Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[dev] Bad libc mapping detection #2370

Open
k4lizen opened this issue Mar 21, 2024 · 0 comments · May be fixed by #2371
Open

[dev] Bad libc mapping detection #2370

k4lizen opened this issue Mar 21, 2024 · 0 comments · May be fixed by #2371

Comments

@k4lizen
Copy link

k4lizen commented Mar 21, 2024

For the process.libc property/function, the logic is currently:

def libc():
        # <snip>
        for lib, address in self.libs().items():
            if 'libc.so' in lib or 'libc-' in lib:
                e = ELF(lib)
                e.address = address
                return e

and:

def libs():
        # <snip>
        # Enumerate all of the libraries actually loaded right now.
        maps = {}
        for mapping in maps_raw:
            path = mapping.path
            if os.sep not in path: continue
            path = os.path.realpath(path)
            if path not in maps:
                maps[path]=0
        # <snip>

So if there is a libc- anywhere in the mappings path, it will be counted as libc. I happened to be running the binary in a path which contained that string, and the binary sometimes gets returned incorrectly. This happens especially often if the actual libc didn't yet have time to load into the process, and None should be returned.
minimal reproducable script:

from pwn import *
p = process(['./libc-nyanya/junior_formatter'])
print(f'\n\nLIBC: {p.libc}\n\n')
p.close()

Output:

─$ python mvp.py        
[+] Starting local process './libc-nyanya/junior_formatter': pid 84213
[*] '/<snip>/libc-nyanya/junior_formatter'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No


LIBC: ELF('/<snip>/libc-nyanya/junior_formatter')


[*] Stopped process './libc-nyanya/junior_formatter' (pid 84213)                                                  

Proposed solution: Still check for '.so' in the second part of the if, and only check for the filename instead of the whole path.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant