We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
from __future__ import print_function from triton import * import sys function = { 0x3ADFC8: b"\xFE\x07\xC1\xDA", # PACIB X30, SP 0x3ADFCC: b"\xFF\x43\x01\xD1", # SUB SP, SP, #0x50 0x3ADFD0: b"\xFD\x7B\x02\xA9", # STP X29, X30, [SP,#0x40+var_20] 0x3ADFD4: b"\xF5\x1B\x00\xF9", # STR X21, [SP,#0x40+var_10] 0x3ADFD8: b"\xF4\x4F\x04\xA9", # STP X20, X19, [SP,#0x40+var_s0] 0x3ADFDC: b"\xFD\x83\x00\x91", # ADD X29, SP, #0x20 0x3ADFE0: b"\xFF\x7F\x01\xA9", # STP XZR, XZR, [SP,#0x40+holder.section] 0x3ADFE4: b"\xFF\x07\x00\xF9", # STR XZR, [SP,#0x40+holder] 0x3ADFE8: b"\x00\x01\x00\xB5", # CBNZ X0, loc_3AE008 0x3ADFEC: b"\xF4\x03\x1F\x2A", # MOV W20, WZR 0x3ADFF0: b"\xE0\x03\x14\x2A", # MOV W0, W20 0x3ADFF4: b"\xF5\x1B\x40\xF9", # LDR X21, [SP,#0x40+var_10] 0x3ADFF8: b"\xF4\x4F\x44\xA9", # LDP X20, X19, [SP,#0x40+var_s0] 0x3ADFFC: b"\xFD\x7B\x42\xA9", # LDP X29, X30, [SP,#0x40+var_20] 0x3AE000: b"\xFF\x43\x01\x91", # ADD SP, SP, #0x50 0x3AE004: b"\xFF\x0F\x5F\xD6", # RETAB 0x3AE008: b"\x08\x00\x40\xF9", # LDR X8, [X0] 0x3AE00C: b"\x08\x1D\x40\xB9", # LDR W8, [X8,#0x1C] } if __name__ == '__main__': # Triton context ctx = TritonContext() # Set the architecture ctx.setArchitecture(ARCH.AARCH64) # Symbolic optimization ctx.setMode(MODE.ALIGNED_MEMORY, True) # Define the Python syntax ctx.setAstRepresentationMode(AST_REPRESENTATION.PYTHON) # Define entry point pc = 0x3ADFC8 # Let's emulate the function for pc in function: # Build an instruction inst = Instruction() # Setup opcode inst.setOpcode(function[pc]) # Setup Address inst.setAddress(pc) # Process the instruction ctx.processing(inst) #print(inst) # Spread the instruction address and its disassembly into its symbolic # expressions. Used to refer an instruction to its expressions. Will # be useful to understand the slicing part. for se in inst.getSymbolicExpressions(): se.setComment(str(inst)) reg_obj = ctx.getRegister('X8') # Let's slice (backward) the rcx expression at 0x4005ae if pc == 0x3AE00C: x8Expr = ctx.getSymbolicRegister(reg_obj) slicing = ctx.sliceExpressions(x8Expr) # Sort the slicing and display all expressions with their comments for k, v in sorted(slicing.items()): # Here we display the comment to understand the correspondence # between an expression and its referenced instruction. print('[slicing]', v.getComment()) break sys.exit(0)
After execution, the following result is output:
[slicing] 0x3ae00c: ldr w8, [x8, #0x1c]
The correct result should be:
[slicing] 0x3ae008: ldr x8, [x0] [slicing] 0x3ae00c: ldr w8, [x8, #0x1c]
Question: Is the issue with my code, or does Triton have bugs in analyzing ARM64 programs?
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Uh oh!
There was an error while loading. Please reload this page.
After execution, the following result is output:
The correct result should be:
Question: Is the issue with my code, or does Triton have bugs in analyzing ARM64 programs?
The text was updated successfully, but these errors were encountered: