lunixbochs / patchkit

binary patching from Python
Other
631 stars 85 forks source link

Replacing a C function Error, Can't injecode c code to elf file #19

Open jinyu00 opened 7 years ago

jinyu00 commented 7 years ago
ubuntu:~/patchkit-master$ ./patch fun patch.py

[*] patch.py
 [+] replace_free()
  [LINK] printf
  [LINK] puts
  [LINK] strlen
Exception thrown by patch: /home/haclh/patchkit-master/patch.py replace_free
Traceback (most recent call last):
  File "/home/haclh/patchkit-master/core/patcher.py", line 69, in patch
    func(patchset)
  File "/home/haclh/patchkit-master/patch.py", line 10, in replace_free
    ''')
  File "/home/haclh/patchkit-master/core/context.py", line 301, in inject
    asm = compiler.compile(c, self.binary.linker)
  File "/home/haclh/patchkit-master/core/compiler.py", line 110, in compile
    asm = linker.post(asm, syms=syms)
  File "/home/haclh/patchkit-master/core/linker.py", line 177, in post
    asm = re.sub(find_ref, '0x%x' % self.resolve(ref), asm)
  File "/home/haclh/patchkit-master/core/linker.py", line 106, in resolve
    self.inject(sym)
  File "/home/haclh/patchkit-master/core/linker.py", line 101, in inject
    self.addrs.update(self.syms[sym][1].inject(self, sym))
  File "/home/haclh/patchkit-master/core/linker.py", line 39, in inject
    asm = compiler.compile(self.source, linker, syms=self.syms.keys())
  File "/home/haclh/patchkit-master/core/compiler.py", line 110, in compile
    asm = linker.post(asm, syms=syms)
  File "/home/haclh/patchkit-master/core/linker.py", line 177, in post
    asm = re.sub(find_ref, '0x%x' % self.resolve(ref), asm)
  File "/home/haclh/patchkit-master/core/linker.py", line 106, in resolve
    self.inject(sym)
  File "/home/haclh/patchkit-master/core/linker.py", line 101, in inject
    self.addrs.update(self.syms[sym][1].inject(self, sym))
  File "/home/haclh/patchkit-master/core/linker.py", line 39, in inject
    asm = compiler.compile(self.source, linker, syms=self.syms.keys())
  File "/home/haclh/patchkit-master/core/compiler.py", line 110, in compile
    asm = linker.post(asm, syms=syms)
  File "/home/haclh/patchkit-master/core/linker.py", line 177, in post
    asm = re.sub(find_ref, '0x%x' % self.resolve(ref), asm)
  File "/home/haclh/patchkit-master/core/linker.py", line 106, in resolve
    self.inject(sym)
  File "/home/haclh/patchkit-master/core/linker.py", line 101, in inject
    self.addrs.update(self.syms[sym][1].inject(self, sym))
  File "/home/haclh/patchkit-master/core/linker.py", line 45, in inject
    raw = pt.asm(asm, addr=addr, att_syntax=True)
  File "/home/haclh/patchkit-master/core/context.py", line 135, in asm
    return self.arch.asm(asm, addr=addr, att_syntax=att_syntax)
  File "/home/haclh/patchkit-master/core/arch.py", line 22, in asm
    return ''.join(map(chr, tmp))
TypeError: argument 2 to map() must support iteration

the patch.py source

def replace_free(pt):
    # pretend free() is at this address:
    old_free = 0x804fc4

    # inject a function to replace free()
    new_free = pt.inject(c=r'''
    void free_stub(void *addr) {
        printf("stubbed free(%p)\n", addr);
    }
    ''')
jinyu00 commented 7 years ago

And I also want to know how to use this tool to fix format string vulnerability in ctf games ^~^

lunixbochs commented 7 years ago

My intuition is bad compiler output. Join my slack (lunixbochs.herokuapp.com) if you want to chat.

jinyu00 commented 7 years ago

I have joined ^~^

ba0f3 commented 6 years ago

this may fixed by 129bf0e26aa87d3664b25308622201f21477cd5b