GrammaTech / ddisasm

A fast and accurate disassembler
https://grammatech.github.io/ddisasm/
GNU Affero General Public License v3.0
645 stars 60 forks source link

[x86] fails Reassembly #41

Closed miksh closed 2 years ago

miksh commented 2 years ago

I am trying to reassemble x86 binary with latest ddisasm (grammatech/ddisasm:1.5.2). However, I could not recompile the reassembled code since ddisasm does not create main symbol.

I reassembled a toy program (hello.c) as follows.

$ cat hello.c
#include <stdio.h>
int main()
{
    printf("hello world\n");
    return 0;
}
$ gcc hello.c -m32 -o hello_32
$ strip hello_32

$ sudo docker run --rm -v /home/test/test/:/test grammatech/ddisasm:1.5.2 sh -c "ddisasm /test/hello_32 --asm /test/hello_32.s"
Building the initial gtirb representation  (3ms)
Decoding the binary  (5ms)
Disassembling (20ms)
Populating gtirb representation  (5ms)
Computing intra-procedural SCCs  (0ms)
Computing no return analysis  (0ms)
Detecting additional functions  (1ms)
Printing assembler  (9ms)

I got the following errors.

$ gcc hello_32.s -m32
/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib32/Scrt1.o: In function `_start':
(.text+0x28): undefined reference to `main'
collect2: error: ld returned 1 exit status

I hope ddisasm fixes this bug soon.

kwarrick commented 2 years ago

Looks like PIE code loads the main address from GOT.

          406:   push DWORD PTR [EBX+FUN_1309@GOT]
          40c:   call __libc_start_main@PLT

          411:   hlt 

Should be an easy fix.

kwarrick commented 2 years ago

Fixed in dfdf8adbf42c1e85527aabafacf8cf8e389101c8.

@miksh Thanks for reporting this! We should find main now for stripped PIE x86 binaries.

miksh commented 2 years ago

Thank you. :)