search

crytic / ethersplay

EVM dissassembler
GNU Affero General Public License v3.0
834 stars 116 forks source link

Indefinite Loop Analysis #22

Closed gaasedelen closed 6 years ago

gaasedelen commented 6 years ago

With a number of contracts, I've encountered cases where Ethersplay gets stuck attempting to explore loops. In such cases, it may fail to explore the rest of the contract and BN will perpetually spit out an 'analysis' status message.

Sample contract: poc.zip

To repro, simply open poc.bytecode with BinaryNinja + Ethersplay.

The analysis for the provided PoC gets stuck within dispatch. Granted, the dispatch for this contract is a bit of a monstrosity.

I can grab a few more contracts demonstrating similar behavior if needed.

gaasedelen commented 6 years ago

I recognize that the initial PoC is a bit crazy, so here's something more manageable.

Sample contract: poc2.zip

Ethersplay gets trapped in the isActive() function, queuing / undoing the same exploration action.

jiggity

joshwatson commented 6 years ago

These contracts work with master now