Skip to content

Fix remaining disassembly regex search quirks ##search - #26828

Merged
trufae merged 5 commits into
masterfrom
fix/ad-regex-26176
Sep 27, 2026
Merged

trufae merged 5 commits into
masterfrom
fix/ad-regex-26176

Conversation

@trufae

@trufae trufae commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator

Fixes #26176.

The ARM64 example in the issue still failed when its regex was quoted as an argument. Investigation also reproduced missed overlapping matches across read blocks, incorrect bytewise continuation, silent truncation of long patterns, splitting inside regex character classes, and errors reported as successful shell commands.

Keeps /ad in the legacy handler. Uses the existing r_str_unquote helper for whole-pattern arguments, accepts whitespace consistently with cmdctx, and preserves regex backslashes. Existing whole-command quoting, leading-quote calls and escaped instruction separators remain covered.

Commit Change
50c9ea8 Accept single/double quoted patterns and tab-separated arguments; document usable regex examples.
b9d9770 Track the scan address across buffer refills so retries and bytewise sequences keep all overlapping hits. Removes the block-local retry helper.
b3f2198 Consume the final supported instruction pattern and reject more than 1023 expressions instead of returning partial false matches.
75a4a94 Preserve semicolons inside bracket expressions, including POSIX classes, collating symbols and equivalence classes.
82d1a79 Return failure for missing patterns, invalid modifiers/regexes and excess instructions; stop after the first failed map. Successful searches with zero hits still succeed.

Adds 11 r2r cases to test/db/cmd/cmd_search_ad, including the original ARM64 bytes. Ten fail against unmodified master; the additional case protects alignment/maxhits behavior. Production code changes total +95/-47 lines (net +48); tests add 213 lines.

Validation on Linux:

  • Built and installed after rebasing onto dd4b271.
  • 209 tests across cmd_search, cmd_search_ad, cmd_search_asm, cmd_search_in, cmd_search_hit, cmd_search_esil, shell, and feat_quote: 208 pass, zero unexpected failures. The existing Rop search w/ branch delay (mips) remains marked BROKEN.
  • All 28 disassembly-search tests pass.
  • python3 sys/lint.py --all and git diff --check pass.

@trufae
trufae merged commit 03b0437 into master Sep 27, 2026
44 of 46 checks passed
@trufae
trufae deleted the fix/ad-regex-26176 branch September 27, 2026 08:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Quirky /ad/ behaviour

1 participant