The RARVM-Debugger is a dynamic debugging and diagnostic tool for the RARVM made out of the modified source code of unrar version 4.2.1.

./rarvm-debugger p -inul <archive.rar>

Output the content of the archive after executing it through the RarVM to stdout.

./rarvm-debugger p -inul example03.rar 
Yes!

./rarvm-debugger d <archive.rar>

(dbg) help
                          HELP DIALOG                          
===============================================================
 help                            - help dialog
 info registers                  - information about registers
 break  [<addr>]                 - set a breakpoint
 delete [<addr>]                 - remove breakpoints
 disassemble [<amount>] [<from>] - disassemble instructions
 get flags                       - read the flags
 get R<register>                 - read a register
 get <addr>                      - read byte from memory
 set flags <value>               - set the flags
 set R<register>  <value>        - set a register to a value
 set <addr> <value>              - set a byte in memory
 stepi <amount>                  - step over instructions
 continue                        - continue until next break
 quit                            - exit the debugger

./rarvm-debugger d -trace <archive.rar>

Output an instruction trace of the execution of a RARVM program.

  ./rarvm-debugger d -trace example01.rar 
  [0000] JMP      #0x00000001
  [0001] MOVD     R0, #0x0000BEEF
  [0002] CMPD     R0, #0x00C0FFEE
  [0003] JZ       #0x00000006
  [0004] MOVD     [#0x00001000], #0x2E2E6F4E
  [0005] JMP      #0x00000008
  [0008] MOVD     [#0x0003C020], #0x00001000
  [0009] MOVD     [#0x0003C01C], #0x00000004
  [000A] JMP      #0x0003FF00

./rarvm-debugger d -dump <archive.rar>

Dump all code loaded in the RARVM without executing it.

  ./rarvm-debugger d -dump example01.rar 
  JMP      #0x00000001
  MOVD     R0, #0x0000BEEF
  CMPD     R0, #0x00C0FFEE
  JZ       #0x00000006
  MOVD     [#0x00001000], #0x2E2E6F4E
  JMP      #0x00000008
  MOVD     [#0x00001000], #0x21B39AB7
  XOR      [#0x00001000], R0
  MOVD     [#0x0003C020], #0x00001000
  MOVD     [#0x0003C01C], #0x00000004
  JMP      #0x0003FF00
  MOVD     #0x00000000, #0x00000000
  RETb 

./rarvm-debugger d -diagnostic <archive.rar>

Output Debug information regarding the parsing of the RarVM programs parameters and execute the program. Outputs nothing if the archive does not contain RarVM code.

  ./rarvm-debugger d -diagnostic example04.rar 
  FirstByte = 17
  Length = 4E
    Initial Block Start: 00000000
    Default Block Length: 00000000
    Modified Initial Register Flag: 1F
      Changed Initial Register 0 to 0000006F
      Changed Initial Register 1 to 6C000000
      Changed Initial Register 2 to 006C0000
      Changed Initial Register 3 to 00006500
      Changed Initial Register 4 to 00000048
    Code Size: 48
  The checksum (B4) matches the expected value (B4).
  Initial R6 Value = 0
  Initial GlobalData[0x24] = 0
  Initial GlobalData[0x28] = 0
  Initial R7 Value = 262144

UnRAR licence is included in the source folder.

Note that the RARVM was removed from unrar and winrar in the release of version 5.0 so the information displayed here has very few practical applications

The Architecture provides 8 General Purpose Registers R0..R7, a program counter and a flag register containing a carry, zero and signed flag. R7 is used as a stack pointer by the instructions using the stack.

By default at the beginning of a program R3 holds the address of the global memory (which is 0x3C000), R4 the size of original data, R5 the amount of instruction already executed, R6 the amount of bytes already written and R7 the size of the memory page (0x40000).

[b] is the ByteMode bit which decides whether an instruction operates on 4 bytes or only one byte. If the bit is set it switches to single byte mode.

For the other parameters the decoding function can be read here: https://github.com/pmachapman/unrar/blob/bca1c247dd58da11e500013130a22ca64e830a55/rarvm.cpp#L674

It's notable that all operants can be registers, immediate values or memory references from a register, an offset or both.

I've done most of my testing with unrar 4.2.1 and WinRar 4.20

Since Version 3.3.0 instruction parameters data pointers point to the content of themself by default, this allows for some interesting cases of self modifying code

./rarvm-debugger d -trace example02.rar 
[0000] SUB      #0x00000002, #0x00000001
[0001] JNZ      #0x00000001
[0000] SUB      #0x00000001, #0x00000001
[0001] JNZ      #0x00000001

https://github.com/pmachapman/unrar/commit/614508aaf441d08de64d68bf3464ecfbd9b603c9#diff-9fbcab26b4523426ccb1520539e7408b

In Version 3.6.1 the "PRINT" debug instruction was removed https://github.com/pmachapman/unrar/commit/30566e3abf4c9216858bae3ea6b44f048df8c4a5#diff-9fbcab26b4523426ccb1520539e7408b

The article pdf was first published in Paged Out! #2 as "Looking at the RarVM" and is uploaded here for archive purpose.

A binary which output depends on the initial register state, without tools or modification will always output "No.."

An example of self modifying instructions (See notes)

Example01 but with changed initial register state so it will output "Yes!" by default

Multiple changed initial register states that contain the output at startup

An example of included static binary data. It copies over the static data to output it

• https://github.com/taviso/rarvmtools
• http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html
• https://github.com/pmachapman/unrar
• https://github.com/pmachapman/unrar/tree/bca1c247dd58da11e500013130a22ca64e830a55
• https://github.com/pmachapman/unrar/blob/bca1c247dd58da11e500013130a22ca64e830a55/rarvm.cpp
• https://github.com/pmachapman/unrar/blob/bca1c247dd58da11e500013130a22ca64e830a55/rarvm.hpp
• https://github.com/pmachapman/unrar/blob/bca1c247dd58da11e500013130a22ca64e830a55/rarvmtbl.cpp