pbc_dump crashes on certain inputs

[ild]

A number of bugs discovered in pbc_dump by Avalanche dynamic program analysis tool ( http://code.google.com/p/avalanche/).

pbc_dump crashes on certain exploit inputs (attached).

[ild]

to reproduce:

parrot-2.6.0/inst/bin/pbc_dump -d exploit_0_0 parrot-2.6.0/inst/bin/pbc_dump -d exploit_3_0 ... etc.

stacktrace_20.log added by mistake

[dukeleto]

Could you describe how you used the Avalanche tool to create the exploit_* files? That would be really useful. Thanks!

[ild]

I'm pleased that you are interested in Avalanche. Cause I'm its developer:)

OK, I'll try to describe it. We are currently working on adding new features to Avalanche, and those exploits were found using these features. They are probably not yet stable, but already quite useful.

You'll have to checkout the sources from SVN:

$ svn checkout http://avalanche.googlecode.com/svn/branches/separate-analysis avalanche

Then build Avalanche (you'll need autotools for that)

$ ./autogen.sh
$ ./configure --prefix=<path to avalanche install directory>
$ make
$ make install

If everything is build fine, run Avalanche. You may find the actual command line  here.

There is a special new option for Avalanche: '--input-filter-file=<mask file>'. If it is not specified, Avalanche considers all the data in the input file as tainted. In this case the analysis may take too much time and won't be effective. If this option is specified, then only those positions that are listed in the mask file are considered to hold the tainted data. It may significantly speed up the analysis and allows Avalanche to explore certain parts of the application ignoring other parts.

Other options should be described  here

That was a very brief description. Consult the  Avalanche wiki for further information and feel free to ask any questions. You may write to iisaev@ispras.ru. I'm interested in any feedback.

Hope you'll find Avalanche useful.

[ild]

In addition to previous comment:

'--input-filter-file=<mask file>' Avalanche option is now renamed to '--mask=<mask file>'