ghidra
ghidra copied to clipboard
32bit x86 Rust binaries are unsupported and incorrectly loaded as 64bit binaries
Describe the bug Loading an i686 Linux rust binary throws an exception related to loading the cspec and RDI:
Full application.log is attached below.
kaida/.local/opt/ghidra_11.0_PUBLIC/Ghidra/Processors/x86/data/extensions/rust/unix/cc.xml ghidra.xml.XmlParseException: Unknown pentry register: RDI
To Reproduce Steps to reproduce the behavior:
- Download the Linux i686 GNU ripgrep and import
rg
(SHA256:1275b5345b08e5bdc9bd7bd138a3b617863dcce9db5fe70814a194aea4c18508
) - Import with default options
- Ghidra throws an error (See application.log)
Expected behavior No error about RDI, cscpec loaded correctly.
Screenshots If applicable, add screenshots to help explain your problem.
Attachments
Environment (please complete the following information):
- OS: macOS 14.1.2 - Build 23B2091
- Java Version: openjdk 17.0.9 2023-10-17
- Ghidra Version: 11.0
- Ghidra Origin: 11.0 GitHub release
Additional context Seems to be an issue in only the Linux cspec? I tried an aarch64 macOS binary and a Windows binary and both were fine.
Should this be mentioning RDI
? Should it be EDI
?
% file ~/Downloads/ripgrep-14.0.3-i686-unknown-linux-gnu/rg
/Users/kaida/Downloads/ripgrep-14.0.3-i686-unknown-linux-gnu/rg: ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=214b1ffe3fa4d81ab6eddc0129856206864d95e1, stripped
It looks like it is using 64 bit extensions for this 32 bit file. Loading a 64 bit executable works fine.
I think the bitsize of the architecture needs to be considered here: https://github.com/NationalSecurityAgency/ghidra/blob/f7013bdfab8eac54387a49ed290444da9af88499/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java#L73-L81
and a new compiler spec needs to be written for 32 bit x86.