search

al3xtjames / ghidra-firmware-utils

Ghidra utilities for analyzing PC firmware
Other
401 stars 45 forks source link

Exception when importing - AddressOverflowException: Address Overflow in add: ffffffe0 + 0x27 #10

Closed dev747368 closed 4 years ago

dev747368 commented 4 years ago

Also from batch importing the firmware bundle.

I think its in file /fw/MP51.fd/Volume 000 - EfiFirmwareFileSystemGuid/File 020 - 736eb068-8c01-47c5-964b-1c57bd5d4d64/ TE Image Section


2020-03-27 15:15:58 INFO  (ImportBatchTask) Imported firmware_testing:/fw/MP51.fd/Volume 000 - EfiFirmwareFileSystemGuid/File 021 - S3ResumePei/ TE Image Section, 965 of 972  
2020-03-27 15:15:58 INFO  (ImportBatchTask) Additional info:
----- Loading /Volume 000 - EfiFirmwareFileSystemGuid/File 021 - S3ResumePei/TE Image Section -----

2020-03-27 15:15:58 DEBUG (TELoader) Added .text section: 0xFFCB4ADC-0xFFCB4BBB  
2020-03-27 15:15:58 DEBUG (TELoader) Added .data section: 0xFFCB4BBC-0xFFCB4BDC  
2020-03-27 15:15:58 DEBUG (TELoader) Added .reloc section: 0xFFCB4BDC-0xFFCB4BEE  
2020-03-27 15:15:58 INFO  (ImportBatchTask) Imported firmware_testing:/fw/MP51.fd/Volume 000 - EfiFirmwareFileSystemGuid/File 020 - 736eb068-8c01-47c5-964b-1c57bd5d4d64/ TE Image Section, 966 of 972  
2020-03-27 15:15:58 INFO  (ImportBatchTask) Additional info:
----- Loading /Volume 000 - EfiFirmwareFileSystemGuid/File 020 - 736eb068-8c01-47c5-964b-1c57bd5d4d64/TE Image Section -----

2020-03-27 15:15:58 DEBUG (TELoader) Added .text section: 0x100003F8-0x10000D1C  
2020-03-27 15:15:58 DEBUG (TELoader) Added .rdata section: 0x10000D38-0x10000D43  
2020-03-27 15:15:58 DEBUG (TELoader) Added .data section: 0x10000D58-0x100011F8  
2020-03-27 15:15:58 DEBUG (TELoader) Added .reloc section: 0x100011F8-0x1000127A  
2020-03-27 15:15:58 INFO  (ImportBatchTask) Imported firmware_testing:/fw/MP51.fd/Volume 006 - EfiFirmwareFileSystemGuid/File 055 - SmmRelocatePei/ TE Image Section, 967 of 972  
2020-03-27 15:15:58 INFO  (ImportBatchTask) Additional info:
----- Loading /Volume 006 - EfiFirmwareFileSystemGuid/File 055 - SmmRelocatePei/TE Image Section -----

2020-03-27 15:15:58 DEBUG (TELoader) Added .text section: 0xFFFFF300-0xFFFFF467  
2020-03-27 15:15:58 DEBUG (TELoader) Added _TEXT_RE section: 0xFFFFF480-0xFFFFF4ED  
2020-03-27 15:15:58 DEBUG (TELoader) Added _TEXT_PR section: 0xFFFFF500-0xFFFFFFD0  
2020-03-27 15:15:58 ERROR (TELoader) Terse Executable (TE) Loader: Address Overflow in add: ffffffe0 + 0x27 ghidra.program.model.address.AddressOverflowException: Address Overflow in add: ffffffe0 + 0x27
    at ghidra.program.model.address.AbstractAddressSpace.addNoWrap(AbstractAddressSpace.java:455)
    at ghidra.program.model.address.GenericAddressSpace.addNoWrap(GenericAddressSpace.java:21)
    at ghidra.program.model.address.GenericAddress.addNoWrap(GenericAddress.java:218)
    at ghidra.program.database.mem.MemoryMapDB.checkRange(MemoryMapDB.java:1855)
    at ghidra.program.database.mem.MemoryMapDB.createInitializedBlock(MemoryMapDB.java:514)
    at ghidra.program.flatapi.FlatProgramAPI.createMemoryBlock(FlatProgramAPI.java:329)
    at firmware.uefi_te.TELoader.load(TELoader.java:116)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.doLoad(AbstractLibrarySupportLoader.java:346)
    at ghidra.app.util.opinion.AbstractLibrarySupportLoader.loadProgram(AbstractLibrarySupportLoader.java:83)
    at ghidra.app.util.opinion.AbstractProgramLoader.load(AbstractProgramLoader.java:112)
    at ghidra.plugins.importer.tasks.ImportBatchTask.doImportApp(ImportBatchTask.java:148)
    at ghidra.plugins.importer.tasks.ImportBatchTask.doImportBatchGroup(ImportBatchTask.java:127)
    at ghidra.plugins.importer.tasks.ImportBatchTask.doBatchImport(ImportBatchTask.java:116)
    at ghidra.plugins.importer.tasks.ImportBatchTask.run(ImportBatchTask.java:91)
    at ghidra.util.task.Task.monitoredRun(Task.java:126)
    at ghidra.util.task.TaskRunner.lambda$startTaskThread$1(TaskRunner.java:94)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)

2020-03-27 15:15:59 INFO  (ImportBatchTask) Imported firmware_testing:/fw/MP51.fd/Volume 008 - 04adeead-61ff-4d31-b6ba-64f8bf901f5a/File 002 - VolumeTopFile/ TE Image Section, 968 of 972  
2020-03-27 15:15:59 INFO  (ImportBatchTask) Additional info:
----- Loading /Volume 008 - 04adeead-61ff-4d31-b6ba-64f8bf901f5a/File 002 - VolumeTopFile/TE Image Section -----

2020-03-27 15:15:59 DEBUG (TELoader) Added .text section: 0xFFFF02EC-0xFFFF07A3  
2020-03-27 15:15:59 DEBUG (TELoader) Added .data section: 0xFFFF07AC-0xFFFF07CC  
2020-03-27 15:15:59 DEBUG (TELoader) Added .reloc section: 0xFFFF07CC-0xFFFF07DE  
2020-03-27 15:15:59 INFO  (ImportBatchTask) Imported firmware_testing:/fw/MP51.fd/Volume 008 - 04adeead-61ff-4d31-b6ba-64f8bf901f5a/File 001 - 7da04c46-2e86-4a24-b50b-3e6c445d730f/ TE Image Section, 969 of 972  
2020-03-27 15:15:59 INFO  (ImportBatchTask) Additional info:
----- Loading /Volume 008 - 04adeead-61ff-4d31-b6ba-64f8bf901f5a/File 001 - 7da04c46-2e86-4a24-b50b-3e6c445d730f/TE Image Section -----

2020-03-27 15:15:59 DEBUG (TELoader) Added .text section: 0xFFFFF320-0xFFFFF487  
2020-03-27 15:15:59 DEBUG (TELoader) Added _TEXT_RE section: 0xFFFFF4A0-0xFFFFF50D  
2020-03-27 15:15:59 DEBUG (TELoader) Added _TEXT_PR section: 0xFFFFF520-0xFFFFFFD0  
2020-03-27 15:15:59 ERROR (TELoader) Terse Executable (TE) Loader: Address Overflow in add: ffffffe0 + 0x27 ghidra.program.model.address.AddressOverflowException: Address Overflow in add: ffffffe0 + 0x27
    at ghidra.program.model.address.AbstractAddressSpace.addNoWrap(AbstractAddressSpace.java:455)
    at ghidra.program.model.address.GenericAddressSpace.addNoWrap(GenericAddressSpace.java:21)
    at ghidra.program.model.address.GenericAddress.addNoWrap(GenericAddress.java:218)
    at ghidra.program.database.mem.MemoryMapDB.checkRange(MemoryMapDB.java:1855)
al3xtjames commented 4 years ago

A bit late, but thanks! It looks like this binary has an invalid .data section (this is a 32-bit TE, yet .data goes past 0xFFFFFFFF). It looks like IDA just prints a warning and skips such sections, so I did the same.