search

Gallopsled / pwntools

CTF framework and exploit development library
http://pwntools.com
Other
11.99k stars 1.7k forks source link

Fix support for amd64 x32 ABI #2305

Closed peace-maker closed 10 months ago

peace-maker commented 10 months ago

x32 detection was broken since https://github.com/Gallopsled/pwntools/commit/fbf2727ac6f625f56fea9aa10cdb03a01a3b19e7 There is special handling in the plt emulation for this, which cannot be reached anymore.

https://github.com/Gallopsled/pwntools/blob/65f9d5761d1fdb7c6dc4e98cbc6ac4f221678371/pwnlib/elf/plt.py#L80-L83

Setting context.arch while loading a x32 ELF caused an exception in the LocalContext.__enter__ function, which caused the context not getting reset while leaving the contextmanager. This causes the behavior seen in #2304, where the log_level is reset to the default INFO and not reset to the old one after leaving the context. (Python context managers not to be confused with pwntools context class)

https://github.com/Gallopsled/pwntools/blob/65f9d5761d1fdb7c6dc4e98cbc6ac4f221678371/pwnlib/elf/elf.py#L278-L285

Fixes #2304

Arusekk commented 10 months ago

Do we want to add a small x32 binary for tests? I think we can do without it, but just curious what's your opinion.

Anyway, just as a note, I think it will be nice to refer to the faulty commit in the message of the merged commit.

peace-maker commented 10 months ago

I've compiled a small program with the different flags to test PLT emulation on x32 too.

gcc test.c -o test-x32 -mx32 -no-pie -Wl,-z,norelro -fstack-protector-all
gcc test.c -o test-x32-pie -mx32 -pie -Wl,-z,norelro -fstack-protector-all
gcc test.c -o test-x32-relro -mx32 -no-pie -Wl,-z,relro,-z,now -fstack-protector-all
gcc test.c -o test-x32-relro-pie -mx32 -pie -Wl,-z,relro,-z,now -fstack-protector-all