
  ___________ _____  ______   _____
  \___   ___/ _==_ \'   ._ \/ _==_ \
    \'   '//        \   '   \       \  for radare
     \___/ \________/.______/_______/


===========================================================

=== TODAY ===

* folders are broken
* do not create trace.log by default
* rasc - helper for format strings
  - no cal
* implement bindiff patchers
  - fer un binpatch a traves del contexte del asm que sigui muahah (LUA)
* Move javasm.c as dietjava in rabin
// TODO: store data and show (flag.data) in last_print_format

* Allow to edit flags in Vt

* radare malloc://30 && e file.write=1 && wx 90 = segfaults
* folders doesnt works well

* Make the color palette more accessible to the users
  - integrated with eval config in visual Ve
* Use rabin directly . not rsc
0- store all the stack analysis info in a struct per-function
   and before removing it store a comment or metadata at the
   begginging of it.
1- syscall-flag  using userdefined table (in file)
   - must be implemented in code analysis!!

* Add !int opcode to call a syscall
  !int eax=30 ebx=0x8048400
  - store/restore regs
  - shows return value in eax before restoring regs
* call <flag> arg arg arg
 - done with lua

3- global data in graphs - allow to run specific commands in nodes
6- aop.ref must get more ref types (write checks)
9- reload project file if changes
e- rsc monitor cool from teh graph view or so
f- pcap/radare for fun
10 backward search until (config.limit <0)? config.seek+config.limit : 0;
11 happier bindiff

8- remove project strange commands (use radare ones) -- ?? sure? is not secure!


* olly assembler segfaults everywhere everytime :OO
* disasm is incorrect. always returns the negative value :OO
  - 03 e4 f0 = and esp, 0xf0
  but must be= and esp, 0xfffffff0

* more wrong disass 
 8d9574ffffff    lea edx, [ebp-0x8c] 

=====
0.9.9
=====
* autodetect references to flags with aop.ref on
	a1acc30508      mov eax, [0x805c3ac]
	3d00800000      cmp eax, 0x8000
	833d0cc4050803  cmp dword [0x805c40c], 0x3
	bf0d9b0508      mov edi, 0x8059b0d

* Avoid dupped code between rabin.c and rabin/rabin.c
* Make 'Cs' autodetect multiple strings
* Xrefs working with the core (radare_read and so)
* Add 'bookmarked flags'
* rabin
  - Elf64
  - string xrefs
  - exports: CF'em
  - .data section: Cd't

* search backward (esteve?)
  - search backward in memory (invert string and add inc as argument for binparse)
  - useful to static analyze interrupt calls

* Really?
 * define default print format per flags (useful to find strings, code,etc..) :D

Radare:
    + Dwarf support:
        - dwarfdump parser???
        - natively use libwarf in rabin
    + StackFram analysis for local variables

* scriptedit must work also for 'radare scripts'
  - Multiple open/close is broken :?
  - make it work with vim in console
* cfg.inverse must be universal!
* ease rsc monitor access from the visual (xterm or so) (run inside dvtm?) -- 
* write shellcode to dump a buffer in hexa (inline jump)
* !contu must use '!mp rw- 0x8048000 0x4045' if supported
* rasm : Add .db, .byte, .dw, .dd directives or so, .string
  - make them usable from the assembler (labels and so too)
  - be like a cmdline gas. use the internal code of gnu (stripped down plz!)
* rasc : send file and execute (pitbull inside!)

Stack Analysis:
===============
* Add function analysis in code analysis
  - detect push ebp ; mov esp, ebp (begin)
  - Access to local variables using dwarf stuff
* show esp-ebp !!! stackframe is important everywhere! ??
* show pm xxxxxxxx @ esp (show esp-ebp bytes here or so)
* show esp-ebp of stack at top (or mark a range)
  - show stack offsets
  - max size of stack
  - colorize esb-ebp with temp cursor or so

DWARF
=====
	/* Merge libdwarf inside rabin */
	/* This is dwarfdump -G <file> */

	DwarfDumpOutput:
	----------------

	/* Enums */
<2>< 1308>      DW_TAG_enumerator
                DW_AT_name                  FILETYPE_MACHO
                DW_AT_const_value           6

<1>< 1155>      DW_TAG_structure_type
                DW_AT_name                  list_head
                DW_AT_byte_size             8
                DW_AT_decl_file             7 ../list.h
                DW_AT_decl_line             14
                DW_AT_sibling               <1204>

	/* VarTypes */

<1>< 1122>      DW_TAG_pointer_type
                DW_AT_byte_size             4
                DW_AT_type                  <1128>


	/* Local Variables */

	info we get:
		varname,
		file,
		file_line,
		var_type


<2>< 2507>      DW_TAG_formal_parameter
                DW_AT_name                  file
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             80
                DW_AT_type                  <1122>
                DW_AT_location              DW_OP_fbreg -60
<2>< 2521>      DW_TAG_variable
                DW_AT_name                  buf
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             82
                DW_AT_type                  <2563>
                DW_AT_location              DW_OP_fbreg -44
<2>< 2535>      DW_TAG_variable
                DW_AT_name                  addr
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             83
                DW_AT_type                  <173>
                DW_AT_location              DW_OP_fbreg -48


==============================================================

* colorize background of flagged bytes in hexdump
* '<' and '>' commands converted in prefix modifiers
* Funroll mode - stacked disassembly
* Indentify, parse and show the auxv_t structure
  * LD_AUXV_SHOW=1 /bin/ls before start to debug
  * dbg.auxv = true
* file.insertblock - TODO: implement io.c radare_write
  - must interact with search engine too for search and replace
* Move all flags of current flagspace +offset or -offset
  - fm ?
* Add 'strings-cmt' to add comments in strings and use Cs to convert them
  - Make 'Cs' be more intelligent for multiple strings
  - Support for cursor range split
  - Without argument must find the end of string from curseek

 * show labels of all jumps/calls (not only bookmarked ones)
* !contall
* !cont <pid> ???

/* FreeBSD */
debug.elf32_trace: 0

* function hooker in C (dbg.hooker)      
  - some C macros or so to create a .so and LD_PRELOAD't
  - if static...should inject trampolines to our code.
  - or just manage the breakpoints
  - if bp == 1 !jmp 0x8084840 - redirect code execution on certain points
  - stored in file
    [from-address] \t  [to-address]
 * undo write
 * xc is crappy! no args, some vals are invalid
 * add asm.arch=aop -> analyze code engine to disassemble
 * 'ar' -> anal reset -> reset vm
 * populate the use of cmd.flag (in prompt and so)
 * graphically draw structures in memory (adg, aD)?

 * add selfsigstop shellcodes in lua script or rasc
 * add nanosleep shellcode
  - using nanosleep
    -> nanosleep(&foo, NULL);
	call +1
	pop ebx
	push 3
	push 0
	mov eax, 162
	mov ebx
	int 0x80

 * options for trace
  - trace.depth = 0
  - trace.alarm = 0
 * ^C doesnt works with trace

 * shellcode to get cur eip in eax
	de call +1
	pop eax
	mv  [deplaz+eax], restore_value
 *  /x 58 5b c3
   - no funciona be troba coses com 58 5b c9 c3...

 * Allow to increase/decrease folder size with + and -
  - wheen scrolling over folders skip faster
 * add !status to get last crash info and stuff like that
 * fix autocomplete stuff for readline-flags
 * add full autocompletion support for dietline
 * make fixed nodes fixed to the graph view
 * Use SIGHUP to dump monitor stuff to files
 * radare debugger for osx x86/arm
 * support for background color
 * blinking byte at cursor
 * support for search and replace
 * support for oprofile (via rsc or so)

Rabin
=====
* Full PE parser support

Gui
===
* implement start/pause/continue/stop/reload button for a pid
* frontend for hasher (Vala api for hashing)
* the gui must listen:// and connect:// too!

