Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

尝试分析一个so文件时,出现的一些问题,希望能提供帮助或意见 #5

Open
TopCode280 opened this issue Jul 6, 2023 · 0 comments

Comments

@TopCode280
Copy link

使用analyzer.py去分析libmsaoaidsec.so文件
if name == 'main':
# load_to_angr('example/lib64_example.so', 0x13C88)
analyzer = DeflatAnalyzer('example/libmsaoaidsec.so')
analyzer.analysis_flatten_blocks(0xC40C)
analyzer.show_blocks_info()
以下是异常日志
CRITICAL | 2023-07-06 16:23:57,481 | cle.backends.backend | Deprecation warning: the custom_base_addr parameter has been renamed to base_addr
WARNING | 2023-07-06 16:23:57,864 | cle.backends.externs | Symbol was allocated without a known size; emulation may fail if it is used non-opaquely: __stack_chk_guard
WARNING | 2023-07-06 16:23:57,864 | cle.backends.externs | Symbol was allocated without a known size; emulation may fail if it is used non-opaquely: __sF
WARNING | 2023-07-06 16:23:57,868 | cle.loader | For more information about "Symbol was allocated without a known size",see https://docs.angr.io/extending-angr/environment#simdata
WARNING | 2023-07-06 16:24:08,360 | pyvex.lifting.gym.arm_spotter | Ignoring STMxx ^ instruction at 0x17518. This mode is not implemented by VEX! See pyvex/lifting/gym/arm_spotter.py
base addr : 0x0

            [WARNING] start address is higher than base address. 
            Check if the start address has stripped the base address.

fail to find function at 0xc40c, now try blocks analysis
是不是因为导入表的函数未找到,需要导入例如libc.so
感谢项目的开源

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant