NAME=ELF: dynamic p_offset
FILE=bins/elf/analysis/dynamic-poffset
CMDS=ir
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x00600988 0x00000988 SET_64 6     __gmon_start__
0x006009a8 0x000009a8 SET_64 7     write
0x006009b0 0x000009b0 SET_64 7     close
0x006009b8 0x000009b8 SET_64 7     __libc_start_main
0x006009c0 0x000009c0 SET_64 7     open
EOF
RUN

NAME=ELF: Spurious relocations
FILE=bins/elf/analysis/spurious-relocs
CMDS=ir~vaddr=0x0000003a
EXPECT=<<EOF
EOF
RUN

NAME=ELF: .plt/.plt.sec sections
FILE=bins/elf/ls-cet
CMDS=pdi 10 @ main+0x28
EXPECT=<<EOF
0x00004e98                 31c0  xor eax, eax
0x00004e9a           e8a1e60000  call 0x13540
0x00004e9f       488d351e4a0100  lea rsi, [rip + 0x14a1e]
0x00004ea6           bf06000000  mov edi, 6
0x00004eab           e8b0fdffff  call sym.imp.setlocale
0x00004eb0       488d35584b0100  lea rsi, [rip + 0x14b58]
0x00004eb7       488d3d374b0100  lea rdi, [rip + 0x14b37]
0x00004ebe           e81dfaffff  call sym.imp.bindtextdomain
0x00004ec3       488d3d2b4b0100  lea rdi, [rip + 0x14b2b]
0x00004eca           e8d1f9ffff  call sym.imp.textdomain
EOF
RUN

NAME=ELF: use reloc table in dyn entry
FILE=bins/elf/simple-hello-world-with-wrong-rela-section-name
CMDS=<<EOF
e asm.comments=false
e asm.lines=false
pd 15 @ entry0~call
EOF
EXPECT=<<EOF
0x00001068      ff15722f0000   call qword [reloc.__libc_start_main]
EOF
RUN

NAME=ELF: R_X86_64_PLT32 patch reloc
FILE=bins/elf/radare2.c.obj
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
e asm.comments=false
e asm.lines=false
pd 1 @ 0x0800005e
EOF
EXPECT=<<EOF
0x0800005e      e878840300     call reloc.r_spaces_set
EOF
RUN

NAME=ELF: R_X86_64_PLT32 patch reloc 2
FILE=bins/elf/test.ko
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
e asm.comments=false
e asm.lines=false
e asm.flags=false
pd 1 @ 0x0800007c
pd 1 @ 0x0800008c
pd 1 @ 0x0800009f
EOF
EXPECT=<<EOF
0x0800007c      e88e0a0000     call reloc.__fentry__
0x0800008c      e8860a0000     call reloc.printk
0x0800009f      e8730a0000     call reloc.printk
EOF
RUN

NAME=ELF: R_X86_64_PLT32 patch reloc 2 (no io.cache)
FILE=bins/elf/test.ko
CMDS=<<EOF
e asm.comments=false
e asm.lines=false
e asm.flags=false
pd 1 @ 0x0800007c
pd 1 @ 0x0800008c
pd 1 @ 0x0800009f
EOF
EXPECT=<<EOF
0x0800007c      e800000000     call __fentry__
0x0800008c      e800000000     call printk
0x0800009f      e800000000     call printk
EOF
RUN

NAME=x86 32bit relocs in kernel module
FILE=bins/elf/linux-example-x86-32.ko
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
s 0x0800007c
pi 15
px 0x26
EOF
EXPECT=<<EOF
call reloc.__fentry__
push ebp
mov ebp, esp
push str.8D____n
call reloc.printk
xor eax, eax
leave
ret
push ebp
mov ebp, esp
push str.Ulu_mulu_n
call reloc.printk
pop eax
leave
ret
- offset -  7C7D 7E7F 8081 8283 8485 8687 8889 8A8B  CDEF0123456789AB
0x0800007c  e8cc c802 0055 89e5 68a2 0000 08e8 c3c8  .....U..h.......
0x0800008c  0200 31c0 c9c3 5589 e568 b100 0008 e8b2  ..1...U..h......
0x0800009c  c802 0058 c9c3                           ...X..
EOF
RUN

NAME=x86 32bit relocs in kernel module (bin.relocs.apply=false)
FILE=bins/elf/linux-example-x86-32.ko
ARGS=-e bin.relocs.apply=false
CMDS=<<EOF
s 0x0800007c
pi 15
px 0x26
EOF
EXPECT=<<EOF
call reloc.__fentry__
push ebp
mov ebp, esp
push 0
call printk
xor eax, eax
leave
ret
push ebp
mov ebp, esp
push .rodata.str1.1
call reloc.printk
pop eax
leave
ret
- offset -  7C7D 7E7F 8081 8283 8485 8687 8889 8A8B  CDEF0123456789AB
0x0800007c  e8fc ffff ff55 89e5 6800 0000 00e8 fcff  .....U..h.......
0x0800008c  ffff 31c0 c9c3 5589 e568 0f00 0000 e8fc  ..1...U..h......
0x0800009c  ffff ff58 c9c3                           ...X..
EOF
RUN

NAME=ELF: relocs init array
FILE=bins/elf/r2pay-arm64.so
CMDS=<<EOF
s section..init_array
pd 10
pd 1 @ 0x0800009f
EOF
EXPECT=<<EOF
            ;-- section..init_array:
            ;-- segment.LOAD1:
            ;-- reloc..datadiv_decode9958896245423089702:
            0x00126510      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode9958896245423089702 @ 0x00005a6c ; [13] -rw- section size 728 named .init_array
            ;-- reloc..datadiv_decode10476194973746341988:
            0x00126518      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode10476194973746341988 @ 0x00005a80
            ;-- reloc..datadiv_decode16323044921667855934:
            0x00126520      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode16323044921667855934 @ 0x000efddc
            0x00126528      .qword 0x0000000000009080 ; entry.init0    ; RELOC 64 
            0x00126530      .qword 0x0000000000077d14 ; entry.init1    ; RELOC 64 
            ;-- reloc..datadiv_decode667225052219618748:
            0x00126538      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode667225052219618748 @ 0x000f22e0
            ;-- reloc..datadiv_decode8132880250332170398:
            0x00126540      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode8132880250332170398 @ 0x000f22e4
            ;-- reloc..datadiv_decode3655886617018729963:
            0x00126548      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode3655886617018729963 @ 0x000f22e8
            ;-- reloc..datadiv_decode16406252260792032531:
            0x00126550      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode16406252260792032531 @ 0x000f22ec
            ;-- reloc..datadiv_decode13403071575248320347:
            0x00126558      .qword 0x0000000000000000                  ; RELOC 64 .datadiv_decode13403071575248320347 @ 0x000f22f0
            0x0800009f      ff             unaligned
EOF
RUN

NAME=ELF: relocs r2pay
FILE=bins/elf/r2pay-arm64.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
s section..init_array
pd 10
pd 1 @ 0x0800009f
EOF
EXPECT=<<EOF
            ;-- section..init_array:
            ;-- segment.LOAD1:
            ;-- reloc..datadiv_decode9958896245423089702:
            0x00126510      .qword 0x0000000000005a6c ; sym..datadiv_decode9958896245423089702; RELOC 64 .datadiv_decode9958896245423089702 @ 0x00005a6c ; [13] -rw- section size 728 named .init_array
            ;-- reloc..datadiv_decode10476194973746341988:
            0x00126518      .qword 0x0000000000005a80 ; sym..datadiv_decode10476194973746341988; RELOC 64 .datadiv_decode10476194973746341988 @ 0x00005a80
            ;-- reloc..datadiv_decode16323044921667855934:
            0x00126520      .qword 0x00000000000efddc ; sym..datadiv_decode16323044921667855934; RELOC 64 .datadiv_decode16323044921667855934 @ 0x000efddc
            0x00126528      .qword 0x0000000000009080 ; entry.init0    ; RELOC 64 
            0x00126530      .qword 0x0000000000077d14 ; entry.init1    ; RELOC 64 
            ;-- reloc..datadiv_decode667225052219618748:
            0x00126538      .qword 0x00000000000f22e0 ; sym..datadiv_decode667225052219618748; RELOC 64 .datadiv_decode667225052219618748 @ 0x000f22e0
            ;-- reloc..datadiv_decode8132880250332170398:
            0x00126540      .qword 0x00000000000f22e4 ; sym..datadiv_decode8132880250332170398; RELOC 64 .datadiv_decode8132880250332170398 @ 0x000f22e4
            ;-- reloc..datadiv_decode3655886617018729963:
            0x00126548      .qword 0x00000000000f22e8 ; sym..datadiv_decode3655886617018729963; RELOC 64 .datadiv_decode3655886617018729963 @ 0x000f22e8
            ;-- reloc..datadiv_decode16406252260792032531:
            0x00126550      .qword 0x00000000000f22ec ; sym..datadiv_decode16406252260792032531; RELOC 64 .datadiv_decode16406252260792032531 @ 0x000f22ec
            ;-- reloc..datadiv_decode13403071575248320347:
            0x00126558      .qword 0x00000000000f22f0 ; sym..datadiv_decode13403071575248320347; RELOC 64 .datadiv_decode13403071575248320347 @ 0x000f22f0
            0x0800009f      ff             unaligned
EOF
RUN

