Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[x86] fails Reassembly #41

Closed
miksh opened this issue Jan 24, 2022 · 3 comments
Closed

[x86] fails Reassembly #41

miksh opened this issue Jan 24, 2022 · 3 comments
Assignees
Labels
binary fails DDisasm fails to correctly disassemble a binary

Comments

@miksh
Copy link

miksh commented Jan 24, 2022

I am trying to reassemble x86 binary with latest ddisasm (grammatech/ddisasm:1.5.2).
However, I could not recompile the reassembled code since ddisasm does not create main symbol.

I reassembled a toy program (hello.c) as follows.

$ cat hello.c
#include <stdio.h>
int main()
{
    printf("hello world\n");
    return 0;
}
$ gcc hello.c -m32 -o hello_32
$ strip hello_32

$ sudo docker run --rm -v /home/test/test/:/test grammatech/ddisasm:1.5.2 sh -c "ddisasm /test/hello_32 --asm /test/hello_32.s"
Building the initial gtirb representation  (3ms)
Decoding the binary  (5ms)
Disassembling (20ms)
Populating gtirb representation  (5ms)
Computing intra-procedural SCCs  (0ms)
Computing no return analysis  (0ms)
Detecting additional functions  (1ms)
Printing assembler  (9ms)

I got the following errors.

$ gcc hello_32.s -m32
/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib32/Scrt1.o: In function `_start':
(.text+0x28): undefined reference to `main'
collect2: error: ld returned 1 exit status

I hope ddisasm fixes this bug soon.

@miksh miksh added the binary fails DDisasm fails to correctly disassemble a binary label Jan 24, 2022
@kwarrick
Copy link
Contributor

Looks like PIE code loads the main address from GOT.

          406:   push DWORD PTR [EBX+FUN_1309@GOT]
          40c:   call __libc_start_main@PLT

          411:   hlt 

Should be an easy fix.

@kwarrick
Copy link
Contributor

Fixed in dfdf8ad.

@miksh Thanks for reporting this! We should find main now for stripped PIE x86 binaries.

@miksh
Copy link
Author

miksh commented Jan 28, 2022

Thank you. :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
binary fails DDisasm fails to correctly disassemble a binary
Projects
None yet
Development

No branches or pull requests

4 participants