rizinorg / rizin

UNIX-like reverse engineering framework and command-line toolset.
https://rizin.re
GNU Lesser General Public License v3.0
2.7k stars 361 forks source link

Wrong `__stack_chk_guard` naming in ARMv7 binaries #2205

Open XVilka opened 2 years ago

XVilka commented 2 years ago

Work environment

Questions Answers
OS/arch/bits (mandatory) Debian ARMv7
File format of the file you reverse (mandatory) ELF
Architecture/bits of the file (mandatory) ARMv7 32bit
rizin -v full output, not truncated (mandatory) rizin 0.4.0-git @ linux-x86-64

commit: f40b5ef545c1956971411cd88bc269dbea78dea2, build: 2022-01-14__17:10:21

Expected behavior

aav.aav.0x000113b0 should become obj.__stack_chk_guard__GLIBC_2.4 or just __stack_chk_guard

Actual behavior

[0x000105f0]> s sym.CWE190_Integer_Overflow__char_fscanf_add_01_bad 
[0x000106e0]> pdf
            ; CALL XREF from main @ 0x10798
╭ sym.CWE190_Integer_Overflow__char_fscanf_add_01_bad ();
│           ; var int32_t var_ah @ fp-0xa
│           ; var int32_t var_9h @ fp-0x9
│           ; var int32_t var_8h @ fp-0x8
│           0x000106e0      push  {fp, lr}
│           0x000106e4      add   fp, sp, 4
│           0x000106e8      sub   sp, sp, 8
│           0x000106ec      ldr   r3, [aav.aav.0x000113b0]             ; [0x113b0:4]=0x21f0c obj.__stack_chk_guard__GLIBC_2.4
│           0x000106f0      ldr   r3, [r3]                             ; 0x113b0
│                                                                      ; aav.0x000113b0
│           0x000106f4      str   r3, [var_8h]                         ; 8
│           0x000106f8      mov   r3, 0
│           0x000106fc      mov   r3, 0x20
│           0x00010700      strb  r3, [var_ah]                         ; 0xa ; 10
│           0x00010704      ldr   r3, [obj.stdin]                      ; [0x22060:4]=0
│                                                                      ; obj.stdin__GLIBC_2.4
│           0x00010708      ldr   r3, [r3]                             ; 0x22060
│                                                                      ; obj.stdin__GLIBC_2.4
│           0x0001070c      sub   r2, fp, 0xa
│           0x00010710      ldr   r1, [str.c]                          ; [0x113ac:4]=0x6325 ; "%c" ; const char *format
│           0x00010714      mov   r0, r3                               ; FILE *stream
│           0x00010718      bl    sym.imp.__isoc99_fscanf              ; int fscanf(FILE *stream, const char *format, void *va_args)
│           0x0001071c      ldrb  r3, [var_ah]                         ; 0xa ; 10
│           0x00010720      add   r3, r3, 1
│           0x00010724      strb  r3, [var_9h]                         ; 9
│           0x00010728      ldrb  r3, [var_9h]                         ; 9
│           0x0001072c      mov   r0, r3                               ; int32_t arg1
│           0x00010730      bl    sym.printHexCharLine
│           0x00010734      mov   r0, r0
│           0x00010738      ldr   r3, [aav.aav.0x000113b0]             ; [0x113b0:4]=0x21f0c obj.__stack_chk_guard__GLIBC_2.4
│           0x0001073c      ldr   r2, [r3]                             ; 0x113b0
│                                                                      ; aav.0x000113b0
│           0x00010740      ldr   r3, [var_8h]                         ; 8
│           0x00010744      eors  r2, r3, r2
│           0x00010748      mov   r3, 0
│       ╭─< 0x0001074c      beq   0x10754
│       │   0x00010750      bl    sym.imp.__stack_chk_fail             ; void __stack_chk_fail(void)
│       ╰─> 0x00010754      sub   sp, fp, 4
╰           0x00010758      pop   {fp, pc}
[0x000106e0]> 

Steps to reproduce the behavior

[0x000105f0]> aaa
[0x000105f0]> s sym.CWE190_Integer_Overflow__char_fscanf_add_01_bad 
[0x000106e0]> pdf

Additional Logs, screenshots, source code, configuration dump, ...

rizin-2205-issue-binary.zip

do-min-o commented 1 year ago

@XVilka, is this issue still open? I want to work on this.

XVilka commented 1 year ago

@parthbansaliitr sure, go ahead