Open streams
============
* radare pcap://"eth0/port 4000"
* serial console support
  - configure bps and so
  $ radare /dev/ttyS0

Debugger
========
* trace.libcode = trace libcode or not?
  - dbg.steplibs = true|false ??
  * dbg.stepolibs = true ;  step over non-user code?
  - automatic stepu 

/////////////////////////////////////////////////////////////////////////
/* Fetch the thread-local storage pointer for libthread_db.  */
ps_err_e
ps_get_thread_area (const struct ps_prochandle *ph,
                    lwpid_t lwpid, int idx, void **base)
{
  if (ptrace (PTRACE_GET_THREAD_AREA, lwpid, NULL, base) != 0)
    return PS_ERR;

  /* IDX is the bias from the thread pointer to the beginning of the
     thread descriptor.  It has to be subtracted due to implementation
     quirks in libthread_db.  */
  *base = (void *) ((char *)*base - idx);

  return PS_OK;
}
PTRACE_GET_THREAD_AREA_3264:
/////////////////////////////////////////////////////////////////////////

DONE?
=====
* variable block size
  - config.block_size as default
  - tries to find another flag after
  cfg.vbsize = true -> variable block size (until next flag) (with a similar name to cur one?)

Core
=====
* allow to run without opening a file (useful for batch mode)
* make fdsniff and usbsniff generate a project file and a binary one.

(gdb) break ptrace if $r3 == 31 -> !wp equivalent. better docu/integration


ARM
===
* arm backtrace
- when runnin to bp says invalid address (uh?)
- step over doesnt works on arm/mips

BUGS:
=====
 * !pids must control non-printable chars
* if myinc > len myinc = 1;
  - if pressing '[' multiple times myinc stills being 1, but needs lot of '] to
    recover the 0 position
* wx `pW 33 -> the ` doesnt works
* keybinding assignment dosnt workz
  - UGLY
* wa doesnt handle file resize
* rsc monitor doesnt works as expected
* s <unexistant-flag> -> do not seek
* !ret should use !bt if possible

Random:
=======
* support to append data (without getting out of the block_size) (or so..)
* cfg.invdelta = inverses the delta (<=1024 ..-> >=1024) (or delta range) deltamin deltamax
* implement insert data inda core
* graph.body=asm,flags,symcalls,description, trace execution data
* define block size by hit1[0]-hit0[0] rollo begin-end (buscar <html> i </html>)

* invert pel disasm
  * inv -> make offsets take sense
  - make cursor bytes take sense too

* /a algorithm defined by search.algorithm
 it flags if search.flag
  - armfuncsearch
  - aes
  - token [from] [to] (dinamic block size)
  - x86funcsearch
  - from file formatted as search db
  - carver (find from-to,maxlen, ...)
  - plugin
* RDBs stored into Projects
  project.rdb = false ; store or not
  use [delimiters] to embed rdbs inside rps
* MSB stego


Graphs
======
* identify nodes with 'ret' in graph
* identify nodes with 'cmp' in graph

 * support to remove fixed nodes
 * store node positions (label = x,y)
  - show comments in a separated toggleable box:

   +-------------+
   | 0x0804483   |-----------.
   +-------------+           |
   | mov eax, 3  | sys_write |
   | int 0x80    |           |
   +-------------+-----------'

  - line clicking must be supported!
  - avoid out of context bytes

* tracecc
  - useful to walk to user code
  - copy the program code on another buffer
  - overwrite all code with 0xcc
  - not portable, coz arm mixes data and code
  - continue until breakpoints
* virtual machine decompilation -> helpers for debugging soft VM opcodes (new user-defined archs)

/* done in lua? */
* analize input/output of function calls
  - bp enter
  - bp exit
  - useful to reverse packer VMs
  - see what changes in register and memory

* exception frame information (try { ... } catch stuff)
* ram dump driver for w32

* dinamic block size defined by:
  - height of screen
  - <tags> (set inigial and end binary tags)
    - allow to move forward/backward between 'bintags'
+ EH - event handling (event type + source pid)
  * add '!eh' command, how to handle an event ((ignore?), log, bypass, handle)
* cfg.dbgbsize (default block size for debugger)
* RDB TO GML
* circle to group looped code blocks in graph view

* support size of pointer with [xxx] get_offset expressions
  - b[xxx], w[xxx], d[xxx], 32[xxx], 16[xxx], 8[xxx]
  - also make use of cfg.endian

---------------------------
* do not sigalarm in visual
* new flag type: temporal 
  - they will not survive a project save
  - they are destroyed after a timeout


Search
======
* cfg.limit must be size of current maps section by default (file size?) useful for memory searchs
* add map search doing a search inside the process maps only
* search for head and foot
  - for each head finds a foot and defines block size

Filesystem
==========
* emulate filesystems from a defined seek
* can be done with losetup? not portable
* use fuse emulation?
* use linux kernel emulation?
* shell with grub-like commands to extract and insert files?

Core
====
* Add views/states/.. (S (switch) command) (open multiple files)
  - A view is just a stored copy of the config_t structure
  - and store different states for the same file
  - think on how to allocate new states (linked list of config_t structs)
  - S
    0 /bin/ls 0x0000000 ; comment
    1 /bin/ls 0x0000123 ; comment2
  - S [number]


Tracer
======
* store more info in trace (output of command)
* random trace peeker
  - takes traces from the process while running every N usecs
* timeline of a trace |----------------|
  - in rsc script? - can dump traces on separated files? slow? bloat?
   - single file is better
  - allow to view frame windows inside the timeline
  - extended 'f' and 'F' keys mode
  * List viewer (get offset as index fr cursor, right view shows the
    contents of th selected offset
    - linked list browser
* cmd.trace -> command to execute when tracing
  - trace.log should be parsed insiide radare visual
    (next/next-->prev...)
  - trace extra regs info: (show bytes where they point)
    eax 0x8048484 bytes...
  - blank line means a trace step
  - program_t -> asign name and color
    -> useful to merge graphs of code analysis and code execution
* tracepoints
  - allow to execute a command (!dump?)
    - follow some variables
* colorize traces in vala graphs
* trace graph
  - debug.c -> implement a while(debug_step()) loop to arch_aop() each instruction
    and draw a graph until a breakpoint or ^C
  - creates a program_t graphable with vala


Debugger
========
* Show FPU stack contents
* Support for MMX
* next pel debugger (next source line) -- needs dwarf integration?
  - or just follow a file containing a list of breakpoint addresses
   like: 1 2 10 44 -> radare will set and unset all these breakpoints
   everytime. so you have a separate file with the breakpoints, so you
   can use rsc to generate this and next properly
* dosdebug:// to debug dosemu-based applications
* qemu:// plugin to connect to qemus :D
* windbg:// for serial port (w32 kernel debugger)
* breakpoints
  - command
  - log (trace)
  - enabled
* al atacharse a un proces deixa <pid>.rdb hauria de ser <program.pid>.rdb?
* debug_new() -> alloc new glib object or so
  - allows multiple ps structures to be loaded
  - needs refactoring?
    - maybe only change a pointer. setCurrentProcess() or so

	Debugger d = new Debugger("/bin/ls");
	Debugger d2 = new Debugger("/bin/true");
	d.setCurrentProcess();
	d.breakpoint(0x8048930);
	d.continue();

* code injector for accessing non GP registers like mmx,
   fp, etc and other's section segments. (%ss, ..)
  off_t value = get_reg_inline("m0");
  - store a struct containing 
	char * register_name;
	uchar *shellcode
  - all shellcodes must be coded and injected in the same way
* implement process freze and bootup
* own elf loader (avoid system one)
* amd64 -> x86-64 -> alias ( BSD64 is broken )
* load libraries on the child process
* breakpoint callbacks:
 - integrated with !wp too
  A hook to an api can be emulated from the debugger, no need to inject
  code everywhere, just BP and change regs
 - ptrace layer make't support syscall proxying for remote debugging!!1 rasc -l rulez
* use 'tm' (terminal mixer) to run the target debugged program
   - allows multiple interactives consoles over the program,
     keeping the debugger window clean
   - we need to know the pid of the child process of tm.
   - maybe a debug flag to tm would be nice - i will talk to the author
   - must be hardcoded inside the core
 - handle ^C properly , to allow to stop the process with any signal
* make libgdb2fd work
* Allow to run shellcodes on debugged process.
  (autodetect .s or raw binary)
  - read shellcode from a file 
    should support .c or .s or raw or elf _start

