reusing existing PLT table with symbolization

This is for analyzing statically-linked binaries. After recompilation, the PLT table size and entries may change, making it unreliable to use the new PLT table.

Author: yellowbyte

.github/workflows/build.yml

@@ -5,7 +5,6 @@ on:
     branches:
       - dev
       - main
-      - instrument-framework
 jobs:
   execute-tests-ubuntu22:
     runs-on: ubuntu-22.04

Makefile

@@ -3,7 +3,7 @@
 all:
 	test/test_all.py -a -c
 	test/test_instrument.sh 2>&1 | tee test.instrument
-	rm src/points.ins src/fun.o || true
+	rm src/points/* src/fun.o || true
 	test/test_action.sh 2>&1 | tee test.all
 	test/test_coreutils.sh 2>&1 | tee test.coreutils
 

src/ail.ml

@@ -145,6 +145,7 @@ object (self)
     let module S = Symbol_table_get in
     let module I = Instrumentation in
     let _ = self#pre_process in
+    (* .text section is in instrs.info *)
     let il, fl, re = D.disassemble f funcs secs arch in
 
     print_endline "3: analysis";

src/analysis_process.ml

@@ -10,6 +10,25 @@ module Analysis = struct
   open Type
   open Reassemble_symbol_get
 
+  let instrument_got_plt () =
+    let filelines = read_file "got_plt.info" in
+    let help acc l =
+      let items =
+        Str.split (Str.regexp " +") l
+        |> List.filter (fun i -> i <> "00000000")
+        |> List.map (fun i ->
+            let addr = String.sub i 6 2
+                     ^ String.sub i 4 2
+                     ^ String.sub i 2 2
+                     ^ String.sub i 0 2
+            in
+            "S_" ^ (dec_hex (int_of_string ("0x" ^ addr)))
+           )
+      in
+      items @ acc
+    in
+    List.fold_left help [] filelines
+
   let global_bss () =
     let filelines = read_file "globalbss.info"
     and help acc l =

src/flow_insensitive_analysis.ml

@@ -27,17 +27,13 @@ let got_rewrite_instr
         prefix,
         tags )
     when got_reg = (p_exp (Reg reg1)) ->
-      (*let point = "INSERT BEFORE [" ^ (dec_hex loc.loc_addr)
-                  ^ "] SELF [] \"\" asm x \"add $_GLOBAL_OFFSET_TABLE_, "
-                  ^ (p_reg reg1) ^ "\";" in
-      U.write_file [point] "points0.ins";*)
       (* reg1 contains GOT pointer,
        * reg2 contain index,
        * const1 contains multipler,
        * const2 contains offset
        * EX: 808a4d6: jmp    *-0x2514(%ebp,%eax,4)  ---> jmp *S_0x80F7508(,%eax,0x4)
        *)
-      let got_plus_offset = got_addr + const2 in
+      let got_plus_offset = got_addr - const2 in
       Hashtbl.replace
         result
         loc.loc_addr

src/init.ml

@@ -86,6 +86,9 @@ object (self)
                         > got.info");
     let module EU = ELF_utils in
     if EU.elf_static () then begin
+      ret := Sys.command(objdump_command ^  " -s -j \
+                          .got.plt "^f^" | grep \"^ \" | cut -d \" \" -f3,4,5,6 \
+                          > got_plt.info");
       ret := Sys.command(objdump_command ^ " -d -j \
                           .plt "^f^" | grep jmp | wc -l > plt_entries.info");
       ret := Sys.command(objdump_command ^ " -s -j \
@@ -134,8 +137,13 @@ object (self)
       else failwith "unsupported architecture for fields" in
     ignore (Sys.command("cat "^f^".disassemble | grep \"^ \" | cut -f"^fields^" \
                         > instrs.info"));
+    let module EU = ELF_utils in
+    if EU.elf_static () then
+      ( ignore (Sys.command("cat plt_whole.info | grep \"^ \" | cut -f1,3 \
+                          > plt_whole2.info"));
+      ignore (Sys.command("cat plt_whole2.info >> instrs.info")) );
     ignore (Sys.command("python3 filter_nop.py"));
-    ignore (Sys.command("cut -f 1 instrs.info > text_mem.info"))
+    ignore (Sys.command("cut -f 1 instrs.info > text_mem.info"));
 
   method user_func_process (f : string) : unit =
     ignore (Sys.command("cat "^f^".disassemble | grep \"<\" | grep \">:\" \
@@ -147,12 +155,12 @@ object (self)
         (ignore (Sys.command("readelf -SW " ^ f ^ " | awk \'FNR<15\' | \
                               awk \'/data|bss|got|__libc_IO_vtables|\
                               __libc_freeres_ptrs/ {print $3,$5,$6,$7} \' | \
-                              awk \' $1 != \".got.plt\" {print $1,$2,$3,$4}\' \
+                              awk \' {print $1,$2,$3,$4}\' \
                               > sections.info"));
         ignore (Sys.command("readelf -SW " ^ f ^ " | awk \'FNR>14\' | \
                             awk \'/data|bss|got|__libc_IO_vtables|\
                             __libc_freeres_ptrs/ {print $2,$4,$5,$6} \' | \
-                            awk \' $1 != \".got.plt\" {print $1,$2,$3,$4}\' \
+                            awk \' {print $1,$2,$3,$4}\' \
                             >> sections.info")))
     else
         (ignore (Sys.command("readelf -SW " ^ f ^ " | awk \'FNR<15\' | \
@@ -300,8 +308,8 @@ let main () =
       let _ = Random.self_init () in
       let init = new ailInit in
       ( init#init arch bit_mode;
-        init#disassemble elf arch;
-        init#process elf arch bit_mode;
+        init#disassemble elf arch;  (* create text and data files *)
+        init#process elf arch bit_mode;  (* create other text files *)
         init#ail_process(elf) )
     else
       print_string ("binary file "^elf^" doesn't exist\n")

src/parser.ml

@@ -78,11 +78,16 @@ class parse =
     {loc_label=""; loc_addr=(int_of_string s); loc_visible = true;}
 
   and const_symb s =
-    if s.[0] = '$' then
+    if contains ~str:s ~sub:" # " && not (contains ~str:s ~sub:"*") then
+      let parts = String.split_on_char '#' s in
+      let abs_addr = String.trim (List.hd (List.rev parts)) in
+      Point (int_of_string abs_addr)
+    else
+      ( if s.[0] = '$' then
       let s' = String.sub s 1 ((String.length s)-1) in
       Normal (int_of_string s')
     else
-      Point (int_of_string s) in
+      Point (int_of_string s) ) in
 
   (*
 and ptrtyp_symb = function

src/post_process.py

@@ -8,6 +8,15 @@
 with open("final.s") as f:
     lines = f.readlines()
 
+def is_static():
+    lines = []
+    with open("elf.info") as f:
+        lines = f.readlines()
+    if "statically linked" in lines[0]:
+        return True
+    else:
+        return False
+
 def check_32():
     lines = []
     with open("elf.info") as f:
@@ -27,11 +36,12 @@ def check_32():
 if is_32:
     for i in range(ll):
         m = re.search(r'jmp\s+\*(%e\w{2})',lines[i])
-        if m:
-            if re.search(r'add\s+%e\w{2},'+m.group(1),lines[i-1]):
-                lines[i-1] = "nop\n"
-            elif re.search(r'add\s+%e\w{2},'+m.group(1),lines[i-2]):
-                lines[i-2] = "nop\n"
+# TODO: why this...
+#        if m:
+#            if re.search(r'add\s+%e\w{2},'+m.group(1),lines[i-1]):
+#                lines[i-1] = "nop\n"
+#            elif re.search(r'add\s+%e\w{2},'+m.group(1),lines[i-2]):
+#                lines[i-2] = "nop\n"
 else:
     for i in range(ll):
         m1 = re.search(r'jmp\s+\*(%r\w{2})', lines[i])
@@ -172,10 +182,14 @@ def check_exe():
 
     main_symbol1 = mains[0].strip()
 
-
     def help(l):
         if main_symbol1 != "" and l.startswith(main_symbol1):
             l = ".globl main\nmain:\n"+l
+            if os.path.exists("plt_handler.txt") and is_static():
+                with open("plt_handler.txt") as f:
+                    plt_handler = f.readlines()
+                    l = l + ''.join(plt_handler)
+                os.remove("plt_handler.txt")
         return l
     #print lines
     lines = list(map(lambda l : help(l), lines))

src/pp_print.ml

@@ -398,7 +398,7 @@ let pp_print_list instr_list =
     match l with
 	| h::t ->
 		let s = pp_print_instr h in
-		  help (s::acc) t
+    help (s :: acc) t
 	| []   -> List.rev acc in
     help [] instr_list