Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

wrong offsets for elftools.elf.elffile.GNUNeedVerSection #383

Open
fkil opened this issue Apr 11, 2023 · 0 comments
Open

wrong offsets for elftools.elf.elffile.GNUNeedVerSection #383

fkil opened this issue Apr 11, 2023 · 0 comments

Comments

@fkil
Copy link

fkil commented Apr 11, 2023

Description

The offset given to elffile.GNUVerNeedSection is the RVA, but it expects a file offset.
In most binaries, the RVA and file offset equal for this section, but in cases where it doesn't it leads to an error/exception.

Dirty solution would be to modify the to_rva() transform to to_raw() for this section, but not sure whether this could break things when the file stream is from a memory dump.
Another solution (which seems to be done for other sections) would be to set the stream variable to self.memory after the constructor.

Steps to reproduce the bug

open VMProtect obfuscated sample from https://github.com/JonathanSalwan/VMProtect-devirtualization/tree/main/vmp_binaries/binaries

Run with:

import angr
angr.Project(<sample>)

reproduce.zip

Environment

angr environment report

Date: 2023-04-11 14:38:29.523517
Running in virtual environment at /home/user/angr/venv
Platform: linux-x86_64
Python version: 3.10.10 (main, Mar 5 2023, 22:26:53) [GCC 12.2.1 20230201]
######## angr #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/angr
Pip version angr 9.2.45
Couldn't find git info
######## ailment #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/ailment
Pip version ailment 9.2.45
Couldn't find git info
######## cle #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/cle
Pip version cle 9.2.45
Couldn't find git info
######## pyvex #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/pyvex
Pip version pyvex 9.2.45
Couldn't find git info
######## claripy #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/claripy
Pip version claripy 9.2.45
Couldn't find git info
######## archinfo #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/archinfo
Pip version archinfo 9.2.45
Couldn't find git info
######## z3 #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/z3
Pip version z3-solver 4.10.2.0
Couldn't find git info
######## unicorn #########
Python found it in /home/user/angr/venv/lib/python3.10/site-packages/unicorn
Pip version unicorn 2.0.1.post1
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/user/angr/venv/lib/python3.10/site-packages/angr/state_plugins/../lib/angr_native.so', handle REDACTED at <0x7fREDACTED>>
unicorn: <CDLL '/home/user/angr/venv/lib/python3.10/site-packages/unicorn/lib/libunicorn.so.2', handle REDACTED at <0x7fREDACTED>>
pyvex: <cffi.api._make_ffi_library..FFILibrary object at <0x7fREDACTED>>
z3: <CDLL '/home/user/angr/venv/lib/python3.10/site-packages/z3/lib/libz3.so', handle REDACTED at <0x7fREDACTED>>

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant