search

joleeee / rebg

gdb without the b
0 stars 0 forks source link

Missing Aarch64 / ARM64 Pointer Authentication #2

Closed joleeee closed 11 months ago

joleeee commented 11 months ago

Here is an example trace

   0 0x5500818c00 hint #0x22
   1 0x5500818c04 mov x0, sp
   2 0x5500818c08 bl #0x55008195d0
    3 0x55008195d0 stp x29, x30, [sp, #-0xf0]!
    4 0x55008195d4 adrp x1, #0x550083c000

Capstone disassembles the first instruction of a test program to hint #0x22, but gdb shows it as bti c:

0xffff95b0bc00 <_start>               bti    c
0xffff95b0bc04 <_start+4>             mov    x0, sp
0xffff95b0bc08 <_start+8>             bl     #_dl_start

If i assemble hint #0x22, then it assembled, and disassembled again to bti c when using godbolt,l:'5',n:'0',o:'Assembly+source+%231',t:'0')),k:28.877284595300267,l:'4',n:'0',o:'',s:0,t:'0'),(g:!((h:compiler,i:(compiler:gnuasarm64g1020,deviceViewOpen:'1',filters:(b:'0',binary:'1',binaryObject:'1',commentOnly:'0',debugCalls:'1',demangle:'0',directives:'0',execute:'1',intel:'0',libraryCode:'0',trim:'1'),flagsViewOpen:'1',fontScale:14,fontUsePx:'0',j:1,lang:assembly,libs:!(),options:'',overrides:!(),selection:(endColumn:7,endLineNumber:2,positionColumn:2,positionLineNumber:2,selectionStartColumn:7,selectionStartLineNumber:2,startColumn:2,startLineNumber:2),source:1),l:'5',n:'0',o:'+AArch64+binutils+2.35.1+(Editor+%231)',t:'0')),k:71.12271540469975,l:'4',n:'0',o:'',s:0,t:'0')),l:'2',n:'0',o:'',t:'0')),version:4)

Seems to be Pointer Authentication happening, but it's using hint op-codes because they are effectively NOP-s, so they just reused those. Apparently capstone v5 supports it, and it was released a few months ago, so we should really only have to update to that.