5.8.8 release produces different output when run in docker -- `pdf entry` includes instructions after `call ExitProcess`

[attilamester]

Environment

• local environment:

  • Ubuntu 22.04.03
  • r2:

    $ r2 -v
    radare2 5.8.8 0 @ linux-x86-64
    birth: git.5.8.8 2024-01-13__19:43:19
    commit: 5.8.8
    options: gpl release -O? cs:5 cl:2 make

• Dockerfile:

  
  # =================
  FROM python:3.8-slim as base
  # =================

WORKDIR /usr/callgraph

RUN apt-get update -y && \ apt-get install -y --no-install-recommends curl wget build-essential graphviz graphviz-dev git && \ python3 -m pip install pip==23.0 && \ apt-get clean all && rm -rf /var/lib/apt/lists/ /tmp/ /var/tmp/*

RUN curl -Ls https://github.com/radareorg/radare2/releases/download/5.8.8/radare2-5.8.8.tar.xz | tar xJv && \ cd radare2-5.8.8 && sed -i "265 i patch-capstone capstone-patch:" ./shlr/Makefile && ./sys/install.sh && \ apt-get clean all && rm -rf /var/lib/apt/lists/ /tmp/ /var/tmp/*

COPY ./requirements.txt . RUN python3 -m pip install pygraphviz==1.6 --install-option="--include-path=/usr/include/graphviz" --install-option="--library-path=/usr/lib/graphviz/" && \ python3 -m pip install -r requirements.txt

=================

FROM python:3.8-slim as main

=================

WORKDIR /usr/callgraph

COPY --from=base /usr/local/bin/python3.8 /usr/local/bin/python3.8 COPY --from=base /usr/local/lib/python3.8/site-packages /usr/local/lib/python3.8/site-packages COPY --from=base /usr/lib/x86_64-linux-gnu /usr/lib/x8664-linux-gnu COPY --from=base /usr/include/graphviz /usr/include/graphviz COPY --from=base /usr/share/graphviz /usr/share/graphviz COPY --from=base /usr/local/lib/radare2 /usr/local/lib/radare2 COPY --from=base /usr/local/bin/radare2 /usr/local/bin/radare2 COPY --from=base /usr/local/share/radare2 /usr/local/share/radare2 COPY --from=base /usr/local/bin/r2 /usr/local/bin/r2 COPY --from=base /usr/local/lib/libr*.so /usr/local/lib/

COPY ./src ./src COPY ./test ./test

CMD ["python3", "-m", "pytest", "-ra", "./test/test.py"]

## Description

* testing on malwarebazaar sample (sha256:853fa18adc3f9263a0f98a9a257dd70d7e1aee0545ab47a114f44506482bd188)
* running r2 on sample, then `aaa` command, then `pdf entry0`
* the local r2 misses 4 instructions after the `call ExitProcess`
* local r2 output (extract):

│ └─└└└─> 0x0040c2f8 6a01 push 1 ; 1 ; UINT uExitCode └ 0x0040c2fa ff1568d04000 call dword [sym.imp.KERNEL32.dll_ExitProcess] ; 0x40d068 ; "n\xdc" ; VOID ExitProcess(UINT uExitCode) [0x0040be60]

* dockerized r2 output (extract)

│ └─└└└─> 0x0040c2f8 6a01 push 1 ; 1 │ 0x0040c2fa ff1568d04000 call dword [sym.imp.KERNEL32.dll_ExitProcess] ; 0x40d068 ; "n\xdc" │ 0x0040c300 33c0 xor eax, eax │ 0x0040c302 8be5 mov esp, ebp │ 0x0040c304 5d pop ebp └ 0x0040c305 c21000 ret 0x10 [0x0040be60]> r2 -v radare2 5.8.8 0 @ linux-x86-64 birth: git.5.8.8 2024-01-13__16:40:45 commit: 5.8.8 options: gpl release -O? cs:5 cl:2 make [0x0040be60]>

## Test

<!-- Steps to reproduce the issue and provide files/links/images/.. -->

[attilamester]

I mention that IDA Pro 6's output of GenFuncGdl for that entry node matches the local r2 output version - so, ending with call ExitProcess.

[trufae]

Your r2 installation is missing some support files. The sdb files determine info like noreturn functions, signatures, types and structs and other stuff. So copying the files is not enough. Do a proper installation inside the docker and it should work.

alternatively you can build r2 with gperf which statically links the sdb files inside the binary so it doesnt depend on external files to work

[trufae]

Uhm seems like you are copying the share directory too.. which should be enough. You can try with the tn command and see if its listed as a noreturn type

[attilamester]

@trufae you were right! Thanks, I somehow overlooked the tiny detail that I have a multistage docker build and am copying the files :D so, I did as you suggested, commented the second build stage and now all is good. But still, what could have been the problem? Does radare store files somewhere outside these paths?

# # =================
# FROM python:3.8-slim as main
# # =================
#
# WORKDIR /usr/callgraph
#
# COPY --from=base /usr/local/bin/python3.8 /usr/local/bin/python3.8
# COPY --from=base /usr/local/lib/python3.8/site-packages /usr/local/lib/python3.8/site-packages
# COPY --from=base /usr/lib/x86_64-linux-gnu /usr/lib/x86_64-linux-gnu
# COPY --from=base /usr/include/graphviz /usr/include/graphviz
# COPY --from=base /usr/share/graphviz /usr/share/graphviz
# COPY --from=base /usr/local/lib/radare2 /usr/local/lib/radare2
# COPY --from=base /usr/local/bin/radare2 /usr/local/bin/radare2
# COPY --from=base /usr/local/share/radare2 /usr/local/share/radare2
# COPY --from=base /usr/local/bin/r2 /usr/local/bin/r2
# COPY --from=base /usr/local/lib/libr_*.so /usr/local/lib/

Because I would need the multistage build, it reduces significantly my image size. Thanks in advance! Or, could you provide me some docs regarding the gperf installation of radare2? :pray:

[attilamester]

Update Found out that the missing folder was the original release directory, resulting from this RUN curl -Ls https://github.com/radareorg/radare2/releases/download/5.8.8/radare2-5.8.8.tar.xz | tar xJv && \. If I keep that folder in the docker container, everything works fine.

But it's 413MB so I would like to keep only those files which are necessary. Can you help me with this please?

Update 2 Adding the following line at the end of the 2. build stage solves the issue. COPY --from=base /usr/callgraph/radare2-5.8.8/libr /usr/callgraph/radare2-5.8.8/libr. But it means 232MB plus size for the container.

[trufae]

The sys/install.sh uses symlinks for installation. Uou should better use a destdir for that purpose like this:

./configure —prefix=/use export CFLAGS=“-Os -flto” make -j4 make install DESTDIR=/tmp/r2

then in the COPY step you just take the files under /tmp/r2/* and place the in the root directory of the target image.

the -Os will reduce the build size and the link time optimization will also help on this

after this you should be able to remove the builddir and only keep the target files.

if you are using debian there’s also a .deb in the release page, no need to build from source

[trufae]

Hope that helps!

[attilamester]

You are amazing, thanks for you help! Yes, this helps a lot :)