ghidra icon indicating copy to clipboard operation
ghidra copied to clipboard

32bit x86 Rust binaries are unsupported and incorrectly loaded as 64bit binaries

Open cyberkaida opened this issue 1 year ago • 2 comments

Describe the bug Loading an i686 Linux rust binary throws an exception related to loading the cspec and RDI:

Full application.log is attached below.

kaida/.local/opt/ghidra_11.0_PUBLIC/Ghidra/Processors/x86/data/extensions/rust/unix/cc.xml ghidra.xml.XmlParseException: Unknown pentry register: RDI

To Reproduce Steps to reproduce the behavior:

  • Download the Linux i686 GNU ripgrep and import rg (SHA256: 1275b5345b08e5bdc9bd7bd138a3b617863dcce9db5fe70814a194aea4c18508)
  • Import with default options
  • Ghidra throws an error (See application.log)

Expected behavior No error about RDI, cscpec loaded correctly.

Screenshots If applicable, add screenshots to help explain your problem.

Attachments

Environment (please complete the following information):

  • OS: macOS 14.1.2 - Build 23B2091
  • Java Version: openjdk 17.0.9 2023-10-17
  • Ghidra Version: 11.0
  • Ghidra Origin: 11.0 GitHub release

Additional context Seems to be an issue in only the Linux cspec? I tried an aarch64 macOS binary and a Windows binary and both were fine.

cyberkaida avatar Dec 23 '23 04:12 cyberkaida

Should this be mentioning RDI? Should it be EDI?

% file ~/Downloads/ripgrep-14.0.3-i686-unknown-linux-gnu/rg
/Users/kaida/Downloads/ripgrep-14.0.3-i686-unknown-linux-gnu/rg: ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=214b1ffe3fa4d81ab6eddc0129856206864d95e1, stripped

It looks like it is using 64 bit extensions for this 32 bit file. Loading a 64 bit executable works fine.

cyberkaida avatar Dec 23 '23 04:12 cyberkaida

I think the bitsize of the architecture needs to be considered here: https://github.com/NationalSecurityAgency/ghidra/blob/f7013bdfab8eac54387a49ed290444da9af88499/Ghidra/Features/Base/src/main/java/ghidra/app/plugin/core/analysis/rust/RustUtilities.java#L73-L81

and a new compiler spec needs to be written for 32 bit x86.

cyberkaida avatar Dec 23 '23 05:12 cyberkaida