-
-
Notifications
You must be signed in to change notification settings - Fork 506
Description
Work environment
| Questions | Answers |
|---|---|
| OS/arch/bits (mandatory) | Kali x86_64 |
| File format of the file you reverse (mandatory) | ELF |
| Architecture/bits of the file (mandatory) | x86/64 |
rizin -v full output, not truncated (mandatory) |
rizin 0.9.0 @ linux-x86-64 commit: 8a34735 |
Expected behavior
avgl command does not show global variables in the dectest64 binary.
In the symbols table (using is command), we can see that there is a global_array and global_var object
nth paddr vaddr bind type size lib name
----------------------------------------------------------------------------------------
...
55 0x00003050 0x00404050 GLOBAL OBJ 4 global_var
...
74 0x00003058 0x00404058 GLOBAL OBJ 8 global_array
...
but running avgl command does not output anything.
Actual behavior
avgl command should output global_var and global_array
Initially, I thought avgl only outputs global variables added through the avga command, but running rizin on cutter 64-bit elf executable we can see that avgl shows MARK_ALPHA_F (global variable defined in Cutter/src/dialogs/MarkDialog.h) and a lot of other global variables.
It seems, on some binaries rizin is showing global variables while not showing on others
Steps to reproduce the behavior
binary from rizin-testbins: rizin-testbins/elf/dectest64
rizin -A dectest64avgl
Additional Logs, screenshots, source code, configuration dump, ...
Also running avgl on these two programs, it outputs glob_var_bruv in the second program but not in the first one
First program - compiled using ninja:
// main.cpp
int glob_var_bruv = 0;
int main() {
return 0;
}avgl doesn't output anything here
Second Program (Qt Console APP) - compiled using ninja:
// main.cpp
#include <QCoreApplication>
int glob_var_bruv = 0;
int main(int argc, char *argv[])
{
QCoreApplication a(argc, argv);
return a.exec();
}here avgl outputs: global int glob_var_bruv @ 0x403c <path-to-project>/main.cpp:35
Also if I change glob_var_bruv = 0 to glob_var_bruv = 1 in the second program, then avgl again doesn't output anything. Could it be due to glob_var_bruv now being in the .data segment? But what about the first program?