TracerMisfollowError multiple paths

[bannsec]

When running rex on an input that I know to cause control of eip, I receive an error about tracer misfollowing. The example binary is a recent IceCTF one (attached). The vulnerability is a use-after-free where a pointer can be overwritten to gain execution.

The command is:

crash = rex.Crash("./drumpf","1\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n4294967295\n3\n2\nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n4294967295\n4\n")

drumpf.zip

EDIT: Error is "TracerMisfollowError: program did not behave correctly, expected only one path"

[zardus]

My guess is that this is caused by either a missing syscall or a simprocedure that's not implemented properly. One thing to try is to disable loading simprocedures, if rex doesn't already do that. With all the input preconstrained, it shouldn't cause problems with path explosions.

[Wan-YunPeng]

@Owlz The same problem happens to me , how do you solve it?

[bannsec]

Not sure. Haven't been able to. For the most part when I run into this error I stop trying to use rex for that :-)

[github-actions]

This issue has been marked as stale because it has no recent activity. Please comment or add the pinned tag to prevent this issue from being closed.

[github-actions]

This issue has been closed due to inactivity.