NAME=sparc relocs
FILE=bins/elf/elf-solaris-sparc-ls
CMDS=<<EOF
ir
s section..plt
e asm.lines=false
e asm.bytes=false
pd 40
EOF
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x0003f94c 0x0001f94c ADD_32 20    _Jv_RegisterClasses
0x0003f954 0x0001f954 ADD_32 20    __register_frame_info
0x0003f958 0x0001f958 ADD_32 20    __deregister_frame_info
0x0003f98c 0x0001f98c ADD_32 21    atexit
0x0003f998 0x0001f998 ADD_32 21    exit
0x0003f9a4 0x0001f9a4 ADD_32 21    _exit
0x0003f9b0 0x0001f9b0 ADD_32 21    __deregister_frame_info
0x0003f9bc 0x0001f9bc ADD_32 21    __register_frame_info
0x0003f9c8 0x0001f9c8 ADD_32 21    _Jv_RegisterClasses
0x0003f9d4 0x0001f9d4 ADD_32 21    fputs
0x0003f9e0 0x0001f9e0 ADD_32 21    printf
0x0003f9ec 0x0001f9ec ADD_32 21    __flsbuf
0x0003f9f8 0x0001f9f8 ADD_32 21    free
0x0003fa04 0x0001fa04 ADD_32 21    strncmp
0x0003fa10 0x0001fa10 ADD_32 21    strcoll
0x0003fa1c 0x0001fa1c ADD_32 21    longjmp
0x0003fa28 0x0001fa28 ADD_32 21    strcmp
0x0003fa34 0x0001fa34 ADD_32 21    strrchr
0x0003fa40 0x0001fa40 ADD_32 21    .udiv
0x0003fa4c 0x0001fa4c ADD_32 21    .umul
0x0003fa58 0x0001fa58 ADD_32 21    setjmp
0x0003fa64 0x0001fa64 ADD_32 21    __assert_c99
0x0003fa70 0x0001fa70 ADD_32 21    strlen
0x0003fa7c 0x0001fa7c ADD_32 21    sprintf
0x0003fa88 0x0001fa88 ADD_32 21    memset
0x0003fa94 0x0001fa94 ADD_32 21    lstat64
0x0003faa0 0x0001faa0 ADD_32 21    stat64
0x0003faac 0x0001faac ADD_32 21    __major
0x0003fab8 0x0001fab8 ADD_32 21    __minor
0x0003fac4 0x0001fac4 ADD_32 21    strncpy
0x0003fad0 0x0001fad0 ADD_32 21    strcpy
0x0003fadc 0x0001fadc ADD_32 21    mbrtowc
0x0003fae8 0x0001fae8 ADD_32 21    wcwidth
0x0003faf4 0x0001faf4 ADD_32 21    mbsinit
0x0003fb00 0x0001fb00 ADD_32 21    fwrite
0x0003fb0c 0x0001fb0c ADD_32 21    memcpy
0x0003fb18 0x0001fb18 ADD_32 21    fflush
0x0003fb24 0x0001fb24 ADD_32 21    sigprocmask
0x0003fb30 0x0001fb30 ADD_32 21    raise
0x0003fb3c 0x0001fb3c ADD_32 21    signal
0x0003fb48 0x0001fb48 ADD_32 21    .urem
0x0003fb54 0x0001fb54 ADD_32 21    localtime
0x0003fb60 0x0001fb60 ADD_32 21    abort
0x0003fb6c 0x0001fb6c ADD_32 21    fprintf
0x0003fb78 0x0001fb78 ADD_32 21    setlocale
0x0003fb84 0x0001fb84 ADD_32 21    getenv
0x0003fb90 0x0001fb90 ADD_32 21    ioctl
0x0003fb9c 0x0001fb9c ADD_32 21    opendir
0x0003fba8 0x0001fba8 ADD_32 21    fstat64
0x0003fbb4 0x0001fbb4 ADD_32 21    readdir64
0x0003fbc0 0x0001fbc0 ADD_32 21    closedir
0x0003fbcc 0x0001fbcc ADD_32 21    sigismember
0x0003fbd8 0x0001fbd8 ADD_32 21    isatty
0x0003fbe4 0x0001fbe4 ADD_32 21    strchr
0x0003fbf0 0x0001fbf0 ADD_32 21    tcgetpgrp
0x0003fbfc 0x0001fbfc ADD_32 21    sigemptyset
0x0003fc08 0x0001fc08 ADD_32 21    sigaction
0x0003fc14 0x0001fc14 ADD_32 21    sigaddset
0x0003fc20 0x0001fc20 ADD_32 21    malloc
0x0003fc2c 0x0001fc2c ADD_32 21    acl_trivial
0x0003fc38 0x0001fc38 ADD_32 21    readlink
0x0003fc44 0x0001fc44 ADD_32 21    iswcntrl
0x0003fc50 0x0001fc50 ADD_32 21    memcmp
0x0003fc5c 0x0001fc5c ADD_32 21    strerror_r
0x0003fc68 0x0001fc68 ADD_32 21    strcat
0x0003fc74 0x0001fc74 ADD_32 21    tolower
0x0003fc80 0x0001fc80 ADD_32 21    wctype
0x0003fc8c 0x0001fc8c ADD_32 21    btowc
0x0003fc98 0x0001fc98 ADD_32 21    iswctype
0x0003fca4 0x0001fca4 ADD_32 21    memchr
0x0003fcb0 0x0001fcb0 ADD_32 21    wcslen
0x0003fcbc 0x0001fcbc ADD_32 21    wmemcpy
0x0003fcc8 0x0001fcc8 ADD_32 21    wcscat
0x0003fcd4 0x0001fcd4 ADD_32 21    towlower
0x0003fce0 0x0001fce0 ADD_32 21    wmemchr
0x0003fcec 0x0001fcec ADD_32 21    mbsrtowcs
0x0003fcf8 0x0001fcf8 ADD_32 21    clock_gettime
0x0003fd04 0x0001fd04 ADD_32 21    gettimeofday
0x0003fd10 0x0001fd10 ADD_32 21    strdup
0x0003fd1c 0x0001fd1c ADD_32 21    calloc
0x0003fd28 0x0001fd28 ADD_32 21    _Q_flt
0x0003fd34 0x0001fd34 ADD_32 21    _Q_qtoull
0x0003fd40 0x0001fd40 ADD_32 21    _Q_lltoq
0x0003fd4c 0x0001fd4c ADD_32 21    _Q_add
0x0003fd58 0x0001fd58 ADD_32 21    _Q_fne
0x0003fd64 0x0001fd64 ADD_32 21    localeconv
0x0003fd70 0x0001fd70 ADD_32 21    _Q_div
0x0003fd7c 0x0001fd7c ADD_32 21    _Q_mul
0x0003fd88 0x0001fd88 ADD_32 21    _Q_itoq
0x0003fd94 0x0001fd94 ADD_32 21    _Q_fle
0x0003fda0 0x0001fda0 ADD_32 21    memmove
0x0003fdac 0x0001fdac ADD_32 21    getpwuid
0x0003fdb8 0x0001fdb8 ADD_32 21    getpwnam
0x0003fdc4 0x0001fdc4 ADD_32 21    getgrgid
0x0003fdd0 0x0001fdd0 ADD_32 21    getgrnam
0x0003fddc 0x0001fddc ADD_32 21    iswprint
0x0003fde8 0x0001fde8 ADD_32 21    toupper
0x0003fdf4 0x0001fdf4 ADD_32 21    mbrlen
0x0003fe00 0x0001fe00 ADD_32 21    tzset
0x0003fe0c 0x0001fe0c ADD_32 21    strftime
0x0003fe18 0x0001fe18 ADD_32 21    .div
0x0003fe24 0x0001fe24 ADD_32 21    .rem
0x0003fe30 0x0001fe30 ADD_32 21    gmtime_r
0x0003fe3c 0x0001fe3c ADD_32 21    localtime_r
0x0003fe48 0x0001fe48 ADD_32 21    realloc
0x0003fe54 0x0001fe54 ADD_32 21    strtoul
0x0003fe60 0x0001fe60 ADD_32 21    strtoumax
0x0003fe6c 0x0001fe6c ADD_32 21    __fpending
0x0003fe78 0x0001fe78 ADD_32 21    fclose
0x0003fe84 0x0001fe84 ADD_32 21    _Q_fgt
0x0003fe90 0x0001fe90 ADD_32 21    _Q_qtoi
0x0003fe9c 0x0001fe9c ADD_32 21    _Q_sub
0x0003fea8 0x0001fea8 ADD_32 21    _Q_fge
0x0003feb4 0x0001feb4 ADD_32 21    _Q_feq
0x0003fec0 0x0001fec0 ADD_32 21    snprintf
0x0003fecc 0x0001fecc ADD_32 21    frexp
0x0003fed8 0x0001fed8 ADD_32 21    ldexp
0x00040578 0x00040578 ADD_32 19    __iob
0x000406b8 0x000406b8 ADD_32 19    errno
0x000406c0 0x000406c0 ADD_32 19    __ctype
0x000408d8 0x000408d8 ADD_32 19    tzname
0x000408e8 0x000408e8 ADD_32 19    _environ
;-- section..plt:
;-- _PROCEDURE_LINKAGE_TABLE_:
0x0003f95c      unimp 0                                                ; [17] -rwx section size 1420 named .plt
0x0003f960      unimp 0
0x0003f964      unimp 0
0x0003f968      unimp 0
0x0003f96c      unimp 0
0x0003f970      unimp 0
0x0003f974      unimp 0
0x0003f978      unimp 0
0x0003f97c      unimp 0
0x0003f980      unimp 0
0x0003f984      unimp 0
0x0003f988      unimp 0
;-- reloc.atexit:
;-- atexit:
0x0003f98c      sethi 0x30, g1                                         ; RELOC 32 atexit
0x0003f990      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f994      nop
;-- reloc.exit:
;-- exit:
0x0003f998      sethi 0x3c, g1                                         ; RELOC 32 exit
0x0003f99c      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9a0      nop
;-- reloc._exit:
;-- _exit:
0x0003f9a4      sethi 0x48, g1                                         ; RELOC 32 _exit
0x0003f9a8      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9ac      nop
;-- reloc.__deregister_frame_info:
0x0003f9b0      sethi 0x54, g1                                         ; RELOC 32 __deregister_frame_info
0x0003f9b4      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9b8      nop
;-- reloc.__register_frame_info:
0x0003f9bc      sethi 0x60, g1                                         ; RELOC 32 __register_frame_info
0x0003f9c0      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9c4      nop
;-- reloc._Jv_RegisterClasses:
0x0003f9c8      sethi 0x6c, g1                                         ; RELOC 32 _Jv_RegisterClasses
0x0003f9cc      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9d0      nop
;-- reloc.fputs:
;-- fputs:
0x0003f9d4      sethi 0x78, g1                                         ; RELOC 32 fputs
0x0003f9d8      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9dc      nop
;-- reloc.printf:
;-- printf:
0x0003f9e0      sethi 0x84, g1                                         ; RELOC 32 printf
0x0003f9e4      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9e8      nop
;-- reloc.__flsbuf:
;-- __flsbuf:
0x0003f9ec      sethi 0x90, g1                                         ; RELOC 32 __flsbuf
0x0003f9f0      ba,a obj._PROCEDURE_LINKAGE_TABLE_
0x0003f9f4      nop
;-- reloc.free:
;-- free:
0x0003f9f8      sethi 0x9c, g1                                         ; RELOC 32 free
EOF
RUN

NAME=sparc linux relocs
FILE=bins/elf/elf-Linux-SparcV8-bash
CMDS=<<EOF
ir
s section..plt
e asm.lines=false
e asm.bytes=false
pd 40
EOF
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x000ec004 0x000cc004 ADD_32 20    __gmon_start__
0x000ec044 0x000cc044 ADD_32 21    fileno
0x000ec050 0x000cc050 ADD_32 21    fputs
0x000ec05c 0x000cc05c ADD_32 21    abort
0x000ec068 0x000cc068 ADD_32 21    __errno_location
0x000ec074 0x000cc074 ADD_32 21    endservent
0x000ec080 0x000cc080 ADD_32 21    sigemptyset
0x000ec08c 0x000cc08c ADD_32 21    connect
0x000ec098 0x000cc098 ADD_32 21    getpid
0x000ec0a4 0x000cc0a4 ADD_32 21    getdtablesize
0x000ec0b0 0x000cc0b0 ADD_32 21    dcngettext
0x000ec0bc 0x000cc0bc ADD_32 21    strerror
0x000ec0c8 0x000cc0c8 ADD_32 21    regfree
0x000ec0d4 0x000cc0d4 ADD_32 21    setrlimit64
0x000ec0e0 0x000cc0e0 ADD_32 21    strcoll
0x000ec0ec 0x000cc0ec ADD_32 21    sysconf
0x000ec0f8 0x000cc0f8 ADD_32 21    memcmp
0x000ec104 0x000cc104 ADD_32 21    qsort
0x000ec110 0x000cc110 ADD_32 21    freeaddrinfo
0x000ec11c 0x000cc11c ADD_32 21    __strncpy_chk
0x000ec128 0x000cc128 ADD_32 21    __longjmp_chk
0x000ec134 0x000cc134 ADD_32 21    open64
0x000ec140 0x000cc140 ADD_32 21    tgetflag
0x000ec14c 0x000cc14c ADD_32 21    __ctype_get_mb_cur_max
0x000ec158 0x000cc158 ADD_32 21    __gmon_start__
0x000ec164 0x000cc164 ADD_32 21    realloc
0x000ec170 0x000cc170 ADD_32 21    wcscoll
0x000ec17c 0x000cc17c ADD_32 21    __xstat64
0x000ec188 0x000cc188 ADD_32 21    localtime
0x000ec194 0x000cc194 ADD_32 21    setservent
0x000ec1a0 0x000cc1a0 ADD_32 21    strchr
0x000ec1ac 0x000cc1ac ADD_32 21    __printf_chk
0x000ec1b8 0x000cc1b8 ADD_32 21    strncpy
0x000ec1c4 0x000cc1c4 ADD_32 21    wcslen
0x000ec1d0 0x000cc1d0 ADD_32 21    ttyname
0x000ec1dc 0x000cc1dc ADD_32 21    write
0x000ec1e8 0x000cc1e8 ADD_32 21    tzset
0x000ec1f4 0x000cc1f4 ADD_32 21    mbsrtowcs
0x000ec200 0x000cc200 ADD_32 21    dlclose
0x000ec20c 0x000cc20c ADD_32 21    fgets
0x000ec218 0x000cc218 ADD_32 21    regexec
0x000ec224 0x000cc224 ADD_32 21    wcschr
0x000ec230 0x000cc230 ADD_32 21    memset
0x000ec23c 0x000cc23c ADD_32 21    setitimer
0x000ec248 0x000cc248 ADD_32 21    fopen64
0x000ec254 0x000cc254 ADD_32 21    __libc_start_main
0x000ec260 0x000cc260 ADD_32 21    __memcpy_chk
0x000ec26c 0x000cc26c ADD_32 21    strrchr
0x000ec278 0x000cc278 ADD_32 21    tcgetattr
0x000ec284 0x000cc284 ADD_32 21    bindtextdomain
0x000ec290 0x000cc290 ADD_32 21    mbrtowc
0x000ec29c 0x000cc29c ADD_32 21    read
0x000ec2a8 0x000cc2a8 ADD_32 21    __strcat_chk
0x000ec2b4 0x000cc2b4 ADD_32 21    getrusage
0x000ec2c0 0x000cc2c0 ADD_32 21    gettimeofday
0x000ec2cc 0x000cc2cc ADD_32 21    strtol
0x000ec2d8 0x000cc2d8 ADD_32 21    fdopen
0x000ec2e4 0x000cc2e4 ADD_32 21    tcsetpgrp
0x000ec2f0 0x000cc2f0 ADD_32 21    __ctype_toupper_loc
0x000ec2fc 0x000cc2fc ADD_32 21    free
0x000ec308 0x000cc308 ADD_32 21    __lxstat64
0x000ec314 0x000cc314 ADD_32 21    __strtoll_internal
0x000ec320 0x000cc320 ADD_32 21    setpgid
0x000ec32c 0x000cc32c ADD_32 21    dcgettext
0x000ec338 0x000cc338 ADD_32 21    access
0x000ec344 0x000cc344 ADD_32 21    dlsym
0x000ec350 0x000cc350 ADD_32 21    _Q_lltoq
0x000ec35c 0x000cc35c ADD_32 21    tgetent
0x000ec368 0x000cc368 ADD_32 21    sigaction
0x000ec374 0x000cc374 ADD_32 21    sbrk
0x000ec380 0x000cc380 ADD_32 21    fflush
0x000ec38c 0x000cc38c ADD_32 21    regcomp
0x000ec398 0x000cc398 ADD_32 21    opendir
0x000ec3a4 0x000cc3a4 ADD_32 21    wctype
0x000ec3b0 0x000cc3b0 ADD_32 21    ioctl
0x000ec3bc 0x000cc3bc ADD_32 21    wcrtomb
0x000ec3c8 0x000cc3c8 ADD_32 21    iswlower
0x000ec3d4 0x000cc3d4 ADD_32 21    socket
0x000ec3e0 0x000cc3e0 ADD_32 21    dup2
0x000ec3ec 0x000cc3ec ADD_32 21    __ctype_b_loc
0x000ec3f8 0x000cc3f8 ADD_32 21    wctob
0x000ec404 0x000cc404 ADD_32 21    isatty
0x000ec410 0x000cc410 ADD_32 21    strsignal
0x000ec41c 0x000cc41c ADD_32 21    getaddrinfo
0x000ec428 0x000cc428 ADD_32 21    umask
0x000ec434 0x000cc434 ADD_32 21    fclose
0x000ec440 0x000cc440 ADD_32 21    mbstowcs
0x000ec44c 0x000cc44c ADD_32 21    setuid
0x000ec458 0x000cc458 ADD_32 21    mbsinit
0x000ec464 0x000cc464 ADD_32 21    dup
0x000ec470 0x000cc470 ADD_32 21    tcgetpgrp
0x000ec47c 0x000cc47c ADD_32 21    getservent
0x000ec488 0x000cc488 ADD_32 21    readdir64
0x000ec494 0x000cc494 ADD_32 21    memcpy
0x000ec4a0 0x000cc4a0 ADD_32 21    strtoul
0x000ec4ac 0x000cc4ac ADD_32 21    strlen
0x000ec4b8 0x000cc4b8 ADD_32 21    setgrent
0x000ec4c4 0x000cc4c4 ADD_32 21    alarm
0x000ec4d0 0x000cc4d0 ADD_32 21    unlink
0x000ec4dc 0x000cc4dc ADD_32 21    getpwuid
0x000ec4e8 0x000cc4e8 ADD_32 21    gai_strerror
0x000ec4f4 0x000cc4f4 ADD_32 21    getppid
0x000ec500 0x000cc500 ADD_32 21    setlocale
0x000ec50c 0x000cc50c ADD_32 21    waitpid
0x000ec518 0x000cc518 ADD_32 21    clearerr
0x000ec524 0x000cc524 ADD_32 21    sigdelset
0x000ec530 0x000cc530 ADD_32 21    strcpy
0x000ec53c 0x000cc53c ADD_32 21    getegid
0x000ec548 0x000cc548 ADD_32 21    dlopen
0x000ec554 0x000cc554 ADD_32 21    wcsrtombs
0x000ec560 0x000cc560 ADD_32 21    __vsnprintf_chk
0x000ec56c 0x000cc56c ADD_32 21    killpg
0x000ec578 0x000cc578 ADD_32 21    __vfprintf_chk
0x000ec584 0x000cc584 ADD_32 21    chdir
0x000ec590 0x000cc590 ADD_32 21    tputs
0x000ec59c 0x000cc59c ADD_32 21    getuid
0x000ec5a8 0x000cc5a8 ADD_32 21    asprintf
0x000ec5b4 0x000cc5b4 ADD_32 21    mblen
0x000ec5c0 0x000cc5c0 ADD_32 21    getrlimit64
0x000ec5cc 0x000cc5cc ADD_32 21    __strcpy_chk
0x000ec5d8 0x000cc5d8 ADD_32 21    __snprintf_chk
0x000ec5e4 0x000cc5e4 ADD_32 21    strcasecmp
0x000ec5f0 0x000cc5f0 ADD_32 21    getgrent
0x000ec5fc 0x000cc5fc ADD_32 21    select
0x000ec608 0x000cc608 ADD_32 21    closedir
0x000ec614 0x000cc614 ADD_32 21    close
0x000ec620 0x000cc620 ADD_32 21    fwrite
0x000ec62c 0x000cc62c ADD_32 21    eaccess
0x000ec638 0x000cc638 ADD_32 21    strstr
0x000ec644 0x000cc644 ADD_32 21    time
0x000ec650 0x000cc650 ADD_32 21    setvbuf
0x000ec65c 0x000cc65c ADD_32 21    execve
0x000ec668 0x000cc668 ADD_32 21    malloc
0x000ec674 0x000cc674 ADD_32 21    wcscmp
0x000ec680 0x000cc680 ADD_32 21    iswalnum
0x000ec68c 0x000cc68c ADD_32 21    sigprocmask
0x000ec698 0x000cc698 ADD_32 21    setpwent
0x000ec6a4 0x000cc6a4 ADD_32 21    __stack_chk_fail
0x000ec6b0 0x000cc6b0 ADD_32 21    gethostname
0x000ec6bc 0x000cc6bc ADD_32 21    __fprintf_chk
0x000ec6c8 0x000cc6c8 ADD_32 21    fputc
0x000ec6d4 0x000cc6d4 ADD_32 21    dlerror
0x000ec6e0 0x000cc6e0 ADD_32 21    pathconf
0x000ec6ec 0x000cc6ec ADD_32 21    strtold
0x000ec6f8 0x000cc6f8 ADD_32 21    strnlen
0x000ec704 0x000cc704 ADD_32 21    tgoto
0x000ec710 0x000cc710 ADD_32 21    strcasestr
0x000ec71c 0x000cc71c ADD_32 21    sleep
0x000ec728 0x000cc728 ADD_32 21    __strtoull_internal
0x000ec734 0x000cc734 ADD_32 21    sigaddset
0x000ec740 0x000cc740 ADD_32 21    tgetnum
0x000ec74c 0x000cc74c ADD_32 21    readlink
0x000ec758 0x000cc758 ADD_32 21    strncasecmp
0x000ec764 0x000cc764 ADD_32 21    memmove
0x000ec770 0x000cc770 ADD_32 21    __ctype_tolower_loc
0x000ec77c 0x000cc77c ADD_32 21    strcat
0x000ec788 0x000cc788 ADD_32 21    towlower
0x000ec794 0x000cc794 ADD_32 21    getcwd
0x000ec7a0 0x000cc7a0 ADD_32 21    puts
0x000ec7ac 0x000cc7ac ADD_32 21    iswctype
0x000ec7b8 0x000cc7b8 ADD_32 21    fork
0x000ec7c4 0x000cc7c4 ADD_32 21    textdomain
0x000ec7d0 0x000cc7d0 ADD_32 21    __fxstat64
0x000ec7dc 0x000cc7dc ADD_32 21    mbtowc
0x000ec7e8 0x000cc7e8 ADD_32 21    tcsetattr
0x000ec7f4 0x000cc7f4 ADD_32 21    fcntl
0x000ec800 0x000cc800 ADD_32 21    endpwent
0x000ec80c 0x000cc80c ADD_32 21    wcsdup
0x000ec818 0x000cc818 ADD_32 21    getgroups
0x000ec824 0x000cc824 ADD_32 21    strncmp
0x000ec830 0x000cc830 ADD_32 21    _IO_putc
0x000ec83c 0x000cc83c ADD_32 21    strpbrk
0x000ec848 0x000cc848 ADD_32 21    pipe
0x000ec854 0x000cc854 ADD_32 21    strftime
0x000ec860 0x000cc860 ADD_32 21    __sprintf_chk
0x000ec86c 0x000cc86c ADD_32 21    iswupper
0x000ec878 0x000cc878 ADD_32 21    setgid
0x000ec884 0x000cc884 ADD_32 21    tgetstr
0x000ec890 0x000cc890 ADD_32 21    kill
0x000ec89c 0x000cc89c ADD_32 21    wcwidth
0x000ec8a8 0x000cc8a8 ADD_32 21    __memmove_chk
0x000ec8b4 0x000cc8b4 ADD_32 21    __mbrlen
0x000ec8c0 0x000cc8c0 ADD_32 21    getpwent
0x000ec8cc 0x000cc8cc ADD_32 21    getpeername
0x000ec8d8 0x000cc8d8 ADD_32 21    ferror
0x000ec8e4 0x000cc8e4 ADD_32 21    getpwnam
0x000ec8f0 0x000cc8f0 ADD_32 21    lseek64
0x000ec8fc 0x000cc8fc ADD_32 21    strcmp
0x000ec908 0x000cc908 ADD_32 21    confstr
0x000ec914 0x000cc914 ADD_32 21    __sigsetjmp
0x000ec920 0x000cc920 ADD_32 21    towupper
0x000ec92c 0x000cc92c ADD_32 21    exit
0x000ec938 0x000cc938 ADD_32 21    endgrent
0x000ec944 0x000cc944 ADD_32 21    __fpurge
0x000ec950 0x000cc950 ADD_32 21    getpgrp
0x000ec95c 0x000cc95c ADD_32 21    getgid
0x000ec968 0x000cc968 ADD_32 21    _init
0x000ec974 0x000cc974 ADD_32 21    wcsncmp
0x000ec980 0x000cc980 ADD_32 21    geteuid
0x000f0c58 0x000f0c58 ADD_32 19    PC
0x000f0c5c 0x000f0c5c ADD_32 19    UP
0x000f0c60 0x000f0c60 ADD_32 19    stderr
0x000f0c68 0x000f0c68 ADD_32 19    __environ
0x000f0c70 0x000f0c70 ADD_32 19    stdin
0x000f0c74 0x000f0c74 ADD_32 19    BC
0x000f0c78 0x000f0c78 ADD_32 19    stdout
;-- section..plt:
0x000ec014      unimp 0                                                ; [23] -rwx section size 2428 named .plt
0x000ec018      unimp 0
0x000ec01c      unimp 0
0x000ec020      unimp 0
0x000ec024      unimp 0
0x000ec028      unimp 0
0x000ec02c      unimp 0
0x000ec030      unimp 0
0x000ec034      unimp 0
0x000ec038      unimp 0
0x000ec03c      unimp 0
0x000ec040      unimp 0
;-- reloc.fileno:
;-- fileno:
0x000ec044      sethi 0x30, g1                                         ; RELOC 32 fileno
0x000ec048      ba,a section..plt
0x000ec04c      nop
;-- reloc.fputs:
;-- fputs:
0x000ec050      sethi 0x3c, g1                                         ; RELOC 32 fputs
0x000ec054      ba,a section..plt
0x000ec058      nop
;-- reloc.abort:
;-- abort:
0x000ec05c      sethi 0x48, g1                                         ; RELOC 32 abort
0x000ec060      ba,a section..plt
0x000ec064      nop
;-- reloc.__errno_location:
;-- __errno_location:
0x000ec068      sethi 0x54, g1                                         ; RELOC 32 __errno_location
0x000ec06c      ba,a section..plt
0x000ec070      nop
;-- reloc.endservent:
;-- endservent:
0x000ec074      sethi 0x60, g1                                         ; RELOC 32 endservent
0x000ec078      ba,a section..plt
0x000ec07c      nop
;-- reloc.sigemptyset:
;-- sigemptyset:
0x000ec080      sethi 0x6c, g1                                         ; RELOC 32 sigemptyset
0x000ec084      ba,a section..plt
0x000ec088      nop
;-- reloc.connect:
;-- connect:
0x000ec08c      sethi 0x78, g1                                         ; RELOC 32 connect
0x000ec090      ba,a section..plt
0x000ec094      nop
;-- reloc.getpid:
;-- getpid:
0x000ec098      sethi 0x84, g1                                         ; RELOC 32 getpid
0x000ec09c      ba,a section..plt
0x000ec0a0      nop
;-- reloc.getdtablesize:
;-- getdtablesize:
0x000ec0a4      sethi 0x90, g1                                         ; RELOC 32 getdtablesize
0x000ec0a8      ba,a section..plt
0x000ec0ac      nop
;-- reloc.dcngettext:
;-- dcngettext:
0x000ec0b0      sethi 0x9c, g1                                         ; RELOC 32 dcngettext
EOF
RUN

# merged: ELF: call graph names an import called through its GOT slot under bin.relocs.apply
NAME=ELF: relocs.apply keeps symbol-less relocs at their site
FILE=bins/elf/ls
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~ADD_64:0..2
?e --
af @ entry0
agcj~{[0].imports}
EOF
EXPECT=<<EOF
0x00021050 0x00020050 ADD_64 8      0x00005bd0
0x00021058 0x00020058 ADD_64 8      0x00005b80
--
["reloc.__libc_start_main"]
EOF
RUN

NAME=ELF: relr reloc type follows the machine
FILE=malloc://0x81000
CMDS=<<EOF
wff bins/elf/ls-toybox
oba 0
ir~0x00078030
wx 2800 @ 0x12
oba 0
ir~0x00078030
wx 1500 @ 0x12
oba 0
ir~0x00078030
EOF
EXPECT=<<EOF
0x00078030 0x00078030 SET_64 1027
0x00078030 0x00078030 SET_32 23
0x00078030 0x00078030 SET_64 22
EOF
RUN

NAME=ELF: import GOT site keeps its reloc flag under bin.relocs.apply
FILE=bins/elf/analysis/ls-linux64
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~_ITM_deregisterTMCloneTable
fd @ 0x21cf88
pi 1 @ 0x5c6b
EOF
EXPECT=<<EOF
0x0021cf88 0x0001cf88 SET_64 6     _ITM_deregisterTMCloneTable
reloc._ITM_deregisterTMCloneTable
mov rax, qword [reloc._ITM_deregisterTMCloneTable]
EOF
RUN

NAME=ELF: patched ET_REL branch keeps naming its got.r2 target
FILE=bins/elf/random_39855/random_39855.oo
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pi 1 @ 0x0800007c
ir~strcmp[0]
EOF
EXPECT=<<EOF
bl reloc.strcmp
0x08012678
EOF
RUN

NAME=ELF: i386 GOT sites resolve under bin.relocs.apply
FILE=bins/elf/libtest_32.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~printf
pxw 4 @ 0x200c
pxw 4 @ 0x1fec
EOF
EXPECT=<<EOF
0x0000200c 0x0000100c SET_32 7     printf
0x0000200c  0x00002018                                   . ..
0x00001fec  0x00002028                                   ( ..
EOF
RUN

NAME=ELF: i386 glob_dat resolves under bin.relocs.apply (fcn_in_test)
FILE=bins/elf/fcn_in_test.elf
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~__libc_start_main
pxw 4 @ 0x400c
pxw 4 @ 0x3ff4
EOF
EXPECT=<<EOF
0x0000400c 0x0000300c SET_32 7     __libc_start_main
0x0000400c  0x0000401c                                   .@..
0x00003ff4  0x00004038                                   8@..
EOF
RUN

NAME=ELF: i386 full-relro slot resolves under bin.relocs.apply
FILE=bins/elf/hello_world32
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~free
pxw 4 @ 0x1fd0
pxw 4 @ 0x1fe8
EOF
EXPECT=<<EOF
0x00001fd0 0x00000fd0 SET_32 7     free
0x00001fd0  0x0000200c                                   . ..
0x00001fe8  0x00002024                                   $ ..
EOF
RUN

NAME=ELF: i386 relative reloc keeps the link base out
FILE=bins/elf/i386-base10000-rel.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pxw 4 @ 0x132c0
pxw 4 @ 0x122b8
pxw 4 @ 0x132d0
EOF
EXPECT=<<EOF
0x000132c0  0x00011216                                   ....
0x000122b8  0x000132bc                                   .2..
0x000132d0  0x000132d4                                   .2..
EOF
RUN

NAME=ELF: i386 rela relative materializes the addend
FILE=bins/elf/i386-base10000-rela.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pxw 4 @ 0x132d0
pxw 4 @ 0x122c8
EOF
EXPECT=<<EOF
0x000132d0  0x00011222                                   "...
0x000122c8  0x000132cc                                   .2..
EOF
RUN

NAME=ELF: x86-64 relative reloc keeps the link base out
FILE=bins/elf/x86_64-relative-linkbase.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x43390
pv8 @ 0x43398
pv8 @ 0x433a0
ir~ADD_64
EOF
EXPECT=<<EOF
0x00000000000412c8
0x0000000000043398
0x0000000000001234
0x00043390 0x00000390 ADD_64 8      0x000412c8
0x00043398 0x00000398 ADD_64 8      0x00043398
EOF
RUN

NAME=ELF: x86-64 relative reloc moves by the load bias under -B
FILE=bins/elf/x86_64-relative-linkbase.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x103390
pv8 @ 0x103398
EOF
EXPECT=<<EOF
0x00000000001012c8
0x0000000000103398
EOF
RUN

NAME=ELF: aarch64 relative reloc keeps the link base out
FILE=bins/elf/aarch64-relative-linkbase.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x70390
pv8 @ 0x70398
pv8 @ 0x703a0
ir~ADD_64
EOF
EXPECT=<<EOF
0x00000000000502c8
0x0000000000070398
0x0000000000001234
0x00070390 0x00000390 ADD_64 1027   0x000502c8
0x00070398 0x00000398 ADD_64 1027   0x00070398
EOF
RUN

NAME=ELF: aarch64 relative reloc moves by the load bias under -B
FILE=bins/elf/aarch64-relative-linkbase.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x130390
pv8 @ 0x130398
EOF
EXPECT=<<EOF
0x00000000001102c8
0x0000000000130398
EOF
RUN

NAME=ELF: ppc64 relative reloc keeps the link base out
FILE=bins/elf/ppc64-relative-linkbase.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x703a0
pv8 @ 0x703a8
pv8 @ 0x703b0
ir~ADD_64
EOF
EXPECT=<<EOF
0x00000000000502c8
0x00000000000703a8
0x0000000000001234
0x000703a0 0x000003a0 ADD_64 22     0x000502c8
0x000703a8 0x000003a8 ADD_64 22     0x000703a8
EOF
RUN

NAME=ELF: ppc64 relative reloc moves by the load bias under -B
FILE=bins/elf/ppc64-relative-linkbase.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x1303a0
pv8 @ 0x1303a8
EOF
EXPECT=<<EOF
0x00000000001102c8
0x00000000001303a8
EOF
RUN

NAME=ELF: arm rel relative reloc keeps the link base out
FILE=bins/elf/arm-relative-linkbase.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
pv4 @ 0x70220
pv4 @ 0x70224
pv4 @ 0x70228
EOF
EXPECT=<<EOF
0x000501bc
0x00070224
0x00001234
EOF
RUN

NAME=ELF: arm rel relative reloc moves by the load bias under -B
FILE=bins/elf/arm-relative-linkbase.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv4 @ 0x130220
pv4 @ 0x130224
EOF
EXPECT=<<EOF
0x001101bc
0x00130224
EOF
RUN

NAME=ELF: arm rel relative reloc listing is unchanged
FILE=bins/elf/arm-relative-linkbase.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~SET_32
EOF
EXPECT=<<EOF
0x00070220 0x00000220 SET_32 23     0x00040000
0x00070224 0x00000224 SET_32 23     0x00040000
EOF
RUN

NAME=ELF: i386 relative reloc lists its addend
FILE=bins/elf/i386-base10000-rela.so
CMDS=<<EOF
ir~ADD_32
EOF
EXPECT=<<EOF
0x000132d0 0x000002d0 ADD_32 8      0x00011222
EOF
RUN

NAME=ELF: i386 relative reloc moves by the load bias under -B
FILE=bins/elf/i386-base10000-rela.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv4 @ 0x1032d0
EOF
EXPECT=<<EOF
0x00101222
EOF
RUN

NAME=ELF: i386 rel relative reloc moves by the load bias under -B
FILE=bins/elf/i386-base10000-rel.so
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv4 @ 0x1032c0
EOF
EXPECT=<<EOF
0x00101216
EOF
RUN

NAME=ELF: i386 rel relative reloc listing is unchanged
FILE=bins/elf/i386-base10000-rel.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~0x000132c0
EOF
EXPECT=<<EOF
0x000132c0 0x000002c0 SET_32 8      0x00010000
EOF
RUN

NAME=ELF: x86-64 relative reloc in a base-0 PIE is rebased once under -B
FILE=bins/elf/varsub_2
ARGS=-B 0x100000 -e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x300df0
pv8 @ 0x301020
EOF
EXPECT=<<EOF
0x0000000000100610
0x0000000000301020
EOF
RUN

NAME=ELF: relative reloc lists an addend wider than 32 bits
# synthetic ET_DYN linked at 0x400000, one R_X86_64_RELATIVE, addend 0x100003368
FILE=malloc://512
CMDS=<<EOF
wx 7f454c4602010100000000000000000003003e00010000000000000000000000400000000000000000000000000000000000000040003800020040000000000001000000050000000000000000000000000040000000000000004000000000000801000000000000080100000000000000100000000000000200000006000000b000000000000000b000400000000000b0004000000000004000000000000000400000000000000008000000000000000700000000000000f000400000000000080000000000000018000000000000000900000000000000180000000000000000000000000000000000000000000000000140000000000008000000000000006833000001000000
oba
ir~ADD_64
EOF
EXPECT=<<EOF
0x00000100 0x00000100 ADD_64 8      0x100003368
EOF
RUN

NAME=ELF: x86-64 GOT slot keeps the high half of a base above 4gb
FILE=bins/elf/ls
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
pv8 @ 0x100021c78
EOF
EXPECT=<<EOF
0x0000000100023b68
EOF
RUN

NAME=ELF: x86-64 GOT slot write stays inside the slot at base 0
FILE=bins/elf/ls
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
p8 8 @ 0x21c78
EOF
EXPECT=<<EOF
683b020000000000
EOF
RUN

NAME=ELF: ppc64 slot is patched at the mapped address under a custom base
FILE=bins/elf/ppc64v1-libz.so
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
?v [0x100030048]
EOF
EXPECT=<<EOF
0x1000194dc
EOF
RUN

NAME=ELF: ppc64 nobits plt slot is patched under a custom base
FILE=bins/elf/ppc64v1-stub-eagerend.so
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
?v [0x100002018]
EOF
EXPECT=<<EOF
0x10000034c
EOF
RUN

# merged: ELF: ET_REL import slots sit below the .bss flag under a custom base
NAME=ELF: import at a code site keeps its got.r2 slot under a custom base
FILE=bins/elf/test.ko
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
ir~__fentry__
?e --
om~.got.r2[4,6]
f~section..bss
EOF
EXPECT=<<EOF
0x100000b0f 0x0000007d ADD_32 4     __fentry__ - 0x08000081
--
0x100000b0f 0x100000b5e
0x100001050 0 section..bss
EOF
RUN

NAME=ELF: a reloc into an unrebased map is patched where it already is
FILE=bins/elf/cfile_o
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
ompg+r
p8 8 @ 0x08004099
EOF
EXPECT=<<EOF
4d3d01084147aa01
EOF
RUN

NAME=ELF: ppc64 toc window follows its section under a custom base
FILE=bins/elf/ppc64v1-crc32_generic.ko
ARGS=-B 0x10000000 -e bin.relocs.apply=true
CMDS=<<EOF
p8 8 @ 0x1000036c
EOF
EXPECT=<<EOF
3d220000e8698000
EOF
RUN

NAME=ELF: a tls symbol value is not an address and keeps its offset
FILE=bins/elf/glibc-2.34-39.el9.x86_64_libc.so.6
ARGS=-B 0x10000000 -e bin.relocs.apply=true
CMDS=<<EOF
?v [0x101f9f40]
EOF
EXPECT=<<EOF
0x40
EOF
RUN

NAME=ELF: got.r2 slot address is not shifted twice
FILE=bins/elf/ada_test_dwarf
ARGS=-B 0x50000000 -e bin.relocs.apply=true
CMDS=<<EOF
?v [0x50004ff8]
EOF
EXPECT=<<EOF
0x50007bb0
EOF
RUN

