Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version Tracking Exact Function Bytes/Instructions/Mnemonics Match Corelators don't match identical functions #1135

Closed
0x6d696368 opened this issue Oct 11, 2019 · 1 comment
Labels
Feature: Version Tracking Reason: Cannot Reproduce This issue could not be reproduced Type: Bug Something isn't working

Comments

@0x6d696368
Copy link

0x6d696368 commented Oct 11, 2019

Describe the bug
In Version Tracking the Exact Function Bytes/Instructions/Mnemonics Match Correlators don't match an identical function.

To Reproduce
Steps to reproduce the behavior:

  1. Download: windows6.1-kb4512486-x86_4c88f71af8e9d07e5fb141d7aed0bcc7f532781e.msu from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4512486 and extract rdpcorets.dll
  2. Download: windows6.1-kb4520003-x86_86ac80d58f564c48502a7e2e65b64f7fd1fd2c10.msu from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4520003 and extract rdpcorets.dll
  3. Start VT Session between the two rdpcorets.dlls
  4. Add Function Bytes, Instructions and Mnemonics Match Corelators
  5. Function _WPP_SF_DD@24 is not matched by any of the Correlators, even though the function is bit-identical.

Expected behavior
The function is matched.

Screenshots

Here is the function matched with my own custom Correlator, but the included Exact Correlators did not match the function:

ghhidra_bug

Environment (please complete the following information):

  • OS: CentOS 7
  • Java Version: 11.0.4
  • Ghidra Version: 9.1-BETA

I'll try to reduce this to a minimal example. But until then:

Is this a known issue? Anyone experienced this before? Anything I'm missing?

Edit: Are the multiple source and destination labels the issue? If so, this can be closed.

Edit: The Duplicate Function Instructions Match Correlator also did not match the function, hence, I don't think this is caused by the multiple labels.

@dragonmacher
Copy link
Collaborator

I took a peek at this. Unfortunately, as the post is quite old, I was unable to the original binaries. I tried with similar binaries, but was unable to reproduce this issue.
I will close this for now. If anyone finds available binaries that exhibit the issue, then we can reopen this ticket.

@ryanmkurtz ryanmkurtz added the Reason: Cannot Reproduce This issue could not be reproduced label Apr 20, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: Version Tracking Reason: Cannot Reproduce This issue could not be reproduced Type: Bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants