andreafioraldi / qasan

QASan is a custom QEMU 3.1.1 that detects memory errors in the guest using AddressSanitizer.
https://andreafioraldi.github.io/assets/qasan-secdev20.pdf
Other
337 stars 35 forks source link

SEGV when running a 32-bit binary #12

Closed spidermana closed 3 years ago

spidermana commented 4 years ago

Hello. I tried to run a 32-bit binary on an Ubuntu 16.04, which crashed with a SEGV instead.

System Details: Test on Ubuntu 16.04 LTS(x86_64)

Code:

//test.c
#include<stdio.h>
int main(){
    int a;
    a=1;
    return 0;
}

Command:

gcc -m32 ./test.c -o ./test
./build.py --arch i386
./qasan ./test

QASAN Output:

QEMU-AddressSanitizer:DEADLYSIGNAL
=================================================================
==3414==ERROR: QEMU-AddressSanitizer: SEGV on unknown address 0x00008d413dfc (pc 0x00008d413dfc bp 0x0000ffffdb49 sp 0x0000ffffdadc T3414)
    #0 0x00008d413dfc
    #1 0x0000ff7cf871 in strstr (/home/spiderman/qasan_32/libqasan.so+0x3871)

QEMU-AddressSanitizer can not provide additional info.
SUMMARY: QEMU-AddressSanitizer: 
==3414==ABORTING
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault (core dumped)

Probably QASAN_LOAD leads to it.

By the way, I got no problem running this binary on qasan-qemu. Do you have any idea?

andreafioraldi commented 4 years ago

Ubuntu 16.04 is too old and has a not supported libc. See https://github.com/andreafioraldi/qasan/issues/10 for the workaround.

andreafioraldi commented 4 years ago

Ok this is confirmed also with 18.04, it is a regression due to the refactoring of the backdoor code. Just pushed an hotfix https://github.com/andreafioraldi/qasan/commit/ac0e38c44097a6d3b9fd8c9b0b264dbda640ef5f