Name local plt stubs in x86 retpoline layouts ##analysis

Author: phix33

libr/core/canal.c

@@ -5823,14 +5823,14 @@ static void plt_stub_flag(RCore *core, ut64 entry, ut64 size, ut64 slot) {
 	free (fname);
 }
 
-// walk the section decoding entries: remember the last lea and load, and when an
-// entry ends in an indirect jump derive the got slot it goes through
+// decode entries, tracking the last lea/load to derive each got slot
 static void plt_stub_scan_section(RCore *core, RBinSection *sec) {
 	if (sec->vsize < 8 || sec->vsize > 0x100000) {
 		return;
 	}
 	const ut64 sec_vaddr = r_bin_get_vaddr (core->bin, sec->paddr, sec->vaddr);
 	const int len = (int)sec->vsize;
+	const ut64 sec_end = sec_vaddr + len;
 	ut8 *buf = malloc (len);
 	if (!buf || !r_io_read_at (core->io, sec_vaddr, buf, len)) {
 		free (buf);
@@ -5857,15 +5857,13 @@ static void plt_stub_scan_section(RCore *core, RBinSection *sec) {
 			load_disp = UT64_MAX;
 			continue;
 		}
+		ut64 slot = UT64_MAX;
 		if (indirect) {
 			// x86 encodes the slot in one op; arm64-alikes split it lea/load/branch
-			ut64 slot = (op.ptr > 0 && op.ptr != -1)? (ut64)op.ptr: UT64_MAX;
+			slot = (op.ptr > 0 && op.ptr != -1)? (ut64)op.ptr: UT64_MAX;
 			if (slot == UT64_MAX && lea_ptr != UT64_MAX && load_disp != UT64_MAX) {
 				slot = lea_ptr + load_disp;
 			}
-			if (slot != UT64_MAX) {
-				plt_stub_flag (core, entry, at + oplen - entry, slot);
-			}
 		} else {
 			switch (type) {
 			case R_ANAL_OP_TYPE_LEA:
@@ -5887,6 +5885,11 @@ static void plt_stub_scan_section(RCore *core, RBinSection *sec) {
 				break;
 			case R_ANAL_OP_TYPE_JMP:
 			case R_ANAL_OP_TYPE_CALL:
+				// retpoline stubs branch to an in-section thunk
+				if (lea_ptr != UT64_MAX && op.jump >= sec_vaddr && op.jump < sec_end) {
+					slot = lea_ptr + ((load_disp == UT64_MAX)? 0: load_disp);
+				}
+				break;
 			case R_ANAL_OP_TYPE_UCALL:
 			case R_ANAL_OP_TYPE_RET:
 			case R_ANAL_OP_TYPE_TRAP:
@@ -5900,6 +5903,9 @@ static void plt_stub_scan_section(RCore *core, RBinSection *sec) {
 				break;
 			}
 		}
+		if (slot != UT64_MAX) {
+			plt_stub_flag (core, entry, at + oplen - entry, slot);
+		}
 		r_anal_op_fini (&op);
 		i += oplen;
 		if (ends) {

test/db/anal/plt-local

@@ -181,3 +181,53 @@ EXPECT=<<EOF2
 0x00025550 11 sym.plt.calloc
 EOF2
 RUN
+
+NAME=x86_64 lazy retpoline: stubs calling the shared thunk get named
+FILE=bins/elf/pltrel/x86_64-retpoline.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.
+EOF
+EXPECT=<<EOF
+0x000014b0 17 sym.plt.add2
+0x000014d0 17 sym.plt.mul2
+0x000014f0 17 sym.plt.sub2
+EOF
+RUN
+
+NAME=x86_64 lazy retpoline: a call through the stub reads its target name
+FILE=bins/elf/pltrel/x86_64-retpoline.so
+CMDS=<<EOF
+aa
+pd 1 @ 0x144b
+EOF
+EXPECT=<<EOF
+|           0x0000144b      e860000000     call sym.plt.add2
+EOF
+RUN
+
+NAME=x86_64 retpoline with -z now: stubs jumping to the shared thunk get named
+FILE=bins/elf/pltrel/x86_64-retpoline-now.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.
+EOF
+EXPECT=<<EOF
+0x00001460 12 sym.plt.add2
+0x00001470 12 sym.plt.mul2
+0x00001480 12 sym.plt.sub2
+EOF
+RUN
+
+NAME=x86_64 retpoline with -z now: a call through the stub reads its target name
+FILE=bins/elf/pltrel/x86_64-retpoline-now.so
+CMDS=<<EOF
+aa
+pd 1 @ 0x140b
+EOF
+EXPECT=<<EOF
+|           0x0000140b      e850000000     call sym.plt.add2
+EOF
+RUN