e-m-b-a/emba

Huge number of false positives for module S14 weak function check (radare)

開放

#1,319 建立於 2024年9月23日

 (6 則留言) (0 個反應) (0 位負責人)Shell (314 個分叉)auto 404
Core modules (Sxx)EMBAbughelp wantedstale

倉庫指標

星標
 (3,565 顆星)
PR 合併指標
 (PR 指標待抓取)

描述

Describe the bug The Grep commands for identifying weak functions in module S14 are very permissive, leading to a huge number of false positives if identifiers in the binary contain specific keywords like "system". This skews the statistics and hides real weak functions. As an example, the boost_filesystem file from the Boost library is used below.

To Reproduce Steps to reproduce the behavior:

  1. EMBA installation 4.1.0
  2. Use libboost_filesystem.so.1.84.0 from https://freebsd.pkgs.org/14/freebsd-aarch64/boost-libs-1.84.0.pkg.html
  3. Start EMBA with the following parameters: Any as long as module S14 is executed
  4. See results in HTML report at html-report/s14_weak_func_radare_check/vul_func_XXX_system-libboost_filesystem.so.1.84.0.html. Many matches will look as follows, which is definitely not a common weak "system" function:
add r1, pc
blx rsym._ZNK5boost10filesystem15directory_entry12refresh_implEPNS_6system10error_codeE
ldr r0, [r4, 0x14]

Expected behavior Identifiers just containing the keywords out-of-context should not be flagged. The Regex used for flagging these issues should be adapted. This may be hard, as we still want to identify legit weak function wrappers and variations.

Screenshots N/A

Desktop

  • OS: Kali Linux 2024.1
  • EMBA version: v4.1.0
  • Installation method: default with up to date docker image

Priority issue Are you already a Sponsor? - N

Additional context Add any other context about the problem here.

貢獻者指南