Finding thread_arena

[yooo1999]

Please explain me that calculation here
I understand that +4 is the next instruction (32 bits) (so it's mrc 15, 0, reg2, cr13, cr0, {3} instruction , but what is & -4 ?

Please explain the calculation /the struct and offset

When I debug that code

address = 0x500 : ldr R1, [pc, #0x100]
address = 0x504 : mrc 15, 0, R2, cr13, cr0, {3};
address = 0x508 : add R1, pc
address = 0x50c:  ldr R1, [R1];
address = 0x510: add R1, R2

Results:

###instr=<address = 0x508 : add R1, pc>
offset = ldr_instr.operands[1].mem.disp  
###offset=0x100

offset = pwndbg.gdblib.memory.s32( (ldr_instr.address + 4 & -4) + offset )  
###offset = 0x504 (mrc address)+0x100  =0x604

self._thread_arena_offset = pwndbg.gdblib.memory.s32( instr.address + 4 + offset )
###self._thread_arena_offset= memory(0x50c (ldr address) +0x604

Is that expected?

[gsingh93]

@CptGibbon @lebr0nli

[CptGibbon]

I'll defer to Alan on this one since it's their code.

[lebr0nli]

Hi,

I understand that +4 is the next instruction (32 bits) (so it's mrc 15, 0, reg2, cr13, cr0, {3} instruction , but what is & -4 ?

We use & -4 to make sure ldr read from a word-aligned address.
Here is my reference for doing this: https://stackoverflow.com/a/70492270
(But I'm not very experienced at arm actually, so please let me know if I misunderstood something.)

Please explain the calculation /the struct and offset

The reason we doing this calculation here is that the GLIBC will store the offset of &thread_arena somewhere, and it will load the offset and added it with the TLS base address to get &thread_arena every time it tries to read it.
So we emulate the GLIBC behavior here to get &thread_arena without debug symbols.

Is that expected?

Hmm, I'm afk now, but probably unexpected.
I'll expect something like this:

###instr=<address = 0x508 : add R1, pc>
offset = ldr_instr.operands[1].mem.disp  
###offset=0x100

offset = pwndbg.gdblib.memory.s32( (ldr_instr.address + 4 & -4) + offset )  
###offset = *(int32 *)(0x504 + 0x100) = *(int32 *)(0x604)

self._thread_arena_offset = pwndbg.gdblib.memory.s32( instr.address + 4 + offset )
###self._thread_arena_offset= *(int32 *)(0x50c + *(int32 *)(0x604)) = probably 0x50 or something near TLS base

Btw as you can see, the method we used here is quite unreliable since we trying to decompile the assembly, it will easily fail if the compiler has different behavior when compiling it.
So let me know if you have any suggestions or ideas for finding the address of thread_arena without debug symbols xD

[yooo1999]

What do you expect from offset = *(int32 *)(0x504 + 0x100) = *(int32 *)(0x604) ? does 0xf8 makes sense?

I have open issue
@lebr0nli