[PATCH] Fix MCDataAtom never calling remap when adding data.

[Stephen Checkoway]

On Oct 16, 2013, at 11:03 AM, Rafael Espíndola <rafael.espindola at gmail.com> wrote:

>> I think you're right. What do you think the correct behavior here should be? I can think of a few possibilities:
>> 
>> 1. Truncate the text atom after the last valid instruction and add a data atom for the remainder of the section.
>> 2. Truncate the text atom, add a data atom of size 1, and attempt to disassemble starting with the next byte, creating a new text atom if it succeeds.
> 
> Looks like this is what it is trying to do. It should probably be
> creating the data atom with a size of 1. If disassembly flails again
> in the next byte, addData (after your patch) will correctly add the
> second byte to the atom.

I'll write a patch for this. I think it's probably not the best behavior though. It seems like if we hit this situation (which we appear to with real binaries), we're pretty likely to become desynched from the intended instruction stream, particularly for architectures that use constant islands and the like.

>> 3. Perform a smarter disassembly. Section 2.2 of <http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12313-sec13-paper_zhang.pdf> (which won best paper award at USENIX Security this year) offers a mixed linear and recursive disassembly approach which apparently works well in practice.
>> 
> 
> Cheers,
> Rafael
> 

-- 
Stephen Checkoway