NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework

Home Page:https://www.nsa.gov/ghidra

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Version Tracking Exact Function Bytes/Instructions/Mnemonics Match Corelators don't match identical functions

0x6d696368 opened this issue · comments

Describe the bug
In Version Tracking the Exact Function Bytes/Instructions/Mnemonics Match Correlators don't match an identical function.

To Reproduce
Steps to reproduce the behavior:

  1. Download: windows6.1-kb4512486-x86_4c88f71af8e9d07e5fb141d7aed0bcc7f532781e.msu from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4512486 and extract rdpcorets.dll
  2. Download: windows6.1-kb4520003-x86_86ac80d58f564c48502a7e2e65b64f7fd1fd2c10.msu from https://www.catalog.update.microsoft.com/Search.aspx?q=KB4520003 and extract rdpcorets.dll
  3. Start VT Session between the two rdpcorets.dlls
  4. Add Function Bytes, Instructions and Mnemonics Match Corelators
  5. Function _WPP_SF_DD@24 is not matched by any of the Correlators, even though the function is bit-identical.

Expected behavior
The function is matched.

Screenshots

Here is the function matched with my own custom Correlator, but the included Exact Correlators did not match the function:

ghhidra_bug

Environment (please complete the following information):

  • OS: CentOS 7
  • Java Version: 11.0.4
  • Ghidra Version: 9.1-BETA

I'll try to reduce this to a minimal example. But until then:

Is this a known issue? Anyone experienced this before? Anything I'm missing?

Edit: Are the multiple source and destination labels the issue? If so, this can be closed.

Edit: The Duplicate Function Instructions Match Correlator also did not match the function, hence, I don't think this is caused by the multiple labels.

I took a peek at this. Unfortunately, as the post is quite old, I was unable to the original binaries. I tried with similar binaries, but was unable to reproduce this issue.
I will close this for now. If anyone finds available binaries that exhibit the issue, then we can reopen this ticket.