flat assembler
Message board for the users of flat assembler.

Index > Main > assembly line "state tracker" (reverse engineering?)

Author
Thread Post new topic Reply to topic
sylware



Joined: 23 Oct 2020
Posts: 81
Location: Marseille/France
sylware
Hi,

I was wondering if such software exists (it is very close to the task of reverse engineering): a sort of assembly line state tracker.
Namely, for each line of assembly, which regs are in used and for what, and what do we have on the stack with their appropriate offsets.

We could imagine even more with some memory state tracking, but regs and the stack would already be very useful.

we could "diff" the state of a line with the state of another line (could give garbage if those lines are "too far apart").

We could go even further, if this assembly line state could be serialized and encoded as text and appended to this very line as a comment.
In other words, make it part of the source code, then would help a lot any new developer diving in such code.

And to go beyond, we could imagine a passive terminal GUI presenting those states and their diffs, with some communication socket/pipe with your favorite "vim/emacs". But "yankink/pasting" the serialized encoded text should be enough.
Post 23 Aug 2021, 01:01
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18222
Location: In your JS exploiting you and your system
revolution
Please give some examples of what you expect to see.
Post 23 Aug 2021, 02:09
View user's profile Send private message Visit poster's website Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 164
Location: Russia
macomics
I think he wants to write an IDA for Linux. Try to run it with "wine" and enjoy reverse engineering
Post 23 Aug 2021, 10:06
View user's profile Send private message Reply with quote
sylware



Joined: 23 Oct 2020
Posts: 81
Location: Marseille/France
sylware
revolution wrote:
Please give some examples of what you expect to see.


For instance, for one line in one in my source file, in this software, I would have displayed that rax = counter, rsi = base of my array + constant offset, rdi = tintin, rsp - 8 = milou, rsp - 16 = foo. In general, reg = "some text", rsp -+ offset = "some text". In this very software I would be able to shift/pop/push the stack, change the register content stuff, and maybe the advanced options I did describe in my first post, etc.

It is a mix of an IDE with a sort of reverse engineering tool.

I was wondering if such tool does exist ("libre"/open source, ofc), or something close enough.

In other words, this is "comments on steroids".
Post 23 Aug 2021, 11:49
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 18222
Location: In your JS exploiting you and your system
revolution
It looks like you are suggesting something similar to a debugger with source code integration. Those already exist of course.
Post 23 Aug 2021, 11:58
View user's profile Send private message Visit poster's website Reply with quote
Tomasz Grysztar



Joined: 16 Jun 2003
Posts: 7938
Location: Kraków, Poland
Tomasz Grysztar
macomics wrote:
I think he wants to write an IDA for Linux. Try to run it with "wine" and enjoy reverse engineering
Ghidra is another option.
Post 23 Aug 2021, 12:01
View user's profile Send private message Visit poster's website Reply with quote
sylware



Joined: 23 Oct 2020
Posts: 81
Location: Marseille/France
sylware
ghidra is unfortunately java trash. I am looking for something like C/terminal open source, etc.
Post 23 Aug 2021, 13:25
View user's profile Send private message Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 164
Location: Russia
macomics
Tomasz Grysztar wrote:
Ghidra is another option.
I prefer the way the IDA comments on the code
sylware wrote:
For instance, for one line in one in my source file, in this software, I would have displayed that rax = counter, rsi = base of my array + constant offset, rdi = tintin, rsp - 8 = milou, rsp - 16 = foo. In general, reg = "some text", rsp -+ offset = "some text". In this very software I would be able to shift/pop/push the stack, change the register content stuff, and maybe the advanced options I did describe in my first post, etc.
A little advice. Start with something simpler. For example, add a function of repeatable comments to the IDE (like in IDA, which the IDE automatically repeats when using labels or registers next to which such a comment is specified). This is entirely the functionality of the IDE. You will not need to save repeated comments to the source text unnecessarily (reduce its size). And the design of such comments can be within the framework of the standard design of comments (they will not be perceived as something alien saved in the source code, but you will have to complete the definition in the IDE of the presence of a saved copy of such a comment)


Last edited by macomics on 23 Aug 2021, 14:03; edited 1 time in total
Post 23 Aug 2021, 13:41
View user's profile Send private message Reply with quote
bitRAKE



Joined: 21 Jul 2003
Posts: 3307
Location: vpcmipstrm
bitRAKE
Decompiler research has some similar tools. I would bet gdb has some plug-ins in this area - just haven't looked (I like to read the asm). IDA authors have a decompiler tool as well.

_________________
¯\(°_o)/¯ unlicense.org
Post 23 Aug 2021, 13:58
View user's profile Send private message Visit poster's website Reply with quote
sylware



Joined: 23 Oct 2020
Posts: 81
Location: Marseille/France
sylware
I thought of gdb, but it is c++ trash now.
Then I guess I may prototype one if I really get the urge to have such code annotation assistant.
Post 23 Aug 2021, 15:21
View user's profile Send private message Reply with quote
macomics



Joined: 26 Jan 2021
Posts: 164
Location: Russia
macomics
Code:
define icpu
  x /5i $pc
  p /z $rax
  p /z $rcx
  p /z $rdx
  p /z $rbx
  p /z $rbp
  p /z $rsi
  p /z $rdi
 . . .
  p /z $eflags
  x /z $sp+0
  x /z $sp+4
  x /z $sp+8
  x /z $sp+12
  x /z $sp+16
end
define si
  stepi
  icpu
end
    

Everything is fine with gdb for asm.
Post 23 Aug 2021, 16:36
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.