_t arg1, int32_t arg2, int32_t arg_8h, int32_t arg_ch); 1718| ; var int32_t var_20h @ ebp-0x20 1719| ; var int32_t var_1ch @ ebp-0x1c 1720| ; var int32_t var_10h @ ebp-0x10 1721| ; var int32_t var_ch @ ebp-0xc 1722| ; arg int32_t arg_8h @ ebp+0x8 1723| ; arg int32_t arg_ch @ ebp+0xc 1724| ; arg int32_t arg1 @ ecx 1725| ; arg int32_t arg2 @ edx 1726| 0x0804841b 55 push ebp 1727| 0x0804841c 89e5 mov ebp, esp 1728| 0x0804841e 83ec28 sub esp, 0x28 1729| 0x08048421 894de4 mov dword [var_1ch], ecx ; arg1 1730| 0x08048424 8955e0 mov dword [var_20h], edx ; arg2 1731| 0x08048427 8b55e4 mov edx, dword [var_1ch] 1732| 0x0804842a 8b45e0 mov eax, dword [var_20h] 1733| 0x0804842d 01d0 add eax, edx 1734| 0x0804842f 8945f4 mov dword [var_ch], eax 1735| 0x08048432 8b45e0 mov eax, dword [var_20h] 1736| 0x08048435 2b450c sub eax, dword [arg_ch] 1737| 0x08048438 8945f0 mov dword [var_10h], eax 1738| 0x0804843b ff7508 push dword [arg_8h] 1739| 0x0804843e ff75f0 push dword [var_10h] 1740| 0x08048441 ff75f4 push dword [var_ch] 1741| 0x08048444 6874850408 push str._i__i__i_n ; 0x8048574 ; "%i %i %i\n" 1742| 0x08048449 e8a2feffff call sym.imp.printf ; int printf(const char *format) 1743| 0x0804844e 83c410 add esp, 0x10 1744| 0x08048451 90 nop 1745| 0x08048452 c9 leave 1746\ 0x08048453 c20800 ret 8 1747EOF 1748RUN 1749 1750NAME=afva for cdecl/stdcall with no esp vars 1751FILE=bins/elf/analysis/fast 1752CMDS=<<EOF 1753e asm.calls=false 1754aa 1755s sym.nonfastcaslled 1756afc 1757afva 1758pdf 1759EOF 1760EXPECT=<<EOF 1761cdecl 1762 ; CALL XREF from main @ 0x80484db 1763/ (fcn) sym.nonfastcaslled 51 1764| ; var int32_t var_10h @ ebp-0x10 1765| ; var int32_t var_ch @ ebp-0xc 1766| ; arg int32_t arg_8h @ ebp+0x8 1767| ; arg int32_t arg_ch @ ebp+0xc 1768| ; arg int32_t arg_10h @ ebp+0x10 1769| ; arg int32_t arg_14h @ ebp+0x14 1770| 0x08048456 55 push ebp 1771| 0x08048457 89e5 mov ebp, esp 1772| 0x08048459 83ec18 sub esp, 0x18 1773| 0x0804845c 8b5508 mov edx, dword [arg_8h] 1774| 0x0804845f 8b450c mov eax, dword [arg_ch] 1775| 0x08048462 01d0 add eax, edx 1776| 0x08048464 8945f4 mov dword [var_ch], eax 1777| 0x08048467 8b450c mov eax, dword [arg_ch] 1778| 0x0804846a 2b4514 sub eax, dword [arg_14h] 1779| 0x0804846d 8945f0 mov dword [var_10h], eax 1780| 0x08048470 ff7510 push dword [arg_10h] 1781| 0x08048473 ff75f0 push dword [var_10h] 1782| 0x08048476 ff75f4 push dword [var_ch] 1783| 0x08048479 6874850408 push str._i__i__i_n ; 0x8048574 ; "%i %i %i\n" 1784| 0x0804847e e86dfeffff call sym.imp.printf 1785| 0x08048483 83c410 add esp, 0x10 1786| 0x08048486 90 nop 1787| 0x08048487 c9 leave 1788\ 0x08048488 c3 ret 1789EOF 1790RUN 1791 1792NAME=anal vars crash 1793FILE=- 1794CMDS=<<EOF 1795af 1796afvr-* 1797afvr-* 1798EOF 1799EXPECT=<<EOF 1800EOF 1801RUN 1802 1803NAME=anal vars crash 2 1804FILE=- 1805CMDS=<<EOF 1806e asm.bits=64 1807e asm.arch = x86 1808e anal.arch = x86 1809e asm.calls=false 1810wx 554889e5534881ec3810000048830c24004881c42010000064488b042528000000488945e831c04885ff4889fb909090909090c3 @ 10 1811aa 1812afvn new_1 old_1 1813afvn my_local var_18h 1814pd 1 1815EOF 1816EXPECT=<<EOF 1817/ (fcn) fcn.00000000 62 1818// void fcn.00000000 (int64_t arg1); 1819| ; var int64_t my_local @ rbp-0x18 1820| ; arg int64_t arg1 @ rdi 1821| 0x00000000 0000 add byte [rax], al 1822EOF 1823RUN 1824 1825NAME=afvb & afvn 1826FILE=bins/efi/bootia32.efi 1827CMDS=<<EOF 1828af 1829afvn ImageHandle arg_8h 1830afvn SystemTable arg_ch 1831afvb~?ImageHandle 1832afvb~?SystemTable 1833EOF 1834EXPECT=<<EOF 18351 18361 1837EOF 1838RUN 1839 1840NAME=afvb* & afvn 1841FILE=bins/efi/bootia32.efi 1842CMDS=<<EOF 1843af 1844afvn ImageHandle arg_8h 1845afvn SystemTable arg_ch 1846afvb*~?ImageHandle 1847afvb*~?SystemTable 1848EOF 1849EXPECT=<<EOF 18501 18511 1852EOF 1853RUN 1854 1855NAME=afvb idx... & afvn 1856FILE=bins/efi/bootia32.efi 1857CMDS=<<EOF 1858af 1859afvb 8 ImageHandle blah @ 0x10002d8d 1860afvb*~ImageHandle 1861EOF 1862EXPECT=<<EOF 1863afvb 8 ImageHandle blah @ 0x10002d8d 1864EOF 1865RUN 1866 1867NAME=afvbj 1868FILE=bins/efi/bootia32.efi 1869CMDS=<<EOF 1870af 1871afvb 8 ImageHandle blah @ 0x10002d8d 1872afvbj~?ImageHandle 1873EOF 1874EXPECT=<<EOF 18751 1876EOF 1877RUN 1878 1879NAME=afvb-ArgName 1880FILE=bins/efi/bootia32.efi 1881CMDS=<<EOF 1882af 1883afvb 8 ImageHandle blah @ 0x10002d8d 1884afvb-ImageHandle 1885afvb~?ImageHandle 1886EOF 1887EXPECT=<<EOF 18880 1889EOF 1890RUN 1891 1892NAME=afvr & afvn 1893FILE=bins/efi/bootia32.efi 1894CMDS=<<EOF 1895af 1896afvr esi myreg int @ 0x10002d8d 1897afvr~?myreg 1898afvn blah myreg 1899afvr~?blah 1900EOF 1901EXPECT=<<EOF 19021 19031 1904EOF 1905RUN 1906 1907NAME=afvr idx & afvr* 1908FILE=bins/efi/bootia32.efi 1909CMDS=<<EOF 1910af 1911afvr esi myreg int @ 0x10002d8d 1912afvr*~?myreg 1913afvr*~?int 1914EOF 1915EXPECT=<<EOF 19161 19171 1918EOF 1919RUN 1920 1921NAME=afvr-name 1922FILE=bins/efi/bootia32.efi 1923CMDS=<<EOF 1924af 1925afvr esi myreg int @ 0x10002d8d 1926afvr-myreg 1927afvr~?myreg 1928EOF 1929EXPECT=<<EOF 19300 1931EOF 1932RUN 1933 1934NAME=afvb-* afvr-* 1935FILE=bins/efi/bootia32.efi 1936CMDS=<<EOF 1937af 1938afvb-* 1939afvr-* 1940afvb~? 1941afvr~? 1942EOF 1943EXPECT=<<EOF 19440 19450 1946EOF 1947RUN 1948 1949NAME=anal vars count 1950FILE=bins/mach0/ls-osx-x86_64 1951CMDS=<<EOF 1952af 1953afvb~? 