lunixbochs / usercorn

dynamic binary analysis via platform emulation

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

x86_32 stat() is... bad

lunixbochs opened this issue · comments

./usercorn -prefix samples/linux-i686/ samples/linux-i686/bin/stat usercorn

Output:

  File: 'usercorn'
  Size: 1505252135	Blocks: 0          IO Block: 512    weird file
Device: 157a44c01000004h/96726563353001988d	Inode: 0           Links: 0
Access: (0024/?----w-r--)  Uid: ((*cpu.FileDesc)(nil)
invalid fetch: @0x885cb82, 0x1 = 0x0
----------------------------------------
Error: Fetch from non-executable memory (UC_ERR_FETCH_PROT)

Desired:

  File: 'usercorn'
  Size: 12965312  	Blocks: 25323      IO Block: 1024   regular file
Device: 2ch/44d	Inode: 21984       Links: 1
Access: (0755/-rwxr-xr-x)  Uid: ( 1000/ vagrant)   Gid: ( 1000/ vagrant)
Access: 2017-09-12 21:34:27.000000000 +0000
Modify: 2017-09-12 21:31:54.000000000 +0000
Change: 2017-09-12 21:31:54.000000000 +0000
 Birth: -

http://man7.org/linux/man-pages/man2/stat.2.html

   C library/kernel differences
       Over time, increases in the size of the stat structure have led to
       three successive versions of stat(): sys_stat() (slot __NR_oldstat),
       sys_newstat() (slot __NR_stat), and sys_stat64() (slot __NR_stat64)
       on 32-bit platforms such as i386.  The first two versions were
       already present in Linux 1.0 (albeit with different names); the last
       was added in Linux 2.4.  Similar remarks apply for fstat() and
       lstat().

       The kernel-internal versions of the stat structure dealt with by the
       different versions are, respectively:

       __old_kernel_stat
              The original structure, with rather narrow fields, and no
              padding.

       stat   Larger st_ino field and padding added to various parts of the
              structure to allow for future expansion.

       stat64 Even larger st_ino field, larger st_uid and st_gid fields to
              accommodate the Linux-2.4 expansion of UIDs and GIDs to 32
              bits, and various other enlarged fields and further padding in
              the structure.  (Various padding bytes were eventually
              consumed in Linux 2.6, with the advent of 32-bit device IDs
              and nanosecond components for the timestamp fields.)

fixed in 99aa070