aemmitt-ns / radius2 Goto Github PK

The second example from the readme crashes with a huge allocation:
➜ radius git:(main) ✗ ./target/debug/radius2 -p tests/r100 -s stdin 96 -X Incorrect
memory allocation of 137421126912 bytes failed
[1] 4102 IOT instruction (core dumped) ./target/debug/radius2 -p tests/r100 -s stdin 96 -X Incorrect

Or does one need to have 130gb free for allocation?

Hey!

As the title suggests, does radius support under-constrained symbolic execution out of the box? Paper

Hi, I have a question regarding this piece of code:
https://github.com/aemmitt-ns/radius/blob/1a6d76a9b04eb3f6913404e2c28ca7c39f87c813/radius/src/sims/syscall.rs#L235-L244

Is this part really implementing the brk syscall?
Isn't it instead implementing the glibc wrapper function?

Please have a look at the section "C library/kernel differences" in the man page:
https://man7.org/linux/man-pages/man2/brk.2.html

However, the actual Linux system call returns the new
program break on success. On failure, the system call returns
the current break. The glibc wrapper function does some work
(i.e., checks whether the new break is less than addr) to provide
the 0 and -1 return values described above.

(I'm currently working on some kind of user-space emulator and also have to implement the brk and sbrk syscalls and I remembered your project from Twitter so I thought I'd look at how you implemented it :))

For whatever reason, search_strings api throws an error:

➜  radius git:(main) ✗ target/debug/radarx
==========================================
[Radarx] Profiling ======> [ais3]
==========================================
[Radarx] - Main: 0x4005C5
thread 'main' panicked at 'byte index 2 is out of bounds of ``', radius/src/r2_api.rs:790:43
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Looking into the source code, it seems slicing is not working for hex value:

 pub fn search_strings(&mut self, string: &str) -> R2Result<Vec<u64>> {     
        let result = self.cmd(&format!("izz~[2]~{}", string))?;                
                                                                               
        Ok(result                                                              
            .trim()                                                            
            .split('\n').map(|x| u64::from_str_radix(&x[2..], 16).unwrap_or_default())      <---    here                                               
            .filter(|x| *x != 0)                                               
            .collect())                                                        
    }              

So I made the following change which fixed the issue:

pub fn search_strings(&mut self, string: &str) -> R2Result<Vec<u64>> {     
        let result = self.cmd(&format!("izz~[2]~{}", string))?;                
                                                                               
        Ok(result                                                              
            .trim()                                                            
            .split('\n').map(|x| u64::from_str_radix(x.trim_start_matches("0x"), 16).unwrap_or_default())      <---  here                                                 
            .filter(|x| *x != 0)                                               
            .collect())                                                        
    }              

000000000001c8ec:  str x7, [sp, 0x128]                      |  x7,296,sp,+,DUP,tmp,=,=[8]
000000000001c8f0:  str **q0,** [sp, 0x70]                       |  q0,112,sp,+,DUP,tmp,=,=[16]
Unknown word: q0
thread '<unnamed>' panicked at 'attempt to shift right with overflow', /r2/radius/radius/src/memory.rs:595:47

I'm seeing this when run radius for aarch64.

Hi,

the readme states:

"radius2 can execute Dalvik bytecode only involving static methods and variables."

Is this also given for a PCode representation? And what about odex elf binaries?

As r2frida is working on debugging capabilities, could this be used to have a concrete state for the symbolic execution to start and might help radius on execution of dalvik code? See nowsecure/r2frida#284

Hi,
Assume I have below program:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main()
{
  char buf[5];

  memset(buf, 0, 5);

  if (!read(0, buf, 5))
    printf("read error\n");

  if (buf[0] == 'c')
    if (buf[1] == 'r')
      if (buf[2] == 'a')
        if (buf[3] == 's')
          if (buf[4] == 'h')
            abort();

  return 0;
}

I want radius2 to solve the stdio to crash.

Executing the program and output

radius2 -p crash -s stdin 128

  stdin : "crbsh\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}\u{0}"

why it's crbsh not crash?

Given -F flag also doesn't generate crash, the max string it can get is cras. Any idea?

When trying to recreate
how-to-perform-symbolic-execution-of-mobile-apps-with-r2frida-esilsolve i get the following base.odex representation:

From the video in the blog the code looks quite the same (so i suppose its not a radare issue):

I try solving with the following code: https://gist.github.com/GanbaruTobi/1821f9c4cedbc98f07a2c15c22bfae5f

Expected result: 0xcafebabe
Got result: 0xbadd000c
The resulting flag is wrong:

Besides, if u have an idea how to pull the address correctly for each attachment, we could at this to the repo (when its working correctly).

• rename it to radius2 to be in sync with the plugin name?
  • or maybe use r2radius?
• or just rename the plugin to be radius.$dll

I'm using latest r2frida (5.7.8) version.
I've noticed that polling condition in the init_frida function never handles.
self.cmd(&format!("ps 1 @ {}", alloc))?.trim() always returns "/xFF".

Also I've found that newer r2frida requires to use hex value for ":db" command.
So we need to change Frida command to something like that to suspend app.

 let script_data = format!(
            ": Interceptor.attach(ptr('0x{:x}'),function(){});:db 0x{:x}",
            addr, func, addr
  );

But this won't help to trigger hook. ESILSolver works just fine, tho there is another scripting logic.

When trying to solve the challenge:
https://github.com/angr/angr-doc/blob/master/examples/defcon2019quals_veryandroidoso/ooo.defcon2019.quals.veryandroidoso.apk

My code:

https://gist.github.com/GanbaruTobi/a01b31216e7dfc2c2e795b092eb290ca

creates a panic:

thread 'main' panicked at 'attempt to add with overflow', radius/src/processor.rs:712:17
stack backtrace:
0: rust_begin_unwind
at /rustc/7466d5492b2d28d2ba5114dbe71511a6502ac822/library/std/src/panicking.rs:584:5
1: core::panicking::panic_fmt
at /rustc/7466d5492b2d28d2ba5114dbe71511a6502ac822/library/core/src/panicking.rs:142:14
2: core::panicking::panic
at /rustc/7466d5492b2d28d2ba5114dbe71511a6502ac822/library/core/src/panicking.rs:48:5
3: radius2::processor::Processor::fetch_instruction
at ./radius/src/processor.rs:712:17
4: radius2::processor::Processor::execute_instruction
at ./radius/src/processor.rs:718:9
5: radius2::processor::Processor::step
at ./radius/src/processor.rs:742:13
6: radius2::processor::Processor::run
at ./radius/src/processor.rs:853:38
7: radius2::radius::Radius::run_until
at ./radius/src/radius.rs:467:9
8: dex::main
at ./examples/dex/src/main.rs:95:25
9: core::ops::function::FnOnce::call_once
at /rustc/7466d5492b2d28d2ba5114dbe71511a6502ac822/library/core/src/ops/function.rs:248:5
note: Some details are omitted, run with RUST_BACKTRACE=full for a verbose backtrace.