Code analyzer
=============
* handle relative references to code and data
 + in debugger must dump current section
* Implement libcaca/aalib backend for grava! :D
* xrefs does not works for string references
  - make xrefs support base address
  - integrate xrefs into the core (debugger needs love too!)
  [ xref struct ] ; basic jump table
   - u64 from
   - u64 to   -> nothing more :)
  - only for valid analyzed code .. uh?
  - data xrefs is not detected here. uh?
* persistent nodes in graph executing commands


Random
======
* output of rsc help should start with ';'
* Implement a boolean bindiff based on symdiffing (in lua!!!)


===========================================================

TOTHINK
=======
* asm.offset must be for all print modes?
  - renamed to scr.offset?

FileDescriptors
===============
* read/write from/to child filedescriptor
* sniff filedescriptor (dumping to file or socket)
 - using CONTSC ?
 - hooks read/write/ syscalls and gets buf and so
 - can be done in lua
 - !contsc needs lua interface
* rename -v to -q (quiet or -s silent)
  - cfg.verbose = integer (autosetup scr.color and asm.color)
  - cfg.quiet = false
* new search engine allowing AES and RSA key (so...predefined algos for signature searches)
  - must think on! - entropia = 1 en un block (tots numeros primers)
* make !dump incremental using bindiff
  - support to enable full dump (with hashing for reducing sizes)
  - ultra slow ? i should analyze code to enhace this
* cmd.flag = eip -> fer una taula de offsets-comandes per cmd.flag
  - fc = flag command fc <command> @ offset
  - do not execute twice
* Do not use the char '(' in asm.lines. just use - or =
* record radare commands
  - all commands executed within a recording time are stored on a single script file
  - you can later repeat it or edit
  - history control must be back!
* executable offsets
  - execute a command on a certain offset
  - show funtion frames and arguments on the fly
  - automatize unpacks and so

* performance counters:
   - inject code into the child process
   - mmap to backup code from the hooked functions
   - each hooked function should do something like:
       [mmap_addr+func_off]++;
   - these counters can be resetted
   - the mmap is only defined once
   - show statistics of time range and the count of times a function
     has been called.

 - timers:
   - inject code into the child process to define from-to zones
   - these from-to zones have an mmap address assigned
   - uses rdtsc to get time

	// 'from' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func], eax
     pop eax

	// 'to' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func+4], eax
     pop eax

   - statistics will show the time spend to run a determined piece of code


Imports:
========
* import pdi-tool from gerardo to inject code
* import esteve's object injector
* import libdwarf
  * http://reality.sgiweb.org/davea/dwarf.html
  * add 'list' gdb -like command
  * parse dwarfdump output in perl

BSD_SYSCALL_PTRACE:
===================

.global foo
foo:
        mov $2, %ebx
        mov $1, %eax
        push %ebx
        push %eax
        int $0x80

mips:
	li $v0, syscall
	li $v1, arg0
	syscall


libraries
=========
libiconv -> encoding support
libmagic -> better integration with magic stuff (atm use external magic dbs) (obsd magic)
libdwarf -> supports dwarf stuff and so


TODO LIST
=========
* ._ command not supported .. ? of course not!
* use #pragma once?
* bash autocompletion script for rsc and rfile
* base64 conversion, fixer and so
* full charsets support (search strings in utf8, etc)
* implement 'commit' command. delayed write operations with bindiff output

* total world domination
