rabin2 not working/crashing on PDB

[phmarek]

Rabin2 (from radare2=1.1.0+dfsg-1) doesn't work for PDB files built from CL.EXE 19.00.24210 (free EWDK edition).

$ gdb --args rabin2 -P wdm_harvested.pdb
...
/usr/share/radare2/1.1.0/magic/riff, 61: Warning: Printf format is too long for type `lelong' in description `, %lu x'
/usr/share/radare2/1.1.0/magic/riff, 62: Warning: Printf format is too long for type `lelong' in description `%lu,'
pdb root has not initialized
pdb was not parsed

Program received signal SIGSEGV, Segmentation fault.
0x0000555555819300 in ?? ()
(gdb) bt
#0  0x0000555555819300 in ?? ()
#1  0x00007ffff745982f in ?? () from /usr/lib/x86_64-linux-gnu/libr_bin.so.1.1
#2  0x00007ffff77532fc in r_core_bin_info () from /usr/lib/x86_64-linux-gnu/libr_core.so.1.1
#3  0x0000555555558310 in ?? ()
#4  0x00007ffff3c042b1 in __libc_start_main (main=0x555555556750, argc=0x3, argv=0x7fffffffdfb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffdfa8) at ../csu/libc-start.c:291
#5  0x0000555555558a5a in ?? ()

On another file I had no segfault, but the same 4 messages and no output either.

crash.zip

[radare]

try with version of git before reporting plz, cant do much without reproducer file or backtrace without symbols, also 1.1 is old, in r2land we only fix bugs reproducible on git

…

On 05 Jan 2017, at 13:59, Philipp Marek ***@***.***> wrote: Rabin2 (from radare2=1.1.0+dfsg-1) doesn't work for PDB files built from CL.EXE 19.00.24210 (free EWDK edition). $ gdb --args rabin2 -P wdm_harvested.pdb ... /usr/share/radare2/1.1.0/magic/riff, 61: Warning: Printf format is too long for type `lelong' in description `, %lu x' /usr/share/radare2/1.1.0/magic/riff, 62: Warning: Printf format is too long for type `lelong' in description `%lu,' pdb root has not initialized pdb was not parsed Program received signal SIGSEGV, Segmentation fault. 0x0000555555819300 in ?? () (gdb) bt #0 0x0000555555819300 in ?? () #1 0x00007ffff745982f in ?? () from /usr/lib/x86_64-linux-gnu/libr_bin.so.1.1 #2 0x00007ffff77532fc in r_core_bin_info () from /usr/lib/x86_64-linux-gnu/libr_core.so.1.1 #3 0x0000555555558310 in ?? () #4 0x00007ffff3c042b1 in __libc_start_main (main=0x555555556750, argc=0x3, argv=0x7fffffffdfb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdfa8) at ../csu/libc-start.c:291 #5 0x0000555555558a5a in ?? () On another file I had no segfault, but the same 4 messages and no output either. crash.zip <https://github.com/radare/radare2/files/687283/crash.zip> — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#6434>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-lq-8p5WLwSXrbGR3U0h7LDoJv50yks5rPOkxgaJpZM4LbqgN>.

[phmarek]

Reproducer file is attached above. Within the ZIP file.

[radare]

the bug is in finish_pdb_parse

[radare]

I have fixed the crash, but the code is actually leaking. The problem here is that the list of elements is assuming some really bad things and its crashing when the list is constructed in a different order. I'll open an issue to fix this memory leak. But at least it's not crashing now :)

thanks!

[phmarek]

Hmmm, thanks for the fix... but now rabin2 doesn't support -P any more?

$ ./rabin2 -P
Usage: rabin2 [-AcdeEghHiIjlLMqrRsSvVxzZ] [-@ addr] [-a arch] [-b bits]
              [-B addr] [-C F:C:D] [-f str] [-m addr] [-n str] [-N m:M]
              [-o str] [-O str] [-k query] [-D lang symname] | file

How would I dump PDB files now? The manual page still has -P.

[phmarek]

$ git log -1
commit 75dd4536fa3980041b22cf9da2863f0c0bbe2142
Author: pancake <pancake@nopcode.org>
Date:   Mon Jan 16 10:40:09 2017 +0100

    Fix #6434 - Crash in PDB

[radare]

it does. see the output of rabin2 -h, rabin2 -P expects an argument. i'll just update the short help message. thanks for pointing out

[radare]

$ rabin2 -P wdm_harvested.pdb pdb root has not initialized pdb was not parsed works fine here. are you building from scratch? using sys/install.sh?

…

On 16 Jan 2017, at 11:36, Philipp Marek ***@***.***> wrote: Well, of course I gave the path to the PDB file. Still I get the same output, ie. the usage info! — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#6434 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-llCNDl0nTH2DtraJ7suxU0yljXSaks5rS0gmgaJpZM4LbqgN>.

[phmarek]

Sorry, used the wrong shell script that didn't insert the arguments.

Still, I don't get the expected output...

$ ./rabin2 -j -P .../xxx.pdb
pdb root has not initialized
pdb was not parsed
{"pdb":false}

And without -j I get the first two lines, but then no more data.

[radare]

i fixed the crash, i assumed this was a corrupted PDB file. if its a legit one.. well that’s another story ^^D

…

On 16 Jan 2017, at 11:38, Philipp Marek ***@***.***> wrote: Sorry, used the wrong shell script that didn't insert the arguments. Still, I don't get the expected output... $ ./rabin2 -j -P /mnt/iso/IE8.Win7/src/drbd-9/drbd/wdm_harvested.pdb pdb root has not initialized pdb was not parsed {"pdb":false} And without -j I get the first two lines, but then no more data. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#6434 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-lltRtQ87s3P0H6pchyu0D313V_ldks5rS0iTgaJpZM4LbqgN>.

[phmarek]

Well, it's a true output of CL.EXE, so I guess that it's contents should be okay...

[phmarek]

rabin2 is not crashing anymore, but it still won't give any useful output for me.

$ ./rabin2 -P ....pdb
pdb root has not initialized
pdb was not parsed

That's using 7775521.

[radare]

again?? please read the comments of the issue. its not crashing but it is not properly parsed

[phmarek]

Yeah, right.
It's not crashing.
And it's not properly parsing the file.

But it's a freshly generated file, and I didn't run any fuzzying tool... so I hoped for a dump of the contents.

[radare]

well, its not crashing because its leaking, there are some things to change in there and i dont have time/priority to fix the parser now. i dont even use windows at all, so its -1 prio for me, if anyone is interested it welcome :)

…

On 20 Jan 2017, at 13:19, Philipp Marek ***@***.***> wrote: Yeah, right. It's not crashing. And it's not properly parsing the file. But it's a freshly generated file, and I didn't run any fuzzying tool... so I hoped for a dump of the contents. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#6434 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA3-lkhFsap7N9QOd53r6Uf84KM_vxt6ks5rUKY2gaJpZM4LbqgN>.

[alvarofe]

I may give a try this, never did PDB.

[radare]

From what i saw there was many wrong assumptions to not having use after frees, thats why i commented out the freeing part. Check it out maybe you have a faster solution to this

…

On 10 Mar 2017, at 17:19, Álvaro Felipe Melchor ***@***.***> wrote: I may give a try this, never did PDB. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or mute the thread.

[radare]

HELLO @h4ng3r !!! ARE YOU STILL HERE??

[h4ng3r]

@radare no time sorry, I just removed my assignment. I'll focus in my other assigned issues.

[XVilka]

@radare I think this falls into Windows GSoC, just not for this release.

[XVilka]

@xarkes this is for you, but later this summer.