crytic / ethersplay

EVM dissassembler
GNU Affero General Public License v3.0
838 stars 118 forks source link

runtime bytecode ignored #5

Open offlinemark opened 6 years ago

offlinemark commented 6 years ago

It is a common use case to analyze a file that contains contract init and runtime (rt) bytecode. If you give this to ethersplay, it only analyzes the init bytecode, which is not very useful. if it is possible, ethersplay should detect runtime bytecode and disassemble it also.

at the very least, ethersplay should allow the use to click "create function here" at the location of the rt bytecode. currently, this seems broken.

here is an example bytecode file with both init and rt code

x.bytecode.zip

offlinemark commented 6 years ago

example of "create function here" bug. it should have disassembled all the code at the bottom, but it just got 1 basic block and 1 invalid. image

feliam commented 6 years ago

Look out. There is only 1 function in evm. And it starts at 0. The create_func should then assert you are creating it at address zero.

Also there is no guarantee that the init bytecode will contain the runtime bytecode in the clear. I think you need to copy what you think is the runtime bytecode and take it to a new tab.

offlinemark commented 6 years ago

The create_func should then assert you are creating it at address zero.

i'm not sure about this. while yes, technically there is strictly 1 function, beginning at 0x0 in EVM bytecode, it would still be useful to manually disassemble at an arbitrary offset

joshwatson commented 6 years ago

So looking at that particular example, the sub_1e is doing what it's supposed to do, but the jump destination is invalid. That's why you're not seeing anything more. Creating an arbitrary function should work correctly otherwise