search

redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.85k stars 127 forks source link

better check for THUMB mode, and try CB addr as Thumb if not found in… #304

Closed EdwardLarson closed 1 year ago

EdwardLarson commented 1 year ago

…itially

One sentence summary of this PR (This should go in the CHANGELOG!)

Link to Related Issue(s) For some Thumb binaries there were 2 errors:

  1. The complex block could not be found by address. The problem was that the address that angr had for the complex block was the "thumbified" address, with LSB set to zero, while the address we stored in OFRAK for the complex block was the "de-thumbified" address with LSB cleared. It is this "de-thumbified" address that the AngrComplexBlockUnpacker was looking for and could not find.
  2. Basic blocks were not correctly identified as being in Thumb mode because the architecture that angr analyzed for the binary did not include "thumb" in the name. So the capstone disassembly was nonsense, disassembling Thumb instructions as ARM.

Please describe the changes in your request. Fix the first issue by checking for a complex block with the address's LSB set to 1 if the complex block could not be found ith LSB set to 0.

Fix the second issue by checking the address of the basic block that angr gives us is "thumbified" with LSB set 1, and use that to determine if the basic block is Thumb, rather than the name of the global architecture.

Add a new PIE Thumb test case for all disassembler backends.

Fix another ofrak_angr issue with data word extraction - the CB bounds could be over-eager and include data words which would be erroneously unpacked, so now data words are only extracted if they are referenced by basic blocks which have actually been unpacked from the CB.

Anyone you think should look at this, specifically?

whyitfor commented 1 year ago

@EdwardLarson, this looks like it could use an angr chaangelog entry?