NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.9k stars 5.89k forks source link

Cannot correctly read local variable information in the location list from the dwarf section #6974

Open Muqi-Zou opened 1 month ago

Muqi-Zou commented 1 month ago

When decompiling the binary compiled with "gcc -g -O2" from coreutils, I noticed that ghidra cannot recover the name of the local variables. For example, I select DWARF in the analysis and all its options (e.g., output dwarf die info): image I also tried the binary compiled with "gcc -g -O0", here is the same function info: image

The differences between them are how variables are stored in dwarf (i.e., DW_AT_location). For example, for the variable ambiguous, O2 is in the location list: image its location list: image O0 is : image

I checked the source code of ghidra about handling the location list the problem is here:

    public DWARFLocation getLocation(DWARFAttribute attribute, long pc) throws IOException {
        DWARFLocationList locList = getLocationList(attribute);
        return locList.getLocationContaining(pc);
    }

The getLocationContaining(pc); will make the information within the location list null. I checked this by using the following code:

    public DWARFLocation getLocation(DWARFAttribute attribute, long pc) throws IOException {
        DWARFLocationList locList = getLocationList(attribute);
        Msg.error(this,locList.toString());
        Msg.error(this,locList.getLocationContaining(pc));
        Msg.error(this,pc);
        return locList.getLocationContaining(pc);
    }

and have the following: image As you can see from the location list, the local variable uses 5a84 as the "pc", which is not the same as dfunc.getEntryPc() (5a80). I believe in readLocalVariableStorage, the second input of getLocation should be handled differently. However, I am not an expert in dwarf4 writing, it could also be gcc goes wrong.

Muqi-Zou commented 1 month ago

debug_inall.zip Here is the binaries and related logs.