SRec: Fix record matching and entry point parsing - #714
Conversation
The SRec backend could not load a file that any real toolchain produces: * The data field of the record regex demanded between 4 and 64 hex digits, so a record carrying one byte of data, or a termination record carrying none, never matched. Matching only a prefix compounded this: on a record with more than 32 data bytes the checksum group landed inside the data, and the record was rejected for a checksum it never had. objcopy writes the output file name into the S0 header record, so that is reachable on the very first line. * The entry point was read from the data field of the termination record. S7/S8/S9 records carry the start address in their address field and have no data, so the entry point always came out as 0. * Malformed input escaped as KeyError, IndexError, binascii.Error, or a TypeError from concatenating bytes onto a str, rather than as CLEError. Match the whole record, let the data field hold any number of bytes, take the entry point from the address field, and report every malformed record as a CLEError. A data record with an empty data field is now skipped instead of backing an empty memory region.
|
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS Validation record for head Reproducer, with GNU binutils 2.46 objcopy and any ELF:
Beyond the two defects in the description, a data record whose data field is Caveats: S5/S6 record-count records are still refused as unimplemented, exactly |
|
Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/cle_714 |
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
The SRec backend cannot load
objcopy -O srecoutput. The record regex demands4 to 64 hex digits of data, which rejects a one-byte data record and every
S7/S8/S9 termination record, and on a record carrying more than 32 data bytes it
matches only a prefix, so the checksum group lands inside the data and the record
is rejected for a checksum it never had. The entry point is also read from the
termination record's data field, which is empty by definition, so relaxing the
match on its own would report an entry of 0.
The parser now matches the whole record, accepts any data length, and takes the
entry point from the address field. Malformed records raise
CLEErrorinstead ofletting
KeyError,IndexError,binascii.Erroror aTypeErrorescape.tests/test_srec.pycovers both, including three verbatim lines of objcopyoutput; every test in it fails on master.
Validation: #714 (comment)