angr / patcherex

Shellphish's automated patching engine, originally created for the Cyber Grand Challenge.

Patcherex

Patcherex is the component used to create patched binaries in our CRS.

Installation

sudo apt-get install nasm clang

sudo apt-get install clang-10 gcc-avr binutils-avr avr-libc # (optional) for AVR patching (see patcherex/backends/detourbackends/avr.py)

# mkvirtualenv cgc # create and activate a proper virtual env in which other CRS components have been installed (see setup.py)

git clone https://github.com/angr/patcherex.git
cd patcherex
pip install -e .

Usage

There are three fundamental concepts in patcherex:

• patches
• techniques
• backends

patches

A patch is a single modification to a binary.

Different types of patches exist, for instance:

• InsertCodePatch: add some code that is going to be executed before an instruction at a specific address
• AddEntryPointPatch: add some code that is going to be executed before the original entry point of the binary.
• AddCodePatch: add some code that other patches can use.
• AddRWData: add some RW data that other patches can use.
• ...

See patcherex/patches.py for the full list of available patches.

Every patch has a name and it is possible to refer from a patch to another patch using its name.

backends

A backend is the component responsible to "inject" a list of patches in an existing binary and produce a new binary.

There are two backends:

• DetourBackend: it adds patches by inserting jumps inside the original code.
• ReassemblerBacked: it adds code by disassembling and then reassembling the original binary.

The DetourBackend generates bigger and slower binaries (and in some rare cases it cannot insert some patches), however it is slightly more reliable than the ReassemblerBackend (i.e., it breaks slightly less binaries).

techniques

A technique is a component analyzing a binary and returning a list of patches.

For instance:

• StackRetEncryption: it encrypts the return pointers of "unsafe" functions.
• Backdoor: it adds a backdoor to a binary.
• ...

Examples

IPython usage

Patcherex can be used with IPython.

The following example modifies the binary CADET_00003 so that it prints "HI!" every time a new string is entered by the user.

import patcherex
from patcherex.backends.detourbackend import DetourBackend
from patcherex.backends.reassembler_backend import ReassemblerBackend
from patcherex.patches import *

# the detour backend can be used as well:
# backend = DetourBackend("test_binaries/CADET_00003")
backend = ReassemblerBackend("test_binaries/CADET_00003")
patches = []

transmit_code = '''
  ; eax is the transmitted buffer
  ; ebx is the length
  pusha
  mov ecx,eax
  mov edx,ebx
  mov eax,0x2
  mov ebx,0x1
  mov esi,0x0
  int 0x80
  popa
  ret
  '''
patches.append(AddCodePatch(transmit_code, name="transmit_function"))
patches.append(AddRODataPatch(b"HI!\x00", name="transmitted_string"))
# the following code is going to be executed just before the original instruction at 0x8048166
injected_code = '''
; at this code location, it is fine to clobber eax and ebx
mov eax, {transmitted_string} ; a patch can refer to another patch address, by putting its name between curly brackets
mov ebx, 4
call {transmit_function}
'''
patches.append(InsertCodePatch(0x8048166,injected_code,name="injected_code_after_receive"))

# now we ask to the backend to inject all our patches
backend.apply_patches(patches)
# and then we save the file
backend.save("/tmp/CADET_00003_mod1")
# at this point you can try to run /tmp/CADET_00003_mod1 inside the DECREE VM or using our modified version of QEMU

Command line usage

Any method of the class PatchMaster (in patch_master.py) called generate_something_binary can be directly invoked from the command line.

The syntax is the following:

./patch_master.py single <input_file> <method> <output_file>

For instance, running the following command:

./patch_master.py single ../test_binaries/CADET_00003 stackretencryption  /tmp/CADET_00003_stackretencryption

will execute the following code:

def generate_stackretencryption_binary(self, test_bin=None):
    backend = ReassemblerBackend(self.infile)
    patches = []
    patches.extend(StackRetEncryption(self.infile, backend).get_patches())
    backend.apply_patches(patches)
    final_content = backend.get_final_content()
    return (final_content, "")

patch_master.py contains also methods to patch multiple binaries in parallel and quickly test them.

patcherex's Issues

Patcherex (or angr, maybe PyVEX) does not work on 32-bit Ubuntu

I want to disassemble Coreutils code that you said in your paper ramblr,
But I'm in trouble now...

Using given example code Here,
I got output disassembly file under my /tmp directory.

import patcherex
from patcherex.backends.detourbackend import DetourBackend
from patcherex.backends.reassembler_backend import ReassemblerBackend
from patcherex.patches import *

backend = ReassemblerBackend("ELF_binary")
patches = []
backend.save("new_ELF_binary")

However, in the disassembly file,
<text> section seemed not have the complete disassembly.
There was no instructions, and only some some symbols were inside there...

(Maybe it's because my code is too short and has no routine about recover some section about ELF binary)
Would you please give some example python code for disassembling simple ELF binary?

I read your paper ramblr, and I think that's a really good study.
Thanks!

Non-existent labels added during reassembly

Using the reassembler backend with 0 patches (i.e. try to just generate a new binary from the old one with no modifications), the temporary .s file that's generated by patcherex refers to labels that are not defined, usually "label_0". I've used the reassembler backend in the way described in the README example.

The test program is a simple 64-bit ELF binary, the result of a C program compiled with gcc on 64-bit Linux. I attached the C source, binary, and resulting temporary assembly* that patcherex generates. This is not limited to this binary, but missing labels are in every executable that I've tried (all 64-bit ELF).

The * is that the temporary .s file has one immediate value manually changed (at 0x400439, from 0xfffffff0 to 0xfffffffffffffff0), in order to have the assembler (clang, the one used by the assemble script in compilerex -- though the same behaviour is seen for other assemblers) not complain (related to #2).

I believe the label_XX labels are inserted by patcherex (or a submodule like compilerex), and shouldn't need to be linked from any library, but label_0 doesn't appear anywhere.

	.section	.init
	.align	8
	#Procedure 0x4003c8

	# 0x4003c8:	subq	$8, %rsp [IMM, REG]
	.globl _init
	.type _init, @function
_init:
	subq	$8, %rsp
	# 0x4003cc:	movq	0x200c25(%rip), %rax [MEM, REG]
	movq	.label_0(%rip),  %rax
	# 0x4003d3:	testq	%rax, %rax [REG, REG]
	testq	%rax, %rax
	# 0x4003d6:	je	0x4003dd [IMM <CODEREF>]
	je	.label_1
	# 0x4003d8:	callq	0x400420 [IMM <CODEREF>]
	callq	.label_2
	# 0x4003dd:	addq	$8, %rsp [IMM, REG]
.label_1:
	addq	$8, %rsp
	# 0x4003e1:	retq	 []
	retq	
	.section	.plt.got
	.align	32
	#Procedure 0x400420

	# 0x400420:	jmpq	*0x200bd2(%rip) [MEM]
.label_2:
	jmpq	*.label_0(%rip)
	.section	.text
	.align	16
	#Procedure 0x400430
	.globl _start
	.type _start, @function
_start:

	# 0x400430:	xorl	%ebp, %ebp [REG, REG]
	xorl	%ebp, %ebp
	# 0x400432:	movq	%rdx, %r9 [REG, REG]
	movq	%rdx, %r9
	# 0x400435:	popq	%rsi [REG]
	popq	%rsi
	# 0x400436:	movq	%rsp, %rdx [REG, REG]
	movq	%rsp, %rdx
	# 0x400439:	andq	$0xfffffff0, %rsp [IMM, REG]
	andq	$0xfffffffffffffff0, %rsp
	# 0x40043d:	pushq	%rax [REG]
	pushq	%rax
	# 0x40043e:	pushq	%rsp [REG]
	pushq	%rsp
	# 0x40043f:	movq	$0x4005f0, %r8 [IMM <CODEREF>, REG]
	movq	$__libc_csu_fini,  %r8
	# 0x400446:	movq	$0x400580, %rcx [IMM <CODEREF>, REG]
	movq	$__libc_csu_init,  %rcx
	# 0x40044d:	movq	$0x400526, %rdi [IMM <CODEREF>, REG]
	movq	$main,  %rdi
	# 0x400454:	callq	0x400410 [IMM <CODEREF>]
	callq	__libc_start_main
	.section	.text
	.align	16
	#Procedure 0x400459
	.globl sub_400459
	.type sub_400459, @function
sub_400459:

	# 0x400459:	hlt	 []
	hlt	
	.section	.text
	.align	16
	#Procedure 0x400460

	# 0x400460:	movl	$0x60103f, %eax [IMM <DATAREF>, REG]
	.globl deregister_tm_clones
	.type deregister_tm_clones, @function
deregister_tm_clones:
	movl	$label_4,  %eax
	# 0x400465:	pushq	%rbp [REG]
	pushq	%rbp
	# 0x400466:	subq	$0x601038, %rax [IMM <DATAREF>, REG]
	subq	__TMC_END__,  %rax
	# 0x40046c:	cmpq	$0xe, %rax [IMM, REG]
	cmpq	$0xe, %rax
	# 0x400470:	movq	%rsp, %rbp [REG, REG]
	movq	%rsp, %rbp
	# 0x400473:	jbe	0x400490 [IMM <CODEREF>]
	jbe	.label_3
	# 0x400475:	movl	$0, %eax [IMM, REG]
	movl	$0, %eax
	# 0x40047a:	testq	%rax, %rax [REG, REG]
	testq	%rax, %rax
	# 0x40047d:	je	0x400490 [IMM <CODEREF>]
	je	.label_3
	# 0x40047f:	popq	%rbp [REG]
	popq	%rbp
	# 0x400480:	movl	$0x601038, %edi [IMM <DATAREF>, REG]
	movl	$__TMC_END__,  %edi
	# 0x400485:	jmpq	*%rax [REG]
	jmpq	*%rax
	# 0x400487:	nopw	(%rax, %rax) [MEM]
	nopw	(%rax, %rax)
	# 0x400490:	popq	%rbp [REG]
.label_3:
	popq	%rbp
	# 0x400491:	retq	 []
	retq	
	.section	.text
	.align	16
	#Procedure 0x4004a0

	# 0x4004a0:	movl	$0x601038, %esi [IMM <DATAREF>, REG]
	.globl register_tm_clones
	.type register_tm_clones, @function
register_tm_clones:
	movl	$__TMC_END__,  %esi
	# 0x4004a5:	pushq	%rbp [REG]
	pushq	%rbp
	# 0x4004a6:	subq	$0x601038, %rsi [IMM <DATAREF>, REG]
	subq	$__TMC_END__,  %rsi
	# 0x4004ad:	sarq	$3, %rsi [IMM, REG]
	sarq	$3, %rsi
	# 0x4004b1:	movq	%rsp, %rbp [REG, REG]
	movq	%rsp, %rbp
	# 0x4004b4:	movq	%rsi, %rax [REG, REG]
	movq	%rsi, %rax
	# 0x4004b7:	shrq	$0x3f, %rax [IMM, REG]
	shrq	$0x3f, %rax
	# 0x4004bb:	addq	%rax, %rsi [REG, REG]
	addq	%rax, %rsi
	# 0x4004be:	sarq	$1, %rsi [IMM, REG]
	sarq	$1, %rsi
	# 0x4004c1:	je	0x4004d8 [IMM <CODEREF>]
	je	.label_5
	# 0x4004c3:	movl	$0, %eax [IMM, REG]
	movl	$0, %eax
	# 0x4004c8:	testq	%rax, %rax [REG, REG]
	testq	%rax, %rax
	# 0x4004cb:	je	0x4004d8 [IMM <CODEREF>]
	je	.label_5
	# 0x4004cd:	popq	%rbp [REG]
	popq	%rbp
	# 0x4004ce:	movl	$0x601038, %edi [IMM <DATAREF>, REG]
	movl	$__TMC_END__,  %edi
	# 0x4004d3:	jmpq	*%rax [REG]
	jmpq	*%rax
	# 0x4004d5:	nopl	(%rax) [MEM]
	nopl	(%rax)
	# 0x4004d8:	popq	%rbp [REG]
.label_5:
	popq	%rbp
	# 0x4004d9:	retq	 []
	retq	
	.section	.text
	.align	16
	#Procedure 0x4004e0

	# 0x4004e0:	cmpb	$0, 0x200b51(%rip) [IMM, MEM]
	.globl __do_global_dtors_aux
	.type __do_global_dtors_aux, @function
__do_global_dtors_aux:
	cmpb	$0, __TMC_END__(%rip)
	# 0x4004e7:	jne	0x4004fa [IMM <CODEREF>]
	jne	.label_6
	# 0x4004e9:	pushq	%rbp [REG]
	pushq	%rbp
	# 0x4004ea:	movq	%rsp, %rbp [REG, REG]
	movq	%rsp, %rbp
	# 0x4004ed:	callq	0x400460 [IMM <CODEREF>]
	callq	deregister_tm_clones
	# 0x4004f2:	popq	%rbp [REG]
	popq	%rbp
	# 0x4004f3:	movb	$1, 0x200b3e(%rip) [IMM, MEM]
	movb	$1, __TMC_END__(%rip)
	# 0x4004fa:	retq	 []
.label_6:
	retq	
	.section	.text
	.align	16
	#Procedure 0x400500

	# 0x400500:	movl	$0x600e20, %edi [IMM <DATAREF>, REG]
	.globl frame_dummy
	.type frame_dummy, @function
frame_dummy:
	movl	$__JCR_END__,  %edi
	# 0x400505:	cmpq	$0, (%rdi) [IMM, MEM]
	cmpq	$0, (%rdi)
	# 0x400509:	jne	0x400510 [IMM <CODEREF>]
	jne	.label_7
	# 0x40050b:	jmp	0x4004a0 [IMM <CODEREF>]
.label_8:
	jmp	register_tm_clones
	# 0x400510:	movl	$0, %eax [IMM, REG]
.label_7:
	movl	$0, %eax
	# 0x400515:	testq	%rax, %rax [REG, REG]
	testq	%rax, %rax
	# 0x400518:	je	0x40050b [IMM <CODEREF>]
	je	.label_8
	# 0x40051a:	pushq	%rbp [REG]
	pushq	%rbp
	# 0x40051b:	movq	%rsp, %rbp [REG, REG]
	movq	%rsp, %rbp
	# 0x40051e:	callq	*%rax [REG]
	callq	*%rax
	# 0x400520:	popq	%rbp [REG]
	popq	%rbp
	# 0x400521:	jmp	0x4004a0 [IMM <CODEREF>]
	jmp	register_tm_clones
	.section	.text
	.align	16
	#Procedure 0x400526

	# 0x400526:	pushq	%rbp [REG]
	.globl main
	.type main, @function
main:
	pushq	%rbp
	# 0x400527:	movq	%rsp, %rbp [REG, REG]
	movq	%rsp, %rbp
	# 0x40052a:	subq	$0x20, %rsp [IMM, REG]
	subq	$0x20, %rsp
	# 0x40052e:	movl	%edi, -0x14(%rbp) [REG, MEM]
	movl	%edi, -0x14(%rbp)
	# 0x400531:	movq	%rsi, -0x20(%rbp) [REG, MEM]
	movq	%rsi, -0x20(%rbp)
	# 0x400535:	movl	$0x499602d2, -0xc(%rbp) [IMM, MEM]
	movl	$0x499602d2, -0xc(%rbp)
	# 0x40053c:	movl	-0xc(%rbp), %eax [MEM, REG]
	movl	-0xc(%rbp), %eax
	# 0x40053f:	movl	%eax, %esi [REG, REG]
	movl	%eax, %esi
	# 0x400541:	movl	$0x400604, %edi [IMM <DATAREF>, REG]
	movl	$label_9,  %edi
	# 0x400546:	movl	$0, %eax [IMM, REG]
	movl	$0, %eax
	# 0x40054b:	callq	0x400400 [IMM <CODEREF>]
	callq	printf
	# 0x400550:	movl	$0x423a35bd, -8(%rbp) [IMM, MEM]
	movl	$0x423a35bd, -8(%rbp)
	# 0x400557:	movl	-0xc(%rbp), %eax [MEM, REG]
	movl	-0xc(%rbp), %eax
	# 0x40055a:	subl	-8(%rbp), %eax [MEM, REG]
	subl	-8(%rbp), %eax
	# 0x40055d:	movl	%eax, -4(%rbp) [REG, MEM]
	movl	%eax, -4(%rbp)
	# 0x400560:	movl	-4(%rbp), %eax [MEM, REG]
	movl	-4(%rbp), %eax
	# 0x400563:	movl	%eax, %esi [REG, REG]
	movl	%eax, %esi
	# 0x400565:	movl	$0x400604, %edi [IMM <DATAREF>, REG]
	movl	$label_9,  %edi
	# 0x40056a:	movl	$0, %eax [IMM, REG]
	movl	$0, %eax
	# 0x40056f:	callq	0x400400 [IMM <CODEREF>]
	callq	printf
	# 0x400574:	movl	$0, %eax [IMM, REG]
	movl	$0, %eax
	# 0x400579:	leave	 []
	leave	
	# 0x40057a:	retq	 []
	retq	
	.section	.text
	.align	16
	#Procedure 0x400580

