Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Block has been patched??? #6

Open
simhigo opened this issue Mar 20, 2020 · 9 comments
Open

Block has been patched??? #6

simhigo opened this issue Mar 20, 2020 · 9 comments

Comments

@simhigo
Copy link

simhigo commented Mar 20, 2020

When I run ""deflatten_cfg(bv, pw, 0x0034ff78, 0x0034d9b4)"", I get an error message "Block has been pathced"
Can you help me with what is the problem?

image

@amimo
Copy link
Owner

amimo commented Mar 20, 2020

there might be bugs in the "delete_overlap_edges" function, you can start there.

@simhigo
Copy link
Author

simhigo commented Mar 23, 2020

I tried changing the address
"deflatten_cfg(bv, pw, 0x0034d99c, 0x0034d9bc)"
image

it was not optimized.
image

@amimo
Copy link
Owner

amimo commented Mar 23, 2020

does this script produce some log like:"patch branch address xxx".If so, try to re-analyze this function after running the fix-xxx.py script in ida.

@simhigo
Copy link
Author

simhigo commented Mar 24, 2020

This is the result from the completion of re-analyze & function tell edit after running the fix-.py script.

@amimo
Copy link
Owner

amimo commented Apr 3, 2020

hellojni_3.0.3.zip
block 0x001582bc in function 0x1494c4 at libhello-jni.so may be your case. run the script in the attachment, see how it is handled.
ps: it may take ida hours( > 12h) to re-analyze this function.

@simhigo
Copy link
Author

simhigo commented May 7, 2020

In my opinion, it seems to be a different case from the one you delivered.

@simhigo
Copy link
Author

simhigo commented May 7, 2020

i have a one more issue.

It is a new code case.

image

When setting the code range for the case as below, an error message occurred.
image

Can you help me with what is the problem?

@amimo
Copy link
Owner

amimo commented May 7, 2020

Those two addresses are not code range.
The first one is the address of a state var definition in mlil view, the second is the address of the
corresponding dispatcher.

@simhigo
Copy link
Author

simhigo commented May 8, 2020

Those two addresses are code segment.
This binary is dylib
Is there any support for dylib?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants