radareorg/radare2

Base addresses not setting properly on PIE enabled binaries

Open

#9,051 opened on Dec 19, 2017

View on GitHub
 (7 comments) (0 reactions) (0 assignees)C (3,229 forks)batch import
RBingood first issue

Repository metrics

Stars
 (23,826 stars)
PR merge metrics
 (Avg merge 16h 24m) (99 merged PRs in 30d)

Description

radare2 2.2.0-git 16757 @ linux-x86-64 git.2.1.0-173-gf06a360
commit: f06a36097e7a310dbbc2ccd08f790119c31e100b build: 2017-12-19__18:44:21

While setting the base address with the -B switch in r2, it loads the base address fine.

└─▪ radare2 -B 0x40000000 funmail 
 -- The '?' command can be used to evaluate math expressions. Like this: '? (0x34+22)*4'
[0x40000540]> ij~{bin.pic}
true
[0x40000540]> 

But not when the e flag is being set even after reloading the binary.

└─▪ radare2 -e "bin.baddr=0x40000000" funmail 
 -- Setup dbg.fpregs to true to visualize the fpu registers in the debugger view.
[0x00000540]> ij~{bin.pic}
true
[0x00000540]> oo
[0x00000540]>

The same applies to setting bin.baddr from the console:

└─▪ radare2 funmail 
 -- Use scr.accel to browse the file faster!
[0x00000540]> e bin.baddr = 0x40000000
[0x00000540]> oo
[0x00000540]>

Additionally: after the binary is loaded with -B and debugged, the base address gets thrown off.

└─▪ radare2 -B 0x40000000 funmail 
 -- The more 'a' you add after 'aa' the more analysis steps are executed.
[0x40000540]> doo
Process with PID 11052 started...
File dbg:///vagrant/tuctf/rev/funmail  reopened in read-write mode
= attach 11052 11052
WARNING: bin_strings buffer is too big (0xffffffffa99de26c). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
WARNING: bin_strings buffer is too big (0xffffffffa99dcf44). Use -zzz or set bin.maxstrbuf (RABIN2_MAXSTRBUF) in r2 (rabin2)
11052
[0xf77d1a20]> dcu main
Continue until 0x56624b27 using 1 bpsize
hit breakpoint at: 56624b27
[0x56624b27]> s main
[0x56624b27]> pd 4
            ;-- main:
            ;-- main:
            ;-- eip:
            0x56624b27      8d4c2404       lea ecx, esp + 4            ; 4
            0x56624b2b      83e4f0         and esp, 0xfffffff0
            0x56624b2e      ff71fc         push dword [ecx - 4]
            0x56624b31      55             push ebp
[0x56624b27]> ij~{bin.pic}
true
[0x56624b27]>

The above is consistent with setting base address with bin.baddr also

Contributor guide