0

I am using debin project to recover symbols in stripped binaries. This project leverages machine learning approach to reverse engineer variables, types and variable names from stripped binaries. It also rebuilds the stripped section (.debug) so that it will be easier for the reverse engineering frameworks to leverage this information to improve the analysis.

But, I observed that even debin successfully builds some of the symbols, ghidra ignores these symbols during analysis. Is there a particular reason for tha? and is there any way to force ghidra to use such symbols (in gui as well as in cli).

for e.g. I have following code (ref: sard 89 benchmark - 000/000/151):

 50 int main(int argc, char *argv[])
 51 {
 52   int init_value;
 53   int inc_value;
 54   int loop_counter;
 55   char buf[10];
 56
 57   init_value = 0;
 58   inc_value = 4105 - (4105 - 1);
 59
 60   loop_counter = init_value;
 61   while((loop_counter += inc_value) && (loop_counter <= 4105))
 62   {
 63     /*  BAD  */
 64     buf[loop_counter] = 'A';
 65   }
 66
 67
 68   return 0;
 69 }

readelf -wi output on debin binary (symbols are generated by debin):

<1><2d>: Abbrev Number: 2 (DW_TAG_subprogram)
    <2e>   DW_AT_name        : main
    <33>   DW_AT_type        : <0x1d>
    <37>   DW_AT_low_pc      : 0x401106
    <3f>   DW_AT_high_pc     : 0x47
 <2><47>: Abbrev Number: 4 (DW_TAG_variable)
    <48>   DW_AT_name        : matchError
    <53>   DW_AT_location    : 2 byte block: 76 5c      (DW_OP_breg6 (rbp): -36)
    <56>   DW_AT_type        : <0x24>
 <2><5a>: Abbrev Number: 4 (DW_TAG_variable)
    <5b>   DW_AT_name        : name
    <60>   DW_AT_location    : 2 byte block: 76 50      (DW_OP_breg6 (rbp): -48)
    <63>   DW_AT_type        : <0x2b>
 <2><67>: Abbrev Number: 4 (DW_TAG_variable)
    <68>   DW_AT_name        : group
    <6e>   DW_AT_location    : 2 byte block: 76 78      (DW_OP_breg6 (rbp): -8)
    <71>   DW_AT_type        : <0x1d>
 <2><75>: Abbrev Number: 4 (DW_TAG_variable)
    <76>   DW_AT_name        : flushType
    <80>   DW_AT_location    : 2 byte block: 76 74      (DW_OP_breg6 (rbp): -12)
    <83>   DW_AT_type        : <0x1d>
 <2><87>: Abbrev Number: 4 (DW_TAG_variable)
    <88>   DW_AT_name        : i
    <8a>   DW_AT_location    : 2 byte block: 76 7c      (DW_OP_breg6 (rbp): -4)
    <8d>   DW_AT_type        : <0x1d>

Ghidra GUI:

image

Thanks in advanced.

Debin paper ref: https://dl.acm.org/doi/pdf/10.1145/3360572

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.