
  ___________ _____  ______   _____
  \___   ___/ _==_ \'   ._ \/ _==_ \
    \'   '//        \   '   \       \  for radare
     \___/ \________/.______/_______/


===========================================================

* Make 'Cs' autodetect multiple strings
* Vdf doesnt detect func size properly
* store from->to list for all the jumps/calls analized inside functions
  - use them to resolve xrefs at runtime only for functions)

java bug:
  0x000001EE  |           b80007           invokestatic java/lang/Object (null)

-> this should be a call to callme()

* imp_foo are not ok in dietelf :OO.
* rasc -E must be AAAA BBBB CCCC (de 4 en 4 :P)
 - be alphanumeric
 - avoid \n, avoid \r

* documentate dbg.focus
* documentate zoom.from, zoom.to better (zoom.size is removed)
* doc search.from and search.to

* make gdb connector work happily

* cannot remove Code changes CC -addr CF -addr ... it is Cc only??!? C- can be a good alias
* XC floating not happy
* Watchpoints:
  - Make !wp work with ? conditionals
  - Make dbg.wptrace = make it stop when there's a breakpoint
  - support for %eax = %ebx f.ex

  - ^C should be always catched!!

* Memory ranges
  - in core
  - define working memory ranges (0-100,400-500)
  - allow to enable/disable
  - useful for searching

* 'u*' - undo all changes (should be 'uw *') ?

* !contuh doesnt works :O
 - implement continue until cursor

* Build ruby stuff with waf also!

* Signal handling should idenitfy backtracing and siginfo and so from here or so

       static void
       handler(int sig, siginfo_t *si, void *unused)
       {
           printf("Got SIGSEGV at address: 0x%lx\n",
                   (long) si->si_addr);
           exit(EXIT_FAILURE);
       }

* add margin right to the text
  - or margin left to the shell code
  - cut all lines at column scr.width
  - add screen.hshift (horitzontal scrolling)

* debugger
  - follow child or parent
  - ignore other threads

* store xrefs
* add support for strings with "" in CC for.example

* powerpc
  - !regs must show and flag proper regs!!

* !lib /lib/libm.so.1   ; use 'uselib' on linux and dlopen on *bsd MUAHA
  - implement !call
  - must allocate strings

* export a graph to a file using 'Rf' command

0- store all the stack analysis info in a struct per-function
   and before removing it store a comment or metadata at the
   begginging of it.

* bash autocompletion script for rsc and rfile

* arrows+shift in visual
* 'x' char should not be accepted as hexpair

* search backward (esteve?)
  - search backward in memory (invert string and add inc as argument for binparse)
  - useful to static analyze interrupt calls

* BSD imports with dietelf doesnt works well

* deprecate asm.follow for scr.seek or so !!!
 - documentation for this

* define ranges of the file to analize (.text by default...)
  mr - memory ranges ??
  - autodetected using !dall algorithm
  - but if its a static binary ...would be cool to define a way
    to only analyze the calls inside a static bin

* analize previous pushes or stack accesses before a call
  to a function (identify function arguments)
  - not only by the ones accessed in the code)

* asm.stackpointer (show stack pointer value like in IDA)

* !bpc -> execute command when hitting breakpoint
  - stop on breakpoint after N hits
  * breakpoint callbacks:
   - integrated with !wp too
    A hook to an api can be emulated from the debugger, no need to inject
    code everywhere, just BP and change regs
   - ptrace layer make't support syscall proxying for remote debugging!!1 rasc -l rulez
* asm.regs2 or asm.regsegments = true ( to show cs, ds, gs, ... )

// TODO: store data and show (flag.data) in last_print_format

Debugger:
	* when attaching sets <pid>.rdb ..should be <program.pid>.rdb?
	* !contu must use '!mp rw- 0x8048000 0x4045' if supported
	* load libraries on the child process
	* !contall
	* !cont <pid> ???
	* Add !int opcode to call a syscall
	  !int eax=30 ebx=0x8048400
	  - store/restore regs
	  - shows return value in eax before restoring regs
	* call <flag> arg arg arg
	 - done with lua/python
	* breakpoints
	  - command
          - stop at count
	  - log (trace)
	  - enable/disable

Rabin:
	* rabin string refs
	* Move javasm.c as dietjava in rabin
	* entry vs entrypoint flag :O
	* Full PE parser support

Radiff:
	* Entry point for the bin diffing utilities
	- Supports byte-level diffing with differences
	- Allows to diff code-level trees from radare RDB code
	  analysis, that can be generated from IDA or radare.
	
Rasc:
	* rasc - helper for format strings (orly?)
	* rasc : send file and execute (pitbull inside!)
 	* add selfsigstop/stackperm shellcodes in lua script or rasc
	* rasc with ascii-nops

Rasm:
	* RASM is buggy about relative/absolute offsets
	* Support for macros? Write my own cpp? Use cpp?
	* olly assembler segfaults everywhere everytime :OO
	* rasm : Add .db, .byte, .dw, .dd directives or so, .string
	  - make them usable from the assembler (labels and so too)
	  - be like a cmdline gas. use the internal code of gnu (stripped down plz!)

Core:
	BUGS:
	* cons.c (dietline) should work fine without readline and without verbose) (malloc should be happy)
	* radare malloc://30 && e file.write=1 && wx 90 = segfaults
	* folders doesnt works well
	* rsc monitor not so cool from teh graph view or so
	* disasm is incorrect. always returns the negative value :OO
	  - 03 e4 f0 = and esp, 0xf0
	  but must be= and esp, 0xfffffff0
	* more wrong disass 
	  8d9574ffffff    lea edx, [ebp-0x8c] 

	TODO:
	* '<' and '>' commands converted in prefix modifiers
	* remove project strange commands (use radare ones) -- ?? sure? is not secure!
	(avoid system and pipes?!?) .. so drop '!' and '>' chars from input strings that is
	* reload project file if changes
	* folders are broken
	* do not create trace.log by default
	* Allow to edit flags in Vt
	* Make the color palette more accessible to the users
	  - integrated with eval config in visual Ve

Rsc:
	* implement bindiff patchers
  	- fer un binpatch a traves del contexte del asm que sigui muahah (LUA)
	* pcap/radare for fun
	* syscall-flag  using userdefined table (in file)
	   - must use asm.os to get proper syscall table
	   - must be implemented in code analysis!!

Grava:
	3- global data in graphs - allow to run specific commands in nodes

* autodetect references to flags with aop.ref on
  - aop.ref must get more ref types (write checks)
	a1acc30508      mov eax, [0x805c3ac]
	3d00800000      cmp eax, 0x8000
	833d0cc4050803  cmp dword [0x805c40c], 0x3
	bf0d9b0508      mov edi, 0x8059b0d

* Add 'bookmarked flags'

Radare:
    + Dwarf support:
        - dwarfdump parser???
        - natively use libwarf in rabin

* scriptedit must work also for 'radare scripts'
  - Multiple open/close is broken :?
  - make it work with vim in console
* cfg.inverse must be universal!
* ease rsc monitor access from the visual (xterm or so) (run inside dvtm?) -- 
* write shellcode to dump a buffer in hexa (inline jump)

Stack Analysis:
===============
* Add function analysis in code analysis
  - detect push ebp ; mov esp, ebp (begin)
  - Access to local variables using dwarf stuff
* show esp-ebp !!! stackframe is important everywhere! ??
* show pm xxxxxxxx @ esp (show esp-ebp bytes here or so)
* show esp-ebp of stack at top (or mark a range)
  - show stack offsets
  - max size of stack
  - colorize esb-ebp with temp cursor or so

DWARF
=====
	/* Merge libdwarf inside rabin */
	/* This is dwarfdump -G <file> */

	DwarfDumpOutput:
	----------------

	/* Enums */
<2>< 1308>      DW_TAG_enumerator
                DW_AT_name                  FILETYPE_MACHO
                DW_AT_const_value           6

<1>< 1155>      DW_TAG_structure_type
                DW_AT_name                  list_head
                DW_AT_byte_size             8
                DW_AT_decl_file             7 ../list.h
                DW_AT_decl_line             14
                DW_AT_sibling               <1204>

	/* VarTypes */

<1>< 1122>      DW_TAG_pointer_type
                DW_AT_byte_size             4
                DW_AT_type                  <1128>


	/* Local Variables */

	info we get:
		varname,
		file,
		file_line,
		var_type


<2>< 2507>      DW_TAG_formal_parameter
                DW_AT_name                  file
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             80
                DW_AT_type                  <1122>
                DW_AT_location              DW_OP_fbreg -60
<2>< 2521>      DW_TAG_variable
                DW_AT_name                  buf
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             82
                DW_AT_type                  <2563>
                DW_AT_location              DW_OP_fbreg -44
<2>< 2535>      DW_TAG_variable
                DW_AT_name                  addr
                DW_AT_decl_file             1 /home/pancake/prg/radare/src/rabin/rabin.c
                DW_AT_decl_line             83
                DW_AT_type                  <173>
                DW_AT_location              DW_OP_fbreg -48


==============================================================

* Funroll mode - stacked disassembly

* file.insertblock - TODO: implement io.c radare_write
  - must interact with search engine too for search and replace

* fm to move a flag to another flagspace
  > fs foo
  > fm sym_foo
  # makes sym_foo live in foo flagspace

* Add 'strings-cmt' to add comments in strings and use Cs to convert them
  - Make 'Cs' be more intelligent for multiple strings
  - Support for cursor range split
  - Without argument must find the end of string from curseek

* show labels of all jumps/calls (not only bookmarked ones)

* function hooker in C (dbg.hooker)      
  - some C macros or so to create a .so and LD_PRELOAD't
  - if static...should inject trampolines to our code.
  - or just manage the breakpoints
  - if bp == 1 !jmp 0x8084840 - redirect code execution on certain points
  - stored in file
    [from-address] \t  [to-address]
 * xc is crappy! no args, some vals are invalid
 * add asm.arch=aop -> analyze code engine to disassemble
 * 'ar' -> anal reset -> reset vm
 * populate the use of cmd.flag (in prompt and so)
 * graphically draw data structures in memory (adg, aD)?

 * add nanosleep shellcode
  - using nanosleep
    -> nanosleep(&foo, NULL);
	call +1
	pop ebx
	push 3
	push 0
	mov eax, 162
	mov ebx
	int 0x80

 * options for trace
  - trace.depth = 0
  - trace.alarm = 0
 * ^C doesnt works with trace

 * shellcode to get cur eip in eax
	de call +1
	pop eax
	mv  [deplaz+eax], restore_value
 *  /x 58 5b c3
   - no funciona be troba coses com 58 5b c9 c3...

 * Allow to increase/decrease folder size with + and -
  - when scrolling over folders skip faster
 * add !status to get last crash info and stuff like that
 * fix autocomplete stuff for readline-flags
 * add full autocompletion support for dietline
 * make fixed nodes fixed to the graph view
 * Use SIGHUP to dump monitor stuff to files
 * blinking byte at cursor
 * support for search and replace
 * support for oprofile (via rsc or so)

Gui
===
* implement start/pause/continue/stop/reload button for a pid
* frontend for hasher (Vala api for hashing)
* the gui must listen:// and connect:// too!

Open streams
============
* radare pcap://"eth0/port 4000"
* serial console support
  - configure bps and so
  $ radare /dev/ttyS0

Debugger
========
* trace.libcode = trace libcode or not?
  - dbg.steplibs = true|false ??
  * dbg.stepolibs = true ;  step over non-user code?
  - automatic stepu 

/////////////////////////////////////////////////////////////////////////
/* Fetch the thread-local storage pointer for libthread_db.  */
ps_err_e
ps_get_thread_area (const struct ps_prochandle *ph,
                    lwpid_t lwpid, int idx, void **base)
{
  if (ptrace (PTRACE_GET_THREAD_AREA, lwpid, NULL, base) != 0)
    return PS_ERR;

  /* IDX is the bias from the thread pointer to the beginning of the
     thread descriptor.  It has to be subtracted due to implementation
     quirks in libthread_db.  */
  *base = (void *) ((char *)*base - idx);

  return PS_OK;
}
PTRACE_GET_THREAD_AREA_3264:
/////////////////////////////////////////////////////////////////////////

DONE?
=====
* variable block size
  - config.block_size as default
  - tries to find another flag after
  cfg.vbsize = true -> variable block size (until next flag) (with a similar name to cur one?)

Core
=====
* allow to run without opening a file (useful for batch mode)
* make fdsniff and usbsniff generate a project file and a binary one.

(gdb) break ptrace if $r3 == 31 -> !wp equivalent. better docu/integration


ARM
===
* arm backtrace
- when runnin to bp says invalid address (uh?)
- step over doesnt works on arm/mips

BUGS:
=====
 * !pids must control non-printable chars
* if myinc > len myinc = 1;
  - if pressing '[' multiple times myinc stills being 1, but needs lot of '] to
    recover the 0 position
* wx `pW 33 -> the ` doesnt works
* keybinding assignment dosnt workz
  - UGLY
* wa doesnt handle file resize
* rsc monitor doesnt works as expected
* s <unexistant-flag> -> do not seek
* !ret should use !bt if possible

Random:
=======
* support to append data (without getting out of the block_size) (or so..)
* cfg.invdelta = inverses the delta (<=1024 ..-> >=1024) (or delta range) deltamin deltamax
* implement insert data inda core
* graph.body=asm,flags,symcalls,description, trace execution data
* define block size by hit1[0]-hit0[0] rollo begin-end (buscar <html> i </html>)

* invert pel disasm
  * inv -> make offsets take sense
  - make cursor bytes take sense too

* /a algorithm defined by search.algorithm
 it flags if search.flag
  - armfuncsearch
  - aes
  - token [from] [to] (dinamic block size)
  - x86funcsearch
  - from file formatted as search db
  - carver (find from-to,maxlen, ...)
  - plugin
* RDBs stored into Projects
  project.rdb = false ; store or not
  use [delimiters] to embed rdbs inside rps
* MSB stego


Graphs
======
* identify nodes with 'ret' in graph
* identify nodes with 'cmp' in graph

 * support to remove fixed nodes
 * store node positions (label = x,y)
  - show comments in a separated toggleable box:

   +-------------+
   | 0x0804483   |-----------.
   +-------------+           |
   | mov eax, 3  | sys_write |
   | int 0x80    |           |
   +-------------+-----------'

  - line clicking must be supported!
  - avoid out of context bytes

* tracecc
  - useful to walk to user code
  - copy the program code on another buffer
  - overwrite all code with 0xcc
  - not portable, coz arm mixes data and code
  - continue until breakpoints
* virtual machine decompilation -> helpers for debugging soft VM opcodes (new user-defined archs)

/* done in lua? */
* analize input/output of function calls
  - bp enter
  - bp exit
  - useful to reverse packer VMs
  - see what changes in register and memory

* exception frame information (try { ... } catch stuff)
* ram dump driver for w32

* dinamic block size defined by:
  - height of screen
  - <tags> (set inigial and end binary tags)
    - allow to move forward/backward between 'bintags'
+ EH - event handling (event type + source pid)
  * add '!eh' command, how to handle an event ((ignore?), log, bypass, handle)
* cfg.dbgbsize (default block size for debugger)
* RDB TO GML
* circle to group looped code blocks in graph view

* support size of pointer with [xxx] get_offset expressions
  - b[xxx], w[xxx], d[xxx], 32[xxx], 16[xxx], 8[xxx]
  - also make use of cfg.endian

---------------------------
* do not sigalarm in visual
* new flag type: temporal 
  - they will not survive a project save
  - they are destroyed after a timeout


Search
======
* cfg.limit must be size of current maps section by default (file size?) useful for memory searchs
* add map search doing a search inside the process maps only
* search for head and foot
  - for each head finds a foot and defines block size

Core
====
* multiple instancies of the core handled with a pointer to it.
  - use more pointer tables
* Add views/states/.. (S (switch) command) (open multiple files)
  - A view is just a stored copy of the config_t structure
  - and store different states for the same file
  - think on how to allocate new states (linked list of config_t structs)
  - S
    0 /bin/ls 0x0000000 ; comment
    1 /bin/ls 0x0000123 ; comment2
  - S [number]


Tracer
======
* store more info in trace (output of command)
* timeline of a trace |----------------|
  - available as a zoom view
  - in rsc script? - can dump traces on separated files? slow? bloat?
   - single file is better
  - allow to view frame windows inside the timeline
  - extended 'f' and 'F' keys mode
  * List viewer (get offset as index fr cursor, right view shows the
    contents of th selected offset
    - linked list browser
* cmd.trace -> command to execute when tracing
  - trace.log should be parsed insiide radare visual
    (next/next-->prev...)
  - trace extra regs info: (show bytes where they point)
    eax 0x8048484 bytes...
  - blank line means a trace step
  - program_t -> asign name and color
    -> useful to merge graphs of code analysis and code execution
* tracepoints
  - allow to execute a command (!dump?)
    - follow some variables
* colorize traces in vala graphs
* trace graph
  - debug.c -> implement a while(debug_step()) loop to arch_aop() each instruction
    and draw a graph until a breakpoint or ^C
  - creates a program_t graphable with vala


Debugger
========
* Show FPU stack contents
* Support for MMX register manipulation
* dosdebug:// to debug dosemu-based applications
  - semi done..not finished. should be integrated as a plugin
* qemu:// plugin to connect to qemus :D
* windbg:// for serial port (w32 kernel debugger)
* code injector for accessing non GP registers like mmx,
   fp, etc and other's section segments. (%ss, ..)
  off_t value = get_reg_inline("m0");
  - store a struct containing 
	char * register_name;
	uchar *shellcode
  - all shellcodes must be coded and injected in the same way
* Allow to run shellcodes on debugged process.
  (autodetect .s or raw binary)
  - read shellcode from a file 
    should support .c or .s or raw or elf _start

* make libgdb2fd work

* xrefs does not works for string references
  - make xrefs support base address
  - integrate xrefs into the core (debugger needs love too!)
  [ xref struct ] ; basic jump table
   - u64 from
   - u64 to   -> nothing more :)
  - only for valid analyzed code .. uh?
  - data xrefs is not detected here. uh?


===========================================================

TOTHINK
=======
* Filesystem support
  * emulate filesystems from a defined seek
  * can be done with losetup? not portable
  * use fuse emulation?
  * use linux kernel emulation?
  * shell with grub-like commands to extract and insert files?
* Implement libcaca/aalib backend for grava! :D
* new search engine allowing AES and RSA key (so...predefined algos for signature searches)
  - must think on! - entropia = 1 en un block (tots numeros primers)
* implement process freze and bootup
* use 'tm' (terminal mixer) to run the target debugged program
   - allows multiple interactives consoles over the program,
     keeping the debugger window clean
   - we need to know the pid of the child process of tm.
   - maybe a debug flag to tm would be nice - i will talk to the author
   - must be hardcoded inside the core
 - handle ^C properly , to allow to stop the process with any signal
* Indentify, parse and show the auxv_t structure
  * LD_AUXV_SHOW=1 /bin/ls before start to debug
  * dbg.auxv = true // WHY?
* output of rsc help should start with ';'
* asm.offset must be for all print modes?
  - renamed to scr.offset?
* Really?
 * define default print format per flags (useful to find strings, code,etc..) :D
* rename -v to -q (quiet or -s silent)
  - cfg.verbose = integer (autosetup scr.color and asm.color)
  - cfg.quiet = false
* make !dump incremental using bindiff (too complicated approach)
  - support to enable full dump (with hashing for reducing sizes)
  - ultra slow ? i should analyze code to enhace this


FileDescriptors
===============
* read/write from/to child filedescriptor
* sniff filedescriptor (dumping to file or socket)
 - using CONTSC ?
 - hooks read/write/ syscalls and gets buf and so
 - can be done in lua
 - !contsc needs lua interface

Random Stuff
============
* Do not use the char '(' in asm.lines. just use - or =
* record radare commands
  - all commands executed within a recording time are stored on a single script file
  - you can later repeat it or edit
  - history control must be back!

* executable offsets // flag command/grep?
  - execute a command on a certain offset
  - show funtion frames and arguments on the fly
  - automatize unpacks and so

* performance counters:
   - inject code into the child process
   - mmap to backup code from the hooked functions
   - each hooked function should do something like:
       [mmap_addr+func_off]++;
   - these counters can be resetted
   - the mmap is only defined once
   - show statistics of time range and the count of times a function
     has been called.

 - timers:
   - inject code into the child process to define from-to zones
   - these from-to zones have an mmap address assigned
   - uses rdtsc to get time

	// 'from' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func], eax
     pop eax

	// 'to' hook
     push eax
     rdtsc
     mov [mmap_addr+my_func+4], eax
     pop eax

   - statistics will show the time spend to run a determined piece of code


Imports:
========
* import pdi-tool from gerardo to inject code
* import esteve's object injector
* import libdwarf
  * http://reality.sgiweb.org/davea/dwarf.html
  * add 'list' gdb -like command
  * parse dwarfdump output in perl

BSD_SYSCALL_PTRACE:
===================

.global foo
foo:
        mov $2, %ebx
        mov $1, %eax
        push %ebx
        push %eax
        int $0x80

mips:
	li $v0, syscall
	li $v1, arg0
	syscall




 ____  ___ ____  ___ ____  ___  ______   ____
|  _ \/   \'   \/   \  _ \/ _ \ \__   | /    \
|    <  V  . T  . V      <   _/ .--'_/ |  ()  |
|_|\__|_|__|___/|_|_|_|\__\___/ |_____(_)____/

/* ONGOING 2.0 */

Split radare into libraries accessible by VAPI interfaces. (no gobject dependency, but an OO C one).


* full charsets support (search strings in utf8, etc) using iconv
* multithread traces <pid>:<addr>

* implement 'commit' command. delayed write operations with bindiff output
  - using the 'u' command

* search for strings in disassembly
  - pd 1 -> strstr(cons_buffer, mystr)

* next pel debugger (next source line) -- needs dwarf integration?

* total world domination
