Running just one function from an compiled executable or shared object?

Question

Radare lets me view the assembly and pseudo-C code of a function. Can I run those instructions though outside of the process? Perhaps setting the register myself?

If so, how would I go about doing this? Is there a guide or tutorial on this?

I'm new what I'm thinking is that there must be some kind of easy to set the entry point, the registers the function is using, run code until a ret and then see what happened?

Answer 1

I think you are looking for ESIL which allow you to emulate code

Specifically aei to initialize the VM and aeip to set the pc to curseek. You can list registers using aer and set them with aer eax=1

You can find more info here and here

[0x00000000]> ae?
|Usage: ae[idesr?] [arg]ESIL code emulation
| ae [expr]                  evaluate ESIL expression
| ae?                        show this help
| ae??                       show ESIL help
| ae[aA][f] [count]          analyse esil accesses (regs, mem..)
| aec[?]                     continue until ^C
| aecs [sn]                  continue until syscall number
| aecu [addr]                continue until address
| aecue [esil]               continue until esil expression match
| aef [addr]                 emulate function
| aei                        initialize ESIL VM state (aei- to deinitialize)
| aeim [addr] [size] [name]  initialize ESIL VM stack (aeim- remove)
| aeip                       initialize ESIL program counter to curseek
| aek [query]                perform sdb query on ESIL.info
| aek-                       resets the ESIL.info sdb instance
| aep[?] [addr]              manage esil pin hooks
| aepc [addr]                change esil PC to this address
| aer [..]                   handle ESIL registers like 'ar' or 'dr' does
| aets[?]                    ESIL Trace session
| aes                        perform emulated debugger step
| aesp [X] [N]               evaluate N instr from offset X
| aesb                       step back
| aeso                       step over
| aesu [addr]                step until given address
| aesue [esil]               step until esil expression match
| aetr[esil]                 Convert an ESIL Expression to REIL
| aex [hex]                  evaluate opcode expression

Answer 2

As you correctly mentioned, this is a pseudo C code which output a C-like code. This code can't be compiled since it's not a valid C code. This output can be shown using the pdc command.

radare2 contains plugins for decompilers like Snowman and retdec. You can read more about it and my answer here. With these decompilers you have high chances to success with compiling the generated code. In general, it is not recommended to rely on decompilation to achieve 1:1 result compared to the original source code. Decompilation is very complex and has high probability to fail and miss some information.

Regarding to make changes to registers -- although it is not "outside of the process" you can do it internally from radare by using the dr command.

For example, to change EAX to 0x20 you can simply execute:

dr eax=0x20

And in case you ask in general whether you can change registers by yourself, the answer is yes. Just insert ASM code to you C program:

__asm {
  mov eax, 5
  add eax, 3
}

Answer 3

A few of other approaches could be:

1. Using IDA's AppCall functionality. It isn't all too known a feature (and it should be!) but IDA makes an effort letting you use functions inside the binary in isolation. Check out the link for usage details.
2. Using a debugger. This may not be what you're asking about but you could easily provide register values and execute a function until a ret instruction using any debugger.
3. Using one of the many dynamic instrumentation and emulators out there, you can simulate an execution of a given function and state (i.e. registers, etc). angr is one such tool.