angr / angr/archinfo

x32 binaries are analyzed as 32-bit x86

Abierto
#369 3 comentarios 0 reacciones 0 asignados Ver en GitHub
help wanted
Lenguaje dominante
Python
Estrellas
97
Forks
70
Merge medio
2 d 6 h
PR fusionados (30 d)
8

Descripción

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

The x32 ABI — ELFCLASS32 containers holding `EM_X86_64` code — is loaded as 32-bit x86, so the 64-bit instruction stream does not decode. Measured across a large corpus against the binaries' own symbol tables, this accounts for 20 objects and 425 function symbols with no block at their entry.

`arch_from_id` lowercases the machine name and matches `"em_x86_64"` against the x86 pattern, and `bits=32` then excludes `ArchAMD64`, so `ArchX86` wins. Everything using a REX prefix or 64-bit operand size lifts incorrectly or not at all, and `drop_bad_functions` removes the affected functions afterwards, so the loss is silent rather than reported.

As with MIPS o32/n32 on a 64-bit ISA, the underlying problem is that archinfo ties pointer width to register width. x32 needs AMD64 decoding with 32-bit pointers.

The question is whether archinfo should express that, or whether CLE should refuse the file with a clear error instead of analyzing it as x86. Silently recovering a fraction of the code seems the worst available option.

`gcc -mx32` reproduces it without needing any particular corpus.

The MIPS issue filed alongside this one is the same decision on a different architecture.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.