Fail to generate xref from position in .data to .rodata #4751
Labels
Comments
[0x00001060]> iS
paddr size vaddr vsize align perm name type flags
-----------------------------------------------------------------------------------------
0x00000000 0x0 ---------- 0x0 0x0 ---- NULL
0x00000318 0x1c 0x00000318 0x1c 0x0 -r-- .interp PROGBITS alloc
0x00000338 0x20 0x00000338 0x20 0x0 -r-- .note.gnu.property NOTE alloc
0x00000358 0x24 0x00000358 0x24 0x0 -r-- .note.gnu.build-id NOTE alloc
0x0000037c 0x20 0x0000037c 0x20 0x0 -r-- .note.ABI-tag NOTE alloc
0x000003a0 0x24 0x000003a0 0x24 0x0 -r-- .gnu.hash GNU_HASH alloc
0x000003c8 0xa8 0x000003c8 0xa8 0x0 -r-- .dynsym DYNSYM alloc
0x00000470 0x84 0x00000470 0x84 0x0 -r-- .dynstr STRTAB alloc
0x000004f4 0xe 0x000004f4 0xe 0x0 -r-- .gnu.version VERSYM alloc
0x00000508 0x20 0x00000508 0x20 0x0 -r-- .gnu.version_r VERNEED alloc
0x00000528 0xd8 0x00000528 0xd8 0x0 -r-- .rela.dyn RELA alloc
0x00000600 0x18 0x00000600 0x18 0x0 -r-- .rela.plt RELA alloc,info
0x00001000 0x1b 0x00001000 0x1b 0x0 -r-x .init PROGBITS alloc,execute
0x00001020 0x20 0x00001020 0x20 0x0 -r-x .plt PROGBITS alloc,execute
0x00001040 0x10 0x00001040 0x10 0x0 -r-x .plt.got PROGBITS alloc,execute
0x00001050 0x10 0x00001050 0x10 0x0 -r-x .plt.sec PROGBITS alloc,execute
0x00001060 0x195 0x00001060 0x195 0x0 -r-x .text PROGBITS alloc,execute
0x000011f8 0xd 0x000011f8 0xd 0x0 -r-x .fini PROGBITS alloc,execute
0x00002000 0x23 0x00002000 0x23 0x0 -r-- .rodata PROGBITS alloc
0x00002024 0x44 0x00002024 0x44 0x0 -r-- .eh_frame_hdr PROGBITS alloc
0x00002068 0x108 0x00002068 0x108 0x0 -r-- .eh_frame PROGBITS alloc
0x00002db8 0x8 0x00003db8 0x8 0x0 -rw- .init_array INIT_ARRAY write,alloc
0x00002dc0 0x8 0x00003dc0 0x8 0x0 -rw- .fini_array FINI_ARRAY write,alloc
0x00002dc8 0x1f0 0x00003dc8 0x1f0 0x0 -rw- .dynamic DYNAMIC write,alloc
0x00002fb8 0x48 0x00003fb8 0x48 0x0 -rw- .got PROGBITS write,alloc
0x00003000 0x18 0x00004000 0x18 0x0 -rw- .data PROGBITS write,alloc
0x00003018 0x0 0x00004018 0x8 0x0 -rw- .bss NOBITS write,alloc
0x00003018 0x2b ---------- 0x2b 0x0 ---- .comment PROGBITS merge,strings
0x00003048 0x630 ---------- 0x630 0x0 ---- .symtab SYMTAB
0x00003678 0x210 ---------- 0x210 0x0 ---- .strtab STRTAB
0x00003888 0x11a ---------- 0x11a 0x0 ---- .shstrtab STRTAB
[0x00001060]> avgl?
Usage: avgl[jqt] [<var_name>] # show/list global variables
| avgl [<var_name>] # show/list global variables
| avglj [<var_name>] # show/list global variables (JSON mode)
| avglq [<var_name>] # show/list global variables (quiet mode)
| avglt [<var_name>] # show/list global variables (table mode)
[0x00001060]> avgl
[0x00001060]> id
[0x00001060]> There is no section for dwarf (“.debug_*”, compiled with the -g option), so no global variables will be loaded from dwarf, rizin has no information about global variables. |
|
with debuginfo the output looks like this, not quite sure if it is as expected? [0x100003f38]> pdf
; UNKNOWN XREF from aav.0x100000020 @ +0xb0
;-- main:
;-- entry0:
;-- section.0.__TEXT.__text:
;-- _main:
;-- func.100003f38:
;-- pc:
┌ int main()
│ ; var int64_t arg1 @ x0
│ ; var int64_t var_20h @ stack - 0x20
│ ; var int64_t var_18h @ stack - 0x18
│ ; var int64_t var_14h @ stack - 0x14
│ ; var int64_t var_10h @ stack - 0x10
│ ; var int64_t var_8h @ stack - 0x8
│ 0x100003f38 sub sp, sp, 0x20 ; demo.c:4 int main() { ; [00] -r-x section size 68 named 0.__TEXT.__text
│ 0x100003f3c stp fp, lr, [var_10h]
│ 0x100003f40 add fp, sp, 0x10
│ 0x100003f44 mov w8, 0
│ 0x100003f48 str w8, [var_18h]
│ 0x100003f4c stur wzr, [var_14h] ; arg1
│ 0x100003f50 adrp x8, sym._global_data ; demo.c:5 printf("In main, global_data: %s\n", global_data); ; 0x100008000
│ 0x100003f54 ldr x8, [x8] ; [0x100003f88:4]=0x30303031 ; "1000"
│ 0x100003f58 mov x9, sp
│ 0x100003f5c str x8, [x9]
│ 0x100003f60 adrp x0, data.100003000 ; 0x100003000
│ 0x100003f64 add x0, x0, 0xf8d ; 0x100003f8d ; "In main, global_data: %s\n" ; const char *format
│ 0x100003f68 bl sym.imp.printf ; sym.imp.printf ; int printf(const char *format)
│ 0x100003f6c ldr w0, [var_18h] ; [0x8:4]=-1 ; 8
│ 0x100003f70 ldp fp, lr, [var_10h] ; demo.c:6 return 0;
│ 0x100003f74 add sp, sp, 0x20 ; 0x178000
└ 0x100003f78 ret
[0x100003f38]> avgl
global char * global_data @ 0x100008000
[0x100003f38]> axl
aav.0x100000020+32 0x100000040 -> UNKNOWN -> 0x100000000 segment.TEXT
aav.0x100000020+96 0x100000080 -> UNKNOWN -> 0x100000000 segment.TEXT
aav.0x100000020+176 0x1000000d0 -> UNKNOWN -> 0x100003f38 main
aav.0x100000020+256 0x100000120 -> UNKNOWN -> 0x100003f7c section.1.__TEXT.__stubs
aav.0x100000020+336 0x100000170 -> UNKNOWN -> 0x100003f88 str.1000
aav.0x100000020+416 0x1000001c0 -> UNKNOWN -> 0x100003fa8 section.3.__TEXT.__unwind_info
aav.0x100000020+488 0x100000208 -> UNKNOWN -> 0x100004000 segment.DATA_CONST
aav.0x100000020+568 0x100000258 -> UNKNOWN -> 0x100004000 segment.DATA_CONST
aav.0x100000020+820 0x100000354 -> UNKNOWN -> 0x100000000 segment.TEXT
aav.0x100000020+1036 0x10000042c -> UNKNOWN -> 0x100000020 aav.0x100000020
main+8 0x100003f40 -> DATA -> 0x177ff0 x0+1540080
main+24 0x100003f50 -> STRING -> 0x100008000 global_data
main+28 0x100003f54 -> DATA -> 0x100003f88 str.1000
main+28 0x100003f54 -> DATA -> 0x100008000 global_data
main+32 0x100003f58 -> DATA -> 0x177fe0 x0+1540064
main+40 0x100003f60 -> DATA -> 0x100003000 data.100003000
main+44 0x100003f64 -> DATA -> 0x100003f8d str.In_main__global_data:__s
main+48 0x100003f68 -> CALL -> 0x100003f7c section.1.__TEXT.__stubs
main+52 0x100003f6c -> DATA -> 0x177fe8 x0+1540072
main+56 0x100003f70 -> DATA -> 0x177ff0 x0+1540080
main+56 0x100003f70 -> DATA -> 0x177ff8 x0+1540088
main+60 0x100003f74 -> DATA -> 0x178000 x29
section.1.__TEXT.__stubs 0x100003f7c -> STRING -> 0x100004000 segment.DATA_CONST
section.1.__TEXT.__stubs+4 0x100003f80 -> DATA -> 0x100004000 segment.DATA_CONST
section.1.__TEXT.__stubs+4 0x100003f80 -> DATA -> 0x100010008 reloc.target.printf
section.1.__TEXT.__stubs+8 0x100003f84 -> CODE -> 0x100010008 reloc.target.printf |
|
@imbillow Thanks for your comments. I am a little bit confused about why capturing the xref from 0x4010 to 0x2004 requires dwarf information. For the same binary without debug info, ida and binary ninja can capture this xref. Do you mean the areas for global variables will not be analyzed if there is no debug info? Thanks again. |
They will but not in all cases, and this one is apparently isn't covered. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
For the binary generated by the following code (-O0):
The variable
global_datais in 0x4010.The string "1000" is in 0x2004.
There should be an XREF from 0x4010 to 0x2004, but rizin fails to capture this (while ida and binary ninja does).
Work environment
rizin -vfull output, not truncated (mandatory)Expected behavior
An xref from 0x4010 to 0x2004.
Actual behavior
after running
aaaandaxl, the expected xref doesn't appear. The following is the result ofaxl.But it seems rizin does related analysis since in
0x1151we can see comment0x2004 str.1000. Why xref is not created?Steps to reproduce the behavior
rizin demoaaas 0x2004Additional Logs, screenshots, source code, configuration dump, ...
demo.zip
Drag and drop zip archives containing the Additional info here, don't use external services or link.
The text was updated successfully, but these errors were encountered: