avast / avast/retdec

UPX unpacker crash: corrupted double-linked list

Open
#120 1 comment 0 reactions 0 assignees View on GitHub
bug C-unpacker P-run
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Unpacking of [this](https://www.virustotal.com/en/file/a7a112bae60ba29dfc89f681f8106bb5c340fa734631eff6141d336af07e9b7f/analysis/) file crashes.

Command:
```
retdec-unpacker a7a112bae60ba29dfc89f681f8106bb5c340fa734631eff6141d336af07e9b7f
```

Output:
```
[UPX] Detected NRV2E unpacking stub based on signature & metadata.
[UPX] Started unpacking of file 'A7A112BAE60BA29DFC89F681F8106BB5C340FA734631EFF6141D336AF07E9B7F.dat'.
[UPX] Detected filter 0x26 with parameter 0x11 based on signature.
[UPX] Unpacked data based on UPX metadata.
[UPX] Original header found at address 0x95b9f in extra data.
[UPX] Import hints address 0x94000 found in extra data.
[UPX] Original entry point address set to 0x54d5d.
[UPX] Original resources directory found at RVA 0x8d000 with size 0x68000.
corrupted double-linked list
Aborted (core dumped)
```

First problem in valgrind:
```
[UPX] Import hints address 0x94000 found in extra data.
Invalid read of size 4
at 0x6BB2048: preprocessing::unpacker::upx::PeUpxStub<32>::fixSizeOfSections(...) (pe_upx_stub.cpp:478)
by 0x6BC0035: preprocessing::unpacker::upx::PeUpxStub<32>::unpack(std::string const&) (pe_upx_stub.cpp:215)
by 0x6BC3EFE: preprocessing::unpacker::upx::UpxPlugin::unpack() (upx.cpp:104)
by 0x314335: run (plugin.h:158)
by 0x314335: unpackFile(...) (unpacker.cpp:93)
by 0x3155F3: processArgs(...) (unpacker.cpp:157)
by 0x2F058D: main (unpacker.cpp:202)
Address 0x93709dc is 12 bytes after a block of size 192 alloc'd
at 0x4C2D52F: operator new(unsigned long) (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
by 0x482A48: allocate (new_allocator.h:111)
by 0x482A48: allocate (alloc_traits.h:436)
by 0x482A48: _M_allocate (stl_vector.h:172)
by 0x482A48: void std::vector<...>::_M_realloc_insert<...>(...) (vector.tcc:406)
by 0x483235: push_back (stl_vector.h:948)
by 0x483235: PeLib::PeHeaderT<32>::readSections(...) const (PeHeader.h:1070)
by 0x483523: PeLib::PeHeaderT<32>::read(...) (PeHeader.h:1113)
by 0x483879: PeLib::PeFileT<32>::readPeHeader() (PeFile.h:317)
by 0x6BBFF71: preprocessing::unpacker::upx::PeUpxStub<32>::unpack(std::string const&) (pe_upx_stub.cpp:197)
by 0x6BC3EFE: preprocessing::unpacker::upx::UpxPlugin::unpack() (upx.cpp:104)
by 0x314335: run (plugin.h:158)
by 0x314335: unpackFile(...) (unpacker.cpp:93)
by 0x3155F3: processArgs(...) (unpacker.cpp:157)
by 0x2F058D: main (unpacker.cpp:202)
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with preprocessing/unpacker/upx/pe_upx_stub.cpp at fixSizeOfSections() line 478, then trace the unpack() call shown in the Valgrind report. Reproduce with the provided retdec-unpacker command under Valgrind; done means the sample no longer crashes or reports the invalid read.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.