	# 0x400580:	pushq	%r15 [REG]
	.globl __libc_csu_init
	.type __libc_csu_init, @function
__libc_csu_init:
	pushq	%r15
	# 0x400582:	pushq	%r14 [REG]
	pushq	%r14
	# 0x400584:	movl	%edi, %r15d [REG, REG]
	movl	%edi, %r15d
	# 0x400587:	pushq	%r13 [REG]
	pushq	%r13
	# 0x400589:	pushq	%r12 [REG]
	pushq	%r12
	# 0x40058b:	leaq	0x20087e(%rip), %r12 [MEM, REG]
	leaq	__init_array_start(%rip),  %r12
	# 0x400592:	pushq	%rbp [REG]
	pushq	%rbp
	# 0x400593:	leaq	0x20087e(%rip), %rbp [MEM, REG]
	leaq	__init_array_end(%rip),  %rbp
	# 0x40059a:	pushq	%rbx [REG]
	pushq	%rbx
	# 0x40059b:	movq	%rsi, %r14 [REG, REG]
	movq	%rsi, %r14
	# 0x40059e:	movq	%rdx, %r13 [REG, REG]
	movq	%rdx, %r13
	# 0x4005a1:	subq	%r12, %rbp [REG, REG]
	subq	%r12, %rbp
	# 0x4005a4:	subq	$8, %rsp [IMM, REG]
	subq	$8, %rsp
	# 0x4005a8:	sarq	$3, %rbp [IMM, REG]
	sarq	$3, %rbp
	# 0x4005ac:	callq	0x4003c8 [IMM <CODEREF>]
	callq	_init
	# 0x4005b1:	testq	%rbp, %rbp [REG, REG]
	testq	%rbp, %rbp
	# 0x4005b4:	je	0x4005d6 [IMM <CODEREF>]
	je	.label_10
	# 0x4005b6:	xorl	%ebx, %ebx [REG, REG]
	xorl	%ebx, %ebx
	# 0x4005b8:	nopl	(%rax, %rax) [MEM]
	nopl	(%rax, %rax)
	# 0x4005c0:	movq	%r13, %rdx [REG, REG]
.label_11:
	movq	%r13, %rdx
	# 0x4005c3:	movq	%r14, %rsi [REG, REG]
	movq	%r14, %rsi
	# 0x4005c6:	movl	%r15d, %edi [REG, REG]
	movl	%r15d, %edi
	# 0x4005c9:	callq	*(%r12, %rbx, 8) [MEM]
	callq	*(%r12, %rbx, 8)
	# 0x4005cd:	addq	$1, %rbx [IMM, REG]
	addq	$1, %rbx
	# 0x4005d1:	cmpq	%rbp, %rbx [REG, REG]
	cmpq	%rbp, %rbx
	# 0x4005d4:	jne	0x4005c0 [IMM <CODEREF>]
	jne	.label_11
	# 0x4005d6:	addq	$8, %rsp [IMM, REG]
.label_10:
	addq	$8, %rsp
	# 0x4005da:	popq	%rbx [REG]
	popq	%rbx
	# 0x4005db:	popq	%rbp [REG]
	popq	%rbp
	# 0x4005dc:	popq	%r12 [REG]
	popq	%r12
	# 0x4005de:	popq	%r13 [REG]
	popq	%r13
	# 0x4005e0:	popq	%r14 [REG]
	popq	%r14
	# 0x4005e2:	popq	%r15 [REG]
	popq	%r15
	# 0x4005e4:	retq	 []
	retq	
	.section	.text
	.align	16
	#Procedure 0x4005f0

	# 0x4005f0:	retq	 []
	.globl __libc_csu_fini
	.type __libc_csu_fini, @function
__libc_csu_fini:
	retq	
	.section	.fini
	.align	4
	#Procedure 0x4005f4

	# 0x4005f4:	subq	$8, %rsp [IMM, REG]
	.globl _fini
	.type _fini, @function
_fini:
	subq	$8, %rsp
	# 0x4005f8:	addq	$8, %rsp [IMM, REG]
	addq	$8, %rsp
	# 0x4005fc:	retq	 []
	retq	
	.section .plt.got
	.align 32
	# data @ 0x400428
	.label_21:
	.section .text
	.align 16
	# data @ 0x4005f2
	.label_22:
	.section .rodata
	.align 32
	# data @ 0x400600
	.byte 1
	.byte 0
	.byte 2
	.byte 0
	# data @ 0x400604
label_9:
	.asciz "%d\n"
	.section .data
	.align 16
	# data @ 0x600e10
	.globl __init_array_start
	.type __init_array_start, @notype
__init_array_start:
	.quad frame_dummy
	.section .data
	.align 8
	# data @ 0x601028
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.section .bss
	.align 8
	# data @ 0x601038
	.globl __TMC_END__
	.type __TMC_END__, @object
__TMC_END__:
	.byte 0x0
	# data @ 0x601039
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
	.byte 0
label_4:
	.byte 0
	# data @ 0x601040
		.globl _end
	.type _end, @notype
_end:

print.zip

DetourBackend Failed: patched binary crashed during loading

Hi,

During working with patcherex, I found DetourBackend failed and the patched binary crashed during loading.

BTW, I am working on the ezpz branch.

Code:

import patcherex

from patcherex.backends.detourbackend import DetourBackend
from patcherex.patches import *

backend = DetourBackend("./curl_fuzzer_http")
patches = []

transmit_code = '''
  ret
  '''
patches.append(AddCodePatch(transmit_code, name="transmit_function"))
patches.append(AddRODataPatch(b"HI!\x00", name="transmitted_string"))

injected_code = '''
call {transmit_function}
'''
patches.append(InsertCodePatch(0x5CE240,injected_code,name="injected_code_after_receive"))

backend.apply_patches(patches)
backend.save("./curl_fuzzer_http.patched")

Crash Context:

[----------------------------------registers-----------------------------------]
RAX: 0xb0caae
RBX: 0xb0caae
RCX: 0x7ffff7ffe428 --> 0x0
RDX: 0xd ('\r')
RSI: 0xfffffffffffff000
RDI: 0x7ffff7ffe010 --> 0x0
RBP: 0x7fffffffdff0 --> 0xb0caae
RSP: 0x7fffffffde10 --> 0x0
RIP: 0x7ffff7dd7f9d (<dl_main+2365>:    mov    edx,DWORD PTR [rax])
R8 : 0x7ffff7ffe030 --> 0x0
R9 : 0xb0cd86
R10: 0x7ffff7df5c1f --> 0x706e203d3d206900 ('')
R11: 0xd ('\r')
R12: 0x0
R13: 0x0
R14: 0x7ffff7ffe170 --> 0x0
R15: 0x0
EFLAGS: 0x10287 (CARRY PARITY adjust zero SIGN trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff7dd7f90 <dl_main+2352>:       add    rax,0x38
   0x7ffff7dd7f94 <dl_main+2356>:       cmp    r9,rax
   0x7ffff7dd7f97 <dl_main+2359>:       jbe    0x7ffff7dd8034 <dl_main+2516>
=> 0x7ffff7dd7f9d <dl_main+2365>:       mov    edx,DWORD PTR [rax]
   0x7ffff7dd7f9f <dl_main+2367>:       cmp    edx,0x6
   0x7ffff7dd7fa2 <dl_main+2370>:       je     0x7ffff7dd8900 <dl_main+4768>
   0x7ffff7dd7fa8 <dl_main+2376>:       jbe    0x7ffff7dd7f75 <dl_main+2325>
   0x7ffff7dd7faa <dl_main+2378>:       cmp    edx,0x6474e551
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffde10 --> 0x0
0008| 0x7fffffffde18 --> 0x0
0016| 0x7fffffffde20 --> 0x0
0024| 0x7fffffffde28 --> 0x0
0032| 0x7fffffffde30 --> 0x0
0040| 0x7fffffffde38 --> 0x0
0048| 0x7fffffffde40 --> 0x0
0056| 0x7fffffffde48 --> 0x7fffffffde90 --> 0x7fffffffe128 --> 0x7fffffffe3ce ("LANG=C.UTF-8")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
dl_main (phdr=0xb0caae, phnum=0xd, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1148
1148    rtld.c: No such file or directory.
gdb-peda$ bt
#0  dl_main (phdr=0xb0caae, phnum=0xd, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1148
#1  0x00007ffff7defdd0 in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffe110, dl_main=dl_main@entry=0x7ffff7dd7660 <dl_main>) at ../elf/dl-sysdep.c:253
#2  0x00007ffff7dd7128 in _dl_start_final (arg=0x7fffffffe110) at rtld.c:414
#3  _dl_start (arg=0x7fffffffe110) at rtld.c:521
#4  0x00007ffff7dd6098 in _start () from /lib64/ld-linux-x86-64.so.2
#5  0x0000000000000001 in ?? ()
#6  0x00007fffffffe3a7 in ?? ()
#7  0x0000000000000000 in ?? ()

Binary file:

binaries.zip

DetourBackend > InsertCodePatch causes segfault

Environment:

Ubuntu 18.04 LTS, GLIBC 2.27, gcc 7.5.0 ✔️ (working properly)
Ubuntu 20.04 LTS, GLIBC 2.31, gcc 9.3.0 ❌ (segfault, see below)

working on feat/ezpz branch

example

simple.zip

$ gcc -o simple simple.c 

$ python3 simple.py 
CRITICAL | 2020-06-07 17:51:02,156 | cle.backends | Deprecation warning: the custom_base_addr parameter has been renamed to base_addr
WARNING | 2020-06-07 17:51:02,174 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000.
WARNING | 2020-06-07 17:51:02,178 | angr.analyses.cfg.cfg_fast | "collect_data_references" is deprecated and will be removed soon. Please use "data_references" instead
Deprecation warning: Use self.model.nodes() instead of nodes
Deprecation warning: Use self.model.get_any_node() instead of get_any_node
putting them at 0x4018
current len: 0x4148

$ /tmp/simple-mod
Segmentation fault (core dumped)

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7fde1ec in elf_machine_rela_relative (reloc_addr_arg=0x7ffff7fcc008, reloc=0x7ffff7fc8558, 
    l_addr=140737353908224) at ../sysdeps/x86_64/dl-machine.h:542
542	      *reloc_addr = l_addr + reloc->r_addend;
(gdb) bt
#0  0x00007ffff7fde1ec in elf_machine_rela_relative (reloc_addr_arg=0x7ffff7fcc008, 
    reloc=0x7ffff7fc8558, l_addr=140737353908224) at ../sysdeps/x86_64/dl-machine.h:542
#1  elf_dynamic_do_Rela (skip_ifunc=<optimized out>, lazy=<optimized out>, nrelative=<optimized out>, 
    relsize=<optimized out>, reladdr=<optimized out>, map=0x7ffff7ffe200) at do-rel.h:112
#2  _dl_relocate_object (l=l@entry=0x7ffff7ffe200, scope=<optimized out>, reloc_mode=<optimized out>, 
    consider_profiling=<optimized out>, consider_profiling@entry=0) at dl-reloc.c:255
#3  0x00007ffff7fd5350 in dl_main (phdr=<optimized out>, phnum=<optimized out>, 
    user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2313
#4  0x00007ffff7febc6b in _dl_sysdep_start (start_argptr=start_argptr@entry=0x7fffffffe480, 
    dl_main=dl_main@entry=0x7ffff7fd3460 <dl_main>) at ../elf/dl-sysdep.c:252
#5  0x00007ffff7fd2fb1 in _dl_start_final (arg=0x7fffffffe480) at rtld.c:489
#6  _dl_start (arg=0x7fffffffe480) at rtld.c:582
#7  0x00007ffff7fd2098 in _start () from /home/dennydai/glibc/out/lib/ld-linux-x86-64.so.2
(gdb) 

I tried to fix it (#26), and it works for above example.

$ python3 simple.py 
CRITICAL | 2020-06-07 18:08:34,419 | cle.backends | Deprecation warning: the custom_base_addr parameter has been renamed to base_addr
WARNING | 2020-06-07 18:08:34,438 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000.
WARNING | 2020-06-07 18:08:34,442 | angr.analyses.cfg.cfg_fast | "collect_data_references" is deprecated and will be removed soon. Please use "data_references" instead
Deprecation warning: Use self.model.nodes() instead of nodes
Deprecation warning: Use self.model.get_any_node() instead of get_any_node
putting them at 0x5000
current len: 0x5000

$ /tmp/simple-mod
Hi

But it still crashes some more complex binaries date.zip

$ ./date-mod
Segmentation fault (core dumped)

And if I do /lib64/ld-linux-x86-64.so.2 ./date-mod it works...

$ /lib64/ld-linux-x86-64.so.2 ./date-mod
Sun Jun  7 18:29:46 UTC 2020

Detour patch failed on statically compiled binaries (and workaround)

First, thank you for your great work.
I'm writing this to share some issues and how I workarounded.

I found that patchrex fails when I tried to patch static-built binaries.
For instance, patcherex prints error when it try to rewrite a simple 'Hello world' elf built with -static option.
Error messages:

Traceback (most recent call last):
  File "test.py", line 37, in <module>
    backend.apply_patches(patches)
  File "/home/ksw/patcherex/patcherex/backends/detourbackend.py", line 1065, in apply_patches
    self.set_added_segment_headers(len(segments))
  File "/home/ksw/patcherex/patcherex/backends/detourbackend.py", line 593, in set_added_segment_headers
    phdr_offset = self.phdr_segment["p_offset"]
TypeError: 'NoneType' object is not subscriptable

According to the error messages, phdr_segment doesn't seem to have proper value.
So I debugged this phdr_segment variable, in this context
(I put print(segments) above 1062)

patcherex/patcherex/backends/detourbackend.py

Lines 1060 to 1063 in cd6f3ff

	p_filesz, p_memsz + self.added_rwdata_len + self.added_rwinitdata_len, p_flags, p_align
	segments[-1] = last_segment
	self.setup_headers(segments)
	self.set_added_segment_headers(len(segments))

It printed [Container({'p_type': 'PT_LOAD', 'p_flags': 4, 'p_offset': 0, 'p_vaddr': 4194304, 'p_paddr': 4194304, 'p_filesz': 232, 'p_memsz': 232, 'p_align': 4096}), Container({'p_type': 'PT_LOAD', 'p_flags': 5, 'p_offset': 4096, 'p_vaddr': 4198400, 'p_paddr': 4198400, 'p_filesz': 39, 'p_memsz': 39, 'p_align': 4096}), Container({'p_type': 'PT_LOAD', 'p_flags': 4, 'p_offset': 8192, 'p_vaddr': 4202496, 'p_paddr': 4202496, 'p_filesz': 14, 'p_memsz': 14, 'p_align': 4096})], which doesn't contain PT_PHDR.

Withouth PT_PHDR, phdr_segment keep None itself. (Please see below 425-428 lines)

patcherex/patcherex/backends/detourbackend.py

Lines 425 to 428 in cd6f3ff

	if segment["p_type"] == "PT_PHDR":
	if self.phdr_segment is not None:
	raise ValueError("Multiple PHDR segments!")
	self.phdr_segment = segment

Therefore, I tried to temporary comment out these lines below, and it finally works.

patcherex/patcherex/backends/detourbackend.py

Lines 591 to 603 in cd6f3ff

	phdr_offset = self.phdr_segment["p_offset"]
	phdr_vaddr = self.phdr_segment["p_vaddr"]
	phdr_paddr = self.phdr_segment["p_paddr"]
	phdr_fsize = self.phdr_segment["p_filesz"]
	phdr_msize = self.phdr_segment["p_memsz"]
	phdr_segment_header = Container(**{"p_type": 1, "p_offset": phdr_offset,
	"p_vaddr": phdr_vaddr, "p_paddr": phdr_paddr,
	"p_filesz": phdr_fsize, "p_memsz": phdr_msize,
	"p_flags": 0x4, "p_align": 0x1000})
	self.ncontent = utils.bytes_overwrite(self.ncontent, self.structs.Elf_Phdr.build(phdr_segment_header),
	self.original_header_end + (2 * self.structs.Elf_Phdr.sizeof()))
	added_segments += 1

Although it works, I'm still digging in it to find the reason why it happens and what is phdr_segment, getting experts' opinion.
It'd be my pleasure if you can share your experiments and opinions.
@ltfish @DennyDai (I mentioned who recentely made a commit related with phdr_sement)

Errror while compiling binary

when running ```
import patcherex
import os
import subprocess
import random
from patcherex.backends.reassembler_backend import ReassemblerBackend
from patcherex.patches import *
from tracer import QEMURunner

def main():
#InsertCodePatch we use this and bacnedclass ReassemblerBacked
backend = ReassemblerBackend("origin_bin")
patches = []
address = 0x0400948
transmit_code = '''
mov qword ptr [ptr + rax*0x8],0x0
'''

patches.append(AddCodePatch(transmit_code,name="patch"))


backend.apply_patches(patches)
backend.save("ormod")

if name == "main":
main()```
i get Traceback (most recent call last):
File "/home/pwn/Desktop/dreamhack_pwn_patch.py", line 36, in
main()
File "/home/pwn/Desktop/dreamhack_pwn_patch.py", line 34, in main
backend.save("ormod")
File "/home/pwn/patcherex/patcherex/backends/reassembler_backend.py", line 145, in save
raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
and this very long compilation error. Any ideea ?

Can't load basic x86_64 binary

I have been unable to load a basic x86_64 binary in patcherex backend. It looks like the backend is assuming a cgc binary and throwing an exception when it's not one.

