Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bindiff unable to process statically linked binaries exported with BinExport from Ghidra (flow graph already attached error) #34

Open
paul-abb opened this issue Feb 15, 2024 · 8 comments
Labels
bug Something isn't working

Comments

@paul-abb
Copy link

Describe the bug
Bindiff is unable to process statically linked binaries exported by Ghidra with BinExport.

I have not tried BinExport with IDA.

To Reproduce
Steps to reproduce the behavior:
1.

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
A binary like this:
openssl: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=6143bc37788cd04527de063e16c35627b1610ea2, for GNU/Linux 3.2.0, not stripped

Will result in an error like this:
terminate called after throwing an instance of 'std::runtime_error'
E0215 14:29:31.721843 1785634 flow_graph.cc:85] Could not find basic block: 008D6BF0
E0215 14:29:31.721862 1785638 flow_graph.cc:85] Could not find basic block: 005A8E40
E0215 14:29:31.721827 1785635 flow_graph.cc:85] Could not find basic block: 0068A377
E0215 14:29:31.721854 1785637 flow_graph.cc:85] Could not find basic block: 00654090
E0215 14:29:31.721843 1785639 flow_graph.cc:85] Could not find basic block: 008E6230
what(): AttachFlowGraph: flow graph already attached 00401000

Environment (please complete the following information):

  • Ubuntu 23.10
  • Locale: US English
  • Disassembler and version: Ghidra 11.0 with BinExport 12 with BinDiff 8

Additional context
I have tried this with multiple statically compiled binaries and it seems to fail with the same error. Binaries that aren't statically linked do not have this error.

@paul-abb
Copy link
Author

To reproduce:
Compiile OpenSSL statically.
Analyze with Ghidra.
Export with BinExport plugin.
Attempt to diff with Bindiff.

Expected Behavior:
To successfully process the file the same as dynamically linked files.

@cblichmann cblichmann added the bug Something isn't working label Feb 16, 2024
@cblichmann
Copy link
Member

For convenience, can you attach two .BinExport files to this bug?

To me, this looks like an issue with the Ghidra extension and/or Ghidra's disassembly. BinDiff assumes that BinExport files are well-formed and self-consistent.

@paul-abb
Copy link
Author

openssl_static.zip
Ok attached

@paul-abb
Copy link
Author

Using Ida Free, the BinExport is able to be processed.

However, BinExport files from Ida and Ghidra don't seem to be compatible / comparable, I'm not sure if this is expected behavior or not.

@precurse
Copy link

I've noticed this with ESP32 binaries that I've wanted to compare as well. Ghidra exports are completely unusable and I don't have the luxury of using IDA Pro to get support for Xtensa / RISCV architectures.

@paul-abb
Copy link
Author

Thanks for the update, is it something you're investigating?

@precurse
Copy link

Nah, I'm just a user that ran into a similar issue. I was hoping to help out in case someone was looking into resolving it

@cblichmann
Copy link
Member

We should probably move this over to the BinExport repo (filed google/binexport#143 there).

However, BinExport files from Ida and Ghidra don't seem to be compatible / comparable, I'm not sure if this is expected behavior or not.

Yes, this is expected. While I tried to make the exporters behave similar, the disassemblers are very different, so the files they produce will be as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants