Open dennisfischer opened 5 years ago
I've checked with radare2 that the missing ret
is the problem. Inserting a ret
between both functions gives a correct analysis.
Extraction pass is part of the input dependency analyser @anahitH
Reason is the wrong analysis of radare2.
So far there seems to be no way to reliably find the size of a function. In my results I observed that the size seems to be incorrect only for the function main
. According to r2 maintainers, the size of the function that is reported by the analysis is allowed to be wrong. They wont consider this as a bug.
I tried to use the symbols instead which are reported by fj symbols
r2 command. This reduces the amount of errors significantly because the size of the main function is closer to the realsize. However, I'm still able to find cases in which the size is incorrect.
Currently it looks like the only way to solve this problem is to not use main
as a Checkee
.
Alright, let's keep this issue open until we find an adequate solution.
I'm observing an error during patching that is a result of an "incorrect" analysis of radare2. The error occurs from the IR below.
objdump
radare2 aa + afl
Observation: Radare2 identifies sig_handler as size
217 (0xd9)
. However, this is too large and includes alarm_handler function. The patcher receives this size and computes a hash that spans both functions. If alarm_handler contains any other guard that needs to be patched before sig_handler, then this can result in an incorrect hash at runtime.Further, sig_handler contains
unreachable
, but noret
, thus also noret
instruction is present in the binary (possible reason why radare2 fails!).However, have a look at the function before extraction was applied. It contains
ret void
that is now missing insig_handler
and is instead only insig_handler0
.