From 30a0fbb5839b08dc58efe602a5cd19c90fbd4c50 Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Tue, 12 Nov 2024 23:15:56 -0500 Subject: WARP: Set fixed image base for `sigem` Should fix low address sections colliding with non relocatable constants --- plugins/warp/src/bin/sigem.rs | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'plugins') diff --git a/plugins/warp/src/bin/sigem.rs b/plugins/warp/src/bin/sigem.rs index 69193404..6076e7d5 100644 --- a/plugins/warp/src/bin/sigem.rs +++ b/plugins/warp/src/bin/sigem.rs @@ -50,10 +50,16 @@ struct Args { } fn default_settings(bn_settings: &Settings) -> Value { + // TODO: Make these settings configurable through the CLI let mut settings = json!({ "analysis.linearSweep.autorun": false, "analysis.signatureMatcher.autorun": false, "analysis.mode": "full", + // The reason we need to do this is a little unfortunate. + // Basically some of the COFF's have really low image bases that confuses + // Analysis and also our basic block GUID when a constant value points to a low address section. + // TODO: This might not exist, we should set this based on the view. + "loader.imageBase": 0x1000000, }); // If WARP is enabled we must turn it off to prevent matching on other stuff. -- cgit v1.3.1