* missing instr
* more tweaks while I track down some of these graph build messages
* another sprawling commit. Lots of cleanup. decoding fix for intel, qgraphtree fix atlas pointed out that I had initially mised, more better thunk detection, slightly more accurate emucode, and working on but not finished elf relocation additions
* back that out for now
* more tweaks as I try and get elf tests passing again
* tons of test data mostly and a reloc fix
* test update
* Make it slick thanks to willi
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
* clean up a bunch of exception related stuff and doc the new function thunker
* Update vivisect/parsers/elf.py
adding in a comment for @rakuy0 so i can approve this.
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
Co-authored-by: atlas0fd00m <atlas@r4780y.com>
Massive cutover to python3 (baseline is 3.9.1, but is also tested/working on 3.7.x). This merge is a breaking change for any downstream consumers, as the python 2->3 strings/bytes change is central. Most APIs should still work roughly as intended, as I didn't majorly re-organize the codebase, so most APIs live where they lived before. But a changelog/migration guide will be included in the next PR for this.
This PR will constitute most if not all of the v1.0.0 release that is forthcoming soon.
* We decode ud* correctly, but never really added a INS_* definition on it. So added those.
* int1/icebp support since we apparently never had that
* Making sure we don't codeflow past those and bring in a fix from my py3 branch on not code flowing past hlt instructions.
* Even if we fail on codeblock addition, we at least we can add the metadata to the function dictionary.
* We parse but do not make accessible the fixed file info from a PE file (should it be
* Enable ARM analysis on PE
* Pathcount in the UI had succumbed to bitrot and needed
* Some symbolik reduction code coverage
* Address #322
Co-authored-by: atlas0fd00m <atlas@r4780y.com>
A lot of cleanup things in prep for a python 3 transition. Getting rid of the old exception syntax, converting prints over to logging, cutting random scraps of code to be proper unit tests, cut away some older bits of code, etc.
This still works in python2. It's just a lot of tidying up. There are no major functionality changes.
* comment update
* minor update to elfplt.
* mostly added documentation, but start from bridx=0 for analyzing PLT info (we only need the first one, and sometimes there is only one)
* improvements to ELFPLT: finding starting function (bugfix)
* ELFPLT: rearrange location loading for "branch-reverse PLT Start" analysis
* bugfix: codeblocks analyis: if running into an instruction previously described as LOC_POINTER, the call to makeCode didn't include any architecture context. this doesn't work for ARM when in Thumb mode. added "previous opcode" mode.
also, rearranging "pointers" analysis module logging and error handling.
* fixing the pointer analysis also corrected a *whole* bunch of erroreous pointer naming. update unittests.
also, renamed my new "reprLocation()" since it already exists. renamed to "reprLocEntry()"
* bugfix: reprLocEntry() instead of reprLocation()
* reverting to bridx=1. need to decide how to proceed. currently it seems like performing ELF/PLT analysis to "predict" where functions are is more pain than it's worth, and the code is getting more and more complex to do so. either: we'll want to simply lay down opcodes using makeCode() and let the function analysis do the rest, or we may want to refactor the codebase for simplified maintenance.
also, changing unittests to make failures more understandable.
* make LazyLoader "arbitrary" function name duplicate-friendly. even if wrong, complete analysis.
* adding emulation to analyzePLT. the previous commit's message really applies to this. the separation of analyzePLT() and analyzeFunction() is getting blurrier, as analyzePLT() appears to be requiring much more complex analysis to "get it right". going to try a couple things to see how we can reduce brittleness and complexity of the elfplt analysis module.
* most things seem happy with this set of bugfixes/enhancements.
* moving to centralized getGOT() and getPLTs() and bug-fixes.
all unit tests seem to agree.
* reverting to original unittest for testelf
* elfplt now caches gotva/gotsize for each file.
* arm emu: executeOpcode sets T flag based on Opcode's architecture.
* cleanup per @rakuyo
* try/except clause around analyzePLT()
update unittest data for linux/arm/sh
* cleanup unnecessary code
* removing stdlibc++ tests, as cxxfilt versions are changing and mucking up the consistency of the tests.
* testelf updates to print out more failure data, so we can figure out *what* broke, not just that it did.
* thanks @rakuyo!
* and, @rakuyo didn't have to work hard to convince me the global cache of GOT entries was a bad idea. my unittests did that for him. <facepalm>
* unttest enhancements.
* add back in the libstdc++ examples. we have the local cxxfilt bugs (on my machines) figured out.. (damn libc++1)
* more "notes" about PLT, GOT, sections and dynamics.
* savegame
* minor tweaks. unit tests work.
* THUMB_ARCHS per @rakuyo :) and incorporating getPLTs() (and fixing it)
* return if no emulator (per @rakuyo)
* fixups per @rakuyo. thanks!
* cleanup/fix calls to reprLocEntry()... which we renamed.
* unrelated bugfix: ARM ArmRegOper checks the emulator, not itself for getEndian()
prep update to use reprLocation instead of the loctype number.
* minor fix for beauty's sake
* reprLocation needs arch
* unittests modification for linux/arm/sh
* carve out running function mods, add two new vasets
* Well, I tried. At least I cleaned things up a bit
* make things a bit faster and more correct for EmucodeFunctions
* test
* I didn't get all of the conflicts it seems
* analysis passes reordered how we got some functions. So long as they're properly defined functions, that's okay.
AMD64 updates galore.
Shortlist of features and fixes:
* Experimental ieee754 decoder/encoder for intel
* Vast additions to the emulators (symbolik and real) for i386/amd64
* register updates for st* to have the mm* map to them like the manual says.
* more opcodes
* Better handling of the split size optypes
* vtrace updates for getting the full ymm* registers
* Better switchcase detection as a stopgap until the symbolik swithcase PR is in
* reduce Call args for symboliks
* A few more PE noret functions
* Repr a loc when printing the location in the UI
* Make the lockstepper work in 2020
* Highlight fva when we navigate to it in the funcgraph from the search bar
* Standardize exc better.
* Fix some windows apis that were missing parameters
* Fix small decoding issue in i386
* Tweaks for a little less overhead and cleanliness
* Dedup
* Fix test failure
* Code cleanup
James Gross