mandiant / flare-ida

IDA Pro utilities from FLARE team
Apache License 2.0
2.24k stars 464 forks source link

idb2pat RuntimeError: zrange only iterates from smaller to bigger numbers only #35

Closed bjdudu closed 8 years ago

bjdudu commented 8 years ago
RuntimeError: zrange only iterates from smaller to bigger numbers only: 9531258, 9531255
ERROR:idb2pat:make_func_sigs:Failed to create signature for function at 0x916f20L (golang_org_x_net_html_atom_match)
INFO:idb2pat:make_func_sigs:[ 10372 / 10380 ] golang_org_x_net_html_atom_Lookup 0x916f90L
ERROR:idb2pat:make_func_sigs:zrange only iterates from smaller to bigger numbers only: 9531361, 9531358
Traceback (most recent call last):
  File "D:/IDAPro6.8/python/idb2pat.py", line 392, in make_func_sigs
    sigs.append(make_func_sig(config, f))
  File "D:/IDAPro6.8/python/idb2pat.py", line 240, in make_func_sig
    ref_loc = find_ref_loc(config, ea, ref)
  File "D:/IDAPro6.8/python/idb2pat.py", line 163, in find_ref_loc
    for i in zrange(ea, get_item_end(ea) - config.pointer_size):
  File "D:/IDAPro6.8/python/idb2pat.py", line 37, in zrange
    raise RuntimeError("zrange only iterates from smaller to bigger numbers only: {:d}, {:d}".format(start, end))
williballenthin commented 8 years ago

can you provide the source binary?

i added this check and exception to explicitly check one of my assumptions. seems you find a binary that breaks the assumption. i'd like to see how its structured so i can improve the zrange function and use.

bjdudu commented 8 years ago

any golang 1.7 binaries, platom linux x64

bjdudu commented 8 years ago

https://drive.google.com/file/d/0B3ZdizARhBAtcWNLcjVISkpOdzQ/view?usp=sharing

This is a golang helloworld binary, you can have a test

williballenthin commented 8 years ago

great! i'll take a look

williballenthin commented 8 years ago

i believe this was fixed in 0fe3e5a53b5041635c191990955f45cf723174d3