angr / angr/cle

A .NET ReadyToRun image built for a non-Windows target fails to load: its Machine field carries an OS override

Offen
#751 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Python
Sterne
485
Forks
135
Ø Merge
2 T. 2 Std.
Gemergte PRs (30 T.)
15

Beschreibung

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

### Description

A .NET ReadyToRun image published for a non-Windows target cannot be loaded at
all: `PE.__init__` raises `archinfo.arch.ArchNotFound: Can't find architecture
info for architecture 0xfd1d with '' bits and unsure endness`.

```python
# cle/backends/pe/pe.py
machine_type = self._pe.FILE_HEADER.Machine
self.set_arch(archinfo.arch_from_id(pefile.MACHINE_TYPE.get(machine_type, hex(machine_type))))
```

`0xfd1d` is not a machine type. The .NET ReadyToRun compiler alters `Machine` by
an operating-system-specific constant when the image targets an OS other than
Windows, so that the Windows loader refuses a file that is not for it. Every one
of these images in the corpus is the AMD64 case:

```
0xfd1d ^ 0x7b79 = 0x8664 (IMAGE_FILE_MACHINE_AMD64)
```

`0x7b79` is what the images observed here use; the .NET sources are the authority
on the constant for each target OS.

The rest of the header is an ordinary PE32+ image with `.text`, `.data` and
`.reloc`, an `IMAGE_COR20_HEADER` whose `ManagedNativeHeader` points at an `RTR\0`
signature, and native AMD64 code in `.text` — which is the whole point of
ReadyToRun. Nothing else about the image needs special handling.

### Reproduction

```console
$ dotnet new console -o r2rdemo && cd r2rdemo
$ dotnet publish -r linux-x64 -p:PublishReadyToRun=true --self-contained
```

then on the published `r2rdemo` binary:

```python
import cle
cle.Loader("bin/Release/net*/linux-x64/publish/r2rdemo") # ArchNotFound: 0xfd1d
```

Confirming what the file is, without cle:

```python
import struct
data = open("r2rdemo", "rb").read()
pe = struct.unpack_from("

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.