Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix/badbytes #48

Merged
merged 16 commits into from
Jul 31, 2022
Merged

Fix/badbytes #48

merged 16 commits into from
Jul 31, 2022

Conversation

Kyle-Kyle
Copy link
Collaborator

@Kyle-Kyle Kyle-Kyle commented Jul 29, 2022

angr/binaries#95

resolves #29

patch summary:

  1. record concrete register values so that we can use registers like xor rax, rax; ret. These gadgets are important for forging syscall numbers and also NULL when NULL is a bad byte (which is common)
  2. when writing data to memory, handle bad bytes separately. for example, when writing /sh/\x00, there is no way that we can write this value into memory directly if \x00 is a bad byte. but we can do it if we write /shX first and then overwrite the X with \x00\x00\x00\x00 (the register is set through gadgets like xor rax, rax; ret)
  3. utilize gadgets such as add rax, 10. These are useful for crafting syscall numbers.
  4. symbolically execute the register setter chain before returning it to make sure it actually sets registers correctly (I have seen cases where angrop thinks it found a good chain while the chain is wrong)
  5. remove the solve_cache optimization in gadget_finder. since the key is just the controlled ip, which is a controlled value on stack, many gadgets can have the same ip, which causes a lot of hash collision and lead us to miss a lot of simple gadgets like mov eax, 8; pop edi; ret. Removing this optimization increases our overhead, but also helps us find more simple and useful gadgets
  6. add testcases for finding gadgets and generating chains constrained by badbytes

@Kyle-Kyle
Copy link
Collaborator Author

I'll write a testcase for this PR

@Kyle-Kyle Kyle-Kyle requested a review from salls July 29, 2022 03:56
@github-actions
Copy link

github-actions bot commented Jul 29, 2022

Unit Test Results

30 tests  +23   30 ✔️ +23   23m 4s ⏱️ + 19m 47s
19 suites +12     0 💤 ±  0 
19 files   +12     0 ±  0 

Results for commit 82b8fd6. ± Comparison against base commit 6fc4119.

♻️ This comment has been updated with latest results.

@rhelmot rhelmot merged commit 2a53ad9 into master Jul 31, 2022
@rhelmot rhelmot deleted the fix/badbytes branch July 31, 2022 04:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Values passed on stack ignoring badbytes
2 participants