search

beehive-lab / mambo

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).
Apache License 2.0
318 stars 69 forks source link

MAMBO fails to run on kernel 6.5.0 #120

Open AlphaDaze opened 4 months ago

AlphaDaze commented 4 months ago

MAMBO cannot process ELF files with kernel version 6.5.0. Issue appears on latest builds of both Ubuntu 23.04 and 22.04.

System: aarch64 Ampere A1 running 64-bit Ubuntu 22.04 with kernel 6.5.0.

command: ./dbm /usr/bin/ls Output:

Unhandled auxv entry type: 27

I have downgraded to 5.15 as a workaround for now. I have not tested more recent kernels however, they may work.

IgWod commented 4 months ago

Hey,

We're aware of this problem - it has to do with newly added support for RSEQ - but we haven't released a workaround yet. In general it's safe to ignore those vectors, unless the application uses RSEQ. We're working on a clean solution to handle unsupported vectors, without crashing the application, but the actual support for RSEQ will take some time.

More information on RSEQ can be found here: https://github.com/torvalds/linux/blob/master/kernel/rseq.c