Small fix for x64 retrowrite main executable

librw_arm64/rw.py

@@ -68,14 +68,14 @@ class Rewriter():
         ".dynsym",
         ".dynstr",
         ".dynamic",
-        ".eh_frame_hdr",
-        ".eh_frame",
         ".rela.plt",
         ".rela.dyn",
         ".gnu_version",
         ".gnu.version",
         ".gnu_version_r",
         ".gnu.version_r",
+        ".eh_frame_hdr",
+        ".eh_frame",
     ]
 
     # thread-local storage sections. Need special handling.
@@ -296,7 +296,7 @@ def force_section_addr(name, base):
 
 
         if not self.container.loader.is_pie():
-            FAKE_ELF_BASE = 0x1000000
+            FAKE_ELF_BASE = 0x2000000
             for sec in self.container.datasections.values():
                 if sec.name in TRAITOR_SECS:
                     if "interp" in sec.name: continue

librw_x64/container.py

@@ -256,8 +256,6 @@ def __str__(self):
             for iinstr in instruction.after:
                 results.append("{}".format(iinstr))
 
-        results.append(".LCE%x:" % (self.cache[-1].address + self.cache[-1].sz))
-
         # Add .cfi_endproc directive
         results.append("\t.cfi_endproc")
 

retrowrite

@@ -204,29 +204,35 @@ if __name__ == "__main__":
         exit(1)
 
     loader = Loader(args.bin)
-    if loader.is_pie() == False and args.ignore_no_pie == False:
+
+    # x64 supports only PIE binaries with symbols (for now)
+    if arch == "x64" and loader.is_pie() == False and args.ignore_no_pie == False:
         print("***** RetroWrite requires a position-independent executable. *****")
         print("It looks like %s is not position independent" % args.bin)
         print("If you really want to continue, because you think retrowrite has made a mistake, pass --ignore-no-pie.")
         sys.exit(1)
-    if loader.is_stripped() == True and args.ignore_stripped == False and arch == "x64":
+    if arch == "x64" and loader.is_stripped() == True and args.ignore_stripped == False:
         print("The x64 version of RetroWrite requires a non-stripped executable.")
         print("It looks like %s is stripped" % args.bin)
         print("If you really want to continue, because you think retrowrite has made a mistake, pass --ignore-stripped.")
         sys.exit(1)
 
 
     slist = loader.slist_from_symtab()
-    if args.kernel:
-        loader.load_data_sections(slist, krw.is_data_section)
-    else:
-        # loader.load_sections(slist, lambda x: x != ".text")
-        loader.load_sections(slist, lambda x: x not in Rewriter.IGNORE_SECTIONS)
-        # loader.load_data_sections(slist, lambda x: slist[x]['base'] > 0 and x not in ['.text','.plt','.init'] and ".note" not in x)
 
     flist = loader.flist_from_symtab()
     loader.load_functions(flist)
 
+    # this if is due to small architectural implementation differences. Hopefully in the future it will be unified.
+    if arch == "x64":
+        loader.identify_imports()
+        if args.kernel:
+            loader.load_data_sections(slist, krw.is_data_section)
+        else:
+            loader.load_data_sections(slist, lambda x: x in Rewriter.DATASECTIONS)
+    else:
+        loader.load_sections(slist, lambda x: x not in Rewriter.IGNORE_SECTIONS)
+
     reloc_list = loader.reloc_list_from_symtab()
     loader.load_relocations(reloc_list)
 

rwtools_x64/asan/snippets.py

@@ -5,7 +5,8 @@
 
 # TODO: If you're using Debian, this becomes __assan_init
 # TODO: Switch these modifiers automatically
-ASAN_LIB_INIT = "__asan_init_v4"
+# ASAN_LIB_INIT = "__asan_init_v4"
+ASAN_LIB_INIT = "__asan_init" # for debian
 
 ASAN_MEM_EXIT = ".LC_ASAN_EX"
 ASAN_MEM_ENTER = ".LC_ASAN_ENTER"