angr / tracer

Utilities for generating dynamic traces
BSD 2-Clause "Simplified" License
88 stars 28 forks source link

Adding support for full_relro #19

Closed bannsec closed 7 years ago

bannsec commented 7 years ago

Ran into a problem tracing a binary that was compiled with FULLRELRO. Turns out, tracer is making an assumption that the binary is partial relro and needs to be resolved once each time.

My patch to this is to add a check that simply walks bb_cnt up until the dynamic trace is outside of the plt section. This allows it to be more general and cover all the relro possibilities, as well as not having to track a set of resolved functions.

Tested this against a full and partial relro binary and it seems to work appropriately.

salls commented 7 years ago

This is much nicer. Thanks!