search

panda-re / panda

Platform for Architecture-Neutral Dynamic Analysis
https://panda.re
Other
2.48k stars 479 forks source link

Hooks plugin can segfault from pypanda #818

Closed AndrewFasano closed 3 years ago

AndrewFasano commented 3 years ago

From pypanda, the hooks plugin segfaults unless you include extra_args=['-s'] to your pandare.panda constructor.

Looks to be caused because panda hasn't initialized a gdbserver object but it's trying to use one anyway.

[Switching to Thread 0x7fffc08f7700 (LWP 1411066)]
0x00007ffff38f0d97 in gdb_set_stop_cpu (cpu=cpu@entry=0xee4c50) at /home/fasano/panda/gdbstub.c:1559
1559        gdbserver_state->c_cpu = cpu;
(gdb) bt
#0  0x00007ffff38f0d97 in gdb_set_stop_cpu (cpu=cpu@entry=0xee4c50)
    at /home/fasano/panda/gdbstub.c:1559
#1  0x00007ffff38e5636 in cpu_handle_guest_debug (cpu=0xee4c50) at /home/fasano/panda/cpus.c:914
#2  0x00007ffff38e5636 in qemu_tcg_cpu_thread_fn (arg=<optimized out>)
    at /home/fasano/panda/cpus.c:1300
#3  0x00007ffff77ca6db in start_thread (arg=0x7fffc08f7700) at pthread_create.c:463
#4  0x00007ffff7b0371f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb) p gdbserver_state
$1 = (GDBState *) 0x0
lacraig2 commented 3 years ago

@AndrewFasano Is it just unnamed hooks?

It looks like this code here doesn't save a reference to the hook if it doesn't have a name, which would lead to ffi garbage collecting and eventual segfaulting.

https://github.com/panda-re/panda/blob/4b2a30c335ae2acc0ba558d4d5faee471eaf7c7d/panda/python/core/pandare/panda.py#L2441-L2444

Reasonable patch would be generating a uid for the function as a name.

AndrewFasano commented 3 years ago

Given that we use hooks all the time, I'm assuming this is fixed by now.