angr / angr/cle

A .NET ReadyToRun image built for a non-Windows target fails to load: its Machine field carries an OS override

Đang mở
#751 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
485
Fork
135
Merge trung bình
2 ngày 2 giờ
Pull request đã merge (30 ngày)
15

Mô tả

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

### Description

A .NET ReadyToRun image published for a non-Windows target cannot be loaded at
all: `PE.__init__` raises `archinfo.arch.ArchNotFound: Can't find architecture
info for architecture 0xfd1d with '' bits and unsure endness`.

```python
# cle/backends/pe/pe.py
machine_type = self._pe.FILE_HEADER.Machine
self.set_arch(archinfo.arch_from_id(pefile.MACHINE_TYPE.get(machine_type, hex(machine_type))))
```

`0xfd1d` is not a machine type. The .NET ReadyToRun compiler alters `Machine` by
an operating-system-specific constant when the image targets an OS other than
Windows, so that the Windows loader refuses a file that is not for it. Every one
of these images in the corpus is the AMD64 case:

```
0xfd1d ^ 0x7b79 = 0x8664 (IMAGE_FILE_MACHINE_AMD64)
```

`0x7b79` is what the images observed here use; the .NET sources are the authority
on the constant for each target OS.

The rest of the header is an ordinary PE32+ image with `.text`, `.data` and
`.reloc`, an `IMAGE_COR20_HEADER` whose `ManagedNativeHeader` points at an `RTR\0`
signature, and native AMD64 code in `.text` — which is the whole point of
ReadyToRun. Nothing else about the image needs special handling.

### Reproduction

```console
$ dotnet new console -o r2rdemo && cd r2rdemo
$ dotnet publish -r linux-x64 -p:PublishReadyToRun=true --self-contained
```

then on the published `r2rdemo` binary:

```python
import cle
cle.Loader("bin/Release/net*/linux-x64/publish/r2rdemo") # ArchNotFound: 0xfd1d
```

Confirming what the file is, without cle:

```python
import struct
data = open("r2rdemo", "rb").read()
pe = struct.unpack_from("

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.