Access violation exception causing crash in IDA Pro 7.5 about ponce HOT 7 CLOSED

Hi @nikhilh-20 some images are not updated.
We removed some configuration to simplify the usage. But that shouldn't be related with your issue.

I bet this issue is related with the function term executed when IDA closes:

We will try to replicate it.

from ponce.

Does it only crash when exiting IDA?
The stack trace is not helpful in this case. What we can do is adding an option in the config so it can save debug info to a file and you can send that so we can figure out what is going on.

from ponce.

That's what I've observed so far. I tried the following steps to see if it crashes

• Breakpoint on test eax, eax
• Start debugger
• Enable ponce tracing
• Symbolic -> Symbolize eax register
• Resume debugging

This did not crash Ponce. Snippets like the following were seen in the console:

...
...
[+] Triton asking IDA for already syncronized register: edx. IDA returns value: 0x50 (P)
[+] Triton at 0x701019 : test edx, edx (Thread id: 3260)
[+] Triton asking IDA for already syncronized register: zf. IDA returns value: 0x0 
[+] Triton at 0x70101b : je 0x70103c (Thread id: 3260)
[+] Triton asking IDA for already syncronized register: ebp. IDA returns value: 0xaffa4c (�)
[+] Triton asking IDA for already syncronized memory address: 0xaffa48 Size: 4. Value: 0xaffc5f (�)
...
...

Is there an existing option to save the debug info to a file? I see there are two options for verbosity, Show Ponce debug info and Show EXTRA Ponce debug info but there's no option to save it to a user-defined file. It seems to print to IDA's console. Below is what prints to the console when I startup IDA and choose Show EXTRA Ponce debug info

[i] Config file Ponce.cfg not found

limitTime: 60
limitInstructionsTracingMode: 10000
use_symbolic_engine: symbolic engine enabled
showDebugInfo: true
showExtraDebugInfo: true
CONCRETIZE_UNDEFINED_REGISTERS: false
CONSTANT_FOLDING: false
SYMBOLIZE_INDEX_ROTATION: false
AST_OPTIMIZATIONS: false
TAINT_THROUGH_POINTERS: false
addCommentsControlledOperands: true
RenameTaintedFunctionNames: true
addCommentssymbolizexpresions: false
color_tainted: 99ffce
color_tainted_execution: e6e6e6
color_tainted_condition: b377
[+] Ponce plugin running!

Also, if it's relevant I don't see a Tainting options in the config file like I see in the Negate and inject a condition section in the README. Maybe, it's related to some features not loading or faulty loading which causes a crash later.

from ponce.

I noticed there's the Optimizations section in my config file but not in the README illustrations. Is the README updated?

from ponce.

Hi @nikhilh-20 ,

Sorry for the delay.

Can you try something? Can you delete the config file created by Ponce and try to run it again? It will create a new config file.

Let me know if it crashes.

from ponce.

Interesting, I tried that. Ponce v0.3 doesn't seem to crash on 32-bit IDA Pro 7.5 (decompiler included) but it still crashes on 64-bit IDA Pro 7.5.

from ponce.

Hi @nikhilh-20, There is a couple new versions of Ponce that hopefully address the issue you were facing. I'm closing this issue but feel free to reopen if problem persist in the last version.

Cheers

from ponce.