Skip to content

Instantly share code, notes, and snippets.

@offlinemark
Last active April 13, 2017 20:14
Show Gist options
  • Select an option

  • Save offlinemark/1542bb6746ba5676eb279e47dfb432a6 to your computer and use it in GitHub Desktop.

Select an option

Save offlinemark/1542bb6746ba5676eb279e47dfb432a6 to your computer and use it in GitHub Desktop.
related to debugging manticore dynamic binary support bug
#include <stdio.h>
#include <string.h>
#include <err.h>
#include <sys/mman.h>
int main(int argc, const char *argv[])
{
char a[] = "libc.so.6";
char b[] = "ld-linux-x86-64.so.2";
/* char *ldbase = (char*)0x0007ffff7dd7000; */
char *ldbase = (char*)0x00007ffff7dda000;
/* char *ldbase = (char*)0x0007ffff7dd7000; */
void *ret = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS,
-1, 0);
if (ret == MAP_FAILED)
err(1, "map failed");
char *aa = (char*)ret+0x331;
char *bb = (char*)ret+0x7ac;
strcpy(aa, a);
strcpy(bb, b);
void *func = ldbase + 0x19410;
int (*my_strcmp)(char *, char *) = func;
int x = my_strcmp(aa, bb);
/* int x = strcmp(a, b); */
printf("%d\n", x);
return 0;
}
@offlinemark

Copy link
Copy Markdown
Author

debugging why mcore was executing an error condition in ld.so. emulation error causing strcmp to return 0 inappropriately and cause ld.so think libc was already loaded when it wasn't, which would cause things to fail later. this is code i used to debug why strcmp wasn't working. the strcmp was super heavily optimized x64, and even things like the page offsets of the strings matter, and the code behaves differently based on them (related to cache lines/also how many bytes they can slurp in simd insns so they don't go off the end of the page)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment