HexHive / retrowrite

RetroWrite -- Retrofitting compiler passes through binary rewriting
Other
655 stars 78 forks source link

[BUG] -- asan triggers traceback of capstone in ubuntu-arm64 #44

Open Sunxingzhezhexingsun opened 1 year ago

Sunxingzhezhexingsun commented 1 year ago

Describe the bug When I tested asan with "user_space" in the demos directory on an AArch64 ubuntu system, I encountered the following traceback:

$ gcc -O0 -ggdb -Wall -Wpedantic -Wextra -fPIC -fPIE -pie ./stack.c -o stack
...
$ ./retrowrite --asan ./stack ./stack.asan.s
[INFO] Found dependency libc.so.6
[INFO] Found dependency ld-linux-aarch64.so.1
[*] Relocations for a section that's not loaded: .rela.dyn
[*] Relocations for a section that's not loaded: .rela.plt
0x730 _init
0x730 0x744
0x800 _start
0x800 0x838
0x850 deregister_tm_clones
0x850 0x880
0x880 register_tm_clones
0x880 0x8c0
0x8c0 __do_global_dtors_aux
0x8c0 0x908
0x908 frame_dummy
0x908 0x90c
0xbbc _fini
0xbbc 0xbcc
[INFO] Disassembling...
[INFO] Symbolizing...
[INFO] Recovering .eh_frame information
{'name': 'exit', 'st_value': 0, 'offset': 73584, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__cxa_finalize', 'st_value': 0, 'offset': 73592, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'atoi', 'st_value': 0, 'offset': 73600, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__libc_start_main', 'st_value': 0, 'offset': 73608, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__stack_chk_fail', 'st_value': 0, 'offset': 73616, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': '__gmon_start__', 'st_value': 0, 'offset': 73624, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'abort', 'st_value': 0, 'offset': 73632, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'puts', 'st_value': 0, 'offset': 73640, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
{'name': 'printf', 'st_value': 0, 'offset': 73648, 'addend': 0, 'type': 1026}
[*] Unhandled relocation R_AARCH64_JUMP_SLOT
Traceback (most recent call last):
  File "./retrowrite", line 293, in <module>
    asan(rw, loader, args)
  File "./retrowrite", line 52, in asan
    analyze_registers(loader, args)
  File "./retrowrite", line 41, in analyze_registers
    StackFrameAnalysis.analyze(loader.container)
  File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 20, in analyze
    analyzer.analyze_container(container)
  File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 25, in analyze_container
    self.analyze_function(fn, container)
  File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 28, in analyze_function
    self.analyze_is_fn_leaf(function, container)
  File "/root/retrowrite/librw_arm64/analysis/stackframe.py", line 34, in analyze_is_fn_leaf
    target = instruction.cs.operands[-1].imm
  File "/usr/local/lib/python3.8/dist-packages/capstone/__init__.py", line 667, in __getattr__
    raise CsError(CS_ERR_DETAIL)
capstone.CsError: Details are unavailable (CS_ERR_DETAIL)

My environment

$ uname -m
aarch64
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.5 LTS
Release:    20.04
Codename:   focal
$ gcc --version
gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$