qilingframework / qilingframework/qiling

[Support] Working with ARMv8 Binaries expecting MTE and TBI to be enabled

Open
#1,559 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
6.1k
Forks
798
Avg merge
1d 1h
Merged PRs (30d)
9

Description

Hi all - not really an issue per say, but more of a request for some suggestions and guidance. Can close this out if that's not acceptable here.

I am working with an ARMv8 binary that appears to be using MTE, which of course requires TBI.

I am seeing writes to otherwise mapped addresses fail due to there being some metadata (presumably an MTE tag) in the upper byte of a 64-bit address. (Specifically, this occurs in je_arena_tdata_get_hard or one of its calls.)

Perhaps this is more of a Unicorn question than a Qiling question, but I'm wondering what might be a good way to work around this, such that I can get this binary running.

I imagine simply working around TBI by somehow masking off the upper byte of virtual addresses will ultimately fail when some MTE checks are performed. Thus, perhaps the best I can do is to identify and hook the underlying allocator(s) to just avoid this entirely? (e.g. just implement my own simple linear allocator in my Qiling script)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the ARMv8 binary failure around je_arena_tdata_get_hard and its calls, then review how Qiling and Unicorn handle MTE and TBI address metadata. Done would require a documented, validated way to run this binary, or a clear confirmation that the required behavior is unsupported.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.