rizinorg / rizin

UNIX-like reverse engineering framework and command-line toolset.
https://rizin.re
GNU Lesser General Public License v3.0
2.66k stars 357 forks source link

`rz-asm` assembly results may be not correct #1834

Open megrxu opened 2 years ago

megrxu commented 2 years ago

Work environment

Questions Answers
OS/arch/bits (mandatory) Arch Linux x86 64
File format of the file you reverse (mandatory) N/A
Architecture/bits of the file (mandatory) x86/64
rizin -v full output, not truncated (mandatory) rizin 0.3.0 @ linux-x86-64

Expected behavior

Running:

inst="`rz-asm -a x86 -b 64 'xor rax, qword [rbp]'`"
rz-asm -a x86 -b 64 -d "$inst"

Outputs:

xor rax, qword [rbp]

Actual behavior

Outputs:

invalid
invalid
invalid
invalid

It seems that the instruction xor rax, qword [rbp] is not assembled correctly (should be "48334500", but "48330500" instead). However, with a none-zero offset xor rax, qword [rbp + 1], the result is correct.

For example running:

inst="`rz-asm -a x86 -b 64 'xor rax, qword [rbp + 1]'`" # $inst="48334501"
rz-asm -a x86 -b 64 -d "$inst"

Outputs:

xor rax, qword [rbp + 1]
ret2libc commented 1 year ago

This is an assembler problem. I still think we should default to keystone as assembler, because it is much better than the custom one we currently have. cc @XVilka @thestr4ng3r @wargio

wargio commented 1 year ago

ok for me, but keep in mind that keystone input is very buggy.

ret2libc commented 1 year ago

ok for me, but keep in mind that keystone input is very buggy.

Why do you say so? Every time we have a bug on the assembler, I go check with the .ks version and it works.

wargio commented 1 year ago

because you haven't seen the changes i have done to the code to assemble ppc

ret2libc commented 1 year ago

because you haven't seen the changes i have done to the code to assemble ppc

? Could you link/reference here?

wargio commented 1 year ago

https://github.com/rizinorg/rizin-extras/commits/master/keystone check all my commits

thestr4ng3r commented 1 year ago

I think the most obvious blocker is that it is c++.

ret2libc commented 1 year ago

For that I think my old plugins reorg PR can help, as we can build the rz-keystone plugin as a separate shared library without affecting the rest of the codebase.