radareorg/radare2

Base addresses not setting properly on PIE enabled binaries

Open

#9,051 创建于 2017年12月19日

在 GitHub 查看
 (7 评论) (0 反应) (0 负责人)C (23,826 star) (3,229 fork)batch import
RBingood first issue

描述

radare2 2.2.0-git 16757 @ linux-x86-64 git.2.1.0-173-gf06a360
commit: f06a36097e7a310dbbc2ccd08f790119c31e100b build: 2017-12-19__18:44:21

While setting the base address with the -B switch in r2, it loads the base address fine.

└─▪ radare2 -B 0x40000000 funmail 
 -- The '?' command can be used to evaluate math expressions. Like this: '? (0x34+22)*4'
[0x40000540]> ij~{bin.pic}
true
[0x40000540]> 

But not when the e flag is being set even after reloading the binary.

└─▪ radare2 -e "bin.baddr=0x40000000" funmail 
 -- Setup dbg.fpregs to true to visualize the fpu registers in the debugger view.
[0x00000540]> ij~{bin.pic}
true
[0x00000540]> oo
[0x00000540]>

The same applies to setting bin.baddr from the console:

└─▪ radare2 funmail 
 -- Use scr.accel to browse the file faster!
[0x00000540]> e bin.baddr = 0x40000000
[0x00000540]> oo
[0x00000540]>

Additionally: after the binary is loaded with -B and debugged, the base address gets thrown off.

└─▪ radare2 -B 0x40000000 funmail 
 -- The more 'a' you add after 'aa' the more analysis steps are executed.
[0x40000540]> doo
Process with PID 11052 started...
File dbg:///vagrant/tuctf/rev/funmail  reopened in read-write mode
= attach 11052 11052
WARNING: bin_strings buffer is too big (0xffffffffa99de26c). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
WARNING: bin_strings buffer is too big (0xffffffffa99dcf44). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
11052
[0xf77d1a20]> dcu main
Continue until 0x56624b27 using 1 bpsize
hit breakpoint at: 56624b27
[0x56624b27]> s main
[0x56624b27]> pd 4
            ;-- main:
            ;-- main:
            ;-- eip:
            0x56624b27      8d4c2404       lea ecx, esp + 4            ; 4
            0x56624b2b      83e4f0         and esp, 0xfffffff0
            0x56624b2e      ff71fc         push dword [ecx - 4]
            0x56624b31      55             push ebp
[0x56624b27]> ij~{bin.pic}
true
[0x56624b27]>

The above is consistent with setting base address with bin.baddr also

贡献者指南