Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stack underflow using obfuscate_constants #39

Closed
matbrik opened this issue Mar 28, 2024 · 4 comments
Closed

Stack underflow using obfuscate_constants #39

matbrik opened this issue Mar 28, 2024 · 4 comments
Assignees
Labels
bug Something isn't working
Milestone

Comments

@matbrik
Copy link

matbrik commented Mar 28, 2024

Target: iOS arm64e
OMVLL Version: 1.1.0-b5f1bee / 14.0.0git ( (c41f13252ed4b49f246729b4d91ff521d5a6bf9d))
Compilation of O-MVLL: CI

I've noticed that the stack grows until reaching the maximum size using obfuscate_constants on a function while in a loop:

if I try this function:

void testx(){
    int i=0;
    while(1){   
       i++;
    }
}

and the following config.py

"""
class MyConfig(omvll.ObfuscationConfig):
def init(self):
super().init()

def obfuscate_constants(self, _, __):
    if "testx" in str(__.name):
        return True
    return False

"""
sp grows(decreases) by 0x20 for every iteration in the loop crashing the program

@marcobrador marcobrador added the bug Something isn't working label Apr 8, 2024
@marcobrador
Copy link
Collaborator

Thanks @matbrik for the report. We will look into this and come back to you as soon as possible.

antoniofrighetto added a commit to build38/o-mvll that referenced this issue Apr 15, 2024
We should not break the correctness of the program, even when the
compiler may be able to remove infinite loops with no side-effects.
As constants get reconstructed with a stack-allocated variable, do
not conceal loop-variant constants when possibly in presence of
infinite loops; this otherwise could lead to stack-overflow issues.

Fixes: open-obfuscator#39.
antoniofrighetto added a commit to build38/o-mvll that referenced this issue Apr 15, 2024
We should not break the correctness of the program, even when the
compiler may be able to remove infinite loops with no side-effects.
As constants get reconstructed with a stack-allocated variable, do
not conceal loop-variant constants when possibly in presence of
infinite loops; this otherwise could lead to stack-overflow issues.

Fixes: open-obfuscator#39.
@antoniofrighetto
Copy link
Collaborator

@matbrik, thanks for reporting, and please bear with us for coming back just now. I fixed the issue since we clearly cannot segfault when the original program did not, although be aware of how optimizers can pick their own choice in presence of UB in infinite loops in C++ (see: https://godbolt.org/z/1jv99es8P, llvm/llvm-project#60622).

@matbrik
Copy link
Author

matbrik commented Apr 16, 2024

@antoniofrighetto thanks for the fix, it effectively solves the problem in the case of while(1) but it segfaults in the same way if there is a for loop with a lot of iterations
for(int i=0;i<100000;i++){}
also I noticed in my tests that the flatten_cfg on a while(1) reaches the the top of the stack

Should I open a new issue or reopen this one?

@antoniofrighetto
Copy link
Collaborator

@matbrik, unfortunately this is a bit of expected by design, as this is how the pass works. I think we could try preventing opaque within loops, but you would likely have the same issue with recursive functions. Feel free to open a new issue, I'll think about what we can do here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

4 participants