radareorg/radare2

Question about imports

Open

#14,843 opened on Aug 18, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)C (3,229 forks)batch import
good first issue

Repository metrics

Stars
 (23,826 stars)
PR merge metrics
 (Avg merge 16h 24m) (99 merged PRs in 30d)

Description

Hello,

A very simple question: in the sequence below, how can I with ESIL, don't get into the code of sym.imp.func:

address1 call dword [sym.imp.function] address2 mov ...

Ideally, when I meet a call [sym.import...] , I want just to replace the address of import by the address +1 of the actual sequence(i.e. mov instruction on that case). I don't want to make a step over, because I need to see the code of other calls. My concern is only about imports.

Could you please help with some commands that automate that for all sym.imports that I can find in the binary.

Thanks a lot for your help in advance

Contributor guide

Research direction
Use the 'esil' command to step instructions one by one, and when encountering a call to an import, manually set the program counter to the instruction after the call. Automate this by writing a small r2 command script or using r2pipe to detect calls to imports and skip them.
Tech stack
c
Domain
securityreverse engineering
Issue type
Research
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
basic radare2 usage
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
60