radareorg/radare2

Question about imports

Open

#14,843 创建于 2019年8月18日

在 GitHub 查看
 (3 评论) (0 反应) (0 负责人)C (23,826 star) (3,229 fork)batch import
good first issue

描述

Hello,

A very simple question: in the sequence below, how can I with ESIL, don't get into the code of sym.imp.func:

address1 call dword [sym.imp.function] address2 mov ...

Ideally, when I meet a call [sym.import...] , I want just to replace the address of import by the address +1 of the actual sequence(i.e. mov instruction on that case). I don't want to make a step over, because I need to see the code of other calls. My concern is only about imports.

Could you please help with some commands that automate that for all sym.imports that I can find in the binary.

Thanks a lot for your help in advance

贡献者指南

技术栈
c
领域
clisecurity
议题类型
research
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-3 hours
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
mostly clear
前置要求
Basic knowledge of radare2 ESIL
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
20
研究方向
Investigate radare2's ESIL documentation and the step commands (ds, dso). Look for a way to skip over calls to imported functions. Check the radare2 book or help for conditional stepping. Consider using the 'dc' command with a condition to continue until after imports.