1954EOF 1955EXPECT=<<EOF 195613 1957EOF 1958RUN 1959 1960NAME=anal vars retype 1961FILE=bins/mach0/ls-osx-x86_64 1962CMDS=<<EOF 1963af 1964afvt var_30h char 1965afvb~_30h 1966EOF 1967EXPECT=<<EOF 1968var char var_30h @ rbp-0x30 1969EOF 1970RUN 1971 1972NAME=anal vars rename 1973FILE=bins/mach0/ls-osx-x86_64 1974CMDS=<<EOF 1975af 1976afvn newname var_30h 1977afvb~newname 1978EOF 1979EXPECT=<<EOF 1980var int64_t newname @ rbp-0x30 1981EOF 1982RUN 1983 1984NAME=vars display in debugger 1985FILE=bins/elf/analysis/fast 1986CMDS=<<EOF 1987aa 1988s 0x0804843b 1989afvd arg_ch 1990afvd var_10h 1991EOF 1992EXPECT=<<EOF 1993pf d @ebp+0xc 1994pf d @ebp-0x10 1995EOF 1996RUN 1997 1998NAME=afvR and afvW test 1999FILE=bins/elf/crackme0x05 2000CMDS=<<EOF 2001e anal.vars.stackname=true 2002aa 2003s main 2004?e 2005afvR 2006afvW 2007EOF 2008EXPECT=<<EOF 2009 2010 var_7ch 0x8048577,0x804858a 2011 var_88h 2012 var_7ch 2013 var_88h 0x804857a 2014EOF 2015RUN 2016 2017NAME=axt avr 2018FILE=bins/firmware/main.avr 2019CMDS=<<EOF 2020f str.hello 12 @ 0x276 2021Csa 12 @ str.hello 2022axd 0x260 @ str.hello 2023pd 1 @ 0x260 2024EOF 2025EXPECT=<<EOF 2026 ; DATA XREF from str.hello @ 2027 0x00000260 80e0 ldi r24, 0x00 2028EOF 2029RUN 2030 2031NAME=axt capstone x86 2032FILE=bins/elf/analysis/main 2033CMDS=<<EOF 2034e asm.arch = x86 2035e anal.arch = x86 2036e scr.color=false 2037e scr.wheel = false 2038aa 2039axt @ str.Hello_World 2040EOF 2041EXPECT=<<EOF 2042main 0x40050a [DATA] mov edi, str.Hello_World 2043EOF 2044RUN 2045 2046NAME=axt capstone x86: IOLI0 2047FILE=bins/elf/ioli/crackme0x00 2048CMDS=<<EOF 2049e asm.arch = x86 2050e anal.arch = x86 2051e scr.color=false 2052e scr.wheel = false 2053aa 2054axt @ str.Password:_ 2055EOF 2056EXPECT=<<EOF 2057main 0x804843c [DATA] mov dword [esp], str.Password:_ 2058EOF 2059RUN 2060 2061NAME=axt capstone x86: IOLI7 aa 2062FILE=bins/elf/ioli/crackme0x07 2063CMDS=<<EOF 2064aaa 2065axt @ sym.imp.exit 2066EOF 2067EXPECT=<<EOF 2068fcn.08048524 0x804853d [CALL] call sym.imp.exit 2069fcn.08048542 0x80485ab [CALL] call sym.imp.exit 2070(nofunc) 0x804866f [CALL] call sym.imp.exit 2071EOF 2072RUN 2073 2074NAME=axt capstone x86: IOLI7 aa 2 2075FILE=bins/elf/ioli/crackme0x07 2076CMDS=<<EOF 2077aaaa 2078axt @ sym.imp.exit 2079EOF 2080EXPECT=<<EOF 2081fcn.08048524 0x804853d [CALL] call sym.imp.exit 2082fcn.08048542 0x80485ab [CALL] call sym.imp.exit 2083(nofunc) 0x804866f [CALL] call sym.imp.exit 2084EOF 2085RUN 2086 2087NAME=axt respect subrel 2088FILE=bins/pe/ibknoreloc64.exe 2089CMDS=<<EOF 2090aaa 2091e asm.sub.rel=false 2092axt @ sym.imp.msvcrt.dll_printf 2093e asm.sub.rel=true 2094axt @ sym.imp.msvcrt.dll_printf 2095EOF 2096EXPECT=<<EOF 2097entry0 0xffffffffffff100a [CALL] call qword [rip + 0xd8] 2098entry0 0xffffffffffff100a [CALL] call qword [sym.imp.msvcrt.dll_printf] 2099EOF 2100RUN 2101 2102NAME=ax- 2103FILE=- 2104CMDS=<<EOF 2105ax 10 20 2106axq 2107ax-10 20 2108axq 2109EOF 2110EXPECT=<<EOF 21110x00000014 -> 0x0000000a UNKNOWN 2112EOF 2113RUN 2114 2115NAME=ax-@ 2116FILE=- 2117CMDS=<<EOF 2118s 20 2119ax 10 2120axq 2121ax-10 2122axq 2123EOF 2124EXPECT=<<EOF 21250x00000014 -> 0x0000000a UNKNOWN 2126EOF 2127RUN 2128 2129NAME=ax-* 2130FILE=- 2131CMDS=<<EOF 2132ax 10 2133ax 2134ax-* 2135ax 2136EOF 2137EXPECT=<<EOF 2138 ? 0x0 -> UNKNOWN -> 0xa 2139EOF 2140RUN 2141 2142NAME=axt unknown function 2143FILE=bins/pe/lab11.malware 2144CMDS=<<EOF 2145aaa 2146axt fcn.00401270 2147EOF 2148EXPECT=<<EOF 2149(nofunc) 0x401a1d [CALL] call fcn.00401270 2150EOF 2151RUN 2152 2153NAME=axf string ref capstone x86 2154FILE=bins/elf/ioli/crackme0x03 2155CMDS=<<EOF 2156e asm.arch = x86 2157e anal.arch = x86 2158e scr.color = false 2159e scr.wheel = false 2160aa 2161axt str.Sdvvzrug_RN 2162s str.Sdvvzrug_RN 2163axt 2164axf 0x804848a 2165s 0x804848a 2166axf 2167EOF 2168EXPECT=<<EOF 2169d 0x80485fe str.SdvvzrugRN____ 2170d 0x80485fe str.SdvvzrugRN____ 2171EOF 2172RUN 2173 2174NAME=x86 ref issue 2175FILE=- 2176CMDS=<<EOF 2177e asm.bits=64 2178e asm.arch=x86 2179wx c7052a44000050000000 2180ao~^ptr[1] 2181EOF 2182EXPECT=<<EOF 21830x00004434 2184EOF 2185RUN 2186 2187NAME=aoj pushf 2188FILE=- 2189CMDS=<<EOF 2190e asm.arch=x86 2191e asm.bits=64 2192wx 669c 2193aoj~{} 2194EOF 2195EXPECT=<<EOF 2196[ 2197 { 2198 "opcode": "pushf", 2199 "disasm": "pushf", 2200 "pseudo": "pushf ", 2201 "description": "push flags register onto the stack", 2202 "mnemonic": "pushf", 2203 "mask": "ffff", 2204 "esil": "8,rsp,-=,eflags,rsp,=[8]", 2205 "sign": false, 2206 "prefix": 0, 2207 "id": 591, 2208 "opex": { 2209 "operands": [ 2210 { 2211 "size": 8, 2212 "rw": 1, 2213 "type": "reg", 2214 "value": "rflags" 2215 } 2216 ] 2217 }, 2218 "addr": 0, 2219 "bytes": "669c", 2220 "size": 2, 2221 "type": "upush", 2222 "esilcost": 24, 2223 "scale": 0, 2224 "refptr": 0, 2225 "cycles": 2, 2226 "failcycles": 0, 2227 "delay": 0, 2228 "stack": "inc", 2229 "stackptr": 8, 2230 "family": "cpu" 2231 } 2232] 2233EOF 2234RUN 2235 2236NAME=strings xref issue 2237FILE=bins/elf/redpill 2238CMDS=<<EOF 2239e anal.strings=true 2240aa 2241aae 2242axt 0x00001d89 2243axt 0x00001da0 2244axt 0x00001db7 2245axt 0x00001dd1 2246axt 0x00001de8 2247axt 0x00001df4 2248axt 0x00001e09 2249EOF 2250EXPECT=<<EOF 2251main 0x1457 [STRING] lea eax, str._Take_the_Red_Pill____n 2252main 0x148e [STRING] lea eax, str._use:_._exploit1_PILL_ 2253main 0x14eb [STRING] lea eax, str._____Red_Pill__0x50444552 2254main 0x1502 [STRING] lea eax, str._____Your_Pill_0x_08x_n 2255main 0x1523 [STRING] lea eax, str._n__Red_Pill 2256main 0x1557 [STRING] lea eax, str.__fwhibbit 2257main 0x161d [STRING] lea eax, str._n__Blue_Pill 2258EOF 2259RUN 2260 2261NAME=reference to like mov [0x400000], 0x1234 2262FILE=bins/elf/analysis/reference.out 2263CMDS=<<EOF 2264aaa 2265axt@0x0804a01c 2266EOF 2267EXPECT=<<EOF 2268main 0x80483ee [DATA] mov dword [obj.a], 0x1337 2269EOF 2270RUN 2271 2272NAME=delete references with ax- 2273FILE=- 2274CMDS=<<EOF 2275ax 10 20 2276axq 2277ax- 10 2278axq 2279ax 10 20 2280ax 30 40 2281axq 2282ax-* 2283axq 2284EOF 2285EXPECT=<<EOF 22860x00000014 -> 0x0000000a UNKNOWN 22870x00000014 -> 0x0000000a UNKNOWN 22880x00000028 -> 0x0000001e UNKNOWN 2289EOF 2290RUN 2291 2292NAME=reference PIC binary 2293FILE=bins/elf/analysis/xrefpic 2294CMDS=<<EOF 2295e anal.strings=true 2296aa 2297aae 2298axt@0x80484e0 2299EOF 2300EXPECT=<<EOF 2301main 0x8048432 [STRING] lea eax, str.Hello_PIC_ 2302EOF 2303RUN 2304 2305NAME=strings xref issue without subrel 2306FILE=bins/elf/redpill 2307CMDS=<<EOF 2308e anal.strings=true 2309e asm.sub.rel=false 2310aa 2311aae 2312axt 0x00001d89 2313axt 0x00001da0 2314axt 0x00001db7 2315axt 0x00001dd1 2316axt 0x00001de8 2317axt 0x00001df4 2318axt 0x00001e09 2319EOF 2320EXPECT=<<EOF 2321main 0x1457 [STRING] lea eax, [esi - 0x2277] 2322main 0x148e [STRING] lea eax, [esi - 0x2260] 2323main 0x14eb [STRING] lea eax, [esi - 0x2249] 2324main 0x1502 [STRING] lea eax, [esi - 0x222f] 2325main 0x1523 [STRING] lea eax, [esi - 0x2218] 2326main 0x1557 [STRING] lea eax, [esi - 0x220c] 2327main 0x161d [STRING] lea eax, [esi - 0x21f7] 2328EOF 2329RUN 2330 2331NAME=reference PIC binary without subrel 2332FILE=bins/elf/analysis/xrefpic 2333CMDS=<<EOF 2334e anal.strings=true 2335e asm.sub.rel=false 2336aa 2337aae 2338axt@0x80484e0 2339EOF 2340EXPECT=<<EOF 2341main 0x8048432 [STRING] lea eax, [ebx - 0x1b20] 2342EOF 2343RUN 2344 2345NAME=refs on PIC binary disassembly 2346FILE=bins/elf/analysis/xrefpic 2347CMDS=<<EOF 2348e anal.strings=true 2349aa 2350aae 2351pd 1 @ 0x08048432 2352EOF 2353EXPECT=<<EOF 2354| 0x08048432 8d83e0e4ffff lea eax, str.Hello_PIC_ ; 0x80484e0 ; "Hello PIC!" 2355EOF 2356RUN 2357 2358NAME=refs on PIC binary disassembly (color) 2359FILE=bins/elf/analysis/xrefpic 2360CMDS=<<EOF 2361e asm.bytes=false 2362e asm.comments=false 2363e scr.color=1 2364e anal.strings=true 2365aa 2366aae 2367pd 1 @ 0x08048432 2368EOF 2369EXPECT=<<EOF 2370[36m|[0m [32m0x08048432[0m [37mlea[36m eax[0m,[36m [0m[33mstr.Hello_PIC_[0m[36m[0m[0m 2371EOF 2372RUN 2373 2374NAME=axs 2375FILE=- 2376CMDS=<<EOF 2377axs 0x10 2378axq 2379EOF 2380EXPECT=<<EOF 23810x00000000 -> 0x00000010 STRING 2382EOF 2383RUN 2384 2385NAME=refs with aar 2386FILE=bins/elf/crackme 2387CMDS=<<EOF 2388e asm.lines.bb=false 2389e asm.lines.fcn=false 2390aar 2391pd 1 @0x400730 2392pd 1 @0x4007f0 2393pd 1 @0x400610 2394EOF 2395EXPECT=<<EOF 2396; DATA XREF from entry0 @ +0xf 2397;-- __libc_csu_fini: 23980x00400730 f3c3 ret 2399; CODE XREF from sym.__do_global_ctors_aux @ +0x2d 24000x004007f0 4883eb08 sub rbx, 8 2401; CALL XREF from section..fini @ +0x4 2402;-- __do_global_dtors_aux: 24030x00400610 55 push rbp 2404EOF 2405RUN 2406 2407NAME=refs with afr 2408FILE=bins/elf/crackme 2409CMDS=<<EOF 2410e asm.lines.bb=false 2411e asm.lines.fcn=false 2412e anal.jmp.cref=true 2413aa 2414afr 2415pd 1 @0x400730 2416pd 1 @0x4007f0 2417pd 1 @0x400610 2418EOF 2419EXPECT=<<EOF 2420 ; DATA XREF from entry0 @ 0x4005cf 24212: sym.__libc_csu_fini (); 24220x00400730 f3c3 ret 2423; CODE XREF from sym.__do_global_ctors_aux @ 0x4007fd 24240x004007f0 4883eb08 sub rbx, 8 2425 ; CALL XREF from sym._fini @ 0x40080c 2426100: sym.__do_global_dtors_aux (); 24270x00400610 55 push rbp 2428EOF 2429RUN 2430 2431NAME=cjmp data refs with aar 2432FILE=malloc://10000 2433CMDS=<<EOF 2434e asm.arch=8051 2435e asm.lines.bb=false 2436e asm.lines.fcn=false 2437wx 307401000022 2438aar 2439pd 1 @_idata+0x2e 2440EOF 2441EXPECT=<<EOF 2442; DATA XREF from unk @ 24430x1000002e 00 nop 2444EOF 2445RUN 2446 2447NAME=cjmp data refs with afr 2448FILE=malloc://10000 2449CMDS=<<EOF 2450e asm.arch=8051 2451e asm.lines.bb=false 2452e asm.lines.fcn=false 2453wx 307401000022 2454aa 2455afr 2456pd 1 @_idata+0x2e 2457EOF 2458EXPECT=<<EOF 2459; DATA XREF from fcn.00000000 @ 24600x1000002e 00 nop 2461EOF 2462RUN 2463 2464NAME=xrefs and overlapping basic blocks 2465FILE=bins/elf/analysis/ls-linux-x86_64-zlul 2466CMDS=<<EOF 2467aaa 2468axt main 2469EOF 2470EXPECT=<<EOF 2471entry0 0x40488d [DATA] mov rdi, main 2472EOF 2473RUN 2474 2475NAME=unique function names 2476FILE=bins/elf/bash 2477CMDS=<<EOF 2478aaa 2479f~strlen~390 2480EOF 2481EXPECT=<<EOF 2482EOF 2483RUN 2484 2485NAME=no function split without overlapping blocks 2486FILE=bins/elf/libc.so.6 2487CMDS=<<EOF 2488aac 2489s 0x2254d 2490agf~invalid 2491echo end 2492EOF 2493EXPECT=<<EOF 2494end 2495EOF 2496RUN 2497 2498NAME=noreturn of reloc-functions 2499FILE=bins/elf/ls 2500CMDS=<<EOF 2501aaa 2502afbr 0x80b0 2503EOF 2504EXPECT=<<EOF 25050x000081cb 25060x00008237 2507EOF 2508RUN 2509 2510NAME=r_anal_fcn_split_bb FITFCNSZ fix (#12008) 2511FILE=- 2512CMDS=<<EOF 2513e asm.arch=x86 2514e asm.bits=64 2515e anal.jmp.mid=false 2516e io.cache=true 2517wx b8210000c1ebfdbb2c000000000 2518af 2519afi 2520?e 2521afb 2522?e 2523e asm.bb.middle=true 2524pdf 2525?e 2526e asm.bb.middle=false 2527pdf 2528EOF 2529EXPECT=<<EOF 2530# 2531offset: 0x00000000 2532name: fcn.00000000 2533size: 7 2534is-pure: true 2535realsz: 7 2536stackframe: 0 2537call-convention: amd64 2538cyclomatic-cost: 4 2539cyclomatic-complexity: 0 2540bits: 64 2541type: fcn [NEW] 2542num-bbs: 2 2543edges: 2 2544end-bbs: 0 2545call-refs: 2546data-refs: 2547code-xrefs: 2548noreturn: false 2549in-degree: 0 2550out-degree: 0 2551data-xrefs: 2552locals: 0 2553args: 0 2554diff: type: new 2555 25560x00000000 0x00000004 00:0000 4 j 0x00000004 25570x00000004 0x00000007 00:0000 3 j 0x00000004 2558 2559/ 7: fcn.00000000 (); 2560| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!' 2561| ; CODE XREF from fcn.00000000 @ 0x5 2562\ .-> 0x00000004 c1ebfd shr ebx, 0xfd 2563 2564/ 7: fcn.00000000 (); 2565| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2566\ `=< 0x00000005 ebfd jmp 4 2567EOF 2568RUN 2569 2570NAME=overlapping basic blocks and anal.jmp.mid 2571FILE=- 2572CMDS=<<EOF 2573e asm.arch=x86 2574e asm.bits=64 2575e anal.nopskip=false 2576e asm.bb.middle=true 2577e anal.jmp.mid=true 2578e io.cache=true 2579"(show_fcn bin; wx $0; af-*; af; afi; ?e; afb; ?e; pdr; ?e; agf; ?e; e asm.bb.middle=true; pdf; ?e; e asm.bb.middle=false; pdf)" 2580.(show_fcn b8210000c1ebfdbb2c000000cc) 2581?e 2582.(show_fcn b8210000c1ebfdbb2c000000ebf6) 2583?e 2584.(show_fcn b8210000c1ebfdbb2c000000ebf7) 2585?e 2586.(show_fcn 0f1f440000b8210000c1ebfdbb2c000000ebf0) 2587EOF 2588EXPECT=<<EOF 2589# 2590offset: 0x00000000 2591name: fcn.00000000 2592size: 13 2593is-pure: false 2594realsz: 16 2595stackframe: 0 2596call-convention: amd64 2597cyclomatic-cost: 6 2598cyclomatic-complexity: 1 2599bits: 64 2600type: fcn [NEW] 2601num-bbs: 2 2602edges: 1 2603end-bbs: 1 2604call-refs: 0x00000004 J 2605data-refs: 0x0000002c 2606code-xrefs: 0x00000005 J 2607noreturn: false 2608in-degree: 1 2609out-degree: 0 2610data-xrefs: 2611locals: 0 2612args: 0 2613diff: type: new 2614 26150x00000000 0x00000007 00:0000 7 j 0x00000004 26160x00000004 0x0000000d 00:0000 9 2617 2618/ 16: fcn.00000000 (); 2619| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2620| 0x00000005 ebfd jmp 4 2621| ----------- true: 0x00000004 2622| ; CODE XREF from fcn.00000000 @ 0x5 2623| 0x00000004 c1ebfd shr ebx, 0xfd 2624| 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2625\ 0x0000000c cc int3 2626 2627 2628[0x00000000]> # fcn.00000000 (); 2629 .------------------------. 2630 | 0x0 | 2631 | 16: fcn.00000000 (); | 2632 | ; '!' | 2633 | mov eax, 0xc1000021 | 2634 | jmp 4 | 2635 `------------------------' 2636 v 2637 | 2638 .-----' 2639 | 2640.-------------------------------------. 2641| 0x4 | 2642| ; CODE XREF from fcn.00000000 @ 0x5 | 2643| shr ebx, 0xfd | 2644| ; ',' | 2645| mov ebx, 0x2c | 2646| int3 | 2647`-------------------------------------' 2648 2649/ 16: fcn.00000000 (); 2650| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!' 2651| ; CODE XREF from fcn.00000000 @ 0x5 2652| .-> 0x00000004 c1ebfd shr ebx, 0xfd 2653| 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2654\ 0x0000000c cc int3 2655.. 2656 2657/ 16: fcn.00000000 (); 2658| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2659| `=< 0x00000005 ebfd jmp 4 2660| 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2661\ 0x0000000c cc int3 2662.. 2663 2664# 2665offset: 0x00000000 2666name: fcn.00000000 2667size: 14 2668is-pure: false 2669realsz: 17 2670stackframe: 0 2671call-convention: amd64 2672cyclomatic-cost: 7 2673cyclomatic-complexity: 0 2674bits: 64 2675type: fcn [NEW] 2676num-bbs: 2 2677edges: 2 2678end-bbs: 0 2679call-refs: 0x00000004 J 0x00000004 J 2680data-refs: 0x0000002c 2681code-xrefs: 0x00000005 J 0x0000000c J 2682noreturn: false 2683in-degree: 2 2684out-degree: 0 2685data-xrefs: 2686locals: 0 2687args: 0 2688diff: type: new 2689 26900x00000000 0x00000007 00:0000 7 j 0x00000004 26910x00000004 0x0000000e 00:0000 10 j 0x00000004 2692 2693/ 17: fcn.00000000 (); 2694| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2695| 0x00000005 ebfd jmp 4 2696| ----------- true: 0x00000004 2697| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc 2698| 0x00000004 c1ebfd shr ebx, 0xfd 2699| 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2700\ 0x0000000c ebf6 jmp 4 2701| ----------- true: 0x00000004 2702 2703[0x00000000]> # fcn.00000000 (); 2704 .------------------------. 2705 | 0x0 | 2706 | 17: fcn.00000000 (); | 2707 | ; '!' | 2708 | mov eax, 0xc1000021 | 2709 | jmp 4 | 2710 `------------------------' 2711 v 2712 | 2713 '--------. 2714 | 2715 | 2716 | 2717 .---------------' 2718.--------. 2719| | | 2720|.-------------------------------------------. 2721|| 0x4 | 2722|| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc | 2723|| shr ebx, 0xfd | 2724|| ; ',' | 2725|| mov ebx, 0x2c | 2726|| jmp 4 | 2727|`-------------------------------------------' 2728| v 2729| | 2730`----' 2731 2732/ 17: fcn.00000000 (); 2733| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!' 2734| ; CODE XREFS from fcn.00000000 @ 0x5, 0xc 2735| ..-> 0x00000004 c1ebfd shr ebx, 0xfd 2736| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2737\ `=< 0x0000000c ebf6 jmp 4 2738.. 2739 2740/ 17: fcn.00000000 (); 2741| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2742| `==< 0x00000005 ebfd jmp 4 2743| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2744\ `=< 0x0000000c ebf6 jmp 4 2745.. 2746 2747# 2748offset: 0x00000000 2749name: fcn.00000000 2750size: 14 2751is-pure: false 2752realsz: 17 2753stackframe: 0 2754call-convention: amd64 2755cyclomatic-cost: 7 2756cyclomatic-complexity: 0 2757bits: 64 2758type: fcn [NEW] 2759num-bbs: 3 2760edges: 3 2761end-bbs: 0 2762call-refs: 0x00000004 J 0x00000005 J 2763data-refs: 0x0000002c 2764code-xrefs: 0x00000005 J 0x0000000c J 2765noreturn: false 2766in-degree: 2 2767out-degree: 0 2768data-xrefs: 2769locals: 0 2770args: 0 2771diff: type: new 2772 27730x00000000 0x00000005 00:0000 5 j 0x00000005 27740x00000004 0x0000000e 00:0000 10 j 0x00000005 27750x00000005 0x00000007 00:0000 2 j 0x00000004 2776 2777/ 17: fcn.00000000 (); 2778| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2779| ----------- true: 0x00000005 2780| ; CODE XREF from fcn.00000000 @ 0x5 2781| 0x00000004 c1ebfd shr ebx, 0xfd 2782| 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2783\ 0x0000000c ebf7 jmp 5 2784| ----------- true: 0x00000005 2785| ; CODE XREF from fcn.00000000 @ 0xc 2786| 0x00000005 ebfd jmp 4 2787| ----------- true: 0x00000004 2788 2789[0x00000000]> # fcn.00000000 (); 2790 .------------------------. 2791 | 0x0 | 2792 | 17: fcn.00000000 (); | 2793 | ; '!' | 2794 | mov eax, 0xc1000021 | 2795 `------------------------' 2796 v 2797 | 2798 .---' 2799.--------. 2800| | | 2801|.-------------------------------------. 2802|| 0x5 | 2803|| ; CODE XREF from fcn.00000000 @ 0xc | 2804|| jmp 4 | 2805|`-------------------------------------' 2806| v 2807| | 2808| | 2809|.-------------------------------------. 2810|| 0x4 | 2811|| ; CODE XREF from fcn.00000000 @ 0x5 | 2812|| shr ebx, 0xfd | 2813|| ; ',' | 2814|| mov ebx, 0x2c | 2815|| jmp 5 | 2816|`-------------------------------------' 2817| v 2818| | 2819`----' 2820 2821/ 17: fcn.00000000 (); 2822| 0x00000000 ~ b8210000c1 mov eax, 0xc1000021 ; '!' 2823| ; CODE XREF from fcn.00000000 @ 0x5 2824| .-> 0x00000004 ~ c1ebfd shr ebx, 0xfd 2825| | ; CODE XREF from fcn.00000000 @ 0xc 2826| .`=< 0x00000005 ebfd jmp 4 2827| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2828\ `==< 0x0000000c ebf7 jmp 5 2829.. 2830 2831/ 17: fcn.00000000 (); 2832| 0x00000000 b8210000c1 mov eax, 0xc1000021 ; '!' 2833| | ; CODE XREF from fcn.00000000 @ 0xc 2834| .`=< 0x00000005 ebfd jmp 4 2835| : 0x00000007 bb2c000000 mov ebx, 0x2c ; ',' 2836\ `==< 0x0000000c ebf7 jmp 5 2837.. 2838 2839# 2840offset: 0x00000000 2841name: fcn.00000000 2842size: 19 2843is-pure: false 2844realsz: 24 2845stackframe: 0 2846call-convention: amd64 2847cyclomatic-cost: 9 2848cyclomatic-complexity: 0 2849bits: 64 2850type: fcn [NEW] 2851num-bbs: 4 2852edges: 4 2853end-bbs: 0 2854call-refs: 0x00000009 J 0x00000003 J 2855data-refs: 0x0000002c 2856code-xrefs: 0x00000011 J 0x0000000a J 2857noreturn: false 2858in-degree: 2 2859out-degree: 0 2860data-xrefs: 2861locals: 0 2862args: 0 2863diff: type: new 2864 28650x00000000 0x00000005 00:0000 5 j 0x00000005 28660x00000003 0x00000005 00:0000 2 j 0x00000005 28670x00000005 0x0000000c 00:0000 7 j 0x00000009 28680x00000009 0x00000013 00:0000 10 j 0x00000003 2869 2870/ 24: fcn.00000000 (); 2871| 0x00000000 0f1f440000 nop dword [rax + rax] 2872| ----------- true: 0x00000005 2873| ; CODE XREF from fcn.00000000 @ 0x11 2874| 0x00000003 0000 add byte [rax], al 2875| ----------- true: 0x00000005 2876| 0x00000005 b8210000c1 mov eax, 0xc1000021 ; '!' 2877| 0x0000000a ebfd jmp 9 2878| ----------- true: 0x00000009 2879| ; CODE XREF from fcn.00000000 @ 0xa 2880| 0x00000009 c1ebfd shr ebx, 0xfd 2881| 0x0000000c bb2c000000 mov ebx, 0x2c ; ',' 2882\ 0x00000011 ebf0 jmp 3 2883| ----------- true: 0x00000003 2884 2885[0x00000000]> # fcn.00000000 (); 2886 .--------------------------. 2887 | 0x0 | 2888 | 24: fcn.00000000 (); | 2889 | nop dword [rax + rax] | 2890 `--------------------------' 2891 v 2892 | 2893 '--. 2894.---------------. 2895| | | 2896| .------------------------. 2897| | 0x5 | 2898| | ; '!' | 2899| | mov eax, 0xc1000021 | 2900| | jmp 9 | 2901| `------------------------' 2902| v 2903| | 2904| .-----' 2905| | 2906| .-------------------------------------. 2907| | 0x9 | 2908| | ; CODE XREF from fcn.00000000 @ 0xa | 2909| | shr ebx, 0xfd | 2910| | ; ',' | 2911| | mov ebx, 0x2c | 2912| | jmp 3 | 2913| `-------------------------------------' 2914| v 2915| | 2916| .' 2917| | 2918|.--------------------------------------. 2919|| 0x3 | 2920|| ; CODE XREF from fcn.00000000 @ 0x11 | 2921|| add byte [rax], al | 2922|`--------------------------------------' 2923| v 2924| | 2925`----' 2926 2927/ 24: fcn.00000000 (); 2928| 0x00000000 ~ 0f1f440000 nop dword [rax + rax] 2929| ; CODE XREF from fcn.00000000 @ 0x11 2930| .-> 0x00000003 0000 add byte [rax], al 2931| : 0x00000005 ~ b8210000c1 mov eax, 0xc1000021 ; '!' 2932| : ; CODE XREF from fcn.00000000 @ 0xa 2933| .--> 0x00000009 c1ebfd shr ebx, 0xfd 2934| : 0x0000000c bb2c000000 mov ebx, 0x2c ; ',' 2935\ `=< 0x00000011 ebf0 jmp 3 2936.. 2937 2938/ 24: fcn.00000000 (); 2939| 0x00000000 0f1f440000 nop dword [rax + rax] 2940| : 0x00000005 b8210000c1 mov eax, 0xc1000021 ; '!' 2941| `==< 0x0000000a ebfd jmp 9 2942| : 0x0000000c bb2c000000 mov ebx, 0x2c ; ',' 2943\ `=< 0x00000011 ebf0 jmp 3 2944.. 2945EOF 2946RUN 2947 2948NAME=so -N and overlapping basic blocks 2949FILE=- 2950CMDS=<<EOF 2951e asm.arch=x86 2952e asm.bits=64 2953e anal.jmp.mid=true 2954e io.cache=true 2955e anal.nopskip=false 2956wx 0f1f440000b8210000c1ebfdbb2c000000ebf0 2957af 2958s 0x4 2959so -1 2960s 2961s 0x4 2962so -2 2963s 2964EOF 2965EXPECT=<<EOF 29660x3 29670x0 2968EOF 2969RUN 2970 2971NAME=a8 analyze bytes 2972FILE=- 2973CMDS=<<EOF 2974e asm.arch=x86 2975e asm.bits=64 2976e asm.os=linux 2977a8 55| 2978EOF 2979EXPECT=<<EOF 2980address: 0x0 2981opcode: push rbp 2982esilcost: 24 2983disasm: push rbp 2984pseudo: push rbp 2985mnemonic: push 2986description: push word, doubleword or quadword onto the stack 2987mask: ff 2988prefix: 0 2989id: 588 2990bytes: 55 2991refptr: 0 2992size: 1 2993sign: false 2994type: rpush 2995cycles: 1 2996esil: rbp,8,rsp,-,=[8],8,rsp,-= 2997family: cpu 2998stackop: inc 2999stackptr: 8 3000EOF 3001RUN 3002 3003NAME=af jmp after ret 3004FILE=malloc://512 3005CMDS=<<EOF 3006e anal.hasnext=0 3007e asm.arch=x86 3008e asm.bits=64 3009wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3 3010af 3011afl~? 3012EOF 3013EXPECT=<<EOF 30141 3015EOF 3016RUN 3017 3018NAME=af jmp after ret 3019FILE=malloc://512 3020CMDS=<<EOF 3021e anal.hasnext=0 3022e asm.arch=x86 3023e asm.bits=64 3024wx b8010000004839ca7f26b8ffffffff4839ca7c1c498b4838498b5138b8010000004839ca7f0ab8ffffffff4839ca7d025dc34883c7684883c6685dc3 3025af 3026afl~? 3027afl~[2] 3028EOF 3029EXPECT=<<EOF 30301 303160 3032EOF 3033RUN 3034 3035NAME=Windows Function EMU LoadStringA 3036FILE=bins/pe/standard.exe 3037CMDS=<<EOF 3038e asm.arch=x86 3039e asm.bits=32 3040e asm.os=windows 3041e asm.emu=true 3042e emu.write=true 3043e asm.bytes=0 3044e asm.cmt.col=20 3045e asm.lines.bb=false 3046e io.cache=true 3047aeim 3048s 0x00402aee 3049pd 10~?int LoadStringA 3050EOF 3051EXPECT=<<EOF 30521 3053EOF 3054RUN 3055 3056NAME=Linux fcnsign test 3057FILE=bins/elf/analysis/ls-linux64 3058CMDS=<<EOF 3059e asm.arch=x86 3060e asm.bits=64 3061e asm.os=linux 3062e asm.emu=true 3063e emu.write=true 3064e asm.bytes=0 3065e asm.cmt.col=20 3066e asm.lines.bb=false 3067e asm.lines.fcn=false 3068aa 3069aeim 3070s 0x00003cb8-0x30 3071pd 20~env 3072EOF 3073EXPECT=<<EOF 30740x00003cb8 call sym.imp.getenv ; rsp=0x177fe8 -> 0x464c457f ; rip=0x3430 -> 0x97fa25ff 3075 ; char *getenv("COLUMNS") 3076EOF 3077RUN 3078 3079NAME=sar on x86-64 3080FILE=- 3081CMDS=<<EOF 3082e asm.arch=x86 3083e asm.bits=64 3084e anal.hasnext=0 3085# testing mov eax, -4 sar 3086wx 48c7c0fcffffff 48d1f8 48d1f8 48d1f8 48d1f8 48d1f8 48d1f8 3087aes 3088dr?rax 3089aes 3090dr?rax 3091aes 3092dr?rax 3093aes 3094dr?rax 3095EOF 3096EXPECT=<<EOF 30970xfffffffffffffffc 30980xfffffffffffffffe 30990xffffffffffffffff 31000xffffffffffffffff 3101EOF 3102RUN 3103 3104NAME=aes 3105FILE=- 3106CMDS=<<EOF 3107e asm.arch=x86 3108e asm.bits=64 3109e anal.hasnext=0 3110wx 48c7c0fcffffff 48d1f8 48d1f8 48d1f8 3111aes 3112dr?rax 3113aes 3114dr?rax 3115aes 3116dr?rax 3117EOF 3118EXPECT=<<EOF 31190xfffffffffffffffc 31200xfffffffffffffffe 31210xffffffffffffffff 3122EOF 3123RUN 3124 3125NAME=x86-64 after unknown jmp 3126FILE=bins/elf/analysis/ls-linux64 3127CMDS=<<EOF 3128s 0x5c50 3129af 3130pif 3131EOF 3132EXPECT=<<EOF 3133lea rdi, loc._edata 3134lea rax, [0x0021d28f] 3135push rbp 3136sub rax, rdi 3137mov rbp, rsp 3138cmp rax, 0xe 3139jbe 0x5c80 3140mov rax, qword [reloc._ITM_deregisterTMCloneTable] 3141test rax, rax 3142je 0x5c80 3143pop rbp 3144jmp rax 3145nop word [rax + rax] 3146pop rbp 3147ret 3148EOF 3149RUN 3150 3151NAME=t.anal/x86/aap 3152FILE=bins/mach0/ls-osx-x86_64 3153CMDS=<<EOF 3154f-sym.func.* 3155aap 3156pi 2 @ fcn.1000010f8 3157EOF 3158EXPECT=<<EOF 3159push rbp 3160mov rbp, rsp 3161EOF 3162RUN 3163 3164NAME=mac-ls switch count 3165FILE=bins/mach0/ls-osx-x86_64 3166CMDS=<<EOF 3167e anal.jmp.tbl=true 3168af 3169f~switch 3170EOF 3171EXPECT=<<EOF 31720x100001527 1 switch.0x100001527 3173EOF 3174RUN 3175 3176NAME=gcc_5.5.0_64 switch/case flags, meta, hints, etc. 3177FILE=bins/jmptbl/test_gcc_5.5.0_64.out 3178CMDS=<<EOF 3179aaa 3180f~switch 3181f~case. 3182C~Cd 4 3183ah 3184axf 0x59d 3185afb 0x59d 3186EOF 3187EXPECT=<<EOF 31880x0000059d 1 switch.0x0000059d 31890x0000059f 1 case.0x59d.13 31900x000005b2 1 case.0x59d.1 31910x000005c0 1 case.0x59d.2 31920x000005c0 1 case.0x59d.3 31930x000005c0 1 case.0x59d.4 31940x000005ce 1 case.0x59d.5 31950x000005dc 1 case.0x59d.6 31960x000005ea 1 case.0x59d.7 31970x000005f8 1 case.0x59d.9 31980x00000606 1 case.0x59d.11 31990x00000614 1 case.0x59d.12 32000x00000622 1 case.0x59d.0 32010x00000622 1 case.0x59d.8 32020x00000622 1 case.0x59d.10 32030x00000622 1 case.default.0x59d 32040x00000844 data Cd 4 32050x00000848 data Cd 4 32060x0000084c data Cd 4 32070x00000850 data Cd 4 32080x00000854 data Cd 4 32090x00000858 data Cd 4 32100x0000085c data Cd 4 32110x00000860 data Cd 4 32120x00000864 data Cd 4 32130x00000868 data Cd 4 32140x0000086c data Cd 4 32150x00000870 data Cd 4 32160x00000874 data Cd 4 32170x00000878 data Cd 4 3218 0x00000844 => immbase=10 3219 0x00000848 => immbase=10 3220 0x0000084c => immbase=10 3221 0x00000850 => immbase=10 3222 0x00000854 => immbase=10 3223 0x00000858 => immbase=10 3224 0x0000085c => immbase=10 3225 0x00000860 => immbase=10 3226 0x00000864 => immbase=10 3227 0x00000868 => immbase=10 3228 0x0000086c => immbase=10 3229 0x00000870 => immbase=10 3230 0x00000874 => immbase=10 3231 0x00000878 => immbase=10 3232c 0x59f case.0x59d.13 3233c 0x5b2 case.0x59d.1 3234c 0x5c0 case.0x59d.2 3235c 0x5ce case.0x59d.5 3236c 0x5dc case.0x59d.6 3237c 0x5ea case.0x59d.7 3238c 0x5f8 case.0x59d.9 3239c 0x606 case.0x59d.11 3240c 0x614 case.0x59d.12 3241c 0x622 case.0x59d.0 32420x00000580 0x0000058d 00:0000 13 j 0x00000622 f 0x0000058d 32430x0000058d 0x0000059f 00:0000 18 s 0x00000622 s 0x000005b2 s 0x000005c0 s 0x000005ce s 0x000005dc s 0x000005ea s 0x000005f8 s 0x00000606 s 0x00000614 s 0x0000059f 32440x0000059f 0x000005ab 00:0000 12 j 0x000005ab 32450x000005ab 0x000005b2 00:0000 7 32460x000005b2 0x000005c0 00:0000 14 j 0x000005ab 32470x000005c0 0x000005ce 00:0000 14 j 0x000005ab 32480x000005ce 0x000005dc 00:0000 14 j 0x000005ab 32490x000005dc 0x000005ea 00:0000 14 j 0x000005ab 32500x000005ea 0x000005f8 00:0000 14 j 0x000005ab 32510x000005f8 0x00000606 00:0000 14 j 0x000005ab 32520x00000606 0x00000614 00:0000 14 j 0x000005ab 32530x00000614 0x00000622 00:0000 14 j 0x000005ab 32540x00000622 0x00000633 00:0000 17 j 0x000005ab 3255EOF 3256RUN 3257 3258NAME=gcc_7.2.0_64 switch/case flags 3259FILE=bins/jmptbl/test_gcc_7.2.0_64.out 3260CMDS=<<EOF 3261aaa 3262f~switch 3263f~case. 3264EOF 3265EXPECT=<<EOF 32660x0000054d 1 switch.0x0000054d 32670x0000054f 1 case.0x54d.13 32680x00000562 1 case.0x54d.1 32690x00000570 1 case.0x54d.2 32700x00000570 1 case.0x54d.3 32710x00000570 1 case.0x54d.4 32720x0000057e 1 case.0x54d.5 32730x0000058c 1 case.0x54d.6 32740x0000059a 1 case.0x54d.7 32750x000005a8 1 case.0x54d.9 32760x000005b6 1 case.0x54d.11 32770x000005c4 1 case.0x54d.12 32780x000005d2 1 case.0x54d.0 32790x000005d2 1 case.0x54d.8 32800x000005d2 1 case.0x54d.10 32810x000005d2 1 case.default.0x54d 3282EOF 3283RUN 3284 3285NAME=clang_3.8_64 switch/case flags 3286FILE=bins/jmptbl/test_clang_3.8_64.out 3287CMDS=<<EOF 3288aaa 3289f~switch 3290f~case. 3291EOF 3292EXPECT=<<EOF 32930x004004d8 1 switch.0x004004d8 32940x004004df 1 case.0x4004d8.1 32950x004004df 1 case.0x4004d8.2 32960x004004df 1 case.0x4004d8.3 32970x004004e6 1 case.0x4004d8.0 32980x004004ed 1 case.0x4004d8.4 32990x004004f4 1 case.0x4004d8.5 33000x004004fb 1 case.0x4004d8.6 33010x00400502 1 case.0x4004d8.7 33020x00400502 1 case.0x4004d8.9 33030x00400502 1 case.default.0x4004d8 33040x00400509 1 case.0x4004d8.8 33050x00400510 1 case.0x4004d8.10 33060x00400517 1 case.0x4004d8.11 33070x0040051e 1 case.0x4004d8.12 3308EOF 3309RUN 3310 3311NAME=clang_5.0_64 switch/case flags 3312FILE=bins/jmptbl/test_clang_5.0_64.out 3313CMDS=<<EOF 3314aaa 3315f~switch 3316f~case. 3317EOF 3318EXPECT=<<EOF 33190x004004c8 1 switch.0x004004c8 33200x004004cf 1 case.0x4004c8.1 33210x004004cf 1 case.0x4004c8.2 33220x004004cf 1 case.0x4004c8.3 33230x004004d6 1 case.0x4004c8.0 33240x004004dd 1 case.0x4004c8.4 33250x004004e4 1 case.0x4004c8.5 33260x004004eb 1 case.0x4004c8.6 33270x004004f2 1 case.0x4004c8.7 33280x004004f2 1 case.0x4004c8.9 33290x004004f2 1 case.default.0x4004c8 33300x004004f9 1 case.0x4004c8.8 33310x00400500 1 case.0x4004c8.10 33320x00400507 1 case.0x4004c8.11 33330x0040050e 1 case.0x4004c8.12 3334EOF 3335RUN 3336 3337NAME=msvc_1700_64 switch/case flags 3338FILE=bins/jmptbl/test_msvc_1700_64.exe 3339CMDS=<<EOF 3340aaa 3341f~switch 3342f~case. 3343EOF 3344EXPECT=<<EOF 33450x140001023 1 switch.0x140001023 33460x140004b01 1 switch.0x140004b01 33470x140001025 1 case.0x140001023.0 33480x140001038 1 case.0x140001023.1 33490x140001038 1 case.0x140001023.2 33500x140001038 1 case.0x140001023.3 33510x14000104b 1 case.0x140001023.4 33520x14000105e 1 case.0x140001023.5 33530x140001071 1 case.0x140001023.6 33540x140001084 1 case.0x140001023.8 33550x140001097 1 case.0x140001023.10 33560x1400010aa 1 case.0x140001023.11 33570x1400010bd 1 case.0x140001023.12 33580x1400010d0 1 case.0x140001023.7 33590x1400010d0 1 case.0x140001023.9 33600x1400010d0 1 case.default.0x140001023 33610x140004a40 1 case.default.0x140004b01 33620x140004b47 1 case.0x140004b01.0 33630x140004b4b 1 case.0x140004b01.1 33640x140004b56 1 case.0x140004b01.2 33650x140004b62 1 case.0x140004b01.3 33660x140004b77 1 case.0x140004b01.4 33670x140004b80 1 case.0x140004b01.5 33680x140004b92 1 case.0x140004b01.6 33690x140004ba5 1 case.0x140004b01.7 33700x140004bc1 1 case.0x140004b01.8 33710x140004bcb 1 case.0x140004b01.9 33720x140004bde 1 case.0x140004b01.10 33730x140004bf2 1 case.0x140004b01.11 33740x140004c0f 1 case.0x140004b01.12 33750x140004c20 1 case.0x140004b01.13 33760x140004c3a 1 case.0x140004b01.14 33770x140004c55 1 case.0x140004b01.15 33780x140004c79 1 case.0x140004b01.16 3379EOF 3380RUN 3381 3382NAME=test_switch_indirect.exe switch/case flags 3383FILE=bins/jmptbl/test_switch_indirect.exe 3384CMDS=<<EOF 3385s main 3386af 3387e asm.lines = false 3388pdf~case 3389EOF 3390EXPECT=<<EOF 33910x140001012 0f871a010000 ja case.0x140001034.2 33920x140001034 ffe1 jmp rcx ; switch table (99 cases) at 0x140001148 3393;-- case 0: ; from 0x140001034 33940x140001036 488d0dd31100. lea rcx, str.case_1 ; 0x140002210 ; "case 1" 3395;-- case 1: ; from 0x140001034 33960x14000104b 488d0dc61100. lea rcx, str.case_2 ; 0x140002218 ; "case 2" 3397;-- case 10: ; from 0x140001034 33980x140001060 488d0db91100. lea rcx, str.case_11 ; 0x140002220 ; "case 11" 3399;-- case 12: ; from 0x140001034 34000x140001075 488d0dac1100. lea rcx, str.case_13 ; 0x140002228 ; "case 13" 3401;-- case 14...15: ; from 0x140001034 34020x14000108a 488d0d9f1100. lea rcx, str.case_15_and_16 ; 0x140002230 ; "case 15 and 16" 3403;-- case 18: ; from 0x140001034 34040x14000109f 488d0d9a1100. lea rcx, str.case_19 ; 0x140002240 ; "case 19" 3405;-- case 49: ; from 0x140001034 34060x1400010b4 488d0d8d1100. lea rcx, str.case_50 ; 0x140002248 ; "case 50" 3407;-- case 29: ; from 0x140001034 34080x1400010c9 488d0d801100. lea rcx, str.case_30 ; 0x140002250 ; "case 30" 3409;-- case 19: ; from 0x140001034 34100x1400010de 488d0d731100. lea rcx, str.case_20 ; 0x140002258 ; "case 20" 3411;-- case 9: ; from 0x140001034 34120x1400010f3 488d0d661100. lea rcx, str.case_10 ; 0x140002260 ; "case 10" 3413;-- case 98: ; from 0x140001034 34140x140001108 488d0d591100. lea rcx, str.case_99 ; 0x140002268 ; "case 99" 3415;-- case 96: ; from 0x140001034 34160x14000111d 488d0d4c1100. lea rcx, str.case_97 ; 0x140002270 ; "case 97" 3417;-- case 2...8: ; from 0x140001034 3418;-- case 11: ; from 0x140001034 3419;-- case 13: ; from 0x140001034 3420;-- case 17: ; from 0x140001034 3421;-- case 21...28: ; from 0x140001034 3422;-- case 30: ; from 0x140001034 3423;-- case 31...48: ; from 0x140001034 3424;-- case 50: ; from 0x140001034 3425;-- case 51...95: ; from 0x140001034 3426;-- case 97: ; from 0x140001034 3427EOF 3428RUN 3429 3430NAME=msvc_1900_64 switch/case flags 3431FILE=bins/jmptbl/test_msvc_1900_64.exe 3432CMDS=<<EOF 3433aaa 3434f~switch 3435f~case. 3436EOF 3437EXPECT=<<EOF 34380x140001023 1 switch.0x140001023 34390x1400095b4 1 switch.0x1400095b4 34400x14000c185 1 switch.0x14000c185 34410x140001025 1 case.0x140001023.0 34420x140001038 1 case.0x140001023.1 34430x140001038 1 case.0x140001023.2 34440x140001038 1 case.0x140001023.3 34450x14000104b 1 case.0x140001023.4 34460x14000105e 1 case.0x140001023.5 34470x140001071 1 case.0x140001023.6 34480x140001084 1 case.0x140001023.8 34490x140001097 1 case.0x140001023.10 34500x1400010aa 1 case.0x140001023.11 34510x1400010bd 1 case.0x140001023.12 34520x1400010d0 1 case.0x140001023.7 34530x1400010d0 1 case.0x140001023.9 34540x1400010d0 1 case.default.0x140001023 34550x1400095b6 1 case.0x1400095b4.0 34560x1400095bd 1 case.0x1400095b4.1 34570x1400095c4 1 case.0x1400095b4.2 34580x1400095cb 1 case.0x1400095b4.3 34590x1400095d2 1 case.0x1400095b4.4 34600x1400095d9 1 case.0x1400095b4.5 34610x1400095e0 1 case.0x1400095b4.6 34620x1400095e7 1 case.0x1400095b4.7 34630x1400095ee 1 case.0x1400095b4.8 34640x1400095f5 1 case.0x1400095b4.9 34650x1400095fc 1 case.0x1400095b4.10 34660x140009603 1 case.0x1400095b4.11 34670x14000960a 1 case.0x1400095b4.12 34680x140009611 1 case.0x1400095b4.13 34690x140009618 1 case.0x1400095b4.14 34700x14000961d 1 case.default.0x1400095b4 34710x14000c100 1 case.default.0x14000c185 34720x14000c1d0 1 case.0x14000c185.0 34730x14000c1d1 1 case.0x14000c185.2 34740x14000c1d8 1 case.0x14000c185.8 34750x14000c1df 1 case.0x14000c185.3 34760x14000c1ef 1 case.0x14000c185.1 34770x14000c1f5 1 case.0x14000c185.16 34780x14000c200 1 case.0x14000c185.11 34790x14000c21b 1 case.0x14000c185.4 34800x14000c220 1 case.0x14000c185.5 34810x14000c230 1 case.0x14000c185.6 34820x14000c240 1 case.0x14000c185.7 34830x14000c258 1 case.0x14000c185.13 34840x14000c270 1 case.0x14000c185.9 34850x14000c280 1 case.0x14000c185.10 34860x14000c290 1 case.0x14000c185.12 34870x14000c2a0 1 case.0x14000c185.14 34880x14000c2c0 1 case.0x14000c185.15 3489EOF 3490RUN 3491 3492NAME=./noncode 3493FILE=bins/mach0/ls-osx-x86_64 3494CMDS=<<EOF 3495e anal.noncode=false 3496afr 3497afl~?str. 3498EOF 3499EXPECT=<<EOF 35000 3501EOF 3502RUN 3503 3504NAME=./noncode 3505FILE=bins/mach0/ls-osx-x86_64 3506CMDS=<<EOF 3507e anal.noncode=false 3508e anal.calls=true 3509af 3510afl~?str. 3511EOF 3512EXPECT=<<EOF 35130 3514EOF 3515RUN 3516 3517NAME=Microsoft x64 CC Args/Vars 3518FILE=bins/pe/testx64.exe 3519CMDS=<<EOF 3520e asm.comments=0 3521e anal.vars.stackname=true 3522s 0x140001080 3523e anal.cc=ms 3524af 3525pdf 3526EOF 3527EXPECT=<<EOF 3528/ 82: fcn.140001080 (int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4); 3529| ; var int64_t var_50h @ rsp+0x20 3530| ; var int64_t var_20h @ rsp+0x50 3531| ; var int64_t var_18h @ rsp+0x58 3532| ; var int64_t var_10h @ rsp+0x60 3533| ; var int64_t var_8h @ rsp+0x68 3534| ; arg int64_t arg1 @ rcx 3535| ; arg int64_t arg2 @ rdx 3536| ; arg int64_t arg3 @ r8 3537| ; arg int64_t arg4 @ r9 3538| 0x140001080 48894c2408 mov qword [var_20h], rcx 3539| 0x140001085 4889542410 mov qword [var_18h], rdx 3540| 0x14000108a 4c89442418 mov qword [var_10h], r8 3541| 0x14000108f 4c894c2420 mov qword [var_8h], r9 3542| 0x140001094 53 push rbx 3543| 0x140001095 56 push rsi 3544| 0x140001096 57 push rdi 3545| 0x140001097 4883ec30 sub rsp, 0x30 3546| 0x14000109b 488bf9 mov rdi, rcx 3547| 0x14000109e 488d742458 lea rsi, [var_18h] 3548| 0x1400010a3 33c9 xor ecx, ecx 3549| 0x1400010a5 ff15cd100000 call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func] 3550| 0x1400010ab 488bd8 mov rbx, rax 3551| 0x1400010ae e85dffffff call fcn.140001010 3552| 0x1400010b3 4533c9 xor r9d, r9d 3553| 0x1400010b6 4889742420 mov qword [var_50h], rsi 3554| 0x1400010bb 4c8bc7 mov r8, rdi 3555| 0x1400010be 488bd3 mov rdx, rbx 3556| 0x1400010c1 488b08 mov rcx, qword [rax] 3557| 0x1400010c4 ff159e100000 call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfscanf] 3558| 0x1400010ca 4883c430 add rsp, 0x30 3559| 0x1400010ce 5f pop rdi 3560| 0x1400010cf 5e pop rsi 3561| 0x1400010d0 5b pop rbx 3562\ 0x1400010d1 c3 ret 3563EOF 3564RUN 3565 3566NAME=x86_64 show registers in table 3567FILE=- 3568CMDS=<<EOF 3569e asm.arch=x86 3570e asm.bits=64 3571ar= 3572EOF 3573EXPECT=<<EOF 3574 rax 0x00000000 rbx 0x00000000 rcx 0x00000000 3575 rdx 0x00000000 rsi 0x00000000 rdi 0x00000000 3576 r8 0x00000000 r9 0x00000000 r10 0x00000000 3577 r11 0x00000000 r12 0x00000000 r13 0x00000000 3578 r14 0x00000000 r15 0x00000000 rip 0x00000000 3579 rbp 0x00000000 rflags 0x00000000 rsp 0x00000000 3580EOF 3581RUN 3582 3583NAME=x86_64 retpoline jmptbl 3584FILE=bins/elf/retpoline 3585CMDS=<<EOF 3586s 0x780 3587af 3588pdr~- case[2] 3589EOF 3590EXPECT=<<EOF 35913: 35922: 35931: 35940: 35954: 3596EOF 3597RUN 3598 3599NAME=x86_64 retpoline disabled jmptbl 3600FILE=bins/elf/retpoline 3601CMDS=<<EOF 3602e anal.jmp.retpoline = false 3603s 0x780 3604af 3605pdr~- case[2] 3606EOF 3607EXPECT=<<EOF 3608EOF 3609RUN 3610 3611NAME=lea pseudo improvements (pseudo disabled) 3612FILE=- 3613CMDS=<<EOF 3614e asm.arch=x86 3615e asm.bits=64 3616e asm.comments=false 3617e asm.pseudo=false 3618wx 544889e5b40266b83333b85555444448b8bebafecaefbeadde4889d8488d03488b4308488d4308488d041b488d441b0a488d430a488d44240c488d450b488d45f5488d442404488d4508488d45f8 3619aa 3620pd 19 3621EOF 3622EXPECT=<<EOF 3623/ 512: fcn.00000000 (int64_t arg_8h, int64_t arg_bh, int64_t arg_ch); 3624| ; var int64_t var_bh @ rbp-0xb 3625| ; var int64_t var_8h @ rbp-0x8 3626| ; arg int64_t arg_8h @ rbp+0x8 3627| ; arg int64_t arg_bh @ rbp+0xb 3628| ; var int64_t var_4h @ rsp+0x4 3629| ; arg int64_t arg_ch @ rsp+0xc 3630| 0x00000000 54 push rsp 3631| 0x00000001 4889e5 mov rbp, rsp 3632| 0x00000004 b402 mov ah, 2 3633| 0x00000006 66b83333 mov ax, 0x3333 3634| 0x0000000a b855554444 mov eax, 0x44445555 3635| 0x0000000f 48b8bebafeca. movabs rax, 0xdeadbeefcafebabe 3636| 0x00000019 4889d8 mov rax, rbx 3637| 0x0000001c 488d03 lea rax, [rbx] 3638| 0x0000001f 488b4308 mov rax, qword [rbx + 8] 3639| 0x00000023 488d4308 lea rax, [rbx + 8] 3640| 0x00000027 488d041b lea rax, [rbx + rbx] 3641| 0x0000002b 488d441b0a lea rax, [rbx + rbx + 0xa] 3642| 0x00000030 488d430a lea rax, [rbx + 0xa] 3643| 0x00000034 488d44240c lea rax, [arg_ch] 3644| 0x00000039 488d450b lea rax, [arg_bh] 3645| 0x0000003d 488d45f5 lea rax, [var_bh] 3646| 0x00000041 488d442404 lea rax, [var_4h] 3647| 0x00000046 488d4508 lea rax, [arg_8h] 3648| 0x0000004a 488d45f8 lea rax, [var_8h] 3649EOF 3650RUN 3651 3652NAME=lea pseudo improvements (pseudo enabled) 3653FILE=- 3654CMDS=<<EOF 3655e asm.arch=x86 3656e asm.bits=64 3657e asm.comments=false 3658e asm.pseudo=true 3659wx 544889e5b40266b83333b85555444448b8bebafecaefbeadde4889d8488d03488b4308488d4308488d041b488d441b0a488d430a488d44240c488d450b488d45f5488d442404488d4508488d45f8 3660aa 3661pd 19 3662EOF 3663EXPECT=<<EOF 3664/ 512: fcn.00000000 (int64_t arg_8h, int64_t arg_bh, int64_t arg_ch); 3665| ; var int64_t var_bh @ rbp-0xb 3666| ; var int64_t var_8h @ rbp-0x8 3667| ; arg int64_t arg_8h @ rbp+0x8 3668| ; arg int64_t arg_bh @ rbp+0xb 3669| ; var int64_t var_4h @ rsp+0x4 3670| ; arg int64_t arg_ch @ rsp+0xc 3671| 0x00000000 54 push rsp 3672| 0x00000001 4889e5 rbp = rsp 3673| 0x00000004 b402 ah = 2 3674| 0x00000006 66b83333 ax = 0x3333 3675| 0x0000000a b855554444 eax = 0x44445555 3676| 0x0000000f 48b8bebafeca. rax = 0xdeadbeefcafebabe 3677| 0x00000019 4889d8 rax = rbx 3678| 0x0000001c 488d03 rax = rbx 3679| 0x0000001f 488b4308 rax = qword [rbx + 8] 3680| 0x00000023 488d4308 rax = rbx + 8 3681| 0x00000027 488d041b rax = rbx + rbx 3682| 0x0000002b 488d441b0a rax = rbx + rbx + 0xa 3683| 0x00000030 488d430a rax = rbx + 0xa 3684| 0x00000034 488d44240c rax = arg_ch 3685| 0x00000039 488d450b rax = arg_bh 3686| 0x0000003d 488d45f5 rax = var_bh 3687| 0x00000041 488d442404 rax = var_4h 3688| 0x00000046 488d4508 rax = arg_8h 3689| 0x0000004a 488d45f8 rax = var_8h 3690EOF 3691RUN 3692