radareorg/radare2

Question about imports

Open

#14,843 opened on Aug 18, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)C (23,826 stars) (3,229 forks)batch import
good first issue

Description

Hello,

A very simple question: in the sequence below, how can I with ESIL, don't get into the code of sym.imp.func:

address1 call dword [sym.imp.function] address2 mov ...

Ideally, when I meet a call [sym.import...] , I want just to replace the address of import by the address +1 of the actual sequence(i.e. mov instruction on that case). I don't want to make a step over, because I need to see the code of other calls. My concern is only about imports.

Could you please help with some commands that automate that for all sym.imports that I can find in the binary.

Thanks a lot for your help in advance

Contributor guide

Tech stack
c
Domain
clisecurity
Issue type
research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Basic knowledge of radare2 ESIL
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20
Research direction
Investigate radare2's ESIL documentation and the step commands (ds, dso). Look for a way to skip over calls to imported functions. Check the radare2 book or help for conditional stepping. Consider using the 'dc' command with a condition to continue until after imports.