wavestone-cdt / EDRSandblast

1.46k stars 272 forks source link

ExtractOffsets.py fails on linux #11

Closed laxa closed 1 year ago

laxa commented 1 year ago

The ExtractOffsets.py script fails to extract offsets on Linux. No crash happens but every time the offsets are all 0x0. It seems radare2 is crashing on pdb files on multiple version tested, explaining the current behavior, though I am not really sure where the problem is.

themaks commented 1 year ago

Hi Julien, I guess radare2 changed its output and the parsing somehow fails. This would happen less often if we used r2pipe, but it was unfortunately broken on Windows at the time of writing the script. Without any technical info, it’s impossible to say for sure what the problem was, let alone to reproduce the error :) Could you send us additional info, such as:

Cheers

laxa commented 1 year ago

Hello @themaks,

I tried using the radare2 from https://hub.docker.com/r/radare/radare2/ (I needed to patch the extract script with this image as the version parsing fails). I also tried with radare version 5.7.9 (cloned and compiled from master branch). The kernel version is ntoskrnl_17763-3469.exe but when using the -d switch, offsets were also 0x0 for every version. When using Windows, with r2 5.7.8 (officiel release package), offsets were successfully retrieved.

Cheers

themaks commented 1 year ago

Ah, did you see the little warning when launching the script ? WARNING : On Linux systems, radare2 may have trouble to download PDB files. If offsets are reported as 0, export R2_CURL=1 prior to running the script. ?

just run export R2_CURL=1 before running, and you're good to go ;)

(we need to rework the whole script and remove the r2 dependency, not very reliable cross platforms ...)

laxa commented 1 year ago

Hm, just tried again and it worked on the latest build. I mistested by using directly R2 instead of the script, my bad :), thanks for the help.