[lldb-dev] linux: LLDB python API inconsistent with lldb tool
ben at iagu.net
Sun Jun 7 00:20:54 PDT 2015
I have kind of a strange problem. First of all, here is the short version.
My crash analysis tool
https://github.com/bnagy/francis/tree/master/exploitaben works fine on
OSX, but on linux it fails to correctly handle some ( but not all )
faulting programs. The lldb tool in the same environment and on the
same inputs works as expected. Ubuntu 15.04, lldb 3.6.
Here's the longer version.
I am analysing crashes (from afl-fuzz, which _may_ be involved). The
basic harness in exploitaben.py is a light modification of one of the
LLDB API example tools process_events.py. It has worked correctly for
many crashes on OSX, so I feel like the basic approach is sound. Here
are some observations.
I built the basic tests from https://github.com/jfoote/exploitable.
When I run, for example
exploitaben.py -- ~/src/exploitable/exploitable/tests/bin/testAbortSignal.test
I get correct output.
When I run a fault, like
exploitaben.py -- pdftoppm -r 16
[ABORT] no valid frames in faulting thread
Which is my message, based on: if not
The same test in lldb:
fuzzadmin at ebx:~/afl/poppler-0.33.0$ lldb -- pdftoppm -r 16
(lldb) target create "/home/fuzzadmin/afl/poppler-0.33.0/utils/pdftoppm"
Current executable set to
(lldb) settings set -- target.run-args "-r" "16"
Process 7770 launching
Process 7770 launched:
[snip many Syntax Errors]
Syntax Error: Pages top-level is a single Page. The document is
mal-formet, trying to recover...
Internal Error (0): Call to Object where the object was type 7, not
the expected type 9
Process 7770 stopped
* thread #1: tid = 7770, 0x00007ffff6434267 libc.so.6`gsignal + 55,
name = 'pdftoppm', stop reason = signal SIGABRT
frame #0: 0x00007ffff6434267 libc.so.6`gsignal + 55
-> 0x7ffff6434267 <gsignal+55>: cmpq $-0x1000, %rax
0x7ffff643426d <gsignal+61>: ja 0x7ffff6434290 ; gsignal + 96
0x7ffff643426f <gsignal+63>: rep
0x7ffff6434270 <gsignal+64>: retq
I have tested the target built with vanilla gcc, vanilla clang, with
afl instrumentation ( see the afl project for details) and with afl +
clang instrumentation. None work correctly.
At the moment I am at a loss as to how to debug this issue further.
Does anyone have any ideas? If you would prefer to reproduce for
yourself, here's my environment:
poppler-0.33 built from source with ./configure --disable-shared
afl-fuzz v 1.80b
I can provide one of my crashing inputs if required. You can also find
me lurking on #lldb at the moment.
More information about the lldb-dev