Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Some ARM-HF PLT stubs identified at wrong address #457

Open
udiboy1209 opened this issue Jan 29, 2024 · 0 comments
Open

Some ARM-HF PLT stubs identified at wrong address #457

udiboy1209 opened this issue Jan 29, 2024 · 0 comments

Comments

@udiboy1209
Copy link

Description

I have a binary compiled for ARMHF that contains PLT stubs to math library function log.
When I load the binary with cle and use the find_plt_stub_name function, it does not identify the stub at the address that objdump shows.

In the below disassembly, the stub is at 0x518 but cle maps it to 0x51c, which means it probably mis-identifies the start of the stub.
I tracked down the issue to the MetaELF._load_plt function, whose comments say that this is essentially performed by machine code pattern matching. I have not tried understanding the implementation of _load_plt but it looks like the pattern I have in my binary is not captured.

For now, I am checking both addr and addr+4 to find the plt stub name, and it works fine.

This plt stub is called from a tail-call optimized function. I guess this is why it has extra instructions, but I am not sure of this.

Disassembly from objdump:

...
0000050c <__stack_chk_fail@plt>:
 50c:   e28fc600        add     ip, pc, #0, 12
 510:   e28cca10        add     ip, ip, #16, 20 ; 0x10000
 514:   e5bcfabc        ldr     pc, [ip, #2748]!        ; 0xabc

00000518 <log@plt>:
 518:   4778            bx      pc
 51a:   e7fd            b.n     518 <log@plt>
 51c:   e28fc600        add     ip, pc, #0, 12
 520:   e28cca10        add     ip, ip, #16, 20 ; 0x10000
 524:   e5bcfab0        ldr     pc, [ip, #2736]!        ; 0xab0

00000528 <__gmon_start__@plt>:
 528:   e28fc600        add     ip, pc, #0, 12
 52c:   e28cca10        add     ip, ip, #16, 20 ; 0x10000
 530:   e5bcfaa8        ldr     pc, [ip, #2728]!        ; 0xaa8
...

Steps to reproduce the bug

Github wont let me attach the ELF binary. I am attaching the full disassembly from objdump.
myfunc.txt.

Let me know if you need anything else.

Environment

cle version is 9.2.86

Additional context

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants