qilingframework / qilingframework/qiling
[Support] Working with ARMv8 Binaries expecting MTE and TBI to be enabled
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.1k
- Forks
- 798
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 9
Description
Hi all - not really an issue per say, but more of a request for some suggestions and guidance. Can close this out if that's not acceptable here.
I am working with an ARMv8 binary that appears to be using MTE, which of course requires TBI.
I am seeing writes to otherwise mapped addresses fail due to there being some metadata (presumably an MTE tag) in the upper byte of a 64-bit address. (Specifically, this occurs in je_arena_tdata_get_hard or one of its calls.)
Perhaps this is more of a Unicorn question than a Qiling question, but I'm wondering what might be a good way to work around this, such that I can get this binary running.
I imagine simply working around TBI by somehow masking off the upper byte of virtual addresses will ultimately fail when some MTE checks are performed. Thus, perhaps the best I can do is to identify and hook the underlying allocator(s) to just avoid this entirely? (e.g. just implement my own simple linear allocator in my Qiling script)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the ARMv8 binary failure around je_arena_tdata_get_hard and its calls, then review how Qiling and Unicorn handle MTE and TBI address metadata. Done would require a documented, validated way to run this binary, or a clear confirmation that the required behavior is unsupported.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100