angr / angr/cle

wrong offsets for elftools.elf.elffile.GNUNeedVerSection

Ouverte
#383 0 commentaires 1 réaction 0 personnes assignées Voir sur GitHub
bug needs-triage
Langage dominant
Python
Étoiles
485
Forks
135
Merge moyen
2 j 2 h
PR mergées (30 j)
15

Description

### Description

The offset given to `elffile.GNUVerNeedSection` is the RVA, but it expects a file offset.
In most binaries, the RVA and file offset equal for this section, but in cases where it doesn't it leads to an error/exception.

Dirty solution would be to modify the `to_rva()` transform to `to_raw()` for this section, but not sure whether this could break things when the file stream is from a memory dump.
Another solution (which seems to be done for other sections) would be to set the stream variable to self.memory after the constructor.

### Steps to reproduce the bug

open VMProtect obfuscated sample from https://github.com/JonathanSalwan/VMProtect-devirtualization/tree/main/vmp_binaries/binaries

Run with:
```
import angr
angr.Project()
```
[reproduce.zip](https://github.com/angr/cle/files/11200408/reproduce.zip)

### Environment

angr environment report
=============================
Date: 2023-04-11 14:38:29.523517
Running in virtual environment at /home/user/angr/venv
Platform: linux-x86_64
Python version: 3.10.10 (main, Mar 5 2023, 22:26:53) [GCC 12.2.1 20230201]
######## angr #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/angr
Pip version angr 9.2.45
Couldn't find git info
######## ailment #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/ailment
Pip version ailment 9.2.45
Couldn't find git info
######## cle #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/cle
Pip version cle 9.2.45
Couldn't find git info
######## pyvex #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/pyvex
Pip version pyvex 9.2.45
Couldn't find git info
######## claripy #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/claripy
Pip version claripy 9.2.45
Couldn't find git info
######## archinfo #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/archinfo
Pip version archinfo 9.2.45
Couldn't find git info
######## z3 #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/z3
Pip version z3-solver 4.10.2.0
Couldn't find git info
######## unicorn #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/unicorn
Pip version unicorn 2.0.1.post1
Couldn't find git info
######### Native Module Info ##########
angr: >
unicorn: >
pyvex: .FFILibrary object at <0x7fREDACTED>>
z3: >

### Additional context

_No response_

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.