redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.82k stars 128 forks source link

Fix Ghidra serializing negative 64-bit addresses #474

Closed rbs-afflitto closed 1 month ago

rbs-afflitto commented 1 month ago

One sentence summary of this PR (This should go in the CHANGELOG!)

Link to Related Issue(s) N/A

Please describe the changes in your request. The OFRAK Ghidra scripts use %d string format of long integers when building JSON messages. In Java, this will be a signed decimal, but OFRAK expects an unsigned decimal. This causes problems in 64-bit Linux kernels, where commonly the address space is in the negative range. This change uses Long.toUnsignedString to format all long integers as unsigned before serializing to JSON. This PR also adds a test case which uses an elf with a negative address range.

Anyone you think should look at this, specifically? @whyitfor @SamL98

SamL98 commented 1 month ago

LGTM. We should really use an actual JSON library in the ghidra scripts eventually.