Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Find string data in read-only sections in addition to read-only segments #2

Closed
cxiao opened this issue Dec 24, 2023 · 0 comments
Closed
Assignees
Labels
bug Something isn't working

Comments

@cxiao
Copy link
Owner

cxiao commented Dec 24, 2023

There are some cases in which this plugin is not able to find any strings, due to not being able to find any read-only segments in the binary. There may also be cases where we need to look at sections in the binary, rather than segments.

For example, the plugin currently fails to find any strings inside the x86_64 slice of the Mach-O sample 9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747.

This sample has all of its constant string data in the __const section of the binary. The __const section only contains read-only data; however, the segment that it is inside, located from 0x100000000 to 0x10039c000 is read-executable.

This is because this segment contains a number of sections, some of which are code and some of which are data:

Name Start End Semantics
__text 0x100000fd0 0x1002b69d0 Read-only code
__stubs 0x1002b69d0 0x1002b6ed4 Read-only code
__gcc_except_tab 0x1002b6ed4 0x1002dcab8 Default
__const 0x1002dcac0 0x10038e4b0 Read-only data
__unwind_info 0x10038e4b0 0x10039beec Default
__eh_frame 0x10039bef0 0x10039bfe8 Default

This binary actually also contains a read-only segment from 0x1003e8000 to 0x100598000 (the Mach-O __LINKEDIT segment, which contains metadata used by the dynamic linker dyld), but that segment contains no sections, and its contents are also not referenced from anywhere within any of the code inside the binary.

@cxiao cxiao added the bug Something isn't working label Dec 24, 2023
@cxiao cxiao self-assigned this Dec 24, 2023
@cxiao cxiao closed this as completed in cbbacb6 Dec 24, 2023
cxiao added a commit that referenced this issue Dec 25, 2023
… both read-only sections and segments

Fixes #2, for real this time.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant