HexHive / HexHive/retrowrite

[BUG] RetroWrite does not symbolize RIP-relative addressing and omits the definition of labels

Open
#45 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

analysis-needed bug
Dominant language
Python
Stars
751
Forks
87
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

  1. RetroWrite fails on symbolizing RIP-relative addressing.
    I observed that RetroWrite fails on recovering RIP-relative addressing. As an example, given instruction  ‘leaq fix_syms(%rip), %rsi’ found in addr2line of binutils, RetroWrite reassembled the instruction as ‘leaq 5(%rip), %rsi’.
  • Compiler-generated assembly
_bfd_fix_excluded_sec_syms:             
    .cfi_startproc
    movq    %rdi, %rdx
    movq    40(%rsi), %rdi
    leaq    fix_syms(%rip), %rsi
    jmp bfd_link_hash_traverse          # TAILCALL
    .cfi_endproc

fix_syms:                               
    .cfi_startproc
    pushq   %r14
  • Binary
00000000000a663f <_bfd_fix_excluded_sec_syms>:
   a663f:    mov    %rdi,%rdx
   a6642:    mov    0x28(%rsi),%rdi
   a6646:    lea    0x5(%rip),%rsi        # a6652 <fix_syms>
   a664d:    jmpq   a3ec0 <bfd_link_hash_traverse>

00000000000a6652 <fix_syms>:
   a6652:    push   %r14
  • Reassembler-generated assembly 
.LCa6646:
    leaq 5(%rip), %rsi
  1. RetroWrite omits the definition of some labels.
    Also, I found that RetroWrite sometimes omits some definitions of labels. For example, given the data pointer 0x170c80, RetroWrite symbolized the pointer as '.LC170c80', but RetroWrite misses the definition of the label '.LC170c80'. As a result, it causes a compilation error. 

Describe how to reproduce the bug

  1. Platform: x86-64.
  2. Compiler: Clang v12.0 and GCC v7.5.0
  3. Binary: addr2line in binutils-2.31.1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the x86-64 cases with addr2line from binutils-2.31.1 using Clang 12 or GCC 7.5, focusing on RIP-relative symbolization and the missing .LC170c80 label definition. Trace the relevant RetroWrite symbolization and reassembly entry points, then verify that the generated assembly preserves symbolic RIP-relative operands, defines every emitted label, and compiles successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
compilers, reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.