googleprojectzero/Jackalope

Failed to find ENTRY POINT for unar binary

mshudrak opened this issue · 3 comments

mshudrak commented

Hi,
Thanks for the great fuzzer for MacOS.

I have an issue with running Jackalope against unar binary. Basically, I am getting the following error:

sudo ./fuzzer -in in -out out -t 1000 -delivery file -instrument_module unar -target_module unar -target_offset 0x18a0 -nargs 1 -iterations 10000 -persist -loop -cmp_coverage -- unar @@
Fuzzer version 0.01
1 input files read
Running input sample in/game_312.game
[-] PROGRAM ABORT : Unable to find ENTRY POINT command in GetModuleEntrypoint
         Location : GetModuleEntrypoint(), /Users/mshudrak/Downloads/Jackalope/TinyInst/macOS/debugger.cpp:776

Additionally, I tried -target_method start but encountered the same problem.

The binary can be obtained from here: https://theunarchiver.com/command-line (MacOS pre-compiled version).

Thanks in advance :)

ifratric commented

Hmm, probably it's an older binary that doesn't have LC_MAIN command in the in the Mach-O header. This is the "newer" way to expose the entrypoint in the Mach-O files and is currently the only one supported, but it shouldn't be too difficult to add support for the older ones (famous last words). Will look into it.

ifratric commented

This type of binary should now be supported in the latest TinyInst :-)

However, wrt your command line, specifically -target_offset 0x18a0, note that 0x18a0 is indeed the entrypoint, however in this case the entrypoint does not correspond to a start of a function, so it doesn't work as the target method (it's going to result in a crash in the target process if you use that offset). However, it calls another function soon at 0x18dc and this seems to work:

sudo ./fuzzer -in in -out out -t 1000 -delivery file -instrument_module unar -target_module unar -target_offset 0x18dc -nargs 2 -iterations 10000 -persist -loop -cmp_coverage -- ./unar @@

Tentatively closing the issue.

mshudrak commented

Great, thank you for the fast patch! Everything works fine now.
By the way, for anyone who try to reproduce this please pay attention to the number of arguments provided for the target function. It should be -nargs 2 not 1 otherwise you will get the following error:

Total execs: 8
Unique samples: 0 (0 discarded)
Crashes: 0 (0 unique)
Hangs: 0
Offsets: 0
Execs/s: 8
[-] PROGRAM ABORT : No interesting input files
         Location : SynchronizeAndGetJob(), /Users/mshudrak/Downloads/Jackalope/fuzzer.cpp:495