
  ___________ _____  ______   _____
  \___   ___/ _==_ \'   ._ \/ _==_ \
    \'   '//        \   '   \       \  for radare
     \___/ \________/.______/_______/


===========================================================

=== WORK FOR 1.0 ===

* Fix the anoying difference between GUI and HAVE_VALAC
  - VALAC is no longer used to compile (only for developers and available in make)
* Add disassembler for
  - DalvikVM
  - CUDA
  - Flash10
* '<' and '>' commands converted in prefix modifiers
* Write serial:// for radare \o/ based on socket://
   - rfcomm listen hci0  1
* Add !log command for serial:// and socket://

Nibble TODO:
============
* documentate the change of the execstack protection in program section of ELF

---- documentation
* doc4 'g' and 'x' in visual

--- todo

* rsc monitor implemented as a gui plugin
* .rfile.$FOO and .radare.tmp.$FOO are not removed!!
* support string print mode for [len][str] formats
* Use graphviz for code graphs
  - export graph information in a parseable format (svg?)
  - documentate how to use this information (ac*)
* organize Functions (RDBs) in visual mode ala 't' or 'e'

---- refactoring
* syscall-flag using userdefined table (in file)
   - must use asm.os to get proper syscall table
   - must be implemented in code analysis!!
* Add !int opcode to call a syscall
  !int eax=30 ebx=0x8048400
  - store/restore regs
  - shows return value in eax before restoring regs

---- bugs
* Split nodes of the graph code analysis
* disasm is incorrect. always returns the negative value :OO
  - 03 e4 f0 = and esp, 0xf0
  but must be= and esp, 0xfffffff0
* RASM is buggy about relative/absolute offsets
* Vdf doesnt detect func size properly

---- debugger
* !dall should pseudo-initialize the !maps internal structures
  - identify page type by contents (ELF header and so)
  - export info as S commands

* trace.libcode = trace libcode or not?
  - dbg.steplibs = true|false ??
  * dbg.stepolibs = true ;  step over non-user code?
  - automatic stepu 
* !bpc -> execute command when hitting breakpoint
  - stop on breakpoint after N hits
  * breakpoint callbacks:
   - integrated with !wp too
    A hook to an api can be emulated from the debugger, no need to inject
    code everywhere, just BP and change regs
   - ptrace layer make't support syscall proxying for remote debugging!!1 rasc -l rulez
* asm.regs2 or asm.regsegments = true ( to show cs, ds, gs, ... )
* Watchpoints:
  - Make !wp work with ? conditionals
  - Make dbg.wptrace = make it stop when there's a breakpoint
  - support for %eax = %ebx f.ex
  - ^C should be always catched!!
* !contuh doesnt works :O
 - implement continue until cursor
 - implement !bpt properly
* !fork should be fixed
* powerpc OSX (also for ARM)
  - !regs must show and flag proper regs!!

java bug:
  0x000001EE  |           b80007           invokestatic java/lang/Object (null)
-> this should be a call to callme()



===========

WTFS DONE:
----------
* documentate inverse (XXX)
  - it is not working in all the cases

>1.0 STUFF

* integrate ff with rabin and so
  - refactor baddr
* Allow to run shellcodes on debugged process.
  (autodetect .s or raw binary)
  - read shellcode from a file 
    should support .c or .s or raw or elf _start
* add margin right to the text
  - or margin left to the shell code
  - cut all lines at column scr.width
  - add screen.hshift (horitzontal scrolling)
* 'x' char should not be accepted as hexpair
* !lib should be for >1.0
* timezone for timestamps

* support to remove fixed nodes
  - show comments in a separated toggleable box:

* call <flag> arg arg arg
 - done with lua/python

* Add gzip to rdbs

* make gdb connector work happily

* Signal handling should idenitfy backtracing and siginfo and so from here or so

       static void
       handler(int sig, siginfo_t *si, void *unused)
       {
           printf("Got SIGSEGV at address: 0x%lx\n",
                   (long) si->si_addr);
           exit(EXIT_FAILURE);
       }

* search backward (esteve?)
  - search backward in memory (invert string and add inc as argument for binparse)
  - useful to static analyze interrupt calls

* add support for strings with "" in CC for.example

* !lib /lib/libm.so.1   ; use 'uselib' on linux and dlopen on *bsd MUAHA
  - implement !call
  - must allocate strings

0- store all the stack analysis info in a struct per-function
   and before removing it store a comment or metadata at the
   begginging of it.

* bash autocompletion script for rsc and rfile

* analize previous pushes or stack accesses before a call
  to a function (identify function arguments)
  - not only by the ones accessed in the code)
  - as IRA module

Debugger:
	* when attaching sets <pid>.rdb ..should be <program.pid>.rdb?
	* !contu must use '!mp rw- 0x8048000 0x4045' if supported
	* load libraries on the child process
	* !contall
	* !cont <pid> ???
	* breakpoints
	  - command
          - stop at count
	  - log (trace)
	  - enable/disable

Rabin:
	* Move javasm.c as dietjava in rabin

Rasc:
	* rasc - helper for format strings (orly?)
	* rasc : send file and execute (pitbull inside!)
 	* add selfsigstop/stackperm shellcodes in lua script or rasc

Rasm:
	* Support for macros? Write my own cpp? Use cpp?
	* olly assembler segfaults everywhere everytime :OO
	* rasm : Add .db, .byte, .dw, .dd directives or so, .string
	  - make them usable from the assembler (labels and so too)
	  - be like a cmdline gas. use the internal code of gnu (stripped down plz!)

Core:
	* reload project file if changes
	* do not create trace.log by default
	* Allow to edit flags in Vt

Rsc:
  	- fer un binpatch a traves del contexte del asm que sigui muahah (LUA)
	* pcap/radare for fun

Grava:
	3- global data in graphs - allow to run specific commands in nodes

* autodetect references to flags with aop.ref on
  - aop.ref must get more ref types (write checks)
	a1acc30508      mov eax, [0x805c3ac]
	3d00800000      cmp eax, 0x8000
	833d0cc4050803  cmp dword [0x805c40c], 0x3
	bf0d9b0508      mov edi, 0x8059b0d

Radare:
    + Dwarf support:
        - dwarfdump parser???
        - natively use libwarf in rabin

* cfg.inverse must be universal!
* ease rsc monitor access from the visual (xterm or so) (run inside dvtm?) -- 
* write shellcode to dump a buffer in hexa (inline jump)
* use labels in history stuff
* Allow to draw new lines manually (static defined arch_aop lines_t)

Stack Analysis:
===============
* show pm xxxxxxxx @ esp (show esp-ebp bytes here or so)

DWARF
=====
	/* Merge libdwarf inside rabin */
	/* This is dwarfdump -G <file> */

	DwarfDumpOutput:
	----------------

	/* Enums */
<2>< 1308>      DW_TAG_enumerator
                DW_AT_name                  FILETYPE_MACHO
                DW_AT_const_value           6

<1>< 1155>      DW_TAG_structure_type
                DW_AT_name                  list_head
                DW_AT_byte_size             8
                DW_AT_decl_file             7 ../list.h
                DW_AT_decl_line             14
                DW_AT_sibling               <1204>

	/* VarTypes */

<1>< 1122>      DW_TAG_pointer_type
                DW_AT_byte_size             4
                DW_AT_type                  <1128>


	/* Local Variables */

	info we get:
		varname,
		file,
		file_line,
		var_type


<2>< 2507>      DW_TAG_formal_parameter
                DW_AT_name                  file
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             80
                DW_AT_type                  <1122>
                DW_AT_location              DW_OP_fbreg -60
<2>< 2521>      DW_TAG_variable
                DW_AT_name                  buf
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             82
                DW_AT_type                  <2563>
                DW_AT_location              DW_OP_fbreg -44
<2>< 2535>      DW_TAG_variable
                DW_AT_name                  addr
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             83
                DW_AT_type                  <173>
                DW_AT_location              DW_OP_fbreg -48


