Symbolizing memory access fails to identify symbol
- Dominant language
- Python
- Stars
- 750
- Forks
- 87
- PR merge metrics
- No merged PRs in 30d
Description
As part of an ongoing evaluation of Retrowrite by a third party, we identified a case that fails to symbolize correctly. The following steps reproduce it:
wget https://www.busybox.net/downloads/busybox-1.35.0.tar.bz2
tar xf busybox-1.35.0.tar.bz2
cd busybox-1.35.0
make defconfig
make menuconfig # in here, change to a PIE binary
make
This results in the following exception:
```
Traceback (most recent call last):
File "/retrowrite/retro/bin/retrowrite_x64", line 168, in
rw.symbolize()
File "/retrowrite/librw_x64/rw.py", line 76, in symbolize
symb.symbolize_text_section(self.container, None)
File "/retrowrite/librw_x64/rw.py", line 523, in symbolize_text_section
self.symbolize_mem_accesses(container, context)
File "/hexhive/retrowrite/librw_x64/rw.py", line 730, in symbolize_mem_accesses
target, adjust = self._adjust_target(
File "/hexhive/retrowrite/librw_x64/rw.py", line 645, in _adjust_target
assert sec is not None
AssertionError
```
Adding the following diagnostic code:
```
diff --git a/librw_x64/rw.py b/librw_x64/rw.py
index 7c36b2f..9e3b9a1 100644
--- a/librw_x64/rw.py
+++ b/librw_x64/rw.py
@@ -680,6 +680,8 @@ class Symbolizer():
ripbase = inst.address + inst.sz
target = ripbase + value
+ print("RIP REL Information Value=0x%x,RIPBASE=0x%x,TARGET=0x%x" % (value, ripbase, target))
+
is_an_import = False
for relocation in container.relocations[".dyn"]:
@@ -715,10 +717,16 @@ class Symbolizer():
# Check if target is contained within a known region
in_region = self._is_target_in_region(
container, target)
+
if in_region:
inst.op_str = inst.op_str.replace(
hex(value), ".LC%x" % (target))
else:
+ for sec, sval in container.sections.items():
+ print("%s 0x%x - 0x%x" % (sec, sval.base, sval.sz))
+ for fn, fval in container.functions.items():
+ print("%s 0x%x - 0x%x" % (fval.name, fval.start, fval.sz))
+ print("[*] Adjusting memory access, context: %s %s 0x%x" % (inst, context, target))
target, adjust = self._adjust_target(
container, target)
inst.op_str = inst.op_str.replace(
```
To code being refactored in a separate repo suggests that we are unable to correctly identify a rip-relative lea to a text section function. According to the diagnostics, neither the text section nor the function itself are correctly identified.
The root cause of this bug needs to be tracked down and fixed, but is unrelated to previous `init_array` issues.
The following issues are likely related: #29, #3.
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the failure with the BusyBox 1.35.0 PIE build, then start in librw_x64/rw.py at Symbolizer.symbolize_mem_accesses and _adjust_target, using the provided diagnostics to inspect section and function ranges. Done means the RIP-relative memory access identifies the text-section function correctly and symbolization completes without the assertion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100