radareorg / radare2

UNIX-like reverse engineering framework and command-line toolset
https://www.radare.org/
GNU Lesser General Public License v3.0
20.32k stars 2.97k forks source link

Segment registers not honored on ESIL #19086

Open trufae opened 2 years ago

trufae commented 2 years ago

>Native: mov rax, qword fs:[0x28]
>ESIL: 0x28,[8],rax,=
trufae commented 2 years ago

0x64, 0x48, 0x8B, 0x04, 0x25, 0x28, 0x00, 0x00, 0x00

condret commented 2 years ago

this is because we don't have a satisfying description for segments, e.g. esil cannot switch between 32 and 64 bit

trufae commented 2 years ago

any proposal for this @condret?

trufae commented 2 years ago

I think we can add a memory selector esil command, that takes the value from a register or immediate and passes it to configure "whatever" externally to the esil vm with a new callback. That can look like this:

65a114000000   mov eax, dword gs:[0x14]
now its: 0x14,[4],rax,=

but it shuold be:

0x14,gs,@=,[4],rax,=

this can be also useful for iobanks. so.. maybe we can setup the segments as different iobanks configured.

trufae commented 2 years ago

Maybe we need two commands, one for temporal iobank selection (gets discarted after reading the memory. or keeps working after change. This can be useful for emulating syscalls by doing a context switch exposing the kernel memory instead of userspace layout. I would say @@= and @= but maybe something like BANK or easier for the reader.

condret commented 2 years ago

shouldn't that be fs,0x28,+,[8],rax,:=

trufae commented 1 year ago

maybe instead of breaking all the current ops we can make the memory selector as a separate esil command.

gs,@@,0x14,[4],rax,=,0,@@

im proposing @@ but that could be anything else. the ranalesil struct can keep track of that variable that selects the memory bank or segment to use for reading or writing. this var ir reset after parsing every statement.

This could be also an internal var.

trufae commented 4 months ago

depends on https://github.com/radareorg/radare2/pull/22258