Rot127
commented
10 months ago LDR only saves an offset relative to the current PC. So if ldr is located at 0x390, the immediate of the instruction would be 0x8.
/ad likely disassembles every instruction again for the search, but with PC = 0, hence returns ldr ... 0x8 and the search query doesn't match.
Just a guess. Though this would also effect other instructions with relative immediate vals (jumps etc.)
Either way, the documentation of the command should make the behavior more clear.
Work environment
rizin -vfull output, not truncated (mandatory)Expected behavior
Tried to find all ldr instructions with immediate 0x398 Searched with /ad, /a etc with it
Actual behavior
Found no results, but should have since I can see them in the disassembly
Steps to reproduce the behavior
Binary: binary.zip
Additional Logs, screenshots, source code, configuration dump, ...
/ai 0x398works fine.mattermost-messages
##### bqv - i'm trying to search for an instruction with rizin - i'm getting nothing - no hits, each time ##### rot127 - Can you list the commands you use and what the outcome is you are hoping for? ##### bqv - sure - I tried / 0x398 naively, in case that works, but i'm fairly sure that's not how things work, so instead i also tried variations like :> /ad/a ldr r., [r0, .*] - :> /ad/a ldr.w r3, [r0, 0x2e4] - :> /a ldr.w r3, [r0, 0x2e4] - i even tried /a blx, which i'm sure should have hit - none of those hit anything, even though those last two are verbatim instructions in the function i'm currently inspecting - instead if i try / DICT for the data string nearby, that matches - but i'm looking to find values in the offset of that ldr instruction - basically, i want to find all ldr instructions with an offset of e.g. 0x2e4 or 0x398 ##### rot127 - @bqv Try /ai 0x398 - Should give you every instructoin using this immediate. ##### bqv - it matches! yes! - thank you. ##### rot127 - The problem with ldr is, that the offset is depends on the PC the instruction is located. - The immediate is an offset. - My guess is, that the search doesn't find them, because it disassembles each instruction again, but with address 0 - Hence, the result of the offset is only 0x8 instead of 0x398 for example ##### bqv - oh dear, ok ##### rot127 - If the instrucion is located at 0x390 I mean - Just a guess so ##### bqv - yeah, i follow - is that the case for all immediate values? ##### bqv - or just that instruction? ##### rot127 - Could you open an issue about it? Maybe it does work as expected. But than the docs are not specific enough - Every ARM instruction which interprets the immediate as offset to its address - https://developer.arm.com/documentation/dui0041/c/Babbfdih - LDR is one of them. - Jumps to an offset/relative jumps as well I guess ##### rot127 - The issue template should guide you. write what you wrote above: - I'd tried to find all ldr instructions with immediate 0x398 - Searched with /ad, /a etc with it. - Found no results, but should have since I can see them n the disassembly - Something like this - It would be of great help - I'll add the details later when I have time