Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for radare2 #104

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Add support for radare2 #104

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b595b98
Initial support for radare2
radare May 25, 2024
28ded8b
Avoid using - and + in flagnames
radare Jun 19, 2024
85d8e02
Register flags for the constant pool
radare Sep 18, 2024
b30d7ed
fixes the issue where some Dart functions were missing in the Radare2…
Jul 26, 2024
afe9105
some methods have the same name. To differentiate them, adding the of…
cryptax Aug 9, 2024
340df50
fixing names with ?
cryptax Aug 9, 2024
241bd25
Clean code, require latest r2 from git and add class+method info
radare Sep 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
106 changes: 105 additions & 1 deletion blutter/src/DartDumper.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,110 @@ static std::string getFunctionName4Ida(const DartFunction& dartFn, const std::st
return prefix + fnName;
}

static bool is_valid_char(const char ch) {
if ((ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || isdigit(ch)) {
return true;
}
switch (ch) {
case '.':
case ':':
case '_':
return true;
default:
return false;
}
}

static void filterString(std::string &str) {
for (char& ch : str) {
if (!is_valid_char(ch)) {
ch = '_';
}
}
}

void DartDumper::Dump4Radare2(std::filesystem::path outDir)
{
std::filesystem::create_directory(outDir);
std::ofstream of((outDir / "addNames.r2").string());
of << "# create flags for libraries, classes and methods\n";

of << std::format("f app.base = {:#x}\n", app.base());
of << std::format("f app.heap_base = {:#x}\n", app.heap_base());
Comment on lines +114 to +115
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think these are un-necessary since they change with every run and aren't constant.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but its good to have some as reference, but yeah i was trying to expose some pointers for later testing and see if those are useful.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what would be nice is to know where the object pool is located. aka the address of PP. because right now r2 bases it to address 0, but its configurable. and blutter can be specifying that address


bool show_library = true;
bool show_class = true;
for (auto lib : app.libs) {
std::string lib_prefix = lib->GetName();

std::replace(lib_prefix.begin(), lib_prefix.end(), '$', '_');
std::replace(lib_prefix.begin(), lib_prefix.end(), '&', '_');
std::replace(lib_prefix.begin(), lib_prefix.end(), '-', '_');
std::replace(lib_prefix.begin(), lib_prefix.end(), '+', '_');
for (auto cls : lib->classes) {
std::string cls_prefix = cls->Name();
std::replace(cls_prefix.begin(), cls_prefix.end(), '$', '_');
std::replace(cls_prefix.begin(), cls_prefix.end(), '&', '_');
std::replace(cls_prefix.begin(), cls_prefix.end(), '-', '_');
std::replace(cls_prefix.begin(), cls_prefix.end(), '+', '_');
for (auto dartFn : cls->Functions()) {
const auto ep = dartFn->Address();
auto name = getFunctionName4Ida(*dartFn, cls_prefix);
std::replace(name.begin(), name.end(), '$', '_');
std::replace(name.begin(), name.end(), '&', '_');
std::replace(name.begin(), name.end(), '-', '_');
std::replace(name.begin(), name.end(), '+', '_');
std::replace(name.begin(), name.end(), '?', '_');
if (show_library) {
of << std::format("CC Library({:#x}) = {} @ {}\n", lib->id, lib_prefix, ep);
of << std::format("f lib.{}={:#x} # {:#x}\n", lib_prefix, ep, lib->id);
show_library = false;
}
if (show_class) {
of << std::format("CC Class({:#x}) = {} @ {}\n", cls->Id(), cls_prefix, ep);
of << std::format("f class.{}.{}={:#x} # {:#x}\n", lib_prefix, cls_prefix, ep, cls->Id());
show_class = false;
}
of << std::format("f method.{}.{}.{}_{:x}={:#x}\n", lib_prefix, cls_prefix, name.c_str(), ep, ep);
if (dartFn->HasMorphicCode()) {
of << std::format("f method.{}.{}.{}.miss={:#x}\n", lib_prefix, cls_prefix, name.c_str(),
dartFn->PayloadAddress());
of << std::format("f method.{}.{}.{}.check={:#x}\n", lib_prefix, cls_prefix, name.c_str(),
dartFn->MonomorphicAddress());
}
}
show_class = true;
}
show_library = true;
}
for (auto& item : app.stubs) {
auto stub = item.second;
const auto ep = stub->Address();
std::string name = stub->FullName();
std::replace(name.begin(), name.end(), '<', '_');
std::replace(name.begin(), name.end(), '>', '_');
std::replace(name.begin(), name.end(), ',', '_');
std::replace(name.begin(), name.end(), ' ', '_');
std::replace(name.begin(), name.end(), '$', '_');
std::replace(name.begin(), name.end(), '&', '_');
std::replace(name.begin(), name.end(), '-', '_');
std::replace(name.begin(), name.end(), '+', '_');
std::replace(name.begin(), name.end(), '?', '_');
trufae marked this conversation as resolved.
Show resolved Hide resolved
of << std::format("f method.stub.{}_{:x}={:#x}\n", name.c_str(), ep, ep);
}

of << "f pptr=x27\n"; // TODO: hardcoded value
auto comments = DumpStructHeaderFile((outDir / "r2_dart_struct.h").string());
for (const auto& [offset, comment] : comments) {
if (comment.find("String:") != -1) {
std::string flagFromComment = comment;
filterString(flagFromComment);
of << "f pp." << flagFromComment << "=pptr+" << offset << "\n";
of << "'@0x0+" << offset << "'CC " << comment << "\n";
}
}
}

void DartDumper::Dump4Ida(std::filesystem::path outDir)
{
std::filesystem::create_directory(outDir);
Expand Down Expand Up @@ -842,4 +946,4 @@ void DartDumper::DumpObjects(const char* filename)
of << dumpInstance(obj, simpleForm, nestedObj, 0);
of << "\n\n";
}
}
}
1 change: 1 addition & 0 deletions blutter/src/DartDumper.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ class DartDumper
DartDumper(DartApp& app) : app(app) {};

void Dump4Ida(std::filesystem::path outDir);
void Dump4Radare2(std::filesystem::path outDir);

std::vector<std::pair<intptr_t, std::string>> DumpStructHeaderFile(std::string outFile);

Expand Down
3 changes: 2 additions & 1 deletion blutter/src/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ int main(int argc, char** argv)
#endif
dumper.DumpCode((outDir / "asm").string().c_str());
dumper.Dump4Ida(outDir / "ida_script");
dumper.Dump4Radare2(outDir / "r2_script");

std::cout << "Generating Frida script\n";
FridaWriter fwriter{ app };
Expand All @@ -78,4 +79,4 @@ int main(int argc, char** argv)
}

return 0;
}
}