Created
June 19, 2014 11:41
-
-
Save pastcompute/8b3788b9263c515a3d97 to your computer and use it in GitHub Desktop.
Radare2 macro (work in progress) for string scanning a stripped / embedded MIPS binary for strings
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Assumes strings are referenced downwards from the top of a segment | |
# e.g - set | |
f string_end @ 0x80620000 | |
# then addui a0,a0,-12288 <-- string is at 0x8061d000 | |
# This used to add a comment with the text but that broke recently | |
# So now it adds a comment String_addressofstring | |
# It adds a xref mut I am still perfecting that | |
(mipstr1, f mipstr1d_tmp @ $$, s $$+4, ?y `?v $v+string_end`, f str_`?y` @ $v+string_end, axd $v+string_end $$, s $v+string_end, ?v $$, psz, s mipstr1d_tmp,s $$+4,CCa $$ String_`?v $v+string_end`, f-mipstr1d_tmp) | |
e cmd.hit=.(mipstr1) | |
/x 6280043c....8424 # Searches for lui a0,0x8062 followed by addui a0,a0, | |
/x 6280053c....a524 # Searches for lui a1,0x8062 followed by addui a1,a1, | |
/x 6280043c............8424 # Searches for lui a0,0x8062 followed by something else followed by addui a0,a0, | |
/x 6280053c............a524 # Searches for lui a1,0x8062 followed by something else followed by addui a1,a1, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment