Skip to content

Reload malloc:// bin info from the live buffer with obR - #6668

Open
atirna wants to merge 5 commits into
rizinorg:devfrom
atirna:fix/rz-test-virtual-uri-autodetect
Open

Reload malloc:// bin info from the live buffer with obR#6668
atirna wants to merge 5 commits into
rizinorg:devfrom
atirna:fix/rz-test-virtual-uri-autodetect

Conversation

@atirna

@atirna atirna commented Aug 16, 2026

Copy link
Copy Markdown

Your checklist for this pull request

  • I've read the guidelines for contributing to this repository.
  • I made sure to follow the project's coding style.
  • I've documented every RZ_API function and struct this PR changes.
  • I've added tests that prove my changes are effective (required for changes to RZ_API).
  • I've updated the Rizin book with the relevant information (if needed).
  • I've used AI tools to generate fully or partially these code changes and I'm sure the changes are not copyrighted by somebody else.

Detailed description

empty malloc:// lands on the dummy any plugin at open. writing elf/mach0 magic into it used to leave format stuck on any unless you reopened the file, which throws away the buffer.

obR already reloads bin info from the current IO buffer (the help text even mentions malloc://). this PR uses that instead of probing on every wx:

  • wx does not change format. scripts that set asm.arch then write code are not surprised by a reload.
  • obR re-runs plugin autodetection on the live buffer and does not discard it.
  • hex:// with magic already in the uri still detects at open (rz_core_bin_load).
  • rizin - loads bin info after stdin is written into malloc://.
  • om / rz_core_file_malloc_copy_chunk writes the copied bytes before bin load, so the probe sees the data.
  • core_bin_reload keeps the replacement binfile on the core file after the old one is deleted.

reverted an unrelated avr check_buffer tweak that was in an earlier revision of this PR.

AI: Cursor Agent / cursor-grok-4.6-high for this rework. earlier revisions also used Codex / gpt-5.6-terra and Hermes Agent / glm-5.3. i reviewed the diff and checks.

Test plan

  • ./build/test/unit/test_core_bin 13/13 (write stays any; obR reloads elf and keeps the IO bytes; mach0 via obR; hex:// elf at open)
  • rz-test db/cmd/file_malloc 6/6
  • manual: rizin -q malloc://128 then wx 7f45...; i~format stays any; obR; i~format is elf; e io.va=0; p8 4 @ 0 still 7f454c46

Closing issues

closes #6607

Empty malloc:// is probed at open and lands on the dummy any plugin.
Re-probe the live IO buffer after writes near offset 0 so rz-test
FILE=malloc:// workflows pick up real magics without an explicit obR.

Co-authored-by agent: Cursor Agent/cursor-grok-4.6-high
@github-actions github-actions Bot added rizin rz-test RzCore AI/LLM Partially or fully AI generated. Critical thinking is advised! labels Aug 16, 2026
Co-authored-by agent: Codex/gpt-5.6-terra
@atirna atirna changed the title Fix format autodetection for malloc:// and hex:// after writes Fix ELF autodetection for malloc:// after writes Aug 16, 2026
Comment thread librz/core/cfile.c Outdated
The re-probe after a write no longer special-cases elf: any bin
plugin that claims the buffer reloads bin info (mach0, elf64, pe,
...). Two weak claimers that made the broad gate unsafe are
tightened instead:

- avr no longer claims a buffer from the reset vector alone; it
  requires an interrupt vector table of realistic size (smallest
  known board has 19 vectors), so foreign shellcode decoding as
  rjmp stays on any.
- when a plugin claims the data by magic but fails to load it,
  rz_bin_reload keeps the current bin file selected instead of
  leaving the bin without one.

Also, the implicit re-probe no longer clobbers asm config or seeks
to the entrypoint; scripts that set their own asm.arch/cpu before
writing code keep disassembling as configured. Only the detected
plugin becomes current.

Co-authored-by agent: Hermes Agent/glm-5.3
@atirna atirna changed the title Fix ELF autodetection for malloc:// after writes Fix format autodetection for malloc:// after writes Aug 16, 2026
@github-actions github-actions Bot added the RzBin label Aug 16, 2026
@atirna

atirna commented Aug 16, 2026

Copy link
Copy Markdown
Author

done. the elf special case is gone: after a write the re-probe now accepts any plugin that claims the buffer, so mach0/elf64/pe/... all reload bin info, not just elf32.

that broad gate was the reason the elf check existed though, some check_buffer implementations are loose enough to claim shellcode. so instead of narrowing the gate i tightened the claimers that actually misfire:

  • avr no longer claims from the reset vector alone (arm ldr bytes decode as avr rjmp too). it now requires a full interrupt vector table, smallest known board has 19 vectors, so foreign shellcode stays on any
  • when a plugin claims by magic but fails to load, rz_bin_reload now keeps the current bin file instead of leaving the bin empty

the implicit re-probe also stopped clobbering asm.arch/asm.cpu and seeking to the entrypoint mid-script, only the detected plugin becomes current.

checked: wx cefaedfe070000010300000002000000; i~format gives mach0 now, elf64 works the same way, arm shellcode stays any, and db/cmd/file_malloc + db/formats/avr pass 17/17 with the stricter avr check.

@atirna
atirna force-pushed the fix/rz-test-virtual-uri-autodetect branch from 1a2c270 to c4a91c4 Compare August 17, 2026 05:58
Comment thread librz/bin/p/bin_avr.c
Comment thread librz/bin/bin.c Outdated
Comment thread librz/core/cfile.c Outdated

@wargio wargio left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like this should be done via a command to reload the bin & autodetect without discarding the current buffer as autodetecting this may do weird stuff.

@wargio

wargio commented Aug 17, 2026

Copy link
Copy Markdown
Member

@notxvilka @thestr4ng3r @Rot127 please have a look

Implicit autodetection after wx clobbers scripts that set asm.arch
then write code. `obR` already reloads from the live IO buffer
without discarding it. Drop the write-path hook and the unrelated
avr check_buffer change. Register the reloaded binfile on the core
file so close still owns it.

Co-authored-by agent: Cursor Agent/cursor-grok-4.6-high
@atirna atirna changed the title Fix format autodetection for malloc:// after writes Reload malloc:// bin info from the live buffer with obR Aug 17, 2026
@atirna

atirna commented Aug 17, 2026

Copy link
Copy Markdown
Author

probing on wx was not needed. dropped that.

obR already reloads bin info from the current buffer without discarding it, so that can be used. wx leaves format as any, obR picks up elf/mach0 and the malloc bytes can stay. hex:// still detects at open because the buffer is already filled.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AI/LLM Partially or fully AI generated. Critical thinking is advised! rizin rz-test RzBin RzCore

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[rz-test] Enable format autodetection for virtual URIs (e.g., malloc://)

2 participants