1925 Commits

Author SHA1 Message Date
James Gross 4856a51d51 Perf and bad variable usage cleanup. (#681) 2026-05-29 09:41:06 -04:00
atlas0fd00m 6dc1788686 Add missing logger import to cobra tests (#699)
testbasic.py used logger without importing it, causing NameError.
Added logging import and logger instance creation.

Co-authored-by: Matthew Carpenter <kurios@Matthews-MBP.lan>
2026-05-06 00:06:49 -04:00
atlas0fd00m ef475af564 Migration to PyQt6 (#691)
* initial migration to PyQt6

* QContextMenuEvents still use globalPos() instead of globalPosition()

* Apply suggestion from @atlas0fd00m

* migration notes added to vivisect/notes/pyqt6.md

* De-racify per Rakuy0

* handle special keys robustly

* minor bugfixes:
* Reverse Sorting in Tree Views
* Scroll-zoom in FuncgraphView
* Scrolling past end/beginning in MemoryView

enhancement:
* Auto-sort in Tree Views during load-time (now works, never did in PyQt5)

* need the necessary libs to run unittests on pyqt6 modules

* Second lib

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2026-05-05 23:12:45 -04:00
James Gross cfd18339fc V1.3.2 Release Prep (#698) v1.3.2 2026-03-31 09:34:54 -04:00
atlas0fd00m f11b04f770 Aarch64 test cleanup and emulation tests (#690) 2026-03-30 16:19:38 -04:00
James Gross ea95e4befd V1.3.1 Release Prep (#695) v1.3.1 2026-03-30 11:37:28 -04:00
James Gross 6a8017b142 Upgrade deps and prep V1.3.1 release (#693) 2026-03-30 11:29:50 -04:00
atlas0fd00m 139c67f9e2 Fix Intermittent Unittest Hangs n(#694) 2026-03-30 09:23:40 -04:00
James Gross 9c1573e8d4 V1.3.0 Release Prep (#688) v1.3.0 2026-01-16 17:21:32 -05:00
atlas0fd00m b1c21236c9 Aarch64 (#224)
* initial check-in

* Test Commit

Just some initial code

* initial aarch64 Arch module

* .DS_Store banished!

* July 6, 2017

My updated version of the files

* Fixed Syntax Errors

* Added FP Instructions

* Data Processing (reg) instructions

Some changes made to previous instructions and data processing (register) instructions added

* More fixes, crypto instrs added

return p_undef, ienc_parsers updated, crypto instructions added

* Scalar SIMD instructions

All AdvSIMD scalar instructions added

* Part of remaining SIMD instructions

Some non-scalar/vector instructions

* Small Fixes

Oflag fixes

* Added more AdvSIMD instructions

Finished instruction set

* Unit tests and comments

Unit tests added for a) data processing (immediate), b) branch, exception generation and system instructions, c) data processing (register). Helpful comments added to disasm

* starter regs/emu, and a bugfix in const.

* Bug fixes

* Load/store instruction tests, small fixes

All load/store tests added, comments fixed, #nzcv corrected in a few tests

* added aarch64 into envi.__init__

* updating regs.py for sequencing bug

* All AdvSIMD data processing instructions tests added

Lots of variants, arrangement specifiers, and width specifiers for the same instructions.

* Minor changes

Operands added, tests changed, const updated

* lots of minor updates, working toward road-worthiness

* wrap aarch64 into the vivisect family. sorry h8 and msp430, you get bumped and may need to reanalyze.

* a few bugfixes and enhancements

* comments and lots of tweaks and bugfixes.  lots of iflag vars are 1) not initialized before |=, and 2) not returned.  went from 2.6% coverage on the test binary to 11.8% (231481/1955800 bytes)

* a few Py3 issues

* a few Py3 issues

* A64 touchups.

* added impemu for aarch64 (a64)

* stuff

* renaming stuff

* moving right along

* cleanup and converting aarch64 -> a64 and ARCH_AARCH64 -> ARCH_A64.
can now load an A64 ELF into a workspace.

* cleanup

* making rendering work

* many updates to help LDR/STR and memory deref operands

* a little more work on aarch64, getting unittests going

* prfm update

* updated to accept the lastest Vivisect/Envi API

* many many bugfixes.  still sorting out SP versus ZR

* lots of bugfixes, both in the arch mod as well as unittests.
AARCH64 Linux Kernel used for unittests.  probably want to trim down the tests, once we get things under control.

* "mov" alias for add/sub 0

* A64 improvements!!

* more improvements

* more aarch64 improvements

* Corrected default endianness and processing for certain opcodes

* handle edge case for rendering Xrefs

* Updated some opcode displays for unit testing

* More updates to opcode processing

* More opcode updates and new ImmOper display logic

* Bitmask immediate decoding for log_imm opcodes

* Branch adr fix + revamped bitmask imm calcing

* More opcode updates and ZR reg checks

* More opcode updates

* Update to SYS alias processing

* Updated shifted imms and dictification of consts

* Some SIMD fixes for LDR and STR opers

* Correcting formatting and SIMD for LD and ST

* Added bitfield opcodes and improved their aliasing

* Oper flags and bitmask fixes

* Apply suggestions from code review

small tweaks

* Suggested changes from review

* Fix for DMB oper

* Fix for ISB oper

* Fix for HINT and similar opers

* fixes for CSEL/CSET/CSETM/CSINV/CSINC/CSNEG/CNEG (and a little more)

* reg extend stuff

* more fixes

* more tweaks, aliases and such

* Small SVC oper fix

* stubbing out SME decoding (not implemented yet)

* Fix for some edge cases in ext reg CMP and SUB opers

* More elegant fix for previous ext reg CMP oper logic

* Update to PRFM to use A64RegRegOffOper

* making decoding better, and testing too

* more improvements

* Beginnings of processing logic for Atomic memory operations

* more tweaks
stubs for SVE instruction decoding (which isn't currently handled!)

* minor but important fixes/enhancements

* getOperValue impls to keep codeflow working right.

* RegisterGroup "general"
Analysis Emulation module
Emulation: Remove ARM32 conditional checks from executeOpcode
new A64SimdExpImmOper

* wrap in analysis emulation to the various file types

* emulation improvements, and ELF tweak for marking names we know from the ELF

* Processing for Atomic Memory Operations

* Resolution of accidental merge conflict comments

* bug fixes, unittests, etc...

* enable architecture

* missed adding regs_sys.py

* aarch64 improvements, and ELF64Reloc bugfix

* fixes per @rakuy0

* improvements per Rakuy0

* more fixes per Rakuy0

* Update envi/archs/aarch64/emu.py

* Update envi/archs/aarch64/disasm.py

* Update envi/archs/aarch64/const.py

* Update envi/archs/aarch64/const.py

* Update envi/archs/aarch64/const.py

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>

* Update envi/archs/aarch64/regs.py

* updates to the impemu Emulator/analysis module

* update unittest counts for AARCH64 disassembly/emulation

* true up unittests

* continuing cleanup, unittests, and massive improvements to System Registers and PSTATE accessors

* cleanup and improvement of SYSREGs

* more cleanup

* cleanup and unittests

* tweaking stability (redxor changes took some time to really look into, but it actually looks like a better analysis)

* modify stability again

---------

Co-authored-by: mrsillydog <ian.sam.adams@gmail.com>
Co-authored-by: rgadams <roy.g.adams@gmail.com>
Co-authored-by: Nicholas Groters <njgroters@gmail.com>
Co-authored-by: njGroters <140625827+njGroters@users.noreply.github.com>
Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2026-01-09 23:25:05 -05:00
Willi Ballenthin f09349768f PE/ELF loader fixes (#659)
* PE: imports: bail on parsing when encountering invalid string data

closes https://github.com/mandiant/capa/issues/2228

* elf: handle function tables with misaligned sizes

closes https://github.com/mandiant/capa/issues/2229

* elf: better handle symbols with zero size

closes https://github.com/mandiant/capa/issues/2231

* elf: handle extern object symbols

closes https://github.com/mandiant/capa/issues/2232

* elf: handle invalid reads during symbol parsing

closes https://github.com/mandiant/capa/issues/2232

* elf: log corrupt symbol pointer

Co-authored-by: atlas0fd00m <atlas@r4780y.com>

* elf: log extern object symbols

Co-authored-by: atlas0fd00m <atlas@r4780y.com>

* elf: try to document object symbol handling

as well as simplify some of the logic.

* elf: better detect STT_OBJECT data types

* testvivisect: add comments for some NoReturnCalls entries

* tests: remove some incorrectly recovered NULL pointers

* tests: more ELF pointer tweaks

* tests: add additional ELF pointers

* ELF: better guess at NULL pointers versus zerod varibles

* tests: cleanup more ELF pointer detection tests

* remove misidentified VFTABLE locations

---------

Co-authored-by: atlas0fd00m <atlas@r4780y.com>
Co-authored-by: mr-tz <moritz.raabe@mandiant.com>
2025-12-01 11:08:29 -05:00
Jonathan Snyder d04e519337 Fix references being added for dynamic api calls. (#678)
* Fix references being added for dynamic api calls.

* Performance improvement

* Allow updating existing xref flags.

* Update test_basic_callers to handle 3 new references found

* Update redxor.stability.json with new references.

* Update sudo.stability.json with new references.

* Update linux_arm_sh

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2025-02-06 10:29:00 -05:00
atlas0fd00m 5531bdae6f Vstruct repr render improvement (#674)
* vstruct rendering improvements

* bugfix and unittests

* unittests

* Update vivisect/tests/testvstruct.py

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2025-01-07 17:31:53 -05:00
Jonathan Snyder fa673cb758 Update readMemString to respect admin rights. (#677) 2025-01-02 10:23:12 -05:00
atlas0fd00m 40b4e78e6b arm improvements (#672)
* more

* more

* more

* more arm improvements

* updates for undefined and arch='arm'

* unittests

* more ARM disasm coverage

* undefined, so let's not test :)

* test count
2024-12-18 14:24:53 -05:00
James Gross e3d739a4be V1.2.1 Release Prep (#658) v1.2.1 2024-08-28 14:06:55 -04:00
atlas0fd00m c2fc612a5c ARM arch name normalization (fka: arm _arch_id bugfix) (#668)
* fix `ARMv7A` not having/being a valid archname, so `getArchByName()` returns None... causing `ArmModule.getArchId()` to return `None`

* undo the work that @jpsnyder submitted

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2024-08-21 11:13:26 -04:00
atlas0fd00m e29a86b485 fix bug in readMemString(<>, wide=True) where the last \x00 is considered part of the terminator instead of the last character (#663)
with unittests
2024-08-19 14:36:00 -04:00
Jonathan Snyder 4729907d98 Fix missing ARM alias in arch_defs (#666) (#667)
* Fix missing ARM alias in arch_defs (#666)

* Update envi/__init__.py

---------

Co-authored-by: atlas0fd00m <atlas@r4780y.com>
2024-08-12 17:53:42 -04:00
James Gross a8a8c8be0c Callgraph fixes (#657)
Co-authored-by: atlas0fd00m <atlas@r4780y.com>
2024-07-23 12:35:52 -04:00
James Gross 6f729fab2e Fix an annoying off by one issue in the LNK parser (#655) 2024-07-23 11:35:34 -04:00
atlas0fd00m c47e66a4d6 Update python39 to large resource class in config.yml (#526)
Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2024-07-23 00:25:18 -04:00
James Gross 19b00e4d77 Readthedocs fix (#654)
* maybe leave that blank?

* manual build fix
2024-07-16 15:47:45 -04:00
James Gross 3dddc9c8bc fix readme name in pyproject.toml (#653) v1.2.0 2024-07-15 19:47:18 -04:00
James Gross 172ee92955 V1.2.0 Release Prep (#652)
* prep for release

* bump2version change

* bump version
2024-07-15 18:31:08 -04:00
James Gross 0d883083c2 LNK parser (#649) 2024-07-15 14:57:31 -04:00
atlas0fd00m 88e3fafbde VivServer enhancements (#645)
* vivbin -S now starts the VivServer.  -P sets the listening port.
modifying VivServer comms to break up massive event dumps into max chunk sizes, and favor sending Memory Maps individually.
this helps reduce timeouts while loading massive remote workspaces (working on a 500MB workspace right now).
tweaking the timeouts and chunk sizes still.  was taking 35 minutes to load, now down to ~16minutes over Wifi.  still not happy, looking for other ways to enhance performance.  i believe there are unnecessary delays in master, so i'm looking for them.

* dramatic improvements on performance.  now for a little cleanup.

* some cleanup

* cleaned up.  should be gtg.

* updates to cover unittests and other non-huge things

* kill unused variable

* better documentation for VivChunkQueue

* more comment

* more comment

* solidly avoid race condition between Arch and Platform meta's being set before _snapInAnalysisModules()

* metrics/monitoring on VivServer comms performance

* changes per Rakuy0.  configurable timeouts for Cobra and VivServer

* Update vivisect/remote/server.py

* timeo_* to timeout_* per Rakuy0 :)  makes sense to me.

* Apply suggestions from code review

per rakuy0

* remove "block" options from getServerWorkspace.  it's no longer part of the solution.
2024-07-02 08:25:52 -04:00
atlas0fd00m 50b249156e tag tracking in fg/memview (#646)
* initial tag plumbing

* straglers to the delta

* first use-case for tagging.
open to suggestions for improvement.
2024-06-15 00:48:09 -04:00
atlas0fd00m a04a2737bc MemoryView: RenderMemory on Memory Window load/restore (#647)
* load the address on Memory Window load/restore

* make new MemoryWindows point to the first registed file in the workspace.
2024-05-29 00:50:44 -04:00
atlas0fd00m a216f17fb4 (easy) Save and Restore History for MemoryWindows and FuncGraphs (#648)
* Save and Restore History for MemoryWindows and FuncGraphs

* bugfix: create another deque, not [], so that appendleft() works

wrap a little sanity around history (in case of badness)
2024-05-10 15:28:25 -04:00
atlas0fd00m 4d714546e0 NOW!! WE NO LONGER SEND PEOPLE ON A WILD GOOSE CHASE! getting a default view is *super* simple! (#643) 2024-04-05 23:20:16 -04:00
atlas0fd00m 4136ceed1f Arm improvements (#631)
* new emulation for orn instruction and unittest
enhancement for archModXref
mrs, msr register enhancements (supporting Cortex-M registers like BASEPRI)
fix for a minor example_gui_extension.py bug (import bug)

* enhancement for archModXref
a few minor logging messages

* tweaks (thanks unittests!)

* improvements to ARM disasm, emu, and unittests :)

* more touchups

* touch-ups, thumb bugfixes, and unittests

* more improvements: arm/thumb and unittests

* bugfixes and test improvements

* more updates and improvements for arm/thumb, especially MSR/MRS special registers

* more work done on t32 and a32 MSR/MRS registers.  more work to be done, and yet to have unittest parity with binja.  but we're getting there.

* more improvements for arm/thumb

* dramatic improvements on ARM/THUMB unittests and decoding

* unittest count and completion (almost. watch CPSR access unittest)

* support None type registers for enum lists.  this is important for ARM banked registers and the indirection required.

* lots of work correcting register layouts and CPSR/SPSR functionality and unittests

* tweak to make test_PSRs() pass :)

* CPSR/SPSR correctness, and working unittests

* initial changes per @rakuy0

* changes per @rakuy0 (and a little cleanup)

* minor tweak

* Symhints for "built" pointers

* ADV SIMD LDST bugfixes for parsing VST/VLD type instructions

* lots of VLD decode improvements

* VLD all channels decoding implementation and unittests (and missed additions in Opers to support indexes and alignment)

* check for MOVT and mark xrefs

* cleanup and updates per @rakuy0

* update my musings with real docstrs

* Apply suggestions from code review

getAllReads/Writes support mods

* cleanup errors for switchcase analysis for architectures which don't yet implemented a SymbolikTranslator.

* updates to getAllReads() and getAllWrites, updating to use the actual node properties API, as well as documenting how the Paths work.

* slight touchups

* move the troubleshooting notes out of the unittests and into an ARM-specific note.

* remove old comments
2024-03-23 19:49:07 -04:00
atlas0fd00m 70431066ce endianness (#632)
* plumbing endianness through the VivWorkspace and envi.MemoryObject

* Update vivisect/__init__.py

Co-authored-by: atlas0fd00m <atlas@r4780y.com>

* updates per @rakuy0

* Update vivisect/base.py

* Update vivisect/base.py

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2024-03-19 09:23:32 -04:00
atlas0fd00m d6824f02b5 fix pyproject.toml so it works with local pip installs (and is generally more correct) (#642) 2024-03-13 01:48:45 -04:00
James Gross 9534f16495 Make function graph drawing not take ten thousand years (#636)
* wip

* remove

* fixes

* more

* Fix

---------

Co-authored-by: atlas0fd00m <atlas@r4780y.com>
2024-02-15 14:40:12 -05:00
James Gross 45356a7641 make the repr work (#641) 2024-02-14 14:28:52 -05:00
invisig0th 817b186765 Merge pull request #637 from atlas0fd00m/MakePtrArray
MakePointerArray
2024-02-12 17:30:01 -05:00
atlas0fd00m 2b1c48cfa1 Merge branch 'master' into MakePtrArray 2024-02-08 16:25:41 -05:00
atlas 52d5ff1551 and, the rest of the story. 2024-02-08 16:06:36 -05:00
atlas 6dfc7b8f37 updates per @visi 2024-02-08 15:45:57 -05:00
invisig0th 61928cd9d4 Merge pull request #638 from rnumsu/ihex_patch
Missing IHEX_REC_STARTLINADDR check
2024-02-08 10:21:41 -05:00
rnumsu b3846f3156 Missing IHEX_REC_STARTLINADDR check
- In vstruct/defs/ihex.py getMemoryMaps, there is not a check for
IHEX_REC_STARTLINADDR. The patch adds a check for this record type and
skips over the chunk, similarly to IHEX_REC_STARTSEG.
2024-01-29 17:07:45 -05:00
atlas0fd00m 80b0630667 Merge branch 'master' into MakePtrArray 2024-01-18 14:20:08 -05:00
atlas 3ea705cfac make pointer array - VivWorkspace, and GUI elements 2024-01-18 14:07:06 -05:00
James Gross 6d6a5d946e Deal with uninitialized data sections in PE files and tackle some recursion issues (#622) 2023-11-16 15:19:10 -05:00
James Gross 1567510e26 Descend into thunk_reg functions to avoid some infinite recursion issues. (#634) 2023-11-14 11:14:23 -05:00
atlas0fd00m 41aef7045b Architecture Maturity (#588)
* initial Arch Maturity implementation

* rename maturity levels (collaborative)

* i think we're there now.  changes per @rakuy0 and added UI basic interface

```
$ python -m vivisect.vivbin -m
2023-09-24 20:11:54,879:INFO:vivisect: Supported Architectures, Version, and Features[vivbin.py:main:74]
2023-09-24 20:11:54,879:INFO:vivisect: ==============================================[vivbin.py:main:75]
2023-09-24 20:11:54,879:INFO:vivisect:                 i386  ver: v1.0.0  aliases: ('i486', 'i586', 'i686', 'x86')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                amd64  ver: v1.0.0  aliases: ('x86_64',)[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                  arm  ver: v1.0.0  aliases: ('armv6l', 'armv7l', 'a32', 'leg', 'leg32')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:              thumb16  ver: v1.0.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                thumb  ver: v1.0.0  aliases: ('t32', 'thumb2', 'toe', 'toe2', 'toe32')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                  a64  ver: v0.2.0  aliases: ('aarch64', 'leg64', 'legv8')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:               msp430  ver: v1.0.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                   h8  ver: v0.5.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                mcs51  ver: v0.5.0  aliases: ('8051', '80x51')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                 rv32  ver: v0.5.0  aliases: ('riscv', 'risc-v')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                 rv64  ver: v0.5.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:       ppc32-embedded  ver: v1.0.0  aliases: ('ppc32',)[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:         ppc-embedded  ver: v1.0.0  aliases: ('ppc64-embedded', 'ppc-spe')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:         ppc32-server  ver: v0.9.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:           ppc-server  ver: v0.9.0  aliases: ('ppc64-server', 'altivec', 'ppc-altivec')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:              ppc-vle  ver: v1.0.0  aliases: ('vle', 'ppc32-vle', 'ppcvle')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:          ppc-desktop  ver: v0.5.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                 rxv2  ver: v0.5.0  aliases: ('rxv1', 'rx')[vivbin.py:main:77]
2023-09-24 20:11:54,879:INFO:vivisect:                sparc  ver: v0.1.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,880:INFO:vivisect:              sparc64  ver: v0.1.0  aliases: None[vivbin.py:main:77]
2023-09-24 20:11:54,880:INFO:vivisect:               mips32  ver: v0.1.0  aliases: ('mips',)[vivbin.py:main:77]
2023-09-24 20:11:54,880:INFO:vivisect:               mips64  ver: v0.1.0  aliases: None[vivbin.py:main:77]

```

* Update __init__.py

removed Maturity constants per rakuy0

---------

Co-authored-by: James Gross <45212823+rakuy0@users.noreply.github.com>
2023-10-23 19:47:57 -04:00
James Gross 6d760a1c88 Some housecleaning stuff (#629) 2023-10-04 23:22:48 -04:00
atlas0fd00m e6246ee116 give a default name of "loc_########" so the address shows up while editing (in case you want to keep it there). displaying always defaults to that naming convention. (#630) 2023-10-03 13:58:05 -04:00
atlas0fd00m cfae36ff60 ready: Cobra dcode upgrade and bugfix (#610)
* open xrefs and menu items in a new Memory/FuncGraph view

* working on making Cobra work on Python 3.11/3.12, checking to make sure dcode works properly again (currently seems like it does not)

* dcode server worky again.
typo, misvariabled `mod` and `module` mismatch.

* make Dcode a runnable module
add several core elements to the helper functions to start a CobraDaemon

* usability enhancements for cobra Dcode
Dcode unittests which actually make use of Dcode core functionality

* remove `imp` dependency
shore up unittest

* updates to make unittests work on CircleCi like they do locally

* cobra bugfixes and cleanup
cobra helpers unittests

* modifications per @rakuy0

* remove arbitrary setting of loglevel for testdcode

* Update vivisect/qt/main.py

update hotkey for funcGraph

* mods per @rakuy0

* DaemonManager API for handling numerous CobraDaemons (per @rakuy0)

* print->logger (per @rakuy0)

* cleanup and dedup re: @rakuy0
2023-10-01 07:57:02 -04:00