redballoonsecurity / redballoonsecurity/ofrak
PE file complex block extraction not working with Angr
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2.1k
- Forks
- 156
- PR merge metrics
- No merged PRs in 30d
Description
What is the problem? (Here is where you provide a complete Traceback.)
CodeRegion unpacker is not finding code regions for Pe files with Angr backend.
Please provide some information about your environment.
At minimum we would like the following information on your platform and Python environment:
Use ofrak and ofrak-angr.
If you've discovered it, what is the root cause of the problem?
With this file: https://github.com/redballoonsecurity/ofrak/blob/master/ofrak_core/test_ofrak/components/assets/kernel32.dll
This line is filtering out all functions angr finds: https://github.com/redballoonsecurity/ofrak/blob/master/disassemblers/ofrak_angr/ofrak_angr/components/blocks/unpackers.py#L69
The issue seems to be that region_vaddr is Range(0x1000, 0x9ba7d) and none of the complex blocks found have a virtual address in that range.
How often does the issue happen?
What are the steps to reproduce the issue?
See above
How would you implement this fix?
Figure out whether CodeRegion virtual addresses are valid. There is likely a mismatch between the CodeRegion and function virtual addresses that needs to be resolved.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with disassemblers/ofrak_angr/ofrak_angr/components/blocks/unpackers.py at line 69 and reproduce using ofrak-angr with ofrak_core/test_ofrak/components/assets/kernel32.dll. Compare the CodeRegion range with the virtual addresses of angr's complex blocks and determine whether the address mismatch is in CodeRegion or function discovery. Done means code regions are found correctly for this PE file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100