Are there any tools, tutorials, or resources out there for helping to make sense of NaCL binaries? They have some features that should make things easier – most crucially, fully decidable disassembly and code/data disambiguation. But looking at them in a disassembler, it's hard to make sense of what's going on because most of the interesting stuff is done by calls into the NaCL runtime, and I can't seem to find good documentation on what functions are available there or how to resolve the calls in a disassembly.
There's a lot of code like (sample from
21d70: 81 c4 b8 00 00 00 add esp,0xb8 21d76: 4c 01 fc add rsp,r15 21d79: 41 5b pop r11 21d7b: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0] 21d80: 41 83 e3 e0 and r11d,0xffffffe0 21d84: 4d 01 fb add r11,r15 21d87: 41 ff e3 jmp r11
And this makes it pretty hard to follow control flow.
These binaries are of some interest because they're in some ways Google's answer to ActiveX, and they've been used to ship controversial features like OK Google (aka hotwords).
One resource I have found is a technical description of the SFI mechanism:
Which gives some helpful hints on (e.g.) what
R15 does, it's mostly about the what restrictions NaCL assembly code has to comply with, rather than how things work.