radareorg/radare2

Base addresses not setting properly on PIE enabled binaries

Open

#9.051 aberto em 19 de dez. de 2017

Ver no GitHub
 (7 comments) (0 reactions) (0 assignees)C (3.229 forks)batch import
RBingood first issue

Métricas do repositório

Stars
 (23.826 stars)
Métricas de merge de PR
 (Mesclagem média 16h 24m) (99 fundiu PRs em 30d)

Description

radare2 2.2.0-git 16757 @ linux-x86-64 git.2.1.0-173-gf06a360
commit: f06a36097e7a310dbbc2ccd08f790119c31e100b build: 2017-12-19__18:44:21

While setting the base address with the -B switch in r2, it loads the base address fine.

└─▪ radare2 -B 0x40000000 funmail 
 -- The '?' command can be used to evaluate math expressions. Like this: '? (0x34+22)*4'
[0x40000540]> ij~{bin.pic}
true
[0x40000540]> 

But not when the e flag is being set even after reloading the binary.

└─▪ radare2 -e "bin.baddr=0x40000000" funmail 
 -- Setup dbg.fpregs to true to visualize the fpu registers in the debugger view.
[0x00000540]> ij~{bin.pic}
true
[0x00000540]> oo
[0x00000540]>

The same applies to setting bin.baddr from the console:

└─▪ radare2 funmail 
 -- Use scr.accel to browse the file faster!
[0x00000540]> e bin.baddr = 0x40000000
[0x00000540]> oo
[0x00000540]>

Additionally: after the binary is loaded with -B and debugged, the base address gets thrown off.

└─▪ radare2 -B 0x40000000 funmail 
 -- The more 'a' you add after 'aa' the more analysis steps are executed.
[0x40000540]> doo
Process with PID 11052 started...
File dbg:///vagrant/tuctf/rev/funmail  reopened in read-write mode
= attach 11052 11052
WARNING: bin_strings buffer is too big (0xffffffffa99de26c). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
WARNING: bin_strings buffer is too big (0xffffffffa99dcf44). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
11052
[0xf77d1a20]> dcu main
Continue until 0x56624b27 using 1 bpsize
hit breakpoint at: 56624b27
[0x56624b27]> s main
[0x56624b27]> pd 4
            ;-- main:
            ;-- main:
            ;-- eip:
            0x56624b27      8d4c2404       lea ecx, esp + 4            ; 4
            0x56624b2b      83e4f0         and esp, 0xfffffff0
            0x56624b2e      ff71fc         push dword [ecx - 4]
            0x56624b31      55             push ebp
[0x56624b27]> ij~{bin.pic}
true
[0x56624b27]>

The above is consistent with setting base address with bin.baddr also

Guia do colaborador