search

s3team / uroboros

Infrastructure for Reassembleable Disassembling and Transformation
187 stars 56 forks source link

Can't find main symbol #6

Open soomin-kim opened 5 years ago

soomin-kim commented 5 years ago

Hi,

I've tried to reassemble Coreutils binaries with Uroboros, but it doesn't work. The first problem I've met was Uroboros is not able to find main function if it dosn't have specific assembly patterns.

The below is my Coreutils binary's _start function:

08048e30 <_start>:
 8048e30:       31 ed                   xor    %ebp,%ebp
 8048e32:       5e                      pop    %esi
 8048e33:       89 e1                   mov    %esp,%ecx
 8048e35:       83 e4 f0                and    $0xfffffff0,%esp
 8048e38:       50                      push   %eax
 8048e39:       54                      push   %esp
 8048e3a:       52                      push   %edx
 8048e3b:       e8 23 00 00 00          call   8048e63 <_start+0x33>
 8048e40:       81 c3 c0 a1 00 00       add    $0xa1c0,%ebx
 8048e46:       8d 83 30 b7 ff ff       lea    -0x48d0(%ebx),%eax
 8048e4c:       50                      push   %eax
 8048e4d:       8d 83 d0 b6 ff ff       lea    -0x4930(%ebx),%eax
 8048e53:       50                      push   %eax
 8048e54:       51                      push   %ecx
 8048e55:       56                      push   %esi
 8048e56:       c7 c0 35 b0 04 08       mov    $0x804b035,%eax
 8048e5c:       50                      push   %eax
 8048e5d:       e8 7e fe ff ff          call   8048ce0 <__libc_start_main@plt>
 8048e62:       f4                      hlt

If Uroboros track eax register, it can easily find the main is at 0x804b035.

Do you have a plan to use any simple data flow analysis to find main symbol so that it can find main function more generally?

Thank you.

s3team commented 5 years ago

thanks for the feedback. We’ll consider it in the future.

Dinghao

From: soomin-kim notifications@github.com Sent: Wednesday, April 3, 2019 8:22 AM To: s3team/uroboros uroboros@noreply.github.com Cc: Subscribed subscribed@noreply.github.com Subject: [s3team/uroboros] Can't find main symbol (#6)

Hi,

I've tried to reassemble Coreutils binaries with Uroboros, but it doesn't work. The first problem I've met was Uroboros is not able to find main function if it dosn't have specific assembly patterns.

The below is my Coreutils binary's _start function:

08048e30 <_start>:

8048e30: 31 ed xor %ebp,%ebp

8048e32: 5e pop %esi

8048e33: 89 e1 mov %esp,%ecx

8048e35: 83 e4 f0 and $0xfffffff0,%esp

8048e38: 50 push %eax

8048e39: 54 push %esp

8048e3a: 52 push %edx

8048e3b: e8 23 00 00 00 call 8048e63 <_start+0x33>

8048e40: 81 c3 c0 a1 00 00 add $0xa1c0,%ebx

8048e46: 8d 83 30 b7 ff ff lea -0x48d0(%ebx),%eax

8048e4c: 50 push %eax

8048e4d: 8d 83 d0 b6 ff ff lea -0x4930(%ebx),%eax

8048e53: 50 push %eax

8048e54: 51 push %ecx

8048e55: 56 push %esi

8048e56: c7 c0 35 b0 04 08 mov $0x804b035,%eax

8048e5c: 50 push %eax

8048e5d: e8 7e fe ff ff call 8048ce0 __libc_start_main@plt

8048e62: f4 hlt

If Uroboros track eax register, it can easily find the main is at 0x804b035.

Do you have a plan to use any simple data flow analysis to find main symbol so that it can find main function more generally?

Thank you.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHubhttps://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fs3team%2Furoboros%2Fissues%2F6&data=02%7C01%7Cduw12%40psu.edu%7C4a3d400215a445e0d55d08d6b7fcbde6%7C7cf48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C636898693503519461&sdata=WRrA1jUz40euGg9mVTZ2cjA5dUDWAuYv4hMNkKisi3g%3D&reserved=0, or mute the threadhttps://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAMy9mIUNklU4mMQosj74W1QhfoA0ka7Iks5vdEifgaJpZM4cZtR7&data=02%7C01%7Cduw12%40psu.edu%7C4a3d400215a445e0d55d08d6b7fcbde6%7C7cf48d453ddb4389a9c1c115526eb52e%7C0%7C0%7C636898693503529466&sdata=LSccf0y2TO2ivcMz8B5zSpnI1GYLhcY9pazLvdwiuYc%3D&reserved=0.