search

UTSASRG / Scaler

GNU General Public License v2.0
4 stars 0 forks source link

Find out why sometimes .plt.sec location was wrongly parsed #31

Closed GammaPi closed 2 years ago

GammaPi commented 2 years ago

In the tests, I find that the memory search approach is not very robust in finding .plt.sec entry. (But PLT entry seems to work find)

This will cause scaler to execute the wrong function.

The current solution is to increase the search size to bypass this problem.

Possible detection method of such bug: Search with 1entrysize, 2entrysize, 3*entrysize ... and compare their value. If they mismatch, throw a warning.

But in theory this bug won't appear because the function offset is always unique.

GammaPi commented 2 years ago

13 related

GammaPi commented 2 years ago

This fixing approach has some problem. for plt entries < threshold, scaler won't hook it. So I need to find the rootcause.

GammaPi commented 2 years ago

Not priority. The current fix works.