redballoonsecurity / redballoonsecurity/ofrak

PE file complex block extraction not working with Angr

Open
#331 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
2.1k
Forks
156
PR merge metrics
No merged PRs in 30d

Description

What is the problem? (Here is where you provide a complete Traceback.)
CodeRegion unpacker is not finding code regions for Pe files with Angr backend.

Please provide some information about your environment.
At minimum we would like the following information on your platform and Python environment:
Use ofrak and ofrak-angr.

If you've discovered it, what is the root cause of the problem?
With this file: https://github.com/redballoonsecurity/ofrak/blob/master/ofrak_core/test_ofrak/components/assets/kernel32.dll

This line is filtering out all functions angr finds: https://github.com/redballoonsecurity/ofrak/blob/master/disassemblers/ofrak_angr/ofrak_angr/components/blocks/unpackers.py#L69

The issue seems to be that region_vaddr is Range(0x1000, 0x9ba7d) and none of the complex blocks found have a virtual address in that range.

How often does the issue happen?

What are the steps to reproduce the issue?
See above

How would you implement this fix?
Figure out whether CodeRegion virtual addresses are valid. There is likely a mismatch between the CodeRegion and function virtual addresses that needs to be resolved.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with disassemblers/ofrak_angr/ofrak_angr/components/blocks/unpackers.py at line 69 and reproduce using ofrak-angr with ofrak_core/test_ofrak/components/assets/kernel32.dll. Compare the CodeRegion range with the virtual addresses of angr's complex blocks and determine whether the address mismatch is in CodeRegion or function discovery. Done means code regions are found correctly for this PE file.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.