Fix Clemory backer removal and the BackedCGC backend - #718
Open
zardus wants to merge 1 commit into
Open
Conversation
Loading anything with the backedcgc backend raised "Can't find backer to remove". Clemory.remove_backer() searched with bisect_right, which always lands one index past the backer whose start matches, so no removal ever found its target and BackedCGC.__init__ died on the first file backer it tried to drop. split_backer(), and add_backer(overwrite=True) through it, were broken the same way. The backend had further defects on that path: - It compared segment vaddrs and the caller's memory_backer keys, which are linked addresses, against the object's memory, which is keyed relative to the object's base. It dropped the executable segment it meant to keep and mapped the dump at the wrong addresses. - It iterated the backer list while removing from it, so every backer following a removed one was skipped. - FakeSegment assigned to is_readable, is_writable and is_executable, which are read-only properties on Region, so any non-empty memory_backer raised AttributeError before a byte of it was mapped. - Both backers are documented as optional, but a missing memory_backer raised AttributeError, and thread_registers() returned None where Backend documents a mapping and angr's SimOS calls .items() on the result. Both are empty mappings now when the caller supplies nothing. Removing a Clemory's last backer now happens for real, so _update_min_max() restores the empty state a fresh Clemory has instead of asserting; split_backer() passes through that state on every split.
Member
Author
|
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS Validation record for head
Caveats: the backend still marks dump-only regions non-executable, as it always intended to; a CGC replay that needs an executable stack passes |
Member
|
Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/cle_718 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
Loading anything with the
backedcgcbackend failed with "Can't find backer to remove".Clemory.remove_backer()bisected right, landing one index past the backer it was asked to drop, so no removal ever found its target;split_backer()andadd_backer(overwrite=True)were unusable for the same reason.Behind it the backend has its own defects: it mixes linked and object-relative addresses, mutates the backer list while iterating it, assigns to
Region's read-only permission properties, and returnsNonefromthread_registers()whereBackenddocuments a mapping. Both backers are now the optional mappings the docstring already describes.The regression loads
binaries/tests/i386/patchrex/memory_scannerwith and without a process dump.Validation: #718 (comment).
sync: angr/angr#6795