16.3.3 Virtual machine execution

The 'av' command have single line, memory and file input commands to evaluate expressions.

Here's a simple example of an evaluation of a virtual machine expression

[0x4A13B8C0]> "ave eax=33  ; evalueate expression
   ;  eax=33
[0x4A13B8C0]> avr eax      ; show eax register value
eax = 0x00000021

The prefix '"' in the 'ave' command allows us to write special characters on the string without being interpreted by radare. These characters are '|', '>', ...

If you write a set of expressions splitted by commands and newlines in a file they can be evaluated with the 'avf' command:

[0x4A13B8C0]> avf script.ravm

But maybe, the more interesting source of code evaluation is to evaluate real code. You can achieve this with the 'avx' command. This command makes the disassembler output be parsed by some pas rules that convert the real code into evaluable expressions for the virtual machine. Here's an example:

[0x4A13B8C0]> avx 10
Emulating 10 opcodes
MMU: cached
Importing register values
0x4a13b8c0, eip:
0x4a13b8c0,   eax = esp
   ; eax = esp
0x4a13b8c2    call 0x4a13c000
   ; esp=esp-4
   ; [esp]=eip+5
   ;==> [0xbfeb4fac] = 4a13b8cc  ((esp]))
   ; write 4a13b8cc @ 0xbfeb4fac
   ; eip=0x4a13c000
0x4a13c000,   push ebp
   ; esp=esp-4
   ; [esp]=ebp
   ;==> [0xbfeb4fa8] = 0  ((esp]))
   ; write 0 @ 0xbfeb4fa8
0x4a13c001    ebp = esp
   ; ebp = esp
0x4a13c003    push edi
   ; esp=esp-4
   ; [esp]=edi
   ;==> [0xbfeb4fa4] = 0  ((esp]))
   ; write 0 @ 0xbfeb4fa4
0x4a13c004,   push esi
   ; esp=esp-4
   ; [esp]=esi
   ;==> [0xbfeb4fa0] = 0  ((esp]))
   ; write 0 @ 0xbfeb4fa0
0x4a13c005    push ebx
   ; esp=esp-4
   ; [esp]=ebx
   ;==> [0xbfeb4f9c] = 0  ((esp]))
   ; write 0 @ 0xbfeb4f9c
0x4a13c006    esp -= 0x40
   ; esp -= 0x40
0x4a13c009    call 0x4a1508cb
   ; esp=esp-4
   ; [esp]=eip+5
   ;==> [0xbfeb4f98] = 4a13c013  ((esp]))
   ; write 4a13c013 @ 0xbfeb4f98
   ; eip=0x4a1508cb
0x4a1508cb    ebx = [esp]
   ; ebx = [esp]

and now review the registers again:

[0x4A13B8C0]> avr 
.int32  eax = 0xbfeb4fb0
.int16  ax = 0x00004fb0
.int8   al = 0x000000b0
.int8   ah = 0x0000004f
.int32  ebx = 0x4a13c013
.int32  ecx = 0x00000000
.int32  edx = 0x00000000
.int32  esi = 0x00000000
.int32  edi = 0x00000000
.int32  eip = 0x4a1508ce
.int32  esp = 0xbfeb4f98
.int32  ebp = 0xbfeb4fa8
.bit    zf = 0x00000000
.bit    cf = 0x00000000