1 unstable release
|0.0.1||Dec 31, 2022|
#16 in #disassembly
yaxpeax-eval is the repo providing
yaxeval, a tool to execute machine code with preconditions and report state at exit.
yaxeval works by spawning a thread and executing the provided machine code on the local physical processor. there is some boring glue for architecture-dependent state setting and reporting. this means that
yaxeval supports, or is close to supporting, whatever physical processor you would run it on.
i am interested in using qemu-user as an alternate execution backend for cross-platform emulation.
yaxeval should be able to use qemu-user just the same for setup and reporting by using qemu's gdbserver.
if you just want to build and use it,
cargo install yaxpeax-eval should get you started. otherwise, clone this repo and a
cargo build will work as well.
yaxeval <x86 machine code> is a good starting point:
yaxpeax-eval> ./target/release/yaxeval b878563412 loaded code... 00007f774b497000: mov eax, 0x12345678 00007f774b497005: 🏁 (int 0x3) running... rax: 0000000000000000 to -> 0000000012345678 rip: 00007f774b497000 to -> 00007f774b497006
initial register state is generally zeroes, with exception of
rip, which by default points to whatever address an unrestricted
mmap could find.
inital register values, including
rip, can be specified explicitly:
yaxpeax-eval> ./target/release/yaxeval --regs rax=4,rcx=5,rip=0x123456789a,eflags=0x246 03c133c9 loaded code... 000000123456789a: add eax, ecx 000000123456789c: xor ecx, ecx 000000123456789e: 🏁 (int 0x3) running... rax: 0000000000000004 to -> 0000000000000009 rcx: 0000000000000005 to -> 0000000000000000 rip: 000000123456789a to -> 000000123456789f
and if the provided code disastrously crashes,
yaxeval will try to say a bit about what occurred:
yaxpeax-eval> ./target/release/yaxeval --regs rax=4,rcx=5,rip=0x123456789a,eflags=0x246 0000 loaded code... 000000123456789a: add byte [rax], al 000000123456789c: 🏁 (int 0x3) running... eflags: 00000246 to -> 00010246 sigsegv at unexpected address: 000000123456789a
- accept some config to map memory regions other than the implicitly-initialized code region
- machine-friendly input/output formats
- mode to single-step through provided code?