==============================================================

* Funroll mode - stacked disassembly

* Add 'strings-cmt' to add comments in strings and use Cs to convert them
  - Make 'Cs' be more intelligent for multiple strings
  - Support for cursor range split
  - Without argument must find the end of string from curseek

* show labels of all jumps/calls (not only bookmarked ones)
  - generate sub_XXX when analyzing functions

* function hooker in C (dbg.hooker)
  - some C macros or so to create a .so and LD_PRELOAD't
  - if static...should inject trampolines to our code.
  - or just manage the breakpoints
  - if bp == 1 !jmp 0x8084840 - redirect code execution on certain points
  - stored in file
    [from-address] \t  [to-address]
 * 'ar' -> anal reset -> reset vm
 * populate the use of cmd.flag (in prompt and so)
 * graphically draw data structures in memory (adg, aD)?

 * add nanosleep shellcode
  - using nanosleep
    -> nanosleep(&foo, NULL);
	call +1
	pop ebx
	push 3
	push 0
	mov eax, 162
	mov ebx
	int 0x80

 * options for trace
  - trace.depth = 0
  - trace.alarm = 0
 * ^C doesnt works with trace

 * shellcode to get cur eip in eax
	de call +1
	pop eax
	mv  [deplaz+eax], restore_value

 * Allow to increase/decrease folder size with + and -
  - when scrolling over folders skip faster
 * add !status to get last crash info and stuff like that
 * fix autocomplete stuff for readline-flags
 * add full autocompletion support for dietline
 * make fixed nodes fixed to the graph view
 * Use SIGHUP to dump monitor stuff to files
 * blinking byte at cursor
 * support for search and replace
 * support for oprofile (via rsc or so)

Gui
===
* implement start/pause/continue/stop/reload button for a pid
* frontend for hasher (Vala api for hashing)
* the gui must listen:// and connect:// too!

Open streams
============
* radare pcap://"eth0/port 4000"
* serial console support
  - configure bps and so
  $ radare /dev/ttyS0

/////////////////////////////////////////////////////////////////////////
/* Fetch the thread-local storage pointer for libthread_db.  */
ps_err_e
ps_get_thread_area (const struct ps_prochandle *ph,
                    lwpid_t lwpid, int idx, void **base)
{
  if (ptrace (PTRACE_GET_THREAD_AREA, lwpid, NULL, base) != 0)
    return PS_ERR;

  /* IDX is the bias from the thread pointer to the beginning of the
     thread descriptor.  It has to be subtracted due to implementation
     quirks in libthread_db.  */
  *base = (void *) ((char *)*base - idx);

  return PS_OK;
}
PTRACE_GET_THREAD_AREA_3264:
/////////////////////////////////////////////////////////////////////////

DONE?
=====
* variable block size
  - config.block_size as default
  - tries to find another flag after
  cfg.vbsize = true -> variable block size (until next flag) (with a similar name to cur one?)

Core
=====
* allow to run without opening a file (useful for batch mode)
* make fdsniff and usbsniff generate a project file and a binary one.

(gdb) break ptrace if $r3 == 31 -> !wp equivalent. better docu/integration

ARM
===
* arm backtrace
- when runnin to bp says invalid address (uh?)
- step over doesnt works on arm/mips

BUGS:
=====
 * !pids must control non-printable chars
* keybinding assignment dosnt workz
  - UGLY
* wa doesnt handle file resize
* rsc monitor doesnt works as expected
* !ret should use !bt if possible

Random:
=======
* support to append data (without getting out of the block_size) (or so..)
* cfg.invdelta = inverses the delta (<=1024 ..-> >=1024) (or delta range) deltamin deltamax
* implement insert data inda core
* graph.body=asm,flags,symcalls,description, trace execution data
* define block size by hit1[0]-hit0[0] rollo begin-end (buscar <html> i </html>)

* invert pel disasm
  * inv -> make offsets take sense
  - make cursor bytes take sense too

* /a algorithm defined by search.algorithm
 it flags if search.flag
  - armfuncsearch
  - aes
  - token [from] [to] (dinamic block size)
  - x86funcsearch
  - from file formatted as search db
  - carver (find from-to,maxlen, ...)
  - plugin
* RDBs stored into Projects
  project.rdb = false ; store or not
  use [delimiters] to embed rdbs inside rps
* MSB stego


Graphs
======
* identify nodes with 'ret' in graph
* identify nodes with 'cmp' in graph


   +-------------+
   | 0x0804483   |-----------.
   +-------------+           |
   | mov eax, 3  | sys_write |
   | int 0x80    |           |
   +-------------+-----------'

  - line clicking must be supported!
  - avoid out of context bytes

* tracecc
  - useful to walk to user code
  - copy the program code on another buffer
  - overwrite all code with 0xcc
  - not portable, coz arm mixes data and code
  - continue until breakpoints
* virtual machine decompilation -> helpers for debugging soft VM opcodes (new user-defined archs)

/* done in lua? */
* analize input/output of function calls
  - bp enter
  - bp exit
  - useful to reverse packer VMs
  - see what changes in register and memory

* exception frame information (try { ... } catch stuff)
* ram dump driver for w32

* dinamic block size defined by:
  - height of screen
  - <tags> (set inigial and end binary tags)
    - allow to move forward/backward between 'bintags'
+ EH - event handling (event type + source pid)
  * add '!eh' command, how to handle an event ((ignore?), log, bypass, handle)
* cfg.dbgbsize (default block size for debugger)
* RDB TO GML
* circle to group looped code blocks in graph view

---------------------------
* do not sigalarm in visual
* new flag type: temporal 
  - they will not survive a project save
  - they are destroyed after a timeout


Search
======
* cfg.limit must be size of current maps section by default (file size?) useful for memory searchs
* add map search doing a search inside the process maps only
* search for head and foot
  - for each head finds a foot and defines block size

Core
====
* Add views/states/.. (S (switch) command) (open multiple files)
  - A view is just a stored copy of the config_t structure
  - and store different states for the same file
  - think on how to allocate new states (linked list of config_t structs)
  - S
    0 /bin/ls 0x0000000 ; comment
    1 /bin/ls 0x0000123 ; comment2
  - S [number]


Tracer
======
* store more info in trace (output of command)
* timeline of a trace |----------------|
  - available as a zoom view
  - in rsc script? - can dump traces on separated files? slow? bloat?
   - single file is better
  - allow to view frame windows inside the timeline
  - extended 'f' and 'F' keys mode
  * List viewer (get offset as index fr cursor, right view shows the
    contents of th selected offset
    - linked list browser
* cmd.trace -> command to execute when tracing
  - trace.log should be parsed insiide radare visual
    (next/next-->prev...)
  - trace extra regs info: (show bytes where they point)
    eax 0x8048484 bytes...
  - blank line means a trace step
  - program_t -> asign name and color
    -> useful to merge graphs of code analysis and code execution
* tracepoints
  - allow to execute a command (!dump?)
    - follow some variables
* colorize traces in vala graphs
* trace graph
  - debug.c -> implement a while(debug_step()) loop to arch_aop() each instruction
    and draw a graph until a breakpoint or ^C
  - creates a program_t graphable with vala


Debugger
========
* Show FPU stack contents
* Support for MMX register manipulation
* dosdebug:// to debug dosemu-based applications
  - semi done..not finished. should be integrated as a plugin
* qemu:// plugin to connect to qemus :D
* windbg:// for serial port (w32 kernel debugger)
* code injector for accessing non GP registers like mmx,
   fp, etc and other's section segments. (%ss, ..)
  off_t value = get_reg_inline("m0");
  - store a struct containing 
	char * register_name;
	uchar *shellcode
  - all shellcodes must be coded and injected in the same way

* make libgdb2fd work

* xrefs does not works for string references
  - make xrefs support base address

===========================================================

TOTHINK
=======
* Filesystem support
  * emulate filesystems from a defined seek
  * can be done with losetup? not portable
  * use fuse emulation?
  * use linux kernel emulation?
  * shell with grub-like commands to extract and insert files?
* Implement libcaca/aalib backend for grava! :D
* new search engine allowing AES and RSA key (so...predefined algos for signature searches)
  - must think on! - entropia = 1 en un block (tots numeros primers)
* implement process freze and bootup
* use 'tm' (terminal mixer) to run the target debugged program
   - allows multiple interactives consoles over the program,
     keeping the debugger window clean
   - we need to know the pid of the child process of tm.
   - maybe a debug flag to tm would be nice - i will talk to the author
   - must be hardcoded inside the core
 - handle ^C properly , to allow to stop the process with any signal
* Indentify, parse and show the auxv_t structure
  * LD_AUXV_SHOW=1 /bin/ls before start to debug
  * dbg.auxv = true // WHY?
* output of rsc help should start with ';'
* asm.offset must be for all print modes?
  - renamed to scr.offset?
* Really?
 * define default print format per flags (useful to find strings, code,etc..) :D
* rename -v to -q (quiet or -s silent)
  - cfg.verbose = integer (autosetup scr.color and asm.color)
  - cfg.quiet = false
* make !dump incremental using bindiff (too complicated approach)
  - support to enable full dump (with hashing for reducing sizes)
  - ultra slow ? i should analyze code to enhace this


FileDescriptors
===============
* read/write from/to child filedescriptor
* sniff filedescriptor (dumping to file or socket)
 - using CONTSC ?
 - hooks read/write/ syscalls and gets buf and so
 - can be done in lua
 - !contsc needs lua interface

Random Stuff
============
* use libasm to get metadata from each opcode (why? :)
* Do not use the char '(' in asm.lines. just use - or =
* record radare commands
  - all commands executed within a recording time are stored on a single script file
  - you can later repeat it or edit
  - history control must be back!

* executable offsets // flag command/grep?
  - execute a command on a certain offset
  - show funtion frames and arguments on the fly
  - automatize unpacks and so

* performance counters:
   - inject code into the child process
   - mmap to backup code from the hooked functions
   - each hooked function should do something like:
       [mmap_addr+func_off]++;
   - these counters can be resetted
   - the mmap is only defined once
   - show statistics of time range and the count of times a function
     has been called.

 - timers:
   - inject code into the child process to define from-to zones
   - these from-to zones have an mmap address assigned
   - uses rdtsc to get time

	// 'from' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func], eax
     pop eax

	// 'to' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func+4], eax
     pop eax

   - statistics will show the time spend to run a determined piece of code


Imports:
========
* import pdi-tool from gerardo to inject code
* import esteve's object injector
* import libdwarf
  * http://reality.sgiweb.org/davea/dwarf.html
  * add 'list' gdb -like command
  * parse dwarfdump output in perl

BSD_SYSCALL_PTRACE:
===================

.global foo
foo:
        mov $2, %ebx
        mov $1, %eax
        push %ebx
        push %eax
        int $0x80

mips:
	li $v0, syscall
	li $v1, arg0
	syscall




 ____  ___ ____  ___ ____  ___  ______   ____
|  _ \/   \'   \/   \  _ \/ _ \ \__   | /    \
|    <  V  . T  . V      <   _/ .--'_/ |  ()  |
|_|\__|_|__|___/|_|_|_|\__\___/ |_____(_)____/

/* ONGOING 2.0 */

Split radare into libraries accessible by VAPI interfaces. (no gobject dependency, but an OO C one).

* make it be an API 
  radare_t *r = radare_new ("/bin/ls", "ro");
  radare_seek(r, 0x100);
  ...

* full charsets support (search strings in utf8, etc) using iconv
* multithread traces <pid>:<addr>

* implement 'commit' command. delayed write operations with bindiff output
  - using the 'u' command

* pD -> 'decompile or sthg like that'
* search for strings in disassembly
  - pd 1 -> strstr(cons_buffer, mystr)

* next pel debugger (next source line) -- needs dwarf integration?

plugins
 - small plugin descriptor that loads the real plugin
 - avoi unnecesasry library loading (gtk and so)

* total world domination
