search

junxzm1990 / x86-sok

124 stars 20 forks source link

Sok appears to miss some functions. #5

Closed thaddywu closed 3 years ago

thaddywu commented 3 years ago

Hi, thanks so much for this wonderful tool. But I found SOK can't correctly resolve some functions from binary. Here below is an example in which SOK missed some functions. (e.g. _start, _dl_relocate_static_pie)

https://drive.google.com/file/d/1227_Am9DKcdtXN0T03297ecMyOmfqD2K/view?usp=sharing This is a simple program compiled with -O2 -m32 flags using your gcc. Could you please take a look at this?

bin2415 commented 3 years ago

Thanks for reporting. There are some functions that may not instrumented by our toolchains. The function are listed here. As for _dl_relocate_static_pie function, it is in glibc, so the glibc should be compiled by the our gcc toolchains and the environment should be set properly.

thaddywu commented 3 years ago

Thanks so much for your quick response. Just to clarify that you said some functions may not be instrumented, and I see _dl_relocate_static_pie is also included in that list you just posted. So I believe I have used the correct version of glibc compiled by your toolchain.

I have also seen function __i686.get_pc_thunk.bx missed by SOK. Though not being listed, I guess it comes from the same reason. But I have no idea why your gcc toolchains always shoot out this function into binaries in my environment while I don't see it in your binaries from the whole test suite. Is it caused by the difference from environments? Mine is Ubuntu 18.04.5 LTS (GNU/Linux 4.15.0-151-generic x86_64).

bin2415 commented 3 years ago

My environment is also Ubuntu 18.04 LTS.

One possible reason is that __i686.get_pc_thunk.reg is defined in libc(here). You could try to export CFLAGS like this and compile the program with the CFLAGS.

thaddywu commented 3 years ago

Thanks quite a lot for your kind reply! That really helps me a lot :)