Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't get the vtable result #6

Closed
happydpc opened this issue May 4, 2019 · 3 comments
Closed

Can't get the vtable result #6

happydpc opened this issue May 4, 2019 · 3 comments

Comments

@happydpc
Copy link

happydpc commented May 4, 2019

Here's the result when I execute the main.py. I can't figure out what's wrong but there's nothing output but these errors.

ERROR at address 0x7ffbd68bd37c: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ffbd68bdce8: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ffbd68be0dc: the vtable pointer was assigned outside of function, could not place BP

@0xgalz
Copy link
Owner

0xgalz commented May 8, 2019

These errors mean that the vtable pointer was assigned to a register outside of the function where the virtual call was made from, or passed in unusual way. It might happens sometimes but it is not common, it depends what happens in this case specifically.

In case this BP is especially important, you can jump to address stated in the comment in IDA, and try to discover the reason your code acts like this.

In order to give you the correct answer to these errors I need to look at the Assembly or Assembly snippet of the case.
In order to add support for them in the future I need to understand exactly what caused them,
can you share the binary or share an assembly snippet?

Thanks!

Gal

@happydpc
Copy link
Author

happydpc commented May 9, 2019

Sure, I have uploaded a dll file. And run the main.py , these errors come:

DataPortPk.zip

ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0a6bb0: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0f97fc: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0f97fc: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0f97fc: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0f9eb4: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0faa00: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0fad50: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f0fc62c: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ff99f10803d: the vtable pointer was assigned outside of function, could not place BP

0xgalz added a commit that referenced this issue Jul 3, 2019
Fixed 2 issues, #6 and #5
#5 was a problem with CFG Asserts.
#6 was caused by a case where the Offset to the vtable was a multiplication of
   a register with a number, this case is now handled by Virtuailor.

Cheers!
\o/
@0xgalz
Copy link
Owner

0xgalz commented Jul 3, 2019

Hi! :)
I Fixed the issue and improved the comments.
If there is a vtable that was assigned outside of the function it'll now look like this:

Warning! At address 0x1400bd600: The vtable assignment might be in another function (Maybe sub_1402F8B18),could not place BP.

In this case the new comment is supposed to help and focus you where
you should look afterwards for the problematic virtual call.

Additionally there was a bug with how the CFG was handled and this bug was fixed,
as of today the amount of warnings/errors should be significantly lower.

I checked it on your DLL it seems to reduce the warnings/errors! :) (The warnings
are now all for BPs that their vtable address might change in previous function calls),

please let me know if it fixed your problem in your opinion too, so I could close the issue.
Thank you very much for reporting about this bug :)

fengjixuchui added a commit to fengjixuchui/Virtuailor that referenced this issue Aug 13, 2019
@0xgalz 0xgalz closed this as completed Sep 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants