angr / angr/cle

A .NET ReadyToRun image built for a non-Windows target fails to load: its Machine field carries an OS override

Abierto
#751 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
485
Forks
135
Merge medio
2 d 2 h
PR fusionados (30 d)
15

Descripción

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

### Description

A .NET ReadyToRun image published for a non-Windows target cannot be loaded at
all: `PE.__init__` raises `archinfo.arch.ArchNotFound: Can't find architecture
info for architecture 0xfd1d with '' bits and unsure endness`.

```python
# cle/backends/pe/pe.py
machine_type = self._pe.FILE_HEADER.Machine
self.set_arch(archinfo.arch_from_id(pefile.MACHINE_TYPE.get(machine_type, hex(machine_type))))
```

`0xfd1d` is not a machine type. The .NET ReadyToRun compiler alters `Machine` by
an operating-system-specific constant when the image targets an OS other than
Windows, so that the Windows loader refuses a file that is not for it. Every one
of these images in the corpus is the AMD64 case:

```
0xfd1d ^ 0x7b79 = 0x8664 (IMAGE_FILE_MACHINE_AMD64)
```

`0x7b79` is what the images observed here use; the .NET sources are the authority
on the constant for each target OS.

The rest of the header is an ordinary PE32+ image with `.text`, `.data` and
`.reloc`, an `IMAGE_COR20_HEADER` whose `ManagedNativeHeader` points at an `RTR\0`
signature, and native AMD64 code in `.text` — which is the whole point of
ReadyToRun. Nothing else about the image needs special handling.

### Reproduction

```console
$ dotnet new console -o r2rdemo && cd r2rdemo
$ dotnet publish -r linux-x64 -p:PublishReadyToRun=true --self-contained
```

then on the published `r2rdemo` binary:

```python
import cle
cle.Loader("bin/Release/net*/linux-x64/publish/r2rdemo") # ArchNotFound: 0xfd1d
```

Confirming what the file is, without cle:

```python
import struct
data = open("r2rdemo", "rb").read()
pe = struct.unpack_from("

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.