Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Analyzing MIPS based firmware (DIR-815-httpd)

See original GitHub issue

Hello The first of all, thank you for realizing one of the best binary analyzing tool. I am a newbie on angr. I wanted to analyze httpd binary (DIR815) dir815.tar.gz

my code is follows: import angr import claripy p = angr.Project('./sbin/httpd', main_opts={'backend':'blob','base_addr':0x400000, 'entry_point':0x40a218,'arch':'mipsel'}, lib_opts = {'libcrypt.so.0':{'backend':'elf'}}) state = p.factory.entry_state(addr=0x40a218) sm = p.factory.simulation_manager(state) sm.explore(find=0x40a854)

After run sim manager exploration Output: WARNING | 2020-11-12 17:28:45,174 | angr.storage.memory_mixins.default_filler_mixin | Filling register a1 with 4 unconstrained bytes referenced from 0x40a254 (offset 0xa254 in httpd (0x40a254)) WARNING | 2020-11-12 17:28:45,176 | angr.storage.memory_mixins.default_filler_mixin | Filling register a0 with 4 unconstrained bytes referenced from 0x40a25c (offset 0xa25c in httpd (0x40a25c)) WARNING | 2020-11-12 17:28:45,448 | angr.engines.successors | Exit state has over 256 possible solutions. Likely unconstrained; skipping. <BV32 mem_424be0_10_32{UNINITIALIZED}> <SimulationManager with 1 unconstrained>

Could you help me to solve this PLEASE! Thank you in advance!

Issue Analytics

State:
Created 3 years ago
Comments:8 (2 by maintainers)

Top GitHub Comments

1reaction

Fayozbekcommented, Nov 24, 2020

The problem is that you have bypassed the entire elf loader by using the blob backend. Why did you specify the blob backend?

Hi, thank you for your reply! We are trying to solve this together with KimYong77(labmate)! Unfortunately, we can not solve it yet. We specified backend because of this WARNING:

WARNING | 2020-11-24 11:50:25,737 | cle.backends.blob | No entry_point was specified for blob httpd, assuming 0
WARNING | 2020-11-24 11:50:25,738 | cle.backends.blob | No base_addr was specified for blob httpd, assuming 0

We got also this SimulationManager with all stashes empty (1 errored)

>>>import angr
>>> import claripy
>>> p = angr.Project('./httpd', main_opts={'backend':'blob','arch':'mipsel'}, lib_opts = {'libcrypt.so.0':{'backend':'elf'}})
WARNING | 2020-11-24 11:50:25,737 | cle.backends.blob | No entry_point was specified for blob httpd, assuming 0
WARNING | 2020-11-24 11:50:25,738 | cle.backends.blob | No base_addr was specified for blob httpd, assuming 0
>>> state = p.factory.entry_state(addr=0x40a218)
>>> sm = p.factory.simulation_manager(state)
>>> sm.explore(find=0x40a3b4)
<SimulationManager with all stashes empty (1 errored)>

0reactions

github-actions[bot]commented, Jul 13, 2022

This issue has been closed due to inactivity.

Top Results From Across the Web

A Novel Framework to Classify Malware in MIPS Architecture ...

We proposed a framework to classify malware in IoT devices by using MIPS-based system behavior (system call—syscall) obtained from our F-Sandbox passive process ......