HexHive / HexHive/retrowrite

[BUG] -- asan triggers traceback of capstone in ubuntu-arm64

Open
#44 0 comments 0 reactions 0 assignees View on GitHub
analysis-needed bug
Dominant language
Python
Stars
750
Forks
87
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
When I tested asan with "user_space" in the demos directory on an AArch64 ubuntu system, I encountered the following traceback:
```
$ gcc -O0 -ggdb -Wall -Wpedantic -Wextra -fPIC -fPIE -pie ./stack.c -o stack
...
$ ./retrowrite --asan ./stack ./stack.asan.s
[INFO] Found dependency libc.so.6
[INFO] Found dependency ld-linux-aarch64.so.1
[*] Relocations for a section that's not loaded: .rela.dyn
[*] Relocations for a section that's not loaded: .rela.plt
0x730 _init
0x730 0x744
0x800 _start
0x800 0x838
0x850 deregister_tm_clones
0x850 0x880
0x880 register_tm_clones
0x880 0x8c0
0x8c0 __do_global_dtors_aux
0x8c0 0x908
0x908 frame_dummy
0x908 0x90c
0xbbc _fini
0xbbc 0xbcc
[INFO] Disassembling...
[INFO] Symbolizing...
[INFO] Recovering .eh_frame information
{'name': 'exit', 'st_value': 0, 'offset': 73584, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__cxa_finalize', 'st_value': 0, 'offset': 73592, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'atoi', 'st_value': 0, 'offset': 73600, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__libc_start_main', 'st_value': 0, 'offset': 73608, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__stack_chk_fail', 'st_value': 0, 'offset': 73616, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__gmon_start__', 'st_value': 0, 'offset': 73624, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'abort', 'st_value': 0, 'offset': 73632, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'puts', 'st_value': 0, 'offset': 73640, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'printf', 'st_value': 0, 'offset': 73648, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
Traceback (most recent call last):
File "./retrowrite", line 293, in
asan(rw, loader, args)
File "./retrowrite", line 52, in asan
analyze_registers(loader, args)
File "./retrowrite", line 41, in analyze_registers
StackFrameAnalysis.analyze(loader.container)
File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 20, in analyze
analyzer.analyze_container(container)
File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 25, in analyze_container
self.analyze_function(fn, container)
File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 28, in analyze_function
self.analyze_is_fn_leaf(function, container)
File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 34, in analyze_is_fn_leaf
target = instruction.cs.operands[-1].imm
File "/usr/local/lib/python3.8/dist-packages/capstone/__init__.py", line 667, in __getattr__
raise CsError(CS_ERR_DETAIL)
capstone.CsError: Details are unavailable (CS_ERR_DETAIL)
```

**My environment**
```
$ uname -m
aarch64
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.5 LTS
Release: 20.04
Codename: focal
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with the documented AArch64 Ubuntu command, then inspect retrowrite:293 and the asan path through librw_arm64/analysis/stackframe.py, especially analyze_is_fn_leaf at line 34. Determine why accessing the instruction operand raises capstone.CsError, and verify that ASAN processing completes without this traceback on the reported environment.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.