search

HexHive / retrowrite

RetroWrite -- Retrofitting compiler passes through binary rewriting
Other
655 stars 78 forks source link

AssertionError #29

Closed this123111 closed 2 years ago

this123111 commented 2 years ago

I faced assertion error when reassemble binary as follows:

python3 -m retrowrite.librw.rw  addr2line addr2line.s
.init_array frame_dummy pointer removed.
[*] Relocations for a section that's not loaded: .rela.dyn
[*] Relocations for a section that's not loaded: .rela.plt
Traceback (most recent call last):
  File "/usr/lib/python3.6/runpy.py", line 193, in _run_module_as_main
    "__main__", mod_spec)
  File "/usr/lib/python3.6/runpy.py", line 85, in _run_code
    exec(code, run_globals)
  File "retrowrite/librw/rw.py", line 439, in <module>
    rw.symbolize()
  File "retrowrite/librw/rw.py", line 58, in symbolize
    symb.symbolize_text_section(self.container, None)
  File "retrowrite/librw/rw.py", line 145, in symbolize_text_section
    self.symbolize_mem_accesses(container, context)
  File "retrowrite/librw/rw.py", line 332, in symbolize_mem_accesses
    container, target)
  File "retrowrite/librw/rw.py", line 266, in _adjust_target
    assert sec is not None
AssertionError

I debugged retrowrite and found a strange reason.

I think RetroWrites handle following instruction as memory access operation.

  File "retrowrite/librw/rw.py", line 332, in symbolize_mem_accesses
    container, target)
(Pdb) hex(inst.address)
'0x36bb3'
objdump -M intel -d 36bb3
36bb3:  48 8d 35 c3 57 00 00    lea    rsi,[rip+0x57c3]        # 3c37d <bfd_section_hash_newfunc>
diagprov commented 2 years ago

Hello, thanks for your bug report. We think this is an issue and as you suggest, it seems we are not correctly symbolizing rip-relative text-section lookups.

I'm going to track these in #30 as we had a private report of such a case we've been working on. Given the bfd symbol, it looks like you're trying to rewrite something from binutils. Could you please confirm that in #30? Thanks!