Skip to content
joelpx edited this page Mar 9, 2016 · 4 revisions

Read a MIPS binary

The value of the $gp register is not computed automatically, you must set it first. The analyzer is "disabled" when you open a MIPS file.

Example :

$ plasma mips_elf_file -i

Go at the entry point in visual mode and create code with c.

>> v EP
>> dump EP
.text 0x4002b0: $zero = $ra
.text 0x4002b4: bal (.text) sub_4002bc

.text 0x4002b8: .db 00
.text 0x4002b9: .db 00
.text 0x4002ba: .db 00
.text 0x4002bb: .db 00

; ---------------------------------------------------------------------
; SUBROUTINE
; ---------------------------------------------------------------------
__noreturn__ sub_4002bc:
.text 0x4002bc: (load upper) $gp = 25
.text 0x4002c0: $gp += -25564
.text 0x4002c4: $gp += $ra
.text 0x4002c8: $ra = 0
...

>> x sub_4002bc
function sub_4002bc (.text) {
    # 0x4002bc: lui $gp, 0x19
    # 0x4002c0: addiu $gp, $gp, -0x63dc
    0x4002bc: li $gp, 0x189c24
    0x4002c4: $gp += $ra
...

We can see that in the function sub_4002bc, $gp is set to 0x189c24 then $ra is added. Here $ra is equal to 0x4002bc, and $gp = 0x189c24 + 0x4002bc = 0x589ee0

>> mips_set_gp 0x589ee0

Then we tell explicitly to start the analysis.

>> push_analyze_symbols
Clone this wiki locally