Fix overflow detection logic in state filter - #3
Open
AmaliaI12 wants to merge 2 commits into
Open
Conversation
Signed-off-by: Amalia Ionescu <ionescu.amalia98@gmail.com>
There was a problem hiding this comment.
Pull request overview
This PR aims to make overflow-path detection more reliable in the simulation manager filter so valid overflow states aren’t missed, and it also adjusts several long-running timeout_decorator usages (and some tooling interactions) used during exploration/exploitation flows.
Changes:
- Updates
overflow_detect_filterlogic used by overflow detection during symbolic exploration. - Switches multiple
timeout_decorator.timeout(...)usages touse_signals=Falseand (in some detectors) returns/propagates thesimgr.explore(...)result. - Introduces a binary copy step (named
radare2_binary) before running local processes / fetching register values.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| zeratool_lib/simgr_helper.py | Modifies the overflow state filter logic used to classify/stash vulnerable states. |
| zeratool_lib/overflowRemoteLeaker.py | Adjusts timeout behavior for remote libc leak exploration. |
| zeratool_lib/overflowExploitSender.py | Adds a binary copy step before spawning the local process. |
| zeratool_lib/overflowExploiter.py | Adds a binary copy step and routes getRegValues through it; adjusts timeout behavior. |
| zeratool_lib/overflowDetector.py | Adjusts timeout behavior and captures the returned SimulationManager. |
| zeratool_lib/formatExploiter.py | Adjusts timeout behavior and captures the returned SimulationManager. |
| zeratool_lib/formatDetector.py | Adjusts timeout behavior and captures the returned SimulationManager. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
295
to
301
| for state in simgr.active: | ||
| if state.globals.get("type", None) == "overflow_variable": | ||
| user_input = state.globals.get("user_input", None) | ||
| if user_input is not None: | ||
| log.info("Found vulnerable state. Overflow variable to win") | ||
| user_input = state.globals["user_input"] | ||
| #user_input = state.globals["user_input"] | ||
| input_bytes = state.solver.eval(user_input, cast_to=bytes) | ||
| log.info("[+] Vulnerable path found {}".format(input_bytes)) |
Comment on lines
+19
to
+26
| radare2_binary_name = "/radare2_binary" | ||
| fin = open(binary_name, "rb") | ||
| fout = open(radare2_binary_name, "wb") | ||
| fout.write(fin.read()) | ||
| fin.close() | ||
| fout.close() | ||
| os.chmod(radare2_binary_name, stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO) | ||
|
|
Comment on lines
+58
to
+65
| radare2_binary_name = "/radare2_binary" | ||
| fin = open(binary_name, "rb") | ||
| fout = open(radare2_binary_name, "wb") | ||
| fout.write(fin.read()) | ||
| fin.close() | ||
| fout.close() | ||
| os.chmod(radare2_binary_name, stat.S_IRWXU | stat.S_IRWXG | stat.S_IRWXO) | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overflow detection depended on the
typefield being set tooverflow_variablebefore the filter was applied. When the flag was not assigned, some valid overflow paths were ignored.This PR depends on #2 . Please review after #2 is merged.