Patch all functions referencing a string

[trufae]

Let's discuss this one-liner and try to find better ways to achieve it:

r2 -wq2A -c '"(ret;wa ret@`afi.`)";.(ret)() @@=`axtq @ str.generalPasteboard`' KanaDrill

issues i found

• @@= can't be @@c:= because the command uses the @ special char so it can be removed to avoid the need of backticks because axtq already takes the address as argument.
• -2 shouldnt be necessary, or maybe it should be implicit when -q is used. this may change in 5.7 when the rlog api gets in
• there should be a way to call more than one command with @@ without having to use macros
• the @afi. can be probably reimplemented as @c:afi. but there's no such thing, also may be good to have a syntax for function-relative addressing Implement @c: temporal seek operator ##shell #19928
• quoting macros is messy and escaping semicolons doesn't work as expected (Honor escaping semicolons in macro definitions ##shell #19929)

[alex-bender]

Is my understanding of that macros correct:

- (ret;wa ret@`afi.`) defines macros which puts `ret` at the current function
- .(ret) calls this macros
-  @@=`axtq @ str.generalPasteboard`' Iterates over functions which x-ref string generalPasteboard

correct me if I'm wrong

[MohX64]

Yes, exactly

[MohX64]

I believe we don't need to '()' in '.(ret) ()' because
(foo args;..;..)() define and call a macro.
But (ret) is already defined in first command '"(ret;wa ret@afi.)"

So it must be
r2 -wq2A -c '"(ret;wa ret@afi.)";.(ret) @@=axtq @ str.generalPasteboard' KanaDrill

I have tried that and it works :D

[trufae]

So after the last fixes this line should work too:

r2 -wq2A -c '(\;wa ret\@c:afi.)()@@c:axtq str.generalPasteboard' KanaDrill

[trufae]

What I find confusing about @@c: is that it takes a list of offsets (separated by space or newline) and passes it to @@=. And that made me think that the command should be @@=c: or @@c=: instead. but as long as the @@c: looks cleaner maybe the problem is just with the = sign and should be just another X: handler. :?

[trufae]

A seek subcommand that takes a command as argument and evaluates its output as an offset can be a way to get rid of the @c: without having to use backticks s \afiq.`. But also we can use $FB in this case. so it's not really necessary to have this seek command` subcommand. 😄

r2 -wq2A -c '(\;wa ret\@$FB)()@@c:axtq str.generalPasteboard' KanaDrill

We can get the refs to a symbol and the address of the function like this:

[0x1000077b0]> axtq sym.imp.tputs
0x100006278
0x1000062a8
0x100006b0c
0x100006b50
0x100006bb4
[0x1000077b0]> ?v $FB @@c:axtq sym.imp.tputs
0x1000061f8
0x1000061f8
0x100006a04
0x100006a04
0x100006a04

[trufae]

Unfortunately, we can't get rid of the macro because the @ doesn't works if escaped inline because the \@ is passed as a string to the ?v command instead of being evaluated. which imho is correct. But forces us to use macros

[0x1000077b0]> ?v $$\@ $FB@@c:axtq sym.imp.tputs
0x100006278
0x1000062a8
0x100006b0c
0x100006b50
0x100006bb4
[0x1000077b0]>

[trufae]

I had another idea... what if we could nest it this way:

> wa ret @ $FB @@c:axtq str.generalPasteboard

^this syntax is currently not valid, but may be a good way to get rid of the need of anonymous macros in some situations

[alex-bender]

would it affect only wa command?

[trufae]

No, ideally that nested @-@@ syntax should be applicable to any command. Like the special char escaping thing i did yesterday it works with all the commands

[MohX64]

I liked this syntax 👍