rizinorg / rizin

UNIX-like reverse engineering framework and command-line toolset.
https://rizin.re
GNU Lesser General Public License v3.0
2.64k stars 354 forks source link

Debugger stepping - `ds` => step opcode - `dsi` => step instruction #761

Closed caribpa closed 3 years ago

caribpa commented 3 years ago

Is your feature request related to a problem? Please describe. It would be nice to have the distinction between stepping an instruction and stepping an opcode.

Sometimes (I haven't really pay attention if the circumstances are the same) I do ds and the prompt address stays the same until issuing ds at least once (or more). From this behavior I came to the understanding that the address under the cursor stays the same because the assembly in there is composed by more than one instruction.

Describe the solution you'd like

Describe alternatives you've considered 💔

Additional context 🤷

ret2libc commented 3 years ago

You lost me here... What would it be the difference between "stepping an opcode" and "stepping an instruction"?

caribpa commented 3 years ago

Well, I'm going to quote the beginning of this answer:

Instruction: A directive for a certain action, like ADD, SUB or MOV as a whole.

OP-Code: The Encoding of an instruction as seen by the CPU.

As well as this answer, as it is more visual:

In Z80 assembly language the code looks like this:

add a,5

Where add is instruction and a,5 are the operands. You can have many permutations of the same instruction (with different operands) each of which has separate op.code. For example:

add a,b
add a,c
add a,d

all are still the "same" instruction add but with different operands and also op.codes (opc [hex]).

opc      T0 T1 MC1   MC2   MC3   MC4   MC5   MC6   MC7   mnemonic

80       04 00 M1R 4 ... 0 ... 0 ... 0 ... 0 ... 0 ... 0 ADD A,B
81       04 00 M1R 4 ... 0 ... 0 ... 0 ... 0 ... 0 ... 0 ADD A,C
82       04 00 M1R 4 ... 0 ... 0 ... 0 ... 0 ... 0 ... 0 ADD A,D

Now, there are instructions like, for example, mov dword ptr [esp+24], 10 that are performing multiple operations at once. Though I haven't checked if that's the case, they may be generating more than one opcode, and in these circumstances performing ds don't move the cursor to the next visible (pd 1) instruction (ds advanced to the next opcode which is still happening in the same assembly line).

caribpa commented 3 years ago

I don't know if I'm explaining myself 😅

ret2libc commented 3 years ago

Well... there was no need to copy what a opcode/instruction is. Rather, i wanted to know how you could just step over just an opcode but not the whole instruction. Because IMO that doesn't make sense, as a concept. You can't just execute/step the mov opcode. You can execute/step the mov dword ptr [esp+24], 10 instruction though.

Now, mov dword ptr [esp+24], 10 is just one instruction. It should be stepped without problems. What you are referring to might happen when you have instructions like rep ....., that actually execute the same instructions multiple times. I am not sure how the debugger works in that case though, I'd need to check.

caribpa commented 3 years ago

Yes, mov dword ptr [esp+24], 10 should get translated into one opcode instruction. Again, I am not sure in which cases I am experiencing this strange ds that doesn't actually steps until insisting with another ds (or more), I'll try to find that one instance.

The other option is that something wasn't properly recognized by Rizin (like, for example, the architecture, platform, etc), and pd 1 is lying showing in one line something that is, in fact, two opcodes/cpu-instructions according to the cpu.

caribpa commented 3 years ago

That's why my mind told me: hey! this: mov dword ptr [esp+24], 10 is being processed by the cpu in this way: first it does dword ptr [esp+24] because why not?, and then it does mov <result from dword ptr [esp+24]>, 10, that's why you have to do ds twice you silly!

And apparently I was convinced by this 😔

caribpa commented 3 years ago

Well, this was an example of my inner-deliberation regarding these strange cases where I had to ds intensively in order to finally step the instruction. I am not implying that mov dword ptr [esp+24], 10 is the culprit, it is just an example.

caribpa commented 3 years ago

On the other hand, I have some strange memories from way back when I couldn't shave to avoid looking like a newborn, where there was this debugger (with an UI, btw), that made a distinction between "stepping" (whatever that was) and stepping one instruction. That's why my mind thought that maybe some difference like that was going on Rizin (but by default ds steps one instruction and there's no way for "stepping").

ret2libc commented 3 years ago

I suggest you re-phrase the issue description, otherwise it is very confusing, in particular due to the many messages. Also, before doing this it would be great to 1) really check what the feature would be about 2) check if some instructions are not "step" when running ds 3) open bugs if some instructions should have been passed but were not (e.g. if doing ds over mov dword ptr [esp+24], 10 does not work, then that's a bug).

caribpa commented 3 years ago

Yes, let's close this issue until I figure out what happens and when.

Basically now I know that Rizin doesn't make any distinction between stepping an opcode and stepping an instruction, so it is probably a strange bug.