Comments (5)
sei-eschwartz
commented on September 16, 2024
1
I might see what is going wrong...
reasonMergeVFTables_A(constructor, 0x672900, 0x6728f8, 0x672900, 0, factVFTableWrite(0x5dd7cf, 0x5dd760, 0, 0x672900)).
Concluding mergeVFTables(0x672900, 0x6728f8).
So we decide that this vftable belongs to the current constructor based on the vftable write. Here is the vftable write:
.text:005DD7C0 call ??2@YAPAXI@Z ; operator new(uint)
.text:005DD7C5 add esp, 4
.text:005DD7C8 cmp eax, edi
.text:005DD7CA jz short loc_5DD7DB
.text:005DD7CC mov [eax+8], edi
.text:005DD7CF mov dword ptr [eax], offset some_vftable_0
In other words, we install this vftable into a new heap-allocated object, not the "this" object this constructor is constructing.
I think this is a side-effect of a change we made recently that exported possibleVFTableFacts for non-this objects. The solution is to validate that the vftable write is in "this" object. I am trying this now.
from pharos.
sei-eschwartz
commented on September 16, 2024
I think this should fix it: cf77c93
It certainly doesn't fail as quickly, but my run of DKII hasn't completed yet.
from pharos.
sei-eschwartz
commented on September 16, 2024
This causes a regression in our unit tests:
117: FAILED: ooex_vs2010/Lite/oo ooanalyzer results +finalClass(0x0040247E void __thiscall std::basic_char_ostream::`vbase destructor(void), 0, 0xc, 0xc, 0x0040247E void __thiscall std::basic_char_ostream::`vbase destructor(void
), [0x0040247E void __thiscall std::basic_char_ostream::`vbase destructor(void), 0x00402FCC __thiscall std::basic_char_ostream::basic_char_ostream(class std::basic_char_streambuf *, bool)]).+
117: FAILED: ooex_vs2010/Lite/oo ooanalyzer results +finalClass(0x0041238C const std::basic_char_ostream::`vftable', 0x0041238C const std::basic_char_ostream::`vftable', 0, 0, 0, [0x00402766 virtual void * __thiscall std::basic_
char_ostream::`vector deleting destructor'(unsigned int)]).+
117: FAILED: ooex_vs2010/Lite/oo ooanalyzer results -finalClass(0x0041238C const std::basic_char_ostream::`vftable', 0x0041238C const std::basic_char_ostream::`vftable', 0xc, 0xc, 0x0040247E void __thiscall std::basic_char_ostre
am::`vbase destructor(void), [0x0040247E void __thiscall std::basic_char_ostream::`vbase destructor(void), 0x00402766 virtual void * __thiscall std::basic_char_ostream::`vector deleting destructor'(unsigned int), 0x00402FCC __th
iscall std::basic_char_ostream::basic_char_ostream(class std::basic_char_streambuf *, bool)]).-
We are no longer able to associate the vbase destructor with the correct class.
Binary ninja says the function simplifies to:
sub_40247e:
0 @ 00402487 *(*(*arg1 + 4) + arg1 + 8 - 8) = 0x41238c
1 @ 00402490 *(arg1 + 8) = 0x412384
2 @ 0040249c return sub_403d09(arg1 + 8)
Statement 0 installs std::ostream::vftable. This is obviously accessing a virtual base offset, which is why the change breaks things. This is unavoidable I think until we improve our support for virtual bases.
from pharos.
sei-eschwartz
commented on September 16, 2024
@Trass3r Take a look at this?
DKII.EXE.json.gz
from pharos.
Trass3r
commented on September 16, 2024
The patch in master...sei-eschwartz:pharos:master (also mentioned in #227 (comment)) indeed made it run to the end.
from pharos.
Related Issues (20)
- Calling conventions and being smarter about statically linked binaries
- SQLite concurrency problem in OOAnalyzer HOT 28
- APIAnalyzer use-after-free HOT 1
- Stop the lies
- stop being rude and stupid
- no need to create lies HOT 1
- ooprolog crash HOT 16
- Consistency checks failed in ooprolog. HOT 22
- Partition stuck at 94%, seems to not be using available memory HOT 14
- Partitioner stucks at 17 % and often gets killed HOT 4
- crash in partitioning: basic block does not contain instruction HOT 8
- Is there a method to exclude classes by name? HOT 29
- Add Support For Non-Standard Windows Based Executables. HOT 6
- Initial sanity check failed in ooprolog HOT 6
- Contribute to OOAnalyzer HOT 1
- Where can I find a plugin for Ghidra? HOT 1
- WSL: cannot see file mapped HOT 1
- Build error running make on CentOS 7 (error: constructor required before non-static data member) HOT 12
- Initial sanity checks failed: Contradictory information about constructor: factConstructor(0x4a347b) but reasonNOTConstructor(0x4a347b) HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pharos.