lancelot icon indicating copy to clipboard operation
lancelot copied to clipboard

better handle packed binaries (dont panic)

Open williballenthin opened this issue 4 years ago • 0 comments

ClipUp.exe is a license manager thing and seems to be packed.

user@hostname ~/c/lancelot> cargo run --bin smoke -- /mnt/c/Windows/System32/ClipUp.exe                                101 v0.2.0-line!
    Finished dev [unoptimized + debuginfo] target(s) in 0.08s
     Running `target/debug/smoke /mnt/c/Windows/System32/ClipUp.exe`
2020-06-10 12:37:22 [INFO ]  found 1468 functions
0x1400013f0: 11 basic blocks
0x140001498: 1 basic blocks
0x140001980: 2 basic blocks
0x1400019a0: 2 basic blocks
0x1400019c0: 2 basic blocks
0x1400019e0: 2 basic blocks
0x140001a20: 2 basic blocks
0x140001a40: 2 basic blocks
0x140001a60: 2 basic blocks
...
0x1400348b0: 1 basic blocks
0x140034d30: 1 basic blocks
0x140034efc: 3 basic blocks
0x140034f30: 18 basic blocks
0x140035150: 0 basic blocks
2020-06-10 12:37:23 [WARN ]  cfg: 0x1400352f2: missing key: 0x1400352f3
Backtrace (most recent call first):
  File "src/libcore/option.rs", line 1264, in core::option::expect_failed
  File "rust:src/libcore/option.rs", line 349, in core::option::Option<T>::expect
  File "rust:src/liballoc/collections/btree/map.rs", line 1988, in <alloc::collections::btree::map::BTreeMap<K,V> as core::ops::index::Index<&Q>>::index
  File "core/src/analysis/cfg.rs", line 737, in lancelot::analysis::cfg::compute_basic_blocks
    if !empty(non_fallthrough_flows(&predecessors[&next_va])) {
  File "core/src/analysis/cfg.rs", line 779, in lancelot::analysis::cfg::build_cfg
    let bbs = compute_basic_blocks(&insns, &predecessors, &successors);
  File "core/src/bin/smoke.rs", line 61, in smoke::_main
    let cfg = lancelot::analysis::cfg::build_cfg(&pe.module, va)?;
  File "core/src/bin/smoke.rs", line 69, in smoke::main
    if let Err(e) = _main() {

The application panicked (crashed).
  no entry found for key
in core/src/analysis/cfg.rs, line 737
thread: main

image

williballenthin avatar Jun 10 '20 18:06 williballenthin