Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Analysis: missing xrefs on MIPS binaries #8245

Open
enovella opened this issue Aug 19, 2017 · 24 comments
Open

Analysis: missing xrefs on MIPS binaries #8245

enovella opened this issue Aug 19, 2017 · 24 comments
Assignees
@trufae
Labels
architectures-enhancements ESIL invalid MIPS MIPS architecture support issues RAnal RIO test-required
Projects
Analysis

Comments

@enovella
Copy link
Contributor

enovella commented Aug 19, 2017 •
edited
Loading

Hi,

Problem

Apparently, after analysis some MIPS binaries do not contain xrefs to strings.

Radare2 pulled from Git

[22:54  tmp] > r2 -v
radare2 1.7.0-git 15624 @ linux-x86-64 git.1.6.0-385-g622df1f
commit: 622df1fdce6877d214826388cbaa419241031d8f build: 2017-08-19__18:21:31

Analysis

[22:54  tmp] > r2 libminiupnpd.so 
 -- r2 talks to you. tries to make you feel well.
[0x000017b0]> aaaa
[read errro all flags starting with sym. and entry0 (aa)
Cannot find function 'entry0' at 0x000017b0
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
read errro
[x] Analyze all flags starting with sym. and entry0 (aa)
[ ] 
[aav: using from to 0x0 0x9a28
Using vmin 0xf4 and vmax 0x18d40
aav: using from to 0x0 0x9a28
Using vmin 0xf4 and vmax 0x18d40
[x] Analyze len bytes of instructions for references (aar)
[x] Analyze function calls (aac)
[x] Emulate code to find computed references (aae)
[read errro consecutive function (aat)
[x] Analyze consecutive function (aat)
[x] Constructing a function name for fcn.* and sym.func.* functions (aan)
[x] Type matching analysis for all functions (afta)
[0x000017b0]>

Missing xrefs to strings

[0x000075d0]> izq
0x75d0 50 49 Failed to open socket for receiving SSDP. EXITING
0x7604 17 16 socket(http): %m
0x7618 35 34 setsockopt(http, SO_REUSEADDR): 
[0x000017b0]> s 0x75d0
[0x000075d0]> pd 5
            ;-- str.Failed_to_open_socket_for_receiving_SSDP._EXITING:
            ;-- section_end..fini:
            ;-- section..rodata:
            0x000075d0     .string "Failed to open socket for receiving SSDP. EXITING" ; len=50 ; section 13 va=0x000075d0 pa=0x000075d0 sz=5152 vsz=5152 rwx=--r-- .rodata
            0x00007602      0000           unaligned
            0x00007603      00             unaligned
            ;-- str.socket_http_:__m:
            0x00007604     .string "socket(http): %m" ; len=17
            0x00007615      353135         unaligned
[0x000075d0]>

MIPS binary to reproduce

libminiupnpd.so.zip

Cheers
@XVilka
Copy link
Contributor

XVilka commented Aug 19, 2017

Hi! It's a known bug caused by migrating to siol. Currently ESIL is broken.

@enovella
Copy link
Contributor Author

Hi @XVilka ,

it is not only the read errro message but the missing xrefs to strings on MIPS binaries.This problem was found a month ago already.

Best,
enovella

@radare
Copy link
Collaborator

radare commented Aug 19, 2017 via email

@enovella
Copy link
Contributor Author

Hi @radare,

the issue was indeed happening a while ago. Also, totally understandable other priorities to be fixed first. :)

Cheers,
enovella

@radare
Copy link
Collaborator

radare commented Aug 20, 2017 via email

@enovella
Copy link
Contributor Author

Hi @radare ,

aav was tried with no luck in an old r2 installation (some months). Xrefs to strings are still missing.

Cheers

@radare
Copy link
Collaborator

radare commented Aug 25, 2017 via email

@radare
Copy link
Collaborator

radare commented Aug 25, 2017

screen shot 2017-08-25 at 18 26 27

@enovella
Copy link
Contributor Author

enovella commented Aug 29, 2017 •
edited
Loading

Hi @radare,

Sorry for my little delay :). There's odd behaviour when printing xrefs in the binary. For instance;

We try to obtain xrefs in the first string, however we do not appreciate XREF in the string below.

Flags in flagspace 'strings'. Press '?' for help.

 >  000 0x000075d0   50 str.Failed_to_open_socket_for_receiving_SSDP._EXITING
    001 0x00007604   17 str.socket_http_:__m
    002 0x00007618   35 str.setsockopt_http__SO_REUSEADDR_:__m
    003 0x0000763c   15 str.bind_http_:__m
    004 0x0000764c   17 str.listen_http_:__m
    005 0x00007660   40 str.Failed_to_open_socket_for_HTTP._EXITING
    006 0x00007688   64 str.Failed_to_open_socket_for_sending_SSDP_notify_messages._EXITING
    007 0x000076c8   19 str.gettimeofday__:__m
    008 0x000076dc   16 str.select_all_:__m
    009 0x000076ec   32 str.Failed_to_select_open_sockets.
    010 0x0000770c   17 str.accept_http_:__m
    011 0x00007720   27 str.HTTP_connection_from__s:_d
    012 0x0000773c   22 str.New_upnphttp___failed
    013 0x00007754   43 str.Failed_to_broadcast_good_bye_notifications

 Selected: str.Failed_to_open_socket_for_receiving_SSDP._EXITING

            ;-- str.Failed_to_open_socket_for_receiving_SSDP._EXITING:
            ;-- section_end..fini:
            ;-- section..rodata:
            0x000075d0     .string "Failed to open socket for receiving SSDP. EXITING" ; len=50 ; section 13 va=0x000075d0 pa=0x000075d0 sz=5152 vsz=5152 rwx=--r-- .rodata
            0x00007602      0000           unaligned
            0x00007603      00             unaligned
            ;-- str.socket_http_:__m:
            0x00007604     .string "socket(http): %m" ; len=17
            0x00007615      000000         unaligned
            0x00007616      0000           unaligned
            0x00007617      00             unaligned

However, when manually jumping into the code that should have the xref, we see the xref in there:

[0x000075d0]> s 0x000022f8
[0x000022f8]> pd 5
|           0x000022f8      24a575d0       addiu a1, a1, str.Failed_to_open_socket_for_receiving_SSDP._EXITING
|           0x000022fc      24020001       addiu v0, zero, 1
|           0x00002300      8fbf01ac       lw ra, 0x1ac(sp)
|           0x00002304      8fbe01a8       lw fp, 0x1a8(sp)
|           0x00002308      8fb701a4       lw s7, 0x1a4(sp)

Regarding the global pointer pointing to unallocated memory, I need more time to analyze it. But I can confirm you that the strings you were showing me in the screenshot, they appear without adjusting the $gp and they are shown just analyzing the binary with aa.

Will try to find some time to clearly spot the issue. Also, checking other binaries (attached goahead.zip) prove that xrefs are missing.

Cheers.

goahead.zip

@radare
Copy link
Collaborator

radare commented Aug 29, 2017 via email

@enovella
Copy link
Contributor Author

I realized that the same issue occurs on ARM32 binaries. At least, when r2-ing the crackme "validate" of the OWASP crackmes.

Binary: validate https://github.com/OWASP/owasp-mstg/tree/master/Crackmes/Android/License_01

@enovella enovella mentioned this issue Nov 7, 2017
Closed
@enovella
Copy link
Contributor Author

Any progress so far on this topic? I see similar issue at #8795

@Maijin
Copy link
Contributor

Maijin commented Nov 28, 2017

https://github.com/radare/radare2-regressions/blob/master/t.anal/mips/mips-ref#L31 Creating test would speed-up process and ensure no regression @enovella

@SrimantaBarua
Copy link
Contributor

SrimantaBarua commented Nov 29, 2017 •
edited
Loading

aa, aar etc don't handle R_ANAL_OP_TYPE_ADD and so on for refs. So addui etc aren't resolved correctly, if at all.
iirc disasm checks refs, then falls back to checking the immediate value for a null-terminated string. That's why strings are seen in disasm.

Should this be added to aa? Problem with adding this is that lots of incorrect refs will be generated for all add-type ops.

@radare
Copy link
Collaborator

radare commented Nov 30, 2017 via email

@SrimantaBarua
Copy link
Contributor

In this case, the immediate value in the addui points to the string. Esil emulation helps with indirect references, but I don't see why it's needed here.

@radare
Copy link
Collaborator

radare commented Nov 30, 2017 via email

@SrimantaBarua
Copy link
Contributor

Yep. I was talking about the examples by @enovella

At 0x2ff8, the instruction is addiu a1, a1, 0x75d0. 0x75d0 points to the string "Failed to open ... ". The disassembly resolves it to addiu a1, a1, str.Failed... But doesn't generate a ref.

Agreed that it makes more sense to generate a ref if the result of the add points to a string. But should this generate a ref too? If yes, then this case doesn't need emulation since it's in the immediate value.

@XVilka XVilka added this to the 2.8.0 milestone Jul 17, 2018
@XVilka XVilka modified the milestones: 2.8.0, 2.9.0 - pre-r2con Aug 5, 2018
@radare radare modified the milestones: 2.9.0, 3.0 Aug 30, 2018
@ret2libc ret2libc removed this from the 3.0 milestone Oct 11, 2018
@ret2libc
Copy link
Contributor

Hi! A lot has changed since you opened this issue. Could you please double-check whether the problem is still there? If not, please close this issues, otherwise just leave a comment here. Thanks again for opening this.

@trufae trufae self-assigned this Jun 24, 2020
@ret2libc
Copy link
Contributor

ret2libc commented Jul 1, 2020

I'm closing this as this is the current output:

[0x000075d0]> pd 5
            ; DATA XREF from sym.miniupnp_deamon @ 0x22f8
            ;-- str.Failed_to_open_socket_for_receiving_SSDP._EXITING:
            ;-- section..rodata:
            ;-- pc:
            0x000075d0     .string "Failed to open socket for receiving SSDP. EXITING" ; len=50 ; [13] -r-- section size 5152 named .rodata
            0x00007602                    unaligned
            0x00007603                    unaligned
            ; DATA XREF from sym.miniupnp_deamon @ 0x23e4
            ; CODE XREF from str.Failed_to_open_socket_for_receiving_SSDP._EXITING @ +0x30
            ;-- str.socket_http_:__m:
            0x00007604     .string "socket(http): %m" ; len=17
            0x00007615                    unaligned

Please re-open if you feel this is not fixed yet or open a new issue if something else is happening now. Thanks for reporting this!

@ret2libc ret2libc closed this as completed Jul 1, 2020
@radare
Copy link
Collaborator

radare commented Jul 1, 2020

@ret2libc can you add a test with the output you are showing here?

@ret2libc
Copy link
Contributor

ret2libc commented Jul 2, 2020

@ret2libc can you add a test with the output you are showing here?

Actually no, sorry. I'm reading, reviewing, moving, reproducing a lot of issues lately. Issues that have been accumulated in the last ~7 years and I don't intend to spend 2 months just to read, review, add reproducers for each one of them. If we were in a manageable state with regard to issues I'd be more than happy to add test cases for each one of them, but with so many that were forgotten here honestly I have no will/time to create test cases (with prs and such) for each one of them. Of course if the reporter (cc @enovella ) would like to help with this and create a PR with the given test case we can happily merge it, but 1/2 persons can't be the single point of failure. We should try to distribute a bit more the work by asking reporters to help us.

@trufae
Copy link
Collaborator

trufae commented Jul 2, 2020

I'm not asking you to do that for every single issue, but for the few that matter we should, and this one is important because we don't like analysis regressions and despite it's tedious, boring and such is necessary if we want issues to not come back again, otherwise i would read, review, write fixes and tests for the 1200 mails i got in my inbox last weeks.

Ideally @enovella should make that PR, but as long as you tested it you are probably more in context than him right now, and probably you have more time than he or me have right now. Anyway, ill do that PR in case edu can't make it.

So keeping this issue open until we have a test is the way to go, though having tests and reproducers was also important for you

@trufae trufae reopened this Jul 2, 2020
@trufae
Copy link
Collaborator

trufae commented Jul 2, 2020

Also the issue is assigned to me

@XVilka XVilka added this to To do in Analysis via automation Jul 13, 2020
@XVilka XVilka added the MIPS MIPS architecture support issues label Aug 12, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@trufae trufae

Labels
architectures-enhancements ESIL invalid MIPS MIPS architecture support issues RAnal RIO test-required
Projects
Analysis
  
To do
Milestone
No milestone
Development

No branches or pull requests
7 participants
@XVilka @ret2libc @radare @Maijin @trufae @SrimantaBarua @enovella