1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
Crashed with 'uncaught target signal SIGILL' while program has registered by signal(SIGILL, handler)
This binary is an CTF reverse challenge binary, it registers signal handler via 'signal(SIGILL, 0x1193D);' while 0x1193D is the SIGILL handler.
Please see the attachment, the file 'repair' is the binary i mentioned above, the file 'qemu-arm' is an old version qemu at 2.5.0, and it seems an official release (not modified).
Which means, it could be a bug in recent release.
You need to input 'flag{' to the stdin to let the binary execute the illegal instruction at 0x10A68.
In 2.5.0 version the -strace logs:
116 uname(0xf6ffed40) = 0
116 brk(NULL) = 0x0009f000
116 brk(0x0009fd00) = 0x0009fd00
116 readlink("/proc/self/exe",0xf6ffde78,4096) = 21
116 brk(0x000c0d00) = 0x000c0d00
116 brk(0x000c1000) = 0x000c1000
116 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
116 rt_sigaction(SIGILL,0xf6ffec48,0xf6ffecd4) = 0
116 fstat64(1,0xf6ffe8e8) = 0
116 ioctl(1,21505,-151000980,-151000924,652480,640808) = 0
116 fstat64(0,0xf6ffe7d0) = 0
116 ioctl(0,21505,-151001260,-151001204,652480,641152) = 0
116 write(1,0xa5548,6)input: = 6
116 read(0,0xa6550,4096)flag{
= 6
116 write(1,0xa5548,7)wrong!
= 7
116 _llseek(0,4294967295,4294967295,0xf6ffee18,SEEK_CUR) = -1 errno=29 (Illegal seek)
116 exit_group(0)
In 2.11.1, it shows:
113 uname(0xfffeed30) = 0
113 brk(NULL) = 0x0009f000
113 brk(0x0009fd00) = 0x0009fd00
113 readlink("/proc/self/exe",0xfffede68,4096) = 21
113 brk(0x000c0d00) = 0x000c0d00
113 brk(0x000c1000) = 0x000c1000
113 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
113 rt_sigaction(SIGILL,0xfffeec38,0xfffeecc4) = 0
113 fstat64(1,0xfffee8d8) = 0
113 ioctl(1,21505,-71588,-71532,652480,640808) = 0
113 fstat64(0,0xfffee7c0) = 0
113 ioctl(0,21505,-71868,-71812,652480,641152) = 0
113 write(1,0xa5548,6)input: = 6
113 read(0,0xa6550,4096)flag{
= 6
--- SIGILL {si_signo=SIGILL, si_code=2, si_addr=0x00010a68} ---
--- SIGILL {si_signo=SIGILL, si_code=2, si_addr=0x0001182c} ---
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
Illegal instruction (core dumped)
|