
  ___________ _____  ______   _____
  \___   ___/ _==_ \'   ._ \/ _==_ \
    \'   '//        \   '   \       \  for radare
     \___/ \________/.______/_______/


===========================================================

0.9.7:
======
 * add asm.arch=aop -> analyze code engine to disassemble
 * 'ar' -> anal reset -> reset vm
 * add 'call <reg>' to rasm
 * search backward in memory (invert string and add inc as argument for binparse)
 * Make the color palette more accessible to the users
 * Make ^C work again in debugger?!?
  - do not pass user signals to child process
 * 'w' in cursor mode with range selected must fill the buffer
 * code injection (as a plugin in lua)
 * Add script editor window for lua and radare
 * when loading strings from file
  - run Cs
  - make Cs support multiple strings at a time
  - split .dbs with flags
 * xc is crappy!
 * Support to change program arguments while running
 * control screen height in cons.c (limit \n per screen)
 * if myinc > len myinc = 1;
  - if pressing '[' multiple times myinc stills being 1, but needs lot of '] to
    recover the 0 position
 * rename -v to -q (quiet or -s silent)
   - cfg.verbose = integer (autosetup scr.color and asm.color)
   - cfg.quiet = false
 * populate the use of cmd.flag (in prompt and so)
 * flag grep print mode
 * graphically draw structures in memory (adg, aD)?
 * define print format per flags (useful to find strings, code,etc..) :D

 * add selfsigstop shellcodes in lua script or rasc
 * add nanosleep shellcode
  - using nanosleep
    -> nanosleep(&foo, NULL);
	call +1
	pop ebx
	push 3
	push 0
	mov eax, 162
	mov ebx
	int 0x80

 * options for trace
  - trace.depth = 0
  - trace.alarm = 0
 * ^C doesnt works with trace

 * shellcode to get cur eip in eax
	de call +1
	pop eax
	mv  [deplaz+eax], restore_value
 *  /x 58 5b c3
   - no funciona be troba coses com 58 5b c9 c3...

 * Allow to increase/decrease folder size with + and -
  - wheen scrolling over folders skip faster
 * embed xrefs into radare (to be used from the debugger)
  - handle current map only
 * Access to local variables using dwarf stuff
 * !pids must control non-printable chars
 * !pid must show status of process
 * add !status to get last crash info and stuff like that
 * flag str_
 * remove comments doesnt works properly
 * fix autocomplete stuff for readline-flags
 * add full autocompletion support for dietline
 * make !get work on linux with arch_get_register (currently only works on w32)
 * show labels of all jumps/calls (not only bookmarked ones)
 * make the gui plugins be possible little demo launched from ag
 * implement waiter for radare debugger as an rsc script
 * make fixed nodes fixed to the graph view
 * Make spcc be happy with pU (!!spcc $BLOCK $OFFSET) ?
   - Must think a more handy way to do this
 * Use SIGHUP to dump monitor stuff to files
 * rename or remove pd command.
   - make it work without file.wmode
 * radare debugger for osx x86/arm
 * support for background color
 * blinking byte at cursor
 * support for search and replace
 * support for oprofile (via rsc or so)
 * Edit modify source references ;)


Gui
===
* implement start/pause/continue/stop/reload button for a pid
* frontend for hasher (Vala api for hashing)
* the gui must listen:// and connect:// too!
* Add toggle endian in gradare
* integrate the gui with maemo!

Open streams
============
* radare pcap://"eth0/port 4000"
* cfg.inverse must be universal!
* serial console support
  - configure bps and so
  $ radare /dev/ttyS0
* '<' and '>' commands converted in prefix modifiers
* trace.libcode = trace libcode or not?
  - dbg.steplibs = true|false ??
  - automatic stepu 

  - file.insertblock=false - to not modify the whole stuff
  - must interact with search engine too for search and replace

/////////////////////////////////////////////////////////////////////////
/* Fetch the thread-local storage pointer for libthread_db.  */
ps_err_e
ps_get_thread_area (const struct ps_prochandle *ph,
                    lwpid_t lwpid, int idx, void **base)
{
  if (ptrace (PTRACE_GET_THREAD_AREA, lwpid, NULL, base) != 0)
    return PS_ERR;

  /* IDX is the bias from the thread pointer to the beginning of the
     thread descriptor.  It has to be subtracted due to implementation
     quirks in libthread_db.  */
  *base = (void *) ((char *)*base - idx);

  return PS_OK;
}
PTRACE_GET_THREAD_AREA_3264:
/////////////////////////////////////////////////////////////////////////

DONE?
=====
* variable block size
  - config.block_size as default
  - tries to find another flag after
  cfg.vbsize = true -> variable block size (until next flag) (with a similar name to cur one?)


Core
=====
* allow to run without opening a file (useful for batch mode)
* Fix XXX hack in src/radare.c to avoid hardcoding all interpretable debugger commands :?
* set asm.arch with rabin_arch
* open/close projects in GUI
* status shows backtrace !?!?!
* dbg.stepolibs = true ;  step over non-user code?
* asm.offset must be for all print modes
* Funroll mode - stacked disassembly
* add u64 cursor[config.block_size]; when printing
  - useful for zoom , disasembly, code folding
support for 7bit text encoding
make fdsniff and usbsniff generate a project file and a binary one.

(gdb) break ptrace if $r3 == 31 -> !wp equivalent. better docu/integration
* xc can get_math!



Imports:
========
* import pdi-tool from gerardo to inject code
* import esteve's object injector
* import libdwarf


ARM
===
* arm has no backtrace
- -S flag move to rabin
- when runnin to bp says invalid address (uh?)

BUGS:
=====
* wx `pW 33 -> the ` doesnt works
* step over doesnt works on arm
* keybinding assignment dosnt workz
* wa doesnt handle file resize
* rsc monitor doesnt works as expected
* inv -> make offsets take sense
  - make cursor bytes take sense too
* s <unexistant-flag> -> do not seek
* !ret should use !bt if possible
* In visual mode the 'w' doesn't allows to erase chars (backspace..)
   - pipecmd2str must use radare_cmd_str

Random:
=======
* Indentify, parse and show the auxv_t structure
* filter visible flags with scr.flagfilter (strstr expression)
* support to append data (without getting out of the block_size) (or so..)
* cfg.invdelta = inverses the delta (<=1024 ..-> >=1024) (or delta range) deltamin deltamax
* implement insert data inda core
* graph.body=asm,flags,symcalls,description, trace execution data
* Create linked list of hit0[0] and hit1[0] , etc..
  define block size by hit1[0]-hit0[0]

* invert pel disasm
* /a algorithm defined by search.algorithm
 it flags if search.flag
  - armfuncsearch
  - aes
  - token [from] [to] (dinamic block size)
  - x86funcsearch
  - from file formatted as search db
  - carver (find from-to,maxlen, ...)
  - plugin
* RDBs stored into Projects
  project.rdb = false ; store or not
  use [delimiters] to embed rdbs inside rps
* MSB stego

Rabin
=====
* elf-section-headers -> loggejar shelf stuff
  - pillar base address al vol ( rabin -b)
* Full PE parser support
* Move radare -S into rabin to find strings in data sections only
  - like gnu strings like bfd does


Graphs
======
* identify nodes with 'ret' in graph
* identify nodes with 'cmp' in graph

 * support to remove fixed nodes
 * store node positions (label = x,y)
  - show comments in a separated toggleable box:

   +-------------+
   | 0x0804483   |-----------.
   +-------------+           |
   | mov eax, 3  | sys_write |
   | int 0x80    |           |
   +-------------+-----------'

  - line clicking must be supported!
  - avoid out of context bytes

* tracecc
  - useful to walk to user code
  - copy the program code on another buffer
  - overwrite all code with 0xcc
  - not portable, coz arm mixes data and code
  - continue until breakpoints
* virtual machine decompilation -> helpers for debugging soft VM opcodes (new user-defined archs)

/* done in lua? */
* analize input/output of function calls
  - bp enter
  - bp exit
  - useful to reverse packer VMs
  - see what changes in register and memory


* exception frame information (try { ... } catch stuff)
* ram dump driver for w32

* use the pattern finding algorithm
* dinamic block size defined by:
  - height of screen
  - <tags> (set inigial and end binary tags)
    - allow to move forward/backward between 'bintags'
+ EH - event handling (event type + source pid)
  * add '!eh' command, how to handle an event ((ignore?), log, bypass, handle)
* cfg.dbgbsize (default block size for debugger)
* RDB TO GML
* circle to group looped code blocks in graph view

* support size of pointer with [xxx] get_offset expressions
  - b[xxx], w[xxx], d[xxx], 32[xxx], 16[xxx], 8[xxx]
  - also make use of cfg.endian

---------------------------
* do not sigalarm in visual
* new flag type: temporal 
  - they will not survive a project save
  - they are destroyed after a timeout


Search
======
* cfg.limit must be size of current maps section by default (file size?) useful for memory searchs
* add map search doing a search inside the process maps only
* search for head and foot
  - for each head finds a foot and defines block size

Filesystem
==========
* emulate filesystems from a defined seek
* can be done with losetup? not portable
* use fuse emulation?
* use linux kernel emulation?
* shell with grub-like commands to extract and insert files?

Core
====
* function hooker in C (dbg.hooker)      
  - some C macros or so to create a .so and LD_PRELOAD't
  - if static...should inject trampolines to our code.
  - defined in a external file. promote description tab files
    - happily done with lua scripts
* add cfg.insert (make user write operations insert or overwrite)
* Multiple rdb load
  - allow to map into flags, etc..
* optimized flag storing algorithm (a bit slower for >5000 strings)
  * flag namespaces (comment, label, symbol, ...) sym. cmt. ...
  * marcar blocks amb cursor i asignar un alias o nom (flag)
    - flags must have start and end
    - flags/comments/labels/dwarf
    - optimized linked list usage
* Add views/states/.. (S (switch) command) (open multiple files)
  - A view is just a stored copy of the config_t structure
  - and store different states for the same file
  - think on how to allocate new states (linked list of config_t structs)
  - S
    0 /bin/ls 0x0000000 ; comment
    1 /bin/ls 0x0000123 ; comment2
  - S [number]

Rasm
====
* Add .db, .byte, .dw, .dd directives or so, .string
  - make them usable from the assembler (labels and so too)

Visual
======
* colorize background of flagged bytes in hexdump
* count the number of lines in backtrace and substract them to make the visual

Hasher
======
* Refactor code -> no dupped code
  - sum*charpos, hash sha0, md2, crc64, hmac, network-hashes

Tracer
======
* store more info in trace (output of command)
* random trace peeker
  - takes traces from the process while running every N usecs
* timeline of a trace |----------------|
  - allow to view frame windows inside the timeline
  - extended 'f' and 'F' keys mode
  * List viewer (get offset as index fr cursor, right view shows the
    contents of th selected offset
    - linked list browser
* cmd.trace -> command to execute when tracing
  - trace.log should be parsed insiide radare visual
    (next/next-->prev...)
  - trace extra regs info: (show bytes where they point)
    eax 0x8048484 bytes...
  - blank line means a trace step
  - program_t -> asign name and color
    -> useful to merge graphs of code analysis and code execution
  - if comments have a '{' indent disasemly to the right and '}' to the left
  - allow to monitor register values and memory pointers
    - for example:
     > :x 200 @ [eax]+33
  - flag monitring
* tracepoints
  - allow to execute a command (!dump?)
    - follow some variables
* colorize traces in vala graphs
* trace graph
  - debug.c -> implement a while(debug_step()) loop to arch_aop() each instruction
    and draw a graph until a breakpoint or ^C
  - creates a program_t graphable with vala
  - can be diffed with rdbdiff

FileDescriptors
===============
* read/write from/to child filedescriptor
* sniff filedescriptor (dumping to file or socket)
 - using CONTSC ?
 - hooks read/write/ syscalls and gets buf and so

Debugger
========
* Show FPU stack contents
* Support for MMX
* next pel debugger (next source line) -- needs dwarf integration?
  - or just follow a file containing a list of breakpoint addresses
   like: 1 2 10 44 -> radare will set and unset all these breakpoints
   everytime. so you have a separate file with the breakpoints, so you
   can use rsc to generate this and next properly
* add dosdebug:// to debug dosemu-based applications
* import of qemu:// plugin to connect to qemus :D
* import of windbg:// for serial port (w32 kernel debugger)
* breakpoints
  - command
  - log (trace)
  - enabled
* al atacharse a un proces deixa <pid>.rdb hauria de ser <program.pid>.rdb?
* debug_new() -> alloc new glib object or so
  - allows multiple ps structures to be loaded
  - needs refactoring?
    - maybe only change a pointer. setCurrentProcess() or so

	Debugger d = new Debugger("/bin/ls");
	Debugger d2 = new Debugger("/bin/true");
	d.setCurrentProcess();
	d.breakpoint(0x8048930);
	d.continue();

* code injector for accessing non GP registers like mmx,
   fp, etc and other's section segments. (%ss, ..)
  off_t value = get_reg_inline("m0");
  - store a struct containing 
	char * register_name;
	uchar *shellcode
  - all shellcodes must be coded and injected in the same way
* show esp-ebp !!! stackframe is important everywhere! ??
* show esp-ebp of stack at top (or mark a range)
  - show stack offsets
  - max size of stack
  - colorize esb-ebp with temp cursor or so
* implement process freze and bootup
* own elf loader (avoid system one)
* amd64 -> x86-64 -> alias ( BSD64 is broken )
* load libraries on the child process
* breakpoint callbacks:
 - integrated with !wp too
  A hook to an api can be emulated from the debugger, no need to inject
  code everywhere, just BP and change regs
 - ptrace layer make't support syscall proxying for remote debugging!!1 rasc -l rulez
* use 'tm' (terminal mixer) to run the target debugged program
   - allows multiple interactives consoles over the program,
     keeping the debugger window clean
   - we need to know the pid of the child process of tm.
   - maybe a debug flag to tm would be nice - i will talk to the author
   - must be hardcoded inside the core
 - handle ^C properly , to allow to stop the process with any signal
* make libgdb2fd work
* Allow to run shellcodes on debugged process.
  (autodetect .s or raw binary)
  - read shellcode from a file 
    should support .c or .s or raw or elf _start

Code analyzer
=============
* handle relative references to code and data
* Implement libcaca/aalib backend for grava! :D
* xrefs does not works for string references
  - make xrefs support base address
  - integrate xrefs into the core (debugger needs love too!)
  [ xref struct ] ; basic jump table
   - u64 from
   - u64 to   -> nothing more :)
  - only for valid analyzed code .. uh?
  - data xrefs is not detected here. uh?
* persistent nodes in graph executing commands


Random
======
* Update manpages
* output of rsc help should start with ';'
* Implement a boolean bindiff based on symdiffing (uses dwarf)
* make monitors work with inotify and glib events or so


===========================================================

TOTHINK
=======
* new search engine allowing AES and RSA key (so...predefined algos for signature searches)
  - must think on! - entropia = 1 en un block (tots numeros primers)
* ease rsc monitor access from the visual (xterm or so) (run inside dvtm?) -- 
* Implement gtk-dialog replacement (radialog)? (in lua-gtk?)
* make !dump incremental
  - support to enable full dump (with hashing for reducing sizes)
  - bindiffing using bdiff
  - ultra slow ? i should analyze code to enhace this
[MAGIC] repeat a command at every flag matching
> wx foo @ hit*
* cmd.flag = eip -> fer una taula de offsets-comandes per cmd.flag
  - fc = flag command fc <command> @ offset
  - do not execute twice
* Do not use the char '(' in asm.lines. just use - or =
* record radare commands
  - all commands executed within a recording time are stored on a single script file
  - you can later repeat it or edit
  - history control must be back!
* executable offsets
  - execute a command on a certain offset
  - show funtion frames and arguments on the fly
  - automatize unpacks and so
change flags search and replace
 /r foo
 /1-5 ranged search

* performance counters:
   - inject code into the child process
   - mmap to backup code from the hooked functions
   - each hooked function should do something like:
       [mmap_addr+func_off]++;
   - these counters can be resetted
   - the mmap is only defined once
   - show statistics of time range and the count of times a function
     has been called.

 - timers:
   - inject code into the child process to define from-to zones
   - these from-to zones have an mmap address assigned
   - uses rdtsc to get time

	// 'from' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func], eax
     pop eax

	// 'to' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func+4], eax
     pop eax

   - statistics will show the time spend to run a determined piece of code

* implement move data inside the core (yank?)
 - add software watchpoints with stepall (register and memory changes control)
 - fer un binpatch a traves del contexte del asm que sigui muahah
 - rasc : send file and execute (pitbull inside!)
  - use it for the fuzzer framework

* DWARF DUMP !!! 
  * add 'list' gdb -like command
  * http://reality.sgiweb.org/davea/dwarf.html

BSD_SYSCALL_PTRACE:
===================

.global foo
foo:
        mov $2, %ebx
        mov $1, %eax
        push %ebx
        push %eax
        int $0x80

mips:
	li $v0, syscall
	li $v1, arg0
	syscall


libraries
=========
libsal   -> implements a layer on top of radare for SAL (or parrot?) (or nekovm?)
libiconv -> encoding support
libmagic -> better integration with magic stuff (atm use external magic dbs) (obsd magic)
libdwarf -> supports dwarf stuff and so


TODO LIST
=========
* ._ command not supported .. ? of course not!
* use #pragma once?
* bash autocompletion script for rsc and rfile
* base64 conversion, fixer and so
* full charsets support (search strings in utf8, etc)
* implement 'commit' command. delayed write operations with bindiff output
* undo write and more things

* total world domination
