Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix logic error in _write_to_mem_with_gadget() #93

Merged
merged 1 commit into from
Apr 6, 2024

Conversation

astewart-bah
Copy link
Contributor

raise RopException in _write_to_mem_with_gadget() when selected gadget does not pass the checks stating that the next pc must come from the stack rather than return False

_write_to_mem_with_gadget is called by _try_write_to_mem using the chain += syntax

_try_write_to_mem is called in a try except block for each gadget in _write_to_mem.

The except block excepts the following exceptions: RopException, angr.errors.SimEngineError, angr.errors.SimUnsatError

Before this change, if the first gadget checked with this workflow did not pass the check, the try block would fail to perform chain + False on this line:

o_state = other._blank_state

with:

AttributeError: 'bool' object has no attribute '_blank_state'

Since AttributeErrors are not in the list of excepted errors, the next gadget is not tried.

Replacing the return False with raise RopException fixes this issue and allows all of the gadgets to be tried until a working mem writer chain is found.

… when selected gadget does not pass the checks stating that the next pc must come from the stack
@Kyle-Kyle
Copy link
Collaborator

thank you for the contribution!

@Kyle-Kyle Kyle-Kyle merged commit 8009e66 into angr:master Apr 6, 2024
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants