Vector35 / Vector35/binaryninja-api
invalid handling address math in long mode
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Describe the bug
Version 2.3.2660 Personal (Build ID 88f343c3)
root@l0c4lh05t:/opt/binaryninja/scc-docs# md5sum ../plugins/scc
87c53569ecae19e5bb2f899c9146dedb ../plugins/scc
To Reproduce
Steps to reproduce the behavior:
int main(void)
{
char *data = 0x00;
int fd = 0x00, len = 0x00;
data = (char*)malloc(0x1000);
if ( !data )
return -228;
memset(data, 0x00, 0x1000);
fd = open("/etc/passwd", O_RDONLY, 0x00);
len = read(fd, data, 0x1000);
//write(0x01, "h4h0r1n5\n", strlen("h4h0r1n5\n"));
puts("31337\n");
write(0x01, data, len);
printf("%s\n", data);
free(data);
data = 0x00;
return 0x00;
//printf("grabbed data:\n%s\n", data);
}" > test.c```
2. scc --return-reg rax --mixed-mode --platform linux --unsafe-stack --encode-pointers --pie --arch x64 -m64 -O0 --exec-stack --allow-return --align 64 ./test.c -f elf -o test.elf
3. or alternatively `scc --pie --arch x64 -m64 -O0 -f elf ./test.c -o test.elf`
3. ./test.elf
4. See error
Expected behavior
scc invalid handle x64 addressing.
when generated elf binary do operations with half-register in long mode - it just lost other half.
https://i.ibb.co/58DLv0f/image.png
https://i.ibb.co/sQ6pwxn/image.png
https://i.ibb.co/mDNKbmX/image.png
Desktop (please complete the following information):
root@l0c4lh05t:/opt/binaryninja/scc-docs# hostnamectl
Static hostname: l0c4lh05t
Icon name: computer-laptop
Chassis: laptop
Machine ID: 0a71446503e9469d85974c0bf232cec1
Boot ID: c73453a976fd4db4886536101e8b209b
Operating System: Debian b00st3r GNU/Linux
Kernel: Linux 5.10.0-4-amd64
Architecture: x86-64
Additional context
Program received signal SIGSEGV, Segmentation fault.
0x0000555555554d56 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]{────[ REGISTERS ]────}
RAX 0x55555d80
RBX 0x0
RCX 0xd2da39aff55c
RDX 0xd2da39aff55c
RDI 0x7ffff7ffe180 —▸ 0x555555554000 ◂— jg 0x555555554047
RSI 0x7ffff7ffe720 ◂— 0x0
R8 0x0
R9 0x0
R10 0x555555554000 ◂— jg 0x555555554047
R11 0x7ffff7ffe180 —▸ 0x555555554000 ◂— jg 0x555555554047
R12 0x5555555541ac ◂— sub rsp, 0x1000
R13 0x7fffffffe3a0 ◂— 0x1
R14 0x0
R15 0x0
RBP 0xffffd388
RSP 0x7fffffffd388 —▸ 0x7fffffffd398 ◂— 0x0
RIP 0x555555554d56 ◂— mov eax, dword ptr [rax]
EFLAGS 0x10206 [ cf PF af zf sf IF df of ]
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|{────[ DISASM ]────}
0x555555554d42 mov ebp, esp
0x555555554d44 call 0x555555554d49
0x555555554d49 pop rax
0x555555554d4a lea eax, [rax - 0xb9d]
0x555555554d50 lea eax, [rax + 0x1bd4]
—► 0x555555554d56 mov eax, dword ptr [rax]
0x555555554d58 leave
0x555555554d59 xor dword ptr [rsp], eax
0x555555554d5c ret
0x555555554d5d add byte ptr [rax], al
0x555555554d5f add byte ptr [rax], al
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[||{────[ STACK ]────}
00:0000 rsp 0x7fffffffd388 —▸ 0x7fffffffd398 ◂— 0x0
01:0008 0x7fffffffd390 ◂— 0x878f6cfab4b8
02:0010 0x7fffffffd398 ◂— 0x0
... ↓
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]{────[ BACKTRACE ]────}
—► [w00p-w00t]0 555555554d56
[w00p-w00t]1 7fffffffd398
[w00p-w00t]2 878f6cfab4b8
[w00p-w00t]3 0
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||
pwndbg>
So, I try to work around this via --base-reg - I think if I set it to long-mode reg - it will generate valid code.
But,
scc --base-reg rax --pie --arch x64 -m64 -O0 -f elf ./test.c -o test.elf
error: unrecognized option '--base-reg'
In general I'm writing standalone LKM modules, so, such compiler can be helpfully for me a lot.
Can you, please, fix this?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with the supplied test.c source and the scc commands, then inspect the generated test.elf around the shown x64 instructions. Trace how long-mode address calculations and half-register operations are emitted; done means the generated ELF runs without the reported segmentation fault and preserves the full address.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, cpp
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100