"Too much TLS data" with more complex binary

[JacobBarthelmeh]

Am looking for any tips on an issue that is cropping up with running the shellphuzz from Docker on Ubuntu. Toy examples and simple .c files work just fine but when going to a more complex binary with function callbacks I run into the following issue.

(angr) angr@cd4e2244ab3c:~/$ shellphuzz -c 1 -d 1 -w work-dir/ ./a.out
[*] Drilling...
[*] Creating fuzzer...
WARNING | 2019-06-25 16:46:06,982 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000.
Traceback (most recent call last):
  File "/home/angr/.virtualenvs/angr/bin/shellphuzz", line 7, in <module>
    exec(compile(f.read(), __file__, 'exec'))
  File "/home/angr/angr-dev/fuzzer/shellphuzz", line 87, in <module>
    memory=args.memory, seeds=seeds, timeout=args.run_timeout,
  File "/home/angr/angr-dev/fuzzer/fuzzer/fuzzer.py", line 162, in __init__
    p = angr.Project(binary_path)
  File "/home/angr/angr-dev/angr/angr/project.py", line 121, in __init__
    self.loader = cle.Loader(self.filename, concrete_target=concrete_target, **load_options)
  File "/home/angr/angr-dev/cle/cle/loader.py", line 127, in __init__
    self.initial_load_objects = self._internal_load(main_binary, *preload_libs, preloading=True)
  File "/home/angr/angr-dev/cle/cle/loader.py", line 683, in _internal_load
    self.tls_object.register_object(obj)
  File "/home/angr/angr-dev/cle/cle/backends/tls/elf_tls.py", line 93, in register_object
    raise CLEError("Too much TLS data to handle... file this as a bug")
cle.errors.CLEError: Too much TLS data to handle... file this as a bug

[rhelmot]

Can you upload the binary that does this? Also, this is a CLE bug, not a driller bug. I’ll move it when I get to my computer. (edit: just kidding, I can't transfer issues between organizations)

…

On Tue, Jun 25, 2019 at 9:56 AM JacobBarthelmeh ***@***.***> wrote: Am looking for any tips on an issue that is cropping up with running the shellphuzz from Docker on Ubuntu. Toy examples and simple .c files work just fine but when going to a more complex binary with function callbacks I run into the following issue. (angr) ***@***.***:~/$ shellphuzz -c 1 -d 1 -w work-dir/ ./a.out [*] Drilling... [*] Creating fuzzer... WARNING | 2019-06-25 16:46:06,982 | cle.loader | The main binary is a position-independent executable. It is being loaded with a base address of 0x400000. Traceback (most recent call last): File "/home/angr/.virtualenvs/angr/bin/shellphuzz", line 7, in <module> exec(compile(f.read(), __file__, 'exec')) File "/home/angr/angr-dev/fuzzer/shellphuzz", line 87, in <module> memory=args.memory, seeds=seeds, timeout=args.run_timeout, File "/home/angr/angr-dev/fuzzer/fuzzer/fuzzer.py", line 162, in __init__ p = angr.Project(binary_path) File "/home/angr/angr-dev/angr/angr/project.py", line 121, in __init__ self.loader = cle.Loader(self.filename, concrete_target=concrete_target, **load_options) File "/home/angr/angr-dev/cle/cle/loader.py", line 127, in __init__ self.initial_load_objects = self._internal_load(main_binary, *preload_libs, preloading=True) File "/home/angr/angr-dev/cle/cle/loader.py", line 683, in _internal_load self.tls_object.register_object(obj) File "/home/angr/angr-dev/cle/cle/backends/tls/elf_tls.py", line 93, in register_object raise CLEError("Too much TLS data to handle... file this as a bug") cle.errors.CLEError: Too much TLS data to handle... file this as a bug — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#74?email_source=notifications&email_token=AATCB5NQ3I6G2AVKLOVMFRLP4JE3LA5CNFSM4H3KK6DKYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4G3TG4VQ>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AATCB5MZNYZML3BQP73BE7LP4JE3LANCNFSM4H3KK6DA> .

[JacobBarthelmeh]

I can close this and open it in another location, what's the link to there issue spot? Am trying to trim the binary down to the simplest case that triggers what am seeing, mainly was curious if this had came up before or if a known workaround existed.

[rhelmot]

open it in https://github.com/angr/cle with the binary. I'll check if there are any real bugs, but if your binary actually needs more than 32k of thread-local storage you might just need to tweak a value to get it.

[JacobBarthelmeh]

Thanks @rhelmot , moved to here angr/cle#192. Which value would need tweaked?