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    printf("Hello\n");
    exit(0);
}

Compiled this to a 64-bit binary with just base gcc on ubuntu 16.04 (attached). The following is the error output:

In [1]: from patcherex.backends import DetourBackend

In [2]: backend = DetourBackend("./test")
WARNING | 2018-06-06 00:29:10,156 | ?[33mangr.analyses.cfg.cfg_fast?[0m | ?[33m"auto_load_libs" is enabled. With libraries loaded in project, CFGFast will cover libraries, which may take significantly more time than expected. You may reload the binary with "auto_load_libs" disabled, or specify "regions" to limit the sc
ope of CFG recovery.?[0m
WARNING | 2018-06-06 00:29:10,393 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:10,395 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:10,396 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:10,396 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:10,436 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:10,475 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:10,476 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:10,477 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:10,477 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:10,511 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:10,808 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:10,810 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:10,810 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:10,810 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:10,858 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,860 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,861 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,861 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,861 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:10,907 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,908 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,915 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,916 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,917 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,958 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:10,958 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:11,284 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:11,286 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:11,286 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:11,286 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:11,287 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:11,428 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:11,430 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:11,430 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:11,431 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:11,435 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:11,625 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:11,627 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:11,627 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:11,627 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:11,628 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:14,757 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:14,759 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:14,760 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:14,760 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:14,768 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:15,049 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,051 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,053 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,576 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,578 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,578 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,706 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,707 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,708 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,735 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,737 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:15,738 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:17,515 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:17,517 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:17,517 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:17,517 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:17,518 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:18,416 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,418 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,421 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,609 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:18,611 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:18,632 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:18,633 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:18,668 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,670 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,671 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,678 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,679 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:18,680 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:19,273 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,274 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,275 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,351 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,352 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,354 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,453 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,455 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,455 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,464 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,465 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,467 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,609 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,610 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:19,611 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:20,423 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:20,424 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:20,426 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:20,461 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:20,463 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:20,463 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:20,463 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:20,464 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:20,532 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:20,534 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:20,535 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:20,535 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:20,537 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:20,567 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,568 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,569 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,569 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,571 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,612 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,614 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,615 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,615 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,622 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,623 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,626 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,626 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,635 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,636 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,638 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:20,662 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:20,663 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:20,664 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:20,664 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:20,668 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:20,699 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:20,700 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:20,701 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:20,701 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:20,710 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:20,727 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,728 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:20,731 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:21,070 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000020_411_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:21,126 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000038_426_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:21,595 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000054_2485_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:21,641 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00006c_2492_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:21,711 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000094_2514_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:21,948 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:21,949 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:21,950 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:21,993 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:21,995 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:21,996 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:21,996 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:21,996 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:22,044 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: dup?[0m
WARNING | 2018-06-06 00:29:22,045 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: dup?[0m
WARNING | 2018-06-06 00:29:22,046 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: dup?[0m
WARNING | 2018-06-06 00:29:22,299 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:22,300 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:22,301 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:22,301 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:22,302 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:22,368 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:22,370 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:22,371 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:22,371 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:22,372 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:22,382 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,384 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,386 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,386 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,387 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,393 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,394 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,395 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:22,441 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,442 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,443 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,444 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,446 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,452 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,454 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,455 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:22,658 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,659 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,660 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,660 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,662 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,668 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,670 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,670 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:22,678 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:22,679 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:22,680 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:22,680 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:22,681 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:22,818 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000ac_2566_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:23,144 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:23,146 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:23,153 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:23,155 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:23,155 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:23,156 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:24,208 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:24,209 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:24,210 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:24,210 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:24,216 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:24,989 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:24,990 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:24,991 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:24,991 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:24,994 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:25,331 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:25,332 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:25,334 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:25,356 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:25,358 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:25,360 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:25,407 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:25,409 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:25,410 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:25,431 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:25,434 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:25,436 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:25,451 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:25,452 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:25,454 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:27,668 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,670 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,677 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,678 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,686 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,687 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,688 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,688 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,688 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:27,701 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:27,703 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:27,704 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:27,704 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:27,704 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:29,880 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000cc_2698_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:29,916 | ?[34mangr.engines.successors?[0m | ?[34mExit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000d4_2711_64{UNINITIALIZED}>?[0m
WARNING | 2018-06-06 00:29:30,033 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:30,035 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:30,035 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:30,136 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:30,138 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:30,138 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:30,151 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:30,153 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:30,153 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:30,154 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:30,154 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:31,367 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:31,368 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:31,625 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:31,628 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:32,522 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:32,522 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sys_623?[0m
WARNING | 2018-06-06 00:29:32,748 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:32,748 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigaction?[0m
WARNING | 2018-06-06 00:29:32,749 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:32,749 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigprocmask?[0m
WARNING | 2018-06-06 00:29:32,963 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:32,963 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: writev?[0m
WARNING | 2018-06-06 00:29:33,184 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:33,185 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getdents?[0m
WARNING | 2018-06-06 00:29:33,190 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:33,190 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: clock_getres?[0m
WARNING | 2018-06-06 00:29:33,192 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:33,192 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sched_yield?[0m
WARNING | 2018-06-06 00:29:33,194 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:33,194 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: lstat?[0m
WARNING | 2018-06-06 00:29:33,195 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:33,195 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: newfstatat?[0m
WARNING | 2018-06-06 00:29:33,199 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:33,200 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: fcntl?[0m
WARNING | 2018-06-06 00:29:33,202 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: dup?[0m
WARNING | 2018-06-06 00:29:33,202 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: dup?[0m
WARNING | 2018-06-06 00:29:33,208 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:33,208 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: openat?[0m
WARNING | 2018-06-06 00:29:33,215 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:33,215 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: ioctl?[0m
WARNING | 2018-06-06 00:29:33,221 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:33,221 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: madvise?[0m
WARNING | 2018-06-06 00:29:33,240 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:33,240 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: mremap?[0m
WARNING | 2018-06-06 00:29:33,241 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:33,241 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: bind?[0m
WARNING | 2018-06-06 00:29:33,242 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:33,242 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: connect?[0m
WARNING | 2018-06-06 00:29:33,243 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:33,244 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: getsockname?[0m
WARNING | 2018-06-06 00:29:33,244 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:33,244 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: recvmsg?[0m
WARNING | 2018-06-06 00:29:33,246 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:33,246 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: sendto?[0m
WARNING | 2018-06-06 00:29:33,247 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:33,247 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setsockopt?[0m
WARNING | 2018-06-06 00:29:33,248 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:33,248 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: socket?[0m
WARNING | 2018-06-06 00:29:33,351 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:33,352 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: kill?[0m
WARNING | 2018-06-06 00:29:33,867 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:33,867 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: readlink?[0m
WARNING | 2018-06-06 00:29:34,077 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:34,077 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: access?[0m
WARNING | 2018-06-06 00:29:34,083 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:34,084 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: rt_sigreturn?[0m
WARNING | 2018-06-06 00:29:34,148 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
WARNING | 2018-06-06 00:29:34,148 | ?[32mangr.procedures.definitions?[0m | ?[32munsupported syscall: setitimer?[0m
---------------------------------------
AssertionErrorTraceback (most recent call last)
<ipython-input-2-6967bae71b80> in <module>()
----> 1 backend = DetourBackend("./test")

/home/angr/angr-dev/patcherex/patcherex/backends/detourbackend.py in __init__(self, filename, data_fallback, try_pdf_removal)
     94         # not all the touched bytes are bad, they are only a serious problem in case of InsertCodePatch
     95         self.touched_bytes = set()
---> 96         self.modded_segments = self.dump_segments()
     97
     98         if self.try_pdf_removal == True:

/home/angr/angr-dev/patcherex/patcherex/backends/detourbackend.py in dump_segments(self, tprint)
    323             cgcef_shentsize, cgcef_shnum, cgcef_shstrndx) = struct.unpack("<xxxxxxxxxxxxxxxxHHLLLLLHHHHHH", buf)
    324         phent_size = 8 * 4
--> 325         assert cgcef_phnum != 0
    326         assert cgcef_phentsize == phent_size
    327

AssertionError:

test.zip

requirement povsim not found when run pip install

When run pip install -e .:

$ sudo pip install -e .
Obtaining file:///home/anciety/temp/patcherex/patcherex
Requirement already satisfied: angr in /usr/lib/python2.7/site-packages (from patcherex==1.1)
Requirement already satisfied: capstone in /usr/lib/python2.7/site-packages (from patcherex==1.1)
Requirement already satisfied: psutil in /usr/lib/python2.7/site-packages (from patcherex==1.1)
Collecting timeout-decorator (from patcherex==1.1)
  Downloading timeout-decorator-0.3.3.tar.gz
Collecting subprocess32 (from patcherex==1.1)
  Downloading subprocess32-3.2.7.tar.gz (54kB)
    100% |████████████████████████████████| 61kB 159kB/s 
Collecting tracer (from patcherex==1.1)
  Downloading tracer-0.3.2.tar.gz
Collecting povsim (from patcherex==1.1)
  Could not find a version that satisfies the requirement povsim (from patcherex==1.1) (from versions: )
No matching distribution found for povsim (from patcherex==1.1)

Import Error Issue

Hi, i'm a beginner in patcherex.

I'd installed patcherex-1.2 at python 3.6, python 3.7, and python 3.8.

And then, i've tried to execute example code in the readme documentation. But, i got some trouble in ImportError like this.

I guess that the trouble is occurred by the code which import package 'techniques'. Thus, the modules in techniques are moved to the location which patch_master.py is located. But, another import error is occurred.

Is it right way to move location of the modules?

Reassembly Errors

I am trying to use ramblr for my research but I found some errors when I ran it.

I created a simple patch(re-compile) program as follows.
(I did not add any instrumentations for test)

from patcherex.backends.reassembler_backend import ReassemblerBackend

import argparse
if __name__=='__main__':
    parser = argparse.ArgumentParser();
    parser.add_argument("input")
    parser.add_argument("output")
    args= parser.parse_args()

    backend = ReassemblerBackend(args.input, debugging=False)
    backend.save(args.output)

Also, I use a lastest angr versions as follows.

$ pip3 list| grep angr
angr                   9.1.11508  
$ pip list | grep angr
angr                   7.8.9.26

However, I met several errors even when I ran it

Error #1

I created a toy program (hello.c) as follows.

$ cat hello.c
#include <stdio.h>
int main()
{
    printf("hello world\n");
    return 0;
}
$ gcc hello.c -no-pie -fno-pie -o hello
$ strip hello

Then I ran it, but my program got syntax error.

$ python3 ramblr/test/demo.py hello64 hello64_2
Deprecation warning: Use self.model.nodes() instead of nodes
Traceback (most recent call last):
  File "ramblr/test/demo.py", line 11, in <module>
    backend.save(args.output)
  File "/test/ramblr/patcherex/patcherex/backends/reassembler_backend.py", line 145, in save
    raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
patcherex.errors.CompilationError: File: /tmp/hello6428_s8lf9.s Error: (b'', b"/tmp/hello6428_s8lf9.s: Assembler messages:\n/tmp/hello6428_s8lf9.s: Warning: end of file not at end of a line; newline inserted\n/tmp/hello6428_s8lf9.s:9: Error: too many memory references for `sub'\n/tmp/hello6428_s8lf9.s:11: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:13: Error: too many memory references for `test'\n/tmp/hello6428_s8lf9.s:20: Error: too many memory references for `add'\n/tmp/hello6428_s8lf9.s:40: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:58: Error: junk `ptr cs:[rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:60: Error: junk `ptr [rax]' after expression\n/tmp/hello6428_s8lf9.s:71: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:73: Error: too many memory references for `cmp'\n/tmp/hello6428_s8lf9.s:75: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:79: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:81: Error: too many memory references for `test'\n/tmp/hello6428_s8lf9.s:87: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:91: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:105: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:108: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:112: Error: too many memory references for `sub'\n/tmp/hello6428_s8lf9.s:114: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:116: Error: too many memory references for `sar'\n/tmp/hello6428_s8lf9.s:118: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:120: Error: too many memory references for `shr'\n/tmp/hello6428_s8lf9.s:122: Error: too many memory references for `add'\n/tmp/hello6428_s8lf9.s:124: Error: too many memory references for `sar'\n/tmp/hello6428_s8lf9.s:128: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:130: Error: too many memory references for `test'\n/tmp/hello6428_s8lf9.s:136: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:147: Error: junk `ptr [rax]' after expression\n/tmp/hello6428_s8lf9.s:161: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:170: Error: junk `ptr [rip+label_3]' after expression\n/tmp/hello6428_s8lf9.s:170: Error: too many memory references for `cmp'\n/tmp/hello6428_s8lf9.s:183: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:187: Error: junk `ptr [rip+label_3]' after expression\n/tmp/hello6428_s8lf9.s:187: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:200: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:212: Error: junk `ptr [rax]' after expression\n/tmp/hello6428_s8lf9.s:214: Error: junk `ptr cs:[rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:225: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:240: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:242: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:255: Error: junk `ptr cs:[rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:257: Error: junk `ptr [rax]' after expression\n/tmp/hello6428_s8lf9.s:270: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:276: Error: too many memory references for `lea'\n/tmp/hello6428_s8lf9.s:280: Error: too many memory references for `lea'\n/tmp/hello6428_s8lf9.s:284: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:286: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:288: Error: too many memory references for `sub'\n/tmp/hello6428_s8lf9.s:290: Error: too many memory references for `sub'\n/tmp/hello6428_s8lf9.s:292: Error: too many memory references for `sar'\n/tmp/hello6428_s8lf9.s:296: Error: too many memory references for `test'\n/tmp/hello6428_s8lf9.s:300: Error: too many memory references for `xor'\n/tmp/hello6428_s8lf9.s:302: Error: junk `ptr [rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:305: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:307: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:309: Error: too many memory references for `mov'\n/tmp/hello6428_s8lf9.s:311: Error: junk `ptr [r12+rbx*8]' after expression\n/tmp/hello6428_s8lf9.s:313: Error: too many memory references for `add'\n/tmp/hello6428_s8lf9.s:315: Error: too many memory references for `cmp'\n/tmp/hello6428_s8lf9.s:320: Error: too many memory references for `add'\n/tmp/hello6428_s8lf9.s:345: Error: junk `ptr cs:[rax+rax]' after expression\n/tmp/hello6428_s8lf9.s:363: Error: too many memory references for `sub'\n/tmp/hello6428_s8lf9.s:365: Error: too many memory references for `add'\n")

After debugging, I found that there is a mistake as follows.

#src: ~/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py: 2109 
2070     def assembly(self, comments=False, symbolized=True):
...
2109         s = "\n".join(all_assembly_lines)

I fixed it as follows.

2109         s += "\n".join(all_assembly_lines)

After fixing an aformentioned error, I also got error (error #1) as follows.

$ python3 ramblr/test/demo.py hello64 hello64_2
Deprecation warning: Use self.model.nodes() instead of nodes
Traceback (most recent call last):
  File "ramblr/test/demo.py", line 11, in <module>
    backend.save(args.output)
  File "/data2/tools/sok_script/ramblr/patcherex/patcherex/backends/reassembler_backend.py", line 145, in save
    raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
patcherex.errors.CompilationError: File: /tmp/hello64fxruy6ow.s Error: (b'', b"/tmp/hello64fxruy6ow.s: Assembler messages:\n/tmp/hello64fxruy6ow.s: Warning: end of file not at end of a line; newline inserted\n/tmp/ccLbEVvb.o: In function `init':\n(.text+0x166): undefined reference to `label_9'\n/tmp/ccLbEVvb.o: In function `sub_400390':\n(.init+0x7): undefined reference to `label_0'\ncollect2: error: ld returned 1 exit status\n")

We examined assembly file that ramblr emited, and found that the errors are related to missing symbols.

$ gcc /tmp/hello64fxruy6ow.s  -no-pie -fno-pie
/tmp/hello64fxruy6ow.s: Assembler messages:
/tmp/hello64fxruy6ow.s: Warning: end of file not at end of a line; newline inserted
/tmp/cc2KjYEb.o: In function `init':
(.text+0x166): undefined reference to `label_9'
/tmp/cc2KjYEb.o: In function `sub_400390':
(.init+0x7): undefined reference to `label_0'
collect2: error: ld returned 1 exit status    

Error #2

Next, I test(recompile) 'ls' binary, and I found a different error as follows.
First, I ran python3 version.

python3 ramblr/test/demo.py coreutils-8.30_x64_nopie_ls ls.s
Deprecation warning: Use self.model.nodes() instead of nodes
Traceback (most recent call last):
  File "/test/ramblr/patcherex/patcherex/backends/reassembler_backend.py", line 115, in save
    assembly = self._binary.assembly(comments=True, symbolized=True)  # type: str
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 2087, in assembly
    addr_and_assembly.extend(proc.assembly(comments=comments, symbolized=symbolized))
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 1097, in assembly
    s = b.assembly(comments=comments, symbolized=symbolized)
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 912, in assembly
    s = "\n".join([ins.assembly(comments=comments, symbolized=symbolized) for ins in self.instructions])
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 912, in <listcomp>
    s = "\n".join([ins.assembly(comments=comments, symbolized=symbolized) for ins in self.instructions])
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 805, in assembly
    op_asm = op.assembly()
  File "/home/test/.local/lib/python3.6/site-packages/angr/analyses/reassembler.py", line 546, in assembly
    raise BinaryError('Unsupported memory operand size for operand "%s"' % self.operand_str)
angr.analyses.reassembler.BinaryError: Unsupported memory operand size for operand "xword ptr [rip + 0xf217]"

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "ramblr/test/demo.py", line 11, in <module>
    backend.save(args.output)
  File "/test/ramblr/patcherex/patcherex/backends/reassembler_backend.py", line 119, in save
    str(ex)
patcherex.errors.ReassemblerError: Reassembler failed to reassemble the binary. Here is the exception we caught: Unsupported memory operand size for operand "xword ptr [rip + 0xf217]"

I think ramblr could not properly handle following instruction.

objdump -d -M intel /data2/benchmark/coreutils-8.30/x64/gcc/nopie/o0-bfd/stripbin/ls | grep 0xf217
  4100b3:	db 2d 17 f2 00 00    	fld    TBYTE PTR [rip+0xf217]        # 41f2d0 <_fini@@Base+0x5698>
  4100c3:	db 2d 17 f2 00 00    	fld    TBYTE PTR [rip+0xf217]        # 41f2e0 <_fini@@Base+0x56a8>

Error #3

Also, python2 version emits different error as follows.
I think the error reason is similar to that of error #1

python2 ramblr/test/demo.py coreutils-8.30_x64_nopie_ls ls.s
WARNING | 2022-01-21 19:55:39,425 | angr.analyses.disassembly_utils | Your version of capstone does not support MIPS instruction groups.
WARNING | 2022-01-21 19:55:42,556 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000001_11_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:42,625 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000009_19_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:42,767 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00001a_28_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:42,837 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00002b_37_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:42,892 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000033_44_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:42,948 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00003b_51_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,015 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000043_58_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,081 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000054_67_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,143 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00005c_74_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,209 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000065_84_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,306 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000076_96_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,361 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00007e_104_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,891 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000087_117_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,928 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c00008f_121_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:43,979 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c000098_127_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:44,066 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000a1_143_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:44,102 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000a9_147_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:44,158 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000b2_153_64{UNINITIALIZED}>
WARNING | 2022-01-21 19:55:44,294 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV64 global_c0000bc_164_64{UNINITIALIZED}>
ERROR   | 2022-01-21 19:55:44,477 | angr.analyses.cfg.cfg_fast | Decoding error occurred at basic block address 0x402a4c of function 0x402a4c.
Traceback (most recent call last):
  File "ramblr/test/demo.py", line 11, in <module>
    backend.save(args.output)
  File "/test/ramblr/patcherex/patcherex/backends/reassembler_backend.py", line 145, in save
    raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
patcherex.errors.CompilationError: File: /tmp/lssl1_qt.s Error: ('', "/tmp/lssl1_qt.s: Assembler messages:\n/tmp/lssl1_qt.s:30871: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30873: Error: junk `ptr [word ptr [rip+label_1563]]' after expression\n/tmp/lssl1_qt.s:30881: Error: junk `ptr [word ptr [rip+label_1558]]' after expression\n/tmp/lssl1_qt.s:30883: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30891: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30910: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30912: Error: junk `ptr [word ptr [rip+label_1558]]' after expression\n/tmp/lssl1_qt.s:30949: Error: junk `ptr [word ptr [rip+label_1568]]' after expression\n/tmp/lssl1_qt.s:30954: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30960: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:30996: Error: junk `ptr [word ptr [rip+label_1568]]' after expression\n/tmp/lssl1_qt.s:31001: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:31004: Error: junk `ptr [rbp+0x10]' after expression\n/tmp/lssl1_qt.s:31465: Error: junk `ptr [word ptr [rip+label_1568]]' after expression\n/tmp/lssl1_qt.s:31470: Error: junk `ptr [rbp - 0x20]' after expression\n/tmp/lssl1_qt.s:31478: Error: junk `ptr [word ptr [rip+label_1568]]' after expression\n/tmp/lssl1_qt.s:31489: Error: junk `ptr [word ptr [rip+label_1568]]' after expression\n/tmp/lssl1_qt.s:31494: Error: junk `ptr [rbp - 0x20]' after expression\n/tmp/lssl1_qt.s:31500: Error: junk `ptr [rbp - 0x10]' after expression\n/tmp/lssl1_qt.s:31526: Error: junk `ptr [rsp]' after expression\n/tmp/lssl1_qt.s:31553: Error: junk `ptr [rbp - 0x30]' after expression\n/tmp/lssl1_qt.s:31564: Error: junk `ptr [rbp - 0x30]' after expression\n/tmp/lssl1_qt.s:31568: Error: junk `ptr [rbp - 0x30]' after expression\n/tmp/lssl1_qt.s:31578: Error: junk `ptr [rbp - 0x30]' after expression\n/tmp/lssl1_qt.s:31582: Error: junk `ptr [rbp - 0x10]' after expression\n/tmp/lssl1_qt.s:31597: Error: junk `ptr [rbp - 0x10]' after expression\n/tmp/lssl1_qt.s:31599: Error: junk `ptr [rbp - 0x30]' after expression\n/tmp/lssl1_qt.s:31603: Error: junk `ptr [rbp - 0x10]' after expression\n/tmp/lssl1_qt.s:31621: Error: junk `ptr [rsp]' after expression\n/tmp/lssl1_qt.s:31690: Error: junk `ptr [rbp - 0x10]' after expression\n/tmp/lssl1_qt.s:31692: Error: junk `ptr [word ptr [rip+label_1618]]' after expression\n/tmp/lssl1_qt.s:31700: Error: junk `ptr [rsp]' after expression\n/tmp/lssl1_qt.s:31708: Error: junk `ptr [word ptr [rip+label_1618]]' after expression\n/tmp/lssl1_qt.s:31716: Error: junk `ptr [rsp]' after expression\n/tmp/lssl1_qt.s:63025: Warning: end of file not at end of a line; newline inserted\n")    

Patched Binary Segfault - DetourBackend

Description

Hello, a simple binary I'm trying to patch segfaults. I believe this is due to some RIP relative addressing issue. The code I'm trying to patch in is very basic, so I highly doubt it's the problem. I have even tried to patch an empty string, and still segfault.

Running with gdb, I found that in the original binary as string is being
referenced using llea rax, [rip+0xed3], which results to 0x402004. In the patched binary, the instruction remains the same, however the resulting address is changed due to the trampoline, now it is 0x601b4b, which contains absolutely nothing, while the resulting string is still at 0x402004.

Steps to reproduce the bug

The script I'm using:

import sys
from patcherex.backends.detourbackend import DetourBackend
from patcherex.patches import InsertCodePatch


binary = sys.argv[1]
backend = DetourBackend(binary)
patches = []


project = backend.project

random = '''
    mov r11, 0xdeadbeef
    '''

for node in sorted(backend.cfg.model.nodes(), key=lambda n: n.addr):
    if not node.is_simprocedure and node.name == "hello":
        patch_addr = node.addr

        print("function at 0x%x with name %s" % (node.addr, node.name))
        print("patching at 0x%x" % patch_addr)
        # insert the code at the beginning of the function
        patches.append(InsertCodePatch(patch_addr, random))


backend.apply_patches(patches)
backend.save(sys.argv[2])

It essentially adds some code at the start of the hello function.
Provide the binary as argv[1] and the output as argv[2].
This is the C code of the binary, compiled with gcc hello.c -no-pie -o hello:

#include <stdio.h>
#include <stdlib.h>



void hello() {
  printf("Hello, world!");
}

int main(void) {
  hello();
}

Environment

Linux: 5.15.89-1-lts
GLIBC: 2.36
patchrex: 1.2, commit: f888f5e

angr bug report:

/home/elleven/.local/lib/python3.10/site-packages/angr/misc/bug_report.py:1: DeprecationWarning: the imp module is deprecated in favour of importlib and slated for removal in Python 3.12; see the module's documentation for alternative uses
  import imp
angr environment report
=============================
Date: 2023-01-22 22:01:18.628484
!!! running in global environment.  Are you sure? !!!
Platform: linux-x86_64
Python version: 3.10.9 (main, Dec 19 2022, 17:35:49) [GCC 12.2.0]
######## angr #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/angr
Pip version angr 9.2.34
Couldn't find git info
######## ailment #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/ailment
Pip version ailment 9.2.34
Couldn't find git info
######## cle #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/cle
Pip version cle 9.2.34
Couldn't find git info
######## pyvex #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/pyvex
Pip version pyvex 9.2.34
Couldn't find git info
######## claripy #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/claripy
Pip version claripy 9.2.34
Couldn't find git info
######## archinfo #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/archinfo
Pip version archinfo 9.2.34
Couldn't find git info
######## z3 #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/z3
Pip version z3-solver 4.10.2.0
Couldn't find git info
######## unicorn #########
Python found it in /home/elleven/.local/lib/python3.10/site-packages/unicorn
Pip version unicorn 2.0.1.post1
Couldn't find git info
######### Native Module Info ##########
angr: <CDLL '/home/elleven/.local/lib/python3.10/site-packages/angr/state_plugins/../lib/angr_native.so', handle 55b85f0058f0 at 0x7faf61a66aa0>
unicorn: <CDLL '/home/elleven/.local/lib/python3.10/site-packages/unicorn/lib/libunicorn.so.2', handle 55b85e98f650 at 0x7faf67365c90>
pyvex: <cffi.api._make_ffi_library.<locals>.FFILibrary object at 0x7faf67dfe260>
z3: <CDLL '/home/elleven/.local/lib/python3.10/site-packages/z3/lib/libz3.so', handle 55b85ecfe7d0 at 0x7faf639bd720>

Additional context

No response

Several questions on x86_64 binary patching

Hello,

I have some assembly code I am trying to insert via x86_64 binary rewriting to be called at the start of <main>. Below is a brief, high-level overview of this code:

.text 				
.att_syntax 
.code64 	
.align 8 	

_patch_begin:
	lahf
	seto  %al  
	movq  _patch_var(%rip), %rdx
	testq %rdx, %rdx
	je _patch_func

.align 8

_patch_func:
	do_stuff
	ret

.VARS
	.lcomm   _patch_var, 8

Based on the readme, it seems I must come up with something like this:

_patch_begin = '''
	lahf
	seto  %al  
	movq  _patch_var(%rip), %rdx
	testq %rdx, %rdx
	je _patch_func
	'''

_patch_func = '''
	do_stuff
	ret
	'''

patches.append(AddCodePatch(_patch_begin, name="_begin"))
patches.append(AddCodePatch(_patch_func, name="_func"))

_patch_callback = '''
	call {_begin}
	'''

patches.append(InsertCodePatch(<addr_of_main>, _patch_callback, name="_callback"))

Two questions arise:

1. How would I handle the .text, att_syntax, .code64, and .align operations?
2. During normal assembly, the .VARS content would be inserted at .bss. But it seems patcherex doesn't support this. Would inserting it at .rodata or .rwdata suffice? If not, is there any way to instead patch it to .bss?

Thanks,
-Steve

Refactoring utils.py to work with x64

Currently, the utils.py uses constants that work only with x86 32 bit.
It would be good to re-implement the functionalities in this file as a class which contains some information about the angr.Project instance.

I can try to do this. But if anyone has a better idea I can try to help with it.

Reassembler Issues

Please check the feat/ezpz branch.
The remaining tests failing are:

• adversarial
• nxstack
• backdoor
• bitflip
• indirectcfi
• shiftstack
• transmitprotection

All of them are Reassembler issues.
The CI is also broken though.
@ltfish I'm not sure where those issue would originate from?
The Reassembler backend wasn't really touched and the clang version is shipped...

Merge compilerex functionality into patcherex

We would like to remove compilerex from the integrated angr CI. Doing so would mean dropping the dependency in this repository. We should merge in whatever functionality is needed here to make this change possible.

Randomly failing tests

These tests can randomly fail angr CI.

======================================================================
FAIL: test_add_data_patch_long (test_detourbackend_arm.Tests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/__w/1/s/build/src/patcherex/tests/test_detourbackend_arm.py", line 151, in test_add_data_patch_long
    self.test_add_rw_data_patch(length)
  File "/__w/1/s/build/src/patcherex/tests/test_detourbackend_arm.py", line 109, in test_add_rw_data_patch
    self.run_test("printf_nopie", [p1, p2], expected_output=b"A"*tlen + b"Hi", expected_returnCode=0)
  File "/__w/1/s/build/src/patcherex/tests/test_detourbackend_arm.py", line 287, in run_test
    self.assertEqual(res[0], expected_output)
AssertionError: b'' != b'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[57 chars]AAHi'

======================================================================
FAIL: test_double_patch_collision (test_detourbackend_mips.Tests)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/__w/1/s/build/src/patcherex/tests/test_detourbackend_mips.py", line 211, in test_double_patch_collision
    backend = self.run_test("printf_nopie", [p1, p2, p3, p4], expected_output=test_str2 + b"Hi", try_without_cfg=False)
  File "/__w/1/s/build/src/patcherex/tests/test_detourbackend_mips.py", line 289, in run_test
    self.assertEqual(res[0], expected_output)
AssertionError: b'Hi' != b'2222222222\n\x00Hi'

Error while using patchrex in command line mode

Hi everyone,
I am newbie to patchrex. I am using it for first time.
While running patchrex in command line mode, it stops with import error.
It is:
File "/home/ronak/patchrex/myproj/cgc/patcherex-master/patcherex/backends/reassembler_backend.py", line 7, in
import compilerex
ImportError: No module named compilerex

Can anyone please help me with it.
Thanks

The public version doesn't support ELF format binary

according to the paper,the ramblr is have a good effect on elf binary reassembling , but my experiment and other issues has shown that the public version doesn't support ELF format binary well. Would you mind releasing some test elf binary that public version Ramblr supported. Thanks!

Reading binaries assembled for x86

I am new to binary rewriting. I tried to run your example for patcherex using a test binary on my x86 machine. I get the following WARNINGS and ERRORS after the instruction

>>backend = DetourBackend("test1")
WARNING | 2018-03-13 18:22:27,675 | angr.procedures.definitions | unsupported syscall: rt_sigqueueinfo
WARNING | 2018-03-13 18:22:27,675 | angr.procedures.definitions | unsupported syscall: rt_sigqueueinfo
WARNING | 2018-03-13 18:22:27,675 | angr.procedures.definitions | unsupported syscall: rt_sigqueueinfo
WARNING | 2018-03-13 18:22:27,676 | angr.procedures.definitions | unsupported syscall: rt_sigqueueinfo
WARNING | 2018-03-13 18:22:30,538 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,539 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,539 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,544 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,562 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,563 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,563 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:30,564 | angr.procedures.definitions | unsupported syscall: sys_623
WARNING | 2018-03-13 18:22:34,718 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,719 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,719 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,720 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,727 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,774 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,775 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,775 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,776 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,781 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,797 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,798 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,798 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,799 | angr.procedures.definitions | unsupported syscall: wait4
WARNING | 2018-03-13 18:22:34,825 | angr.procedures.definitions | unsupported syscall: execve
WARNING | 2018-03-13 18:22:34,826 | angr.procedures.definitions | unsupported syscall: execve
WARNING | 2018-03-13 18:22:34,826 | angr.procedures.definitions | unsupported syscall: execve
WARNING | 2018-03-13 18:22:34,827 | angr.procedures.definitions | unsupported syscall: execve
WARNING | 2018-03-13 18:22:34,827 | angr.procedures.definitions | unsupported syscall: execve
WARNING | 2018-03-13 18:22:34,836 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,837 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,837 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,837 | angr.procedures.definitions | unsupported syscall: clone
WARNING | 2018-03-13 18:22:34,876 | angr.procedures.definitions | unsupported syscall: kill
WARNING | 2018-03-13 18:22:34,877 | angr.procedures.definitions | unsupported syscall: kill
WARNING | 2018-03-13 18:22:34,877 | angr.procedures.definitions | unsupported syscall: kill
WARNING | 2018-03-13 18:22:34,877 | angr.procedures.definitions | unsupported syscall: kill
WARNING | 2018-03-13 18:22:35,048 | angr.procedures.definitions | unsupported syscall: readlink
WARNING | 2018-03-13 18:22:35,049 | angr.procedures.definitions | unsupported syscall: readlink
WARNING | 2018-03-13 18:22:35,049 | angr.procedures.definitions | unsupported syscall: readlink
WARNING | 2018-03-13 18:22:35,050 | angr.procedures.definitions | unsupported syscall: readlink
WARNING | 2018-03-13 18:22:35,050 | angr.procedures.definitions | unsupported syscall: readlink
ERROR   | 2018-03-13 18:22:35,279 | angr.engines.vex.statements.dirty | Unsupported dirty helper amd64g_dirtyhelper_FSTENV
ERROR   | 2018-03-13 18:22:35,279 | angr.engines.vex.statements.dirty | Unsupported dirty helper amd64g_dirtyhelper_FLDENV
WARNING | 2018-03-13 18:22:35,285 | angr.procedures.definitions | unsupported syscall: rt_sigprocmask

What am I doing wrong?

x64 arithmetic immediates get truncated

When lifting code from a simply x64 ELF binary with angr and printing out the capstone instructions, there is an instruction such as this:

0x400439:  and  rsp, 0xfffffffffffffff0

However, when patcherex tries to generate a new binary using the Reassembler backend (0 patches applied - i.e. try to just generate a new binary from the old one with no modifications), similar to the tutorial in the patcherex README, I get the following error:

File "angr/patcherex/patcherex/backends/reassembler_backend.py", line 134, in save
raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
patcherex.errors.CompilationError: File: /tmp/print0nP4oL.s Error: ('', '/tmp/print0nP4oL.s:46:7: error: invalid operand for instruction\n andq $0xfffffff0, %rsp\n

When I look in the temp-generated assembly file /tmp/print0nP4oL.s:, I notice the following at the referenced line 46:

# 0x400439: andq  $0xfffffff0, %rsp [IMM, REG]
andq  $0xfffffff0, %rsp

The value seems to have changed, and specifically the sign extension seems to be gone. In any case, there is no binary generated. The code is an extremely simple C program compiled with gcc (with no flags passed to it) on 64-bit Linux:

#include <stdio.h>

int main(int argc, char **argv) {
  int x, y, z;
  x = 1234567890;
  printf("%d\n", x);
  y = 1111111101;
  z = x - y; // z = 123456789
  printf("%d\n", z);
  return 0;
}

I've also tried changing the assemble.sh script called by compilerex to use other assemblers instead of clang (such as gcc and gas), but have the same problem.

I can provide the binary or more information if needed.

This may actually be an issue in compilerex or another module, but I'm not entirely sure.

Is there any functionality about edit existing data?

I carefully read your paper, ramblr.
It was nice and novel paper!

In the paper, you commented that ramblr has functions about appending the new data.
but there's no comment about editing existing data.
(For example, I want edit existing string array 'hello' to 'hello world',)
Is there any feature about this?

Thanks!

ReassemblerBackend Error

Hi,
I just install and try patcherex. When I try the example "modifies the binary CADET_00003 so that it prints "HI!" ", if I use backend = DetourBackend, everything compiles and runs well. However, if I use backend = ReassemblerBackend, there will be the following error:

Traceback (most recent call last):
  File "test_sun.py", line 38, in <module>
    backend.save("/tmp/CADET_00003_mod1")
  File "/var/home/psun/fla/angr-rw/patcherex/patcherex/backends/reassembler_backend.py", line 134, in save
    raise CompilationError("File: %s Error: %s" % (tmp_file_path,res))
patcherex.errors.CompilationError: File: /tmp/CADET_000032Yp69w.s Error: ('', 'bash: /var/home/psun/.virtualenvs/angr-rw/local/lib/python2.7/site-packages/compilerex/../assemble.sh: No such file or directory\n')

install error

Could not find a version that satisfies the requirement povsim (from patcherex==1.2) (from versions: )
No matching distribution found for povsim (from patcherex==1.2)