Let's have a look to this assembly code in radare2:

xxxxxxx  mov rax,rbx
xxxxxxx  add rax,rax
xxxxxxx  add rax,rbx
xxxxxxx  shl rax,2
yyyyyyy  nop

Is there a way to ask radare2 to evaluate rax value at yyyyyy address ?

I want radare2 to say: rax=rbx*6

  • Your question is not at all clear. What do you mean by "evaluate rax at address"? Just set a breakpoint and look at the register. – Twifty Sep 16 '18 at 18:13
  • I do not want to run the program. I want to select lines and ask radare2 to compute a formula which represents how rax is calculated – Bob5421 Sep 17 '18 at 15:31

This looks a lot like symbolic execution. For concrete values this is already supported.

[0x006000b0]> e asm.emu=true
[0x006000b0]> pdf
            ;-- section..shellcode:
            ;-- rip:
┌ (fcn) entry0 23
│   entry0 ();
│           0x006000b0      48c7c3444342.  mov rbx, 0x41424344         ; 'DCBA' ; [01] -rwx section size 22 named .shellcode ; rbx=0x41424344
│           0x006000b7      4889d8         mov rax, rbx                ; rax=0x41424344
│           0x006000ba      4801c0         add rax, rax                ; '#' ; rax=0x82848688 ; of=0x0 ; sf=0x0 ; zf=0x0 ; cf=0x0 ; pf=0x1
│           0x006000bd      4801d8         add rax, rbx                ; '%' ; rax=0xc3c6c9cc ; of=0x0 ; sf=0x0 ; zf=0x0 ; cf=0x0 ; pf=0x1
│           0x006000c0      48c1e002       shl rax, 2                  ; rax=0x30f1b2730 ; zf=0x0 ; pf=0x1 ; sf=0x0

ESIL is not that powerful for static analysis as such. I don't think there exists a plugin which does this. There are r2 plugins like rune which have some symbolic execution features, you can give them a try.

A rather simple option for you to do this is to use miasm, which can simplify symbolic execution of a basic block and print expressions/relations. An option is to use r2m2 for the same (Maijin from r2 told me this).

from miasm2.analysis.binary import Container
from miasm2.analysis.machine import Machine
import sys

with open("/tmp/resenm", "rb") as fdesc:
    cont = Container.from_stream(fdesc)

default_addr = cont.entry_point
bs = cont.bin_stream

machine = Machine(cont.arch)
mn, dis_engine = machine.mn, machine.dis_engine
ira, ir = machine.ira, machine.ir

mdis = dis_engine(bs, loc_db=cont.loc_db)

ir_arch = ir(mdis.loc_db)
ir_arch_a = ira(mdis.loc_db)

ircfg = ir_arch.new_ircfg()
ircfg_a = ir_arch_a.new_ircfg()

asmcfg = mdis.dis_multiblock(default_addr)
print len(asmcfg)
for block in asmcfg.blocks:
    ir_arch.add_asmblock_to_ircfg(block, ircfg)
    ir_arch_a.add_asmblock_to_ircfg(block, ircfg_a)

from miasm2.ir.symbexec import SymbolicExecutionEngine
from miasm2.arch.x86.regs import regs_init
from miasm2.expression.simplifications import expr_simp
from miasm2.expression.expression import ExprId

sb = SymbolicExecutionEngine(ir_arch_a, regs_init)

nxt_ad = sb.run_at(ircfg_a, default_addr)
print expr_simp(sb.symbols[ExprId("RAX",64)])

will print something like

(RBX_init + RBX_init + RBX_init) << 0x2

Interface this with radare2 hackishly with "!". As I am not so good with r2, I have posted this to r2 irc. Lets see if we get better options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.