radareorg/radare2

Base addresses not setting properly on PIE enabled binaries

Open

#9 051 ouverte le 19 déc. 2017

Voir sur GitHub
 (7 commentaires) (0 réactions) (0 assignés)C (3 229 forks)batch import
RBingood first issue

Métriques du dépôt

Stars
 (23 826 stars)
Métriques de merge PR
 (Merge moyen 16h 24m) (99 PRs mergées en 30 j)

Description

radare2 2.2.0-git 16757 @ linux-x86-64 git.2.1.0-173-gf06a360
commit: f06a36097e7a310dbbc2ccd08f790119c31e100b build: 2017-12-19__18:44:21

While setting the base address with the -B switch in r2, it loads the base address fine.

└─▪ radare2 -B 0x40000000 funmail 
 -- The '?' command can be used to evaluate math expressions. Like this: '? (0x34+22)*4'
[0x40000540]> ij~{bin.pic}
true
[0x40000540]> 

But not when the e flag is being set even after reloading the binary.

└─▪ radare2 -e "bin.baddr=0x40000000" funmail 
 -- Setup dbg.fpregs to true to visualize the fpu registers in the debugger view.
[0x00000540]> ij~{bin.pic}
true
[0x00000540]> oo
[0x00000540]>

The same applies to setting bin.baddr from the console:

└─▪ radare2 funmail 
 -- Use scr.accel to browse the file faster!
[0x00000540]> e bin.baddr = 0x40000000
[0x00000540]> oo
[0x00000540]>

Additionally: after the binary is loaded with -B and debugged, the base address gets thrown off.

└─▪ radare2 -B 0x40000000 funmail 
 -- The more 'a' you add after 'aa' the more analysis steps are executed.
[0x40000540]> doo
Process with PID 11052 started...
File dbg:///vagrant/tuctf/rev/funmail  reopened in read-write mode
= attach 11052 11052
WARNING: bin_strings buffer is too big (0xffffffffa99de26c). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
WARNING: bin_strings buffer is too big (0xffffffffa99dcf44). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
11052
[0xf77d1a20]> dcu main
Continue until 0x56624b27 using 1 bpsize
hit breakpoint at: 56624b27
[0x56624b27]> s main
[0x56624b27]> pd 4
            ;-- main:
            ;-- main:
            ;-- eip:
            0x56624b27      8d4c2404       lea ecx, esp + 4            ; 4
            0x56624b2b      83e4f0         and esp, 0xfffffff0
            0x56624b2e      ff71fc         push dword [ecx - 4]
            0x56624b31      55             push ebp
[0x56624b27]> ij~{bin.pic}
true
[0x56624b27]>

The above is consistent with setting base address with bin.baddr also

Guide contributeur