10110111 / edb-debugger

edb is a cross platform x86/x86-64 debugger.
GNU General Public License v2.0
6 stars 0 forks source link

Show memory operands as symbols #34

Open 10110111 opened 8 years ago

10110111 commented 8 years ago

When Show symbolic addresses is enabled, it'd be great to show absolute and rip-relative memory operands as symbols. Namely, the C++ program

#include <iostream>

int myGlobalVar=0x1a2b3c4;

int main()
{
    myGlobalVar=0xf9c8a796;
    std::cerr << myGlobalVar << "\n";
}

should have the disassembly of main look like

push ebp
mov  ebp,esp
and  esp,0xfffffff0
sub  esp,0x10
mov  dword [myGlobalVar], 0xf9c8a796  # note the symbol
mov  eax, [myGlobalVar]               # note the symbol
mov  [esp+4],eax
mov  dword [esp], std::cerr           # note that not _edata, not std::cerr@@GLIBCXX_3.4
call std::ostream::operator<<(int)@plt
mov  dword [esp+4], 0x80486f0         # TODO: recognize strings referred to by immediates
mov  [esp], eax
call ..operator<<..(..ostream..&,char const*)@plt
mov  eax,0
leave
ret

NOTE: the symbol for immediate constant, which is not obviously a memory address, must only be symbolified if it's relocated OR an option to guess symbols for immediates is enabled. NOTE: multiple symbols with the same address should be arbitrated somehow (by relocations?). NOTE: objconv somehow appears to be able to choose the correct std::cerr among different other options (although doesn't resolve function call symbols).