NAME=ELF: aarch64 ET_REL branch relocs are patched under a custom base
FILE=bins/elf/analysis/arm64-relocs
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
p8 4 @ 0x100000044
p8 8 @ 0x10000004c
EOF
EXPECT=<<EOF
06000094
8000183660000054
EOF
RUN

NAME=ELF: aarch64 ET_REL adrp/add pair is patched under a custom base
FILE=bins/elf/random_39855/random_39855.oo
ARGS=-B 0x100000000 -e bin.relocs.apply=true
CMDS=<<EOF
p8 8 @ 0x100000074
EOF
EXPECT=<<EOF
210000b021701f91
EOF
RUN

NAME=ELF: overlapping PT_LOADs patch each reloc in its own segment
FILE=bins/elf/x86-64-ovl-ptload.so
ARGS=-B 0x40000000 -e bin.relocs.apply=true
CMDS=<<EOF
p8 8 @ 0x40005800
p8 8 @ 0x40000900
EOF
EXPECT=<<EOF
0051004000000000
0001004000000000
EOF
RUN

NAME=ELF: ET_REL NOBITS section is laid out past the file image, not over the next section
FILE=bins/elf/random_39855/random_39855.oo
CMDS=<<EOF
iS~NOBITS
iS~PROGBITS .rodata$
is~crc32_tab
EOF
EXPECT=<<EOF
6   0x00012af8     0x0 0x08012af8   0x400 -rw- 0x3   NOBITS   .bss
7   0x000057f8   0x168 0x080057f8   0x168 -r-- 0x2   PROGBITS .rodata
9   0x00012af8 0x08012af8 LOCAL  OBJ    1024     crc32_tab
EOF
RUN

NAME=ELF: ET_REL adrp/add to a .bss symbol lands in the bss map under a custom base
FILE=bins/elf/random_39855/random_39855.oo
ARGS=-B 0x1000 -e bin.relocs.apply=true
CMDS=<<EOF
pd 2 @ 0x1168
om~mmap..bss[4,6]
EOF
EXPECT=<<EOF
            0x00001168      890000d0       adrp x9, 0x13000
            0x0000116c      29e12b91       add x9, x9, 0xaf8
0x00013af8 0x00013ef7
EOF
RUN

NAME=ELF: ET_REL import slots stay below the NOBITS block
FILE=bins/elf/radare2.c.obj
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
om~.got.r2[4,6]
iS~NOBITS
is~rabin_cmd
EOF
EXPECT=<<EOF
0x080384db 0x08040e2a
4   0x00040e40      0x0 0x08040e40  0x618a0 -rw- 0x3   NOBITS   .bss
8   0x00040e40 0x08040e40 LOCAL  OBJ    8          rabin_cmd
EOF
RUN

NAME=ELF: x86-64 ET_REL ir* prints each of many shared import slots once
FILE=bins/elf/radare2.c.obj
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir*~reloc.?
ir*~r_list_free?
ir~r_list_free?
EOF
EXPECT=<<EOF
3905
1
78
EOF
RUN

NAME=ELF: ELF32 ET_REL NOBITS section is laid out past the import slots
FILE=bins/elf/pngrutil_o
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
iS~NOBITS
iS~PROGBITS .rodata$
om~.got.r2[4,6]
EOF
EXPECT=<<EOF
4   0x00009a83     0x0 0x08009a83     0x0 -rw- 0x3   NOBITS   .bss
5   0x000055c8   0xe64 0x080055c8   0xe64 -r-- 0x2   PROGBITS .rodata
0x08008703 0x080090be
EOF
RUN

NAME=ELF: JMPREL aliased over RELA reads each entry once
FILE=bins/elf/pltrel/ppc32be.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir
om~.got.r2
EOF
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x00002000 0x00001000 ADD_32 21    mul2
0x00002004 0x00001004 ADD_32 21    sub2
0x00002008 0x00001008 ADD_32 21    add2
- 3 fd: 4 +0x00000000 0x0000200c - 0x00002017 rw- rw- .got.r2
EOF
RUN

NAME=ELF: JMPREL nested in RELA keeps the entries outside the plt range
FILE=bins/elf/pltrel/ppc32be-align-tls.so
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir
om~.got.r2
EOF
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x00001fec 0x00000fec ADD_32 68
0x00002000 0x00001000 ADD_32 21    mul2
0x00002004 0x00001004 ADD_32 21    sub2
0x00002008 0x00001008 ADD_32 21    __tls_get_addr_opt
0x0000200c 0x0000100c ADD_32 21    add2
- 3 fd: 4 +0x00000000 0x00002010 - 0x00002023 rw- rw- .got.r2
EOF
RUN

NAME=ELF: x86-64 DTPMOD64 relocs are listed and take no got.r2 slot
FILE=bins/elf/libstdc++.so.6
ARGS=-e bin.relocs.apply=true
CMDS=<<EOF
ir~ADD_64 16
pv8 @ 0x1885a8
EOF
EXPECT=<<EOF
0x00188588 0x00187588 ADD_64 16
0x00188be0 0x00187be0 ADD_64 16    std::__once_callable
0x00189bb8 0x00188bb8 ADD_64 16    std::__once_call
0x000000000018fe30
EOF
RUN

NAME=ELF: a ppc32 DTPMOD32 in an executable .got keeps its own address
FILE=bins/elf/tls/ppc32-bssplt-tls.so
ARGS=-e bin.relocs.apply=true
CMDS=ir~ADD_
EXPECT=<<EOF
0x000011fc 0x000001fc ADD_32 68    tv
0x00001214 0x00000170 ADD_24 10    __tls_get_addr - 0x00000170
0x00001218 0x00000174 ADD_24 10    puts - 0x00000174
EOF
RUN

NAME=ELF: applied relocs match the unapplied ones
FILE=bins/elf/rv64/ls
ARGS=-e bin.relocs.apply=true
CMDS=ir~ADD_64?
EXPECT=<<EOF
349
EOF
RUN

NAME=ELF: unapplied relocs match the applied ones
FILE=bins/elf/rv64/ls
ARGS=-e bin.relocs.apply=false
CMDS=ir~ADD_64?
EXPECT=<<EOF
349
EOF
RUN

NAME=ELF: .rela.plt reached only through the section pass keys imports by own symbol
FILE=bins/fuzzed/elf8
CMDS=<<EOF
ii~raise,strncmp,sigemptyset,wcwidth,__fprintf_chk,__ctype_tolower_loc,_ITM_deregisterTMCloneTable,__gmon_start__,_ITM_registerTMCloneTable
EOF
EXPECT=<<EOF
5   0x004021e0       GLOBAL FUNC       raise
10  0x00402240       GLOBAL FUNC       strncmp
11  ----------       WEAK   NOTYPE     _ITM_deregisterTMCloneTable
65  0x004025a0       GLOBAL FUNC       sigemptyset
66  ----------       WEAK   NOTYPE     __gmon_start__
74  0x00402630       GLOBAL FUNC       wcwidth
104 0x00402810       GLOBAL FUNC       __fprintf_chk
105 ----------       WEAK   NOTYPE     _ITM_registerTMCloneTable
111 0x00402870       GLOBAL FUNC       __ctype_tolower_loc
EOF
RUN

NAME=ELF: a DT_RELASZ past the loaded bytes falls back to the rela header
FILE=bins/fuzzed/elf7
CMDS=ir
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x00619ff8 0x00019ff8 SET_64 6     __gmon_start__
0x0061a600 0x0061a600 ADD_64 5     __progname
0x0061a610 0x0061a610 ADD_64 5     stdout
0x0061a620 0x0061a620 ADD_64 5     opvind
0x0061a640 0x0061a640 ADD_64 5     optarg
0x0061a648 0x0061a648 ADD_64 5     __progname_full
0x0061a650 0x0061a650 ADD_64 5     stderr
EOF
RUN

NAME=ELF: oversized rela.plt header stops at the next section
FILE=bins/fuzzed/elf9
CMDS=<<EOF
ir~?
ir~0xba,0xbe,0xbf
EOF
EXPECT=<<EOF
103
EOF
RUN

NAME=ELF: DT_RELA spanning three rela sections keeps every row
FILE=bins/elf/elf-solaris-sparc-ls
CMDS=<<EOF
ir~?
ir~atexit
ir~_environ
EOF
EXPECT=<<EOF
124
0x0003f98c 0x0001f98c ADD_32 21    atexit
0x000408e8 0x000408e8 ADD_32 19    _environ
EOF
RUN

NAME=ELF: rel.dyn longer than DT_RELSZ keeps its trailing rows
FILE=bins/elf/libc.so.0
CMDS=<<EOF
ir~?
ir~__divdi3
EOF
EXPECT=<<EOF
249
0x0009af8c 0x0005af8c SET_32 3     __divdi3
EOF
RUN

NAME=ELF: zeroed reloc section addresses leave dynamic relocs alone
FILE=bins/elf/libshella-2.10.3.1.so
CMDS=<<EOF
ir~?
ir~0x0000eff4
EOF
EXPECT=<<EOF
61
0x0000eff4 0x0000dff4 SET_32 22
EOF
RUN

NAME=ELF: renamed rela sections keep their relocs
FILE=bins/elf/simple-hello-world-with-wrong-rela-section-name
CMDS=ir
EXPECT=<<EOF
vaddr      paddr      type   ntype name
---------------------------------------
0x00003de8 0x00002de8 ADD_64 8      0x00001130
0x00003df0 0x00002df0 ADD_64 8      0x000010e0
0x00003fd8 0x00002fd8 SET_64 6     _ITM_deregisterTMCloneTable
0x00003fe0 0x00002fe0 SET_64 6     __libc_start_main
0x00003fe8 0x00002fe8 SET_64 6     __gmon_start__
0x00003ff0 0x00002ff0 SET_64 6     _ITM_registerTMCloneTable
0x00003ff8 0x00002ff8 SET_64 6     __cxa_finalize
0x00004018 0x00003018 SET_64 7     printf
0x00004028 0x00003028 ADD_64 8      0x00004028
EOF
RUN

NAME=ELF: reloc tables are bounded by vaddr not by file offset
FILE=bins/elf/switch-hello-world.elf
CMDS=<<EOF
ir~?
ir~0x0003a000
EOF
EXPECT=<<EOF
405
0x0003a000 0x0004a000 ADD_64 1027   0x00000318
0x0003a128 0x0004a128 ADD_64 1027   0x0003a000
0x0003a1c8 0x0004a1c8 ADD_64 1027   0x0003a000
0x0003a220 0x0004a220 ADD_64 1027   0x0003a000
0x0003a258 0x0004a258 ADD_64 1027   0x0003a000
0x0003a268 0x0004a268 ADD_64 1027   0x0003a000
EOF
RUN

NAME=ELF: a rela.dyn table ending mid-entry drops the partial reloc
FILE=malloc://0x1b000
CMDS=<<EOF
wff bins/fuzzed/elf7
wx b0 @ 0x1a960
oba 0
ir~?
ir~__ctype_toupper_loc
?e --
wx c0 @ 0x1a960
oba 0
ir~?
ir~__ctype_toupper_loc
EOF
EXPECT=<<EOF
9
--
10
0x0021a018 0x0001a018 SET_64 7     __ctype_toupper_loc
EOF
RUN

NAME=ELF: a rel.dyn table ending mid-entry drops the partial reloc
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/libtest_32.so
wx 3c @ 0xf98
oba 0
ir~_ITM_registerTMCloneTable
?e --
wx 40 @ 0xf98
oba 0
ir~_ITM_registerTMCloneTable
EOF
EXPECT=<<EOF
--
0x00001ffc 0x00000ffc SET_32 6     _ITM_registerTMCloneTable
EOF
RUN

NAME=ELF: a rel.dyn section ending mid-entry drops the partial reloc
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/libtest_32.so
wx 10 @ 0xf98
wx 3c @ 0x178c
oba 0
ir~_ITM_registerTMCloneTable
?e --
wx 40 @ 0x178c
oba 0
ir~_ITM_registerTMCloneTable
EOF
EXPECT=<<EOF
--
0x00001ffc 0x00000ffc SET_32 6     _ITM_registerTMCloneTable
EOF
RUN

NAME=ELF: optional section sizes must not truncate valid dynamic relocations
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/libtest_32.so
oba 0
ir~?
?e --
wx 08000000 @ 0x178c
oba 0
ir~?
?e --
wx 00000000 @ 0x20
wx 00000000 @ 0x30
oba 0
ir~?
EOF
EXPECT=<<EOF
11
--
11
--
11
EOF
RUN

NAME=ELF: shortened rela headers leave DT_RELA and DT_JMPREL whole
FILE=malloc://0x2100
CMDS=<<EOF
wff bins/elf/simple_malloc_x86_64
wx 18 @ 0x1c20
wx 18 @ 0x1c60
oba 0
ir~?
?e --
wx 0000 @ 0x3c
oba 0
ir~?
EOF
EXPECT=<<EOF
14
--
14
EOF
RUN

NAME=ELF: a shortened relr header leaves DT_RELR whole
FILE=malloc://0x81000
CMDS=<<EOF
wff bins/elf/ls-toybox
wx 0800 @ 0x80a08
oba 0
ir~?
EOF
EXPECT=<<EOF
2124
EOF
RUN

# DT_RELR retagged so only the header reaches .relr.dyn, then sh_size 0x1000
NAME=ELF: an oversized relr header stops at the next section
FILE=malloc://0x81000
CMDS=<<EOF
wff bins/elf/ls-toybox
wx 22 @ 0x7b150
oba 0
ir~?
wx 0010 @ 0x80a08
oba 0
ir~?
EOF
EXPECT=<<EOF
2124
2124
EOF
RUN

NAME=ELF: DT_RELSZ and DT_PLTRELSZ past the loaded bytes fall back to the headers
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/libtest_32.so
wx 00ff0000 @ 0xf98
oba 0
ir~?
?e --
wx 40000000 @ 0xf98
wx 00ff0000 @ 0xf78
oba 0
ir~?
?e --
wx f0020000 @ 0xf88
wx 48000000 @ 0xf98
oba 0
ir~printf
?e --
wff bins/elf/libtest_32.so
wx 00000000 @ 0xf78
wx 00ff0000 @ 0xf98
wx 40 @ 0x17b4
oba 0
ir~printf
EOF
EXPECT=<<EOF
11
--
11
--
0x0000200c 0x0000100c SET_32 7     printf
--
0x0000200c 0x0000100c SET_32 7     printf
EOF
RUN

# DT_JMPREL zeroed so only the header reaches .rel.plt, sh_size 8 -> 0x8000
NAME=ELF: a rel.plt header larger than the file still stops at the next section
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/libtest_32.so
wx 00000000 @ 0xf78
wx 00ff0000 @ 0xf98
wx 00800000 @ 0x17b4
oba 0
ir~?
ir~printf
EOF
EXPECT=<<EOF
11
0x0000200c 0x0000100c SET_32 7     printf
EOF
RUN

# DT_DEBUG becomes DT_CREL at a zero byte, a RELA entry sits at .rela.dyn - 1
NAME=ELF: a rela section after a dynamic CREL stream is skipped
FILE=malloc://0x2100
CMDS=<<EOF
wff bins/elf/simple_malloc_x86_64
wx 00 @ 0xf18
wx 101020000000000008000000000000003412000000000000 @ 0x47f
wx 26 @ 0xeb0
wx 7c04 @ 0xeb8
oba 0
ir~?
EOF
EXPECT=<<EOF
5
EOF
RUN

NAME=ELF: a section start inside a rela section bounds it by file offset only
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/simple_malloc_x86_64
wx 15 @ 0xf00
wx 15 @ 0xf10
wx 15 @ 0xf20
wx 15000000 @ 0xf70
oba 0
ir~?
?e --
wx b004 @ 0x1c90
wx b004000000000000 @ 0x1fd0
oba 0
ir~?
?e --
wx b004 @ 0x1c98
oba 0
ir~?
EOF
EXPECT=<<EOF
14
--
14
--
7
EOF
RUN

NAME=ELF: a DT_RELAENT below the entry size reads whole entries
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/simple_malloc_x86_64
wx 08 @ 0xf28
oba 0
ir~?
wx 00 @ 0xf28
oba 0
ir~?
EOF
EXPECT=<<EOF
14
14
EOF
EXPECT_ERR=<<EOF
EOF
RUN

NAME=ELF: a negative DT_RELAENT reads no entry before the table
FILE=malloc://0x4000
CMDS=<<EOF
wff bins/elf/simple_malloc_x86_64
wx f0ffffffffffffff @ 0xf28
oba 0
ir~?
EOF
EXPECT=<<EOF
6
EOF
EXPECT_ERR=<<EOF
EOF
RUN
