search

google / vxsig

Automatically generate AV byte signatures from sets of similar binaries.
Apache License 2.0
259 stars 33 forks source link

Error generating signatures #3

Closed r0ny123 closed 5 years ago

r0ny123 commented 5 years ago

Some of the bindiff files from testdata are creating error while generating signatures with vxsig. For example, this one https://github.com/google/vxsig/blob/master/vxsig/testdata/61971471cedcb4daed8d07ad79297568ffdaa17eb4ff301dc953cfafa91a4507_vs_8433c9a6345d210d2196096461804d7137bbf2a6b71b20cc21f4ecf7d15ef6c2.BinDiff Some of them are good to go.

Here's the error shown below image

cblichmann commented 5 years ago

Took a look at this. Some of the files in testdata/ are still in BinExport v1 format that was never open sourced. It has a custom (non-protobuf) file header and consists of multiple proto messages:

// A .BinExport v1 file contains a header, a Meta message, a Callgraph message
// and an arbitrary number of flow graph messages in this order.
// The header is binary, little endian and contains:
//   uint32          meta_offset;         // file offset for the meta message
//   uint32          call_graph_offset;   // file offset for the call graph
//   uint32          num_flow_graphs;     // number of flow graph messages
// The following are repeated n times with n = number of flow graphs
//     uint64        flow graph address;  // entry point address of flow graph
//     uint32        flow graph offset;   // file offset for the flow graph
// ...

Thus, parsing these as BinExport v2 will inevitably fail. I updated the error handling code to show a better error message in this case (470f04635c4bb8007035bf1fa4f529b80f6e6d3b).

For the second part, what do you mean by "Its also creating this error for bindiff files, generated using Bindiff 5"? BinDiff 5 should work with BinExport v2 files exclusively.

r0ny123 commented 5 years ago

let's say, I generated this bindiff file using two binaries (I used Bindiff 5), contained in this zip (test.zip), and when I tried to produce signatures using vxsig, it returned the same error as I mentioned earlier.

cblichmann commented 5 years ago

Ah, I see. The zip file you sent me contains just the .BinDiff file. For VxSig to work, it also need .BinExport files in order to extract the instruction bytes. Those are not saved by BinDiff.

r0ny123 commented 5 years ago

Oh. thanks for letting me know, now I got it.