Vector35 / Vector35/binaryninja-api

invalid handling address math in long mode

Open
#2,391 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Component: SCC Impact: Low
Dominant language
C++
Stars
1.3k
Forks
298
Avg merge
5d 5h
Merged PRs (30d)
19

Description

Describe the bug
Version 2.3.2660 Personal (Build ID 88f343c3)

root@l0c4lh05t:/opt/binaryninja/scc-docs# md5sum ../plugins/scc 
87c53569ecae19e5bb2f899c9146dedb  ../plugins/scc

To Reproduce
Steps to reproduce the behavior:

int main(void)
{
char *data = 0x00;
int fd = 0x00, len = 0x00;

data = (char*)malloc(0x1000);
if ( !data )
	return -228;

memset(data, 0x00, 0x1000);
    fd = open("/etc/passwd", O_RDONLY, 0x00);
    len = read(fd, data, 0x1000);
    //write(0x01, "h4h0r1n5\n", strlen("h4h0r1n5\n"));
puts("31337\n");
write(0x01, data, len);
printf("%s\n", data);
free(data);
data = 0x00;
return 0x00;
//printf("grabbed data:\n%s\n", data);

}" > test.c```
2. scc --return-reg rax --mixed-mode --platform linux --unsafe-stack --encode-pointers --pie --arch x64 -m64 -O0 --exec-stack --allow-return --align 64 ./test.c -f elf -o test.elf
3. or alternatively `scc --pie --arch x64 -m64 -O0 -f elf ./test.c -o test.elf`
3. ./test.elf
4. See error

Expected behavior
scc invalid handle x64 addressing.
when generated elf binary do operations with half-register in long mode - it just lost other half.

https://i.ibb.co/58DLv0f/image.png
https://i.ibb.co/sQ6pwxn/image.png
https://i.ibb.co/mDNKbmX/image.png

Desktop (please complete the following information):

root@l0c4lh05t:/opt/binaryninja/scc-docs# hostnamectl 
   Static hostname: l0c4lh05t
         Icon name: computer-laptop
           Chassis: laptop
        Machine ID: 0a71446503e9469d85974c0bf232cec1
           Boot ID: c73453a976fd4db4886536101e8b209b
  Operating System: Debian b00st3r GNU/Linux
            Kernel: Linux 5.10.0-4-amd64
      Architecture: x86-64

Additional context


Program received signal SIGSEGV, Segmentation fault.
0x0000555555554d56 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]{────[ REGISTERS ]────}
 RAX  0x55555d80
 RBX  0x0
 RCX  0xd2da39aff55c
 RDX  0xd2da39aff55c
 RDI  0x7ffff7ffe180 —▸ 0x555555554000 ◂— jg     0x555555554047
 RSI  0x7ffff7ffe720 ◂— 0x0
 R8   0x0
 R9   0x0
 R10  0x555555554000 ◂— jg     0x555555554047
 R11  0x7ffff7ffe180 —▸ 0x555555554000 ◂— jg     0x555555554047
 R12  0x5555555541ac ◂— sub    rsp, 0x1000
 R13  0x7fffffffe3a0 ◂— 0x1
 R14  0x0
 R15  0x0
 RBP  0xffffd388
 RSP  0x7fffffffd388 —▸ 0x7fffffffd398 ◂— 0x0
 RIP  0x555555554d56 ◂— mov    eax, dword ptr [rax]
 EFLAGS 0x10206 [ cf PF af zf sf IF df of ]
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|{────[ DISASM ]────}
    0x555555554d42    mov    ebp, esp
    0x555555554d44    call   0x555555554d49
    0x555555554d49    pop    rax
    0x555555554d4a    lea    eax, [rax - 0xb9d]
    0x555555554d50    lea    eax, [rax + 0x1bd4]
 —► 0x555555554d56    mov    eax, dword ptr [rax]
    0x555555554d58    leave  
    0x555555554d59    xor    dword ptr [rsp], eax
    0x555555554d5c    ret    
    0x555555554d5d    add    byte ptr [rax], al
    0x555555554d5f    add    byte ptr [rax], al
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[||{────[ STACK ]────}
00:0000 rsp  0x7fffffffd388 —▸ 0x7fffffffd398 ◂— 0x0
01:0008      0x7fffffffd390 ◂— 0x878f6cfab4b8
02:0010      0x7fffffffd398 ◂— 0x0
... ↓
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]{────[ BACKTRACE ]────}
 —► [w00p-w00t]0     555555554d56 
    [w00p-w00t]1     7fffffffd398 
    [w00p-w00t]2     878f6cfab4b8 
    [w00p-w00t]3                0 
[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||]=[|||
pwndbg> 

So, I try to work around this via --base-reg - I think if I set it to long-mode reg - it will generate valid code.
But,
scc --base-reg rax --pie --arch x64 -m64 -O0 -f elf ./test.c -o test.elf
error: unrecognized option '--base-reg'

In general I'm writing standalone LKM modules, so, such compiler can be helpfully for me a lot.
Can you, please, fix this?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the supplied test.c source and the scc commands, then inspect the generated test.elf around the shown x64 instructions. Trace how long-mode address calculations and half-register operations are emitted; done means the generated ELF runs without the reported segmentation fault and preserves the full address.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.