octopus-platform/bjoern

Double links

Closed this issue · 11 comments

l4l commented

I create a small binary: a.zip for testing some queries.

And in bjosh:

> getCallsTo('c_memcpy')
v[#9:390]
v[#9:391]
> getCallsTo('c_memcpy').map
{repr=call sym.c_memcpy, childNum=12, code=e820000000, comment=, nodeType=Instr, addr=4195679, key=Instr_4195679, esil=rip,8,rsp,-=,rsp,=[],4195716,rip,=}
{repr=call sym.c_memcpy, childNum=, code=, comment=, nodeType=Instr, addr=4195679, key=Instr_4195679, esil=}

And in r2:

> axt sym.c_memcpy
call 0x40055f call sym.c_memcpy in sym.main

Same problem on standard binaries. For example, /bin/cat:

...
v[#9:9417]
v[#9:9418]
v[#9:9520]
v[#9:10588]
v[#9:10589]
v[#9:11037]
v[#9:11038]
...

Hi there, can you try again? Hope it is fixed by the latest commits.

Thanks for reporting this issue
Alwin

l4l commented

Now getCallsTo drops an error: [OCommandExecutionException] Cannot evaluate lucene condition without index configuration.
But g.V query works and still not as intented:

[390] {repr=call sym.c_memcpy, childNum=12, code=e820000000, comment=, nodeType=Instr, addr=4195679, key=Instr_4195679, esil=rip,8,rsp,-=,rsp,=[],4195716,rip,=}
[391] {repr=call sym.c_memcpy, childNum=, code=, comment=, nodeType=Instr, addr=4195679, key=Instr_4195679, esil=}

@a0x77n when you add or remove fields, the name of the index changes. You need to adapt this name in bjoern-lang to fix this, imho.

@a0x77n the created index is named ["addr","childNum","code","comment","esil","key","nodeType","repr"], meaning it still contains childNum. In contrast, the index in lookup.groovy does no contain "childNum". Can you adapt this and test it?

@l4l should work now.

l4l commented

Nice, thanks!

Sorry I forgot to mention that the data fields changed a bit (there is no 'childNum' field anymore). That means, you have to re-import your data (and we must revert the latest commit).

As it is now, the index name will fail for new imports.

On re-import, the index name still contained "childNum", so I reintroduced "childNum" into the index. Please test this on a fresh installation. Are you sure "childNum" is not in there anymore?

Ok, my bad. Apparently, using joern-delete-project to remove the project didn't work earlier. We could use a bjoern-delete-project. Can you revert the commit then?

Done. I did not know that there is a joern-delete-project command. Is the octopus-project delete command not working for joern?