Which arm binary is to be given to disassembler ?

[Heydemann Karine]

I don't manage to test the application disassembler on a ARM binary, which ARM arch should I compile to ?

Which compiler is to be used ?

Thanks a lot for your help.

Karine

I got this message : 

dissambler:./disasm/asm_program.cpp:202: int get_instr_length(asm_program_t*, bfd_dma): Assertion failed 'disas' failed

[Alex Bazhanyuk]

I think ARM is not support in vine-1.0., you can try to compile vine on ARM, but I think you should patch a bit some code for it, and it's still be not avaliable to work. 

Stephen wanted to prepared some project which based on vine, which support ARM, but I am not sure about it and when it will be.

Also, S2E support ARM and DroidScope support ARM too, you can try them.

--
 
---
You received this message because you are subscribed to the Google Groups "BitBlaze User Discussion group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitblaze-user...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

--
Thanks,
Alex

[Stephen McCamant]

>>>>> "Alex" == Alex Bazhanyuk <virv...@gmail.com> writes:

Alex> I think ARM is not support in vine-1.0., you can try to compile
Alex> vine on ARM, but I think you should patch a bit some code for
Alex> it, and it's still be not avaliable to work.
Alex> Stephen wanted to prepared some project which based on vine,
Alex> which support ARM, but I am not sure about it and when it will
Alex> be. Also, S2E support ARM and DroidScope support ARM too, you
Alex> can try them.

Actually, the Vine 1.0 release does already contain the core of the
support for analyzing ARM code ("ARM guest"), though it's not as
complete as the support for x86 code (see for instance
libasmir/src/vex/irtoir-arm.cpp). Implementation-wise Vine itself is
also mostly architecture independent as long as you have an OCaml
compiler, so there are also relatively few obstacles to compiling Vine
on an ARM Linux underlying platform ("ARM host"), though I wouldn't
expect this latter to be a common use case.

The obstacle that I think that you Karine the original poster are
running into is that LibASMIR will only support ARM if you compile it
with a version of the binutils that itself supports ARM; but the
binutils development libraries supplied with Linux distributions
typically only support the host architecture. (Debian and Ubuntu have
"binutils-multiarch" packages that give you binutils binaries that
support many architectures, but last time I checked they don't provide
a "binutils-multiarch-dev" package). So if you want to use Vine to
analyze ARM code while running on an x86 platform ("ARM guest, x86
host"), you probably need to compile the binutils from source. Another
way of describing this is that you need to have a version of "objdump"
that will disassemble an ARM binary before you can expect the
libasmir/disassembler program to do so.

For instance on my Ubuntu 12.04 desktop machine here, I compiled
binutils-2.22 from source using the options --disable-werror
--enable-targets=arm-linux-gnueabi,i486-linux-gnu,x86_64-linux-gnu,
and installed in a directory of my home directory we'll call
$my_binutils. You can then use this version for Vine by passing it
using environment variables to the configure script, as in:

CXXFLAGS=-I$my_binutils/include LDFLAGS=-L$my_binutils/lib LIBS=-lz ./configure

With this I was able to disassemble a small hello-world ARM binary:

% file hw
hw: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically
linked (uses shared libs), for GNU/Linux 2.6.18,
BuildID[sha1]=0x05936789d30a8b18c6dbeeb6a71318c8241dfe19, not stripped
% ./libasmir/apps/disassembler ./hw
_init (82c4-82cb)
push {r4, lr}

bl 0x0000000000008354

_start (8318-8347)
mov fp, #0

mov lr, #0

pop {r1} ; (ldr r1, [sp], #4)
....

"libasmir/apps/disassembler" uses the Binutils disassembler to produce
its text output. For actually converting ARM instructions into Vine
IR, the version of VEX you use is also relevant, though VEX has had
pretty good ARM support for a while. There are some things we've
implemented only subsequent to the Vine 1.0 release, probably the most
important of which is translation of flags updates and condition
computations. This isn't public yet but I hope to make it available in
the future.

-- Stephen