Skip to content

Improved function bytes extraction and bytes-masked mode - #57

Open
valbucci wants to merge 22 commits into
br0kej:devfrom
valbucci:function-bytes
Open

valbucci wants to merge 22 commits into
br0kej:devfrom
valbucci:function-bytes

Conversation

@valbucci

Copy link
Copy Markdown
Contributor

Note: Re-submitting #55 to merge into dev instead of main. Reflecting some further changes that were introduced since then to the output file format.


New bytes-masked Mode

Radare2 v6.0.0 introduced a new command p8fmj. This provides not only a function's raw bytes but some additional information as follows:

{
    "type": "function",
    "linear": true,
    "addr": 5368720672,
    "size": 6,
    "data": "ff254a970400",
    "mask": "7f0c00000000"
}

This PR introduces bytes-masked mode. This works exactly as the bytes mode, except that it uses the p8fm command to extract the a bit-level mask and applies the mask to the function raw bytes with a logic AND operation. The result is stored alongside each function's raw bytes in a separate file with extension .masked.bin.

Hence, for a function named entry0, the output of bin2ml extract on a binary file named test_bin will be the following:

> bin2ml extract -f test_bin -o . -m bytes-masked
> ls -1 test_bin_bytes-masked/
entry0.bin         # The raw bytes
entry0.masked.bin  # The masked bytes

Improved Error Handling

Previously, even though raw bytes would be extracted function-by-function, it could happen that an error would be encountered on a single function, which would abort the entire scan.

For example, a binary with >35k functions could contain a single faulty function leading to an error. That error would abort the scan and also discard all the data extracted until that point.

This commit changes that with function-level error handling. If an error is encountered for a function named entry0, the error message will be stored in test_bin-bytes/entry0.error.log and the scan will continue until the end.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant