Last active
April 13, 2017 20:14
-
-
Save offlinemark/1542bb6746ba5676eb279e47dfb432a6 to your computer and use it in GitHub Desktop.
related to debugging manticore dynamic binary support bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <stdio.h> | |
| #include <string.h> | |
| #include <err.h> | |
| #include <sys/mman.h> | |
| int main(int argc, const char *argv[]) | |
| { | |
| char a[] = "libc.so.6"; | |
| char b[] = "ld-linux-x86-64.so.2"; | |
| /* char *ldbase = (char*)0x0007ffff7dd7000; */ | |
| char *ldbase = (char*)0x00007ffff7dda000; | |
| /* char *ldbase = (char*)0x0007ffff7dd7000; */ | |
| void *ret = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, | |
| -1, 0); | |
| if (ret == MAP_FAILED) | |
| err(1, "map failed"); | |
| char *aa = (char*)ret+0x331; | |
| char *bb = (char*)ret+0x7ac; | |
| strcpy(aa, a); | |
| strcpy(bb, b); | |
| void *func = ldbase + 0x19410; | |
| int (*my_strcmp)(char *, char *) = func; | |
| int x = my_strcmp(aa, bb); | |
| /* int x = strcmp(a, b); */ | |
| printf("%d\n", x); | |
| return 0; | |
| } |
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
debugging why mcore was executing an error condition in ld.so. emulation error causing strcmp to return 0 inappropriately and cause ld.so think libc was already loaded when it wasn't, which would cause things to fail later. this is code i used to debug why strcmp wasn't working. the strcmp was super heavily optimized x64, and even things like the page offsets of the strings matter, and the code behaves differently based on them (related to cache lines/also how many bytes they can slurp in simd insns so they don't go off the end of the page)