From: Adam Bozanich <adam.boz@...>
Date: 2007-05-03T15:30:14+09:00
Subject: ruby packer prototype: core dumps ( design review request )

------=_Part_23176_4242455.1178173811625
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hello All.

I'm developing a ruby-packer type of thing ( i'll give more details below ),
and have run into a problem where I keep getting core dumps.

I guess I'll lay out the problem area first.

I've isolated the coredump issue to this spot:

    rb_funcall( rb_cModule  ,
                rb_intern("require") , 1 , rb_str_new2("mu/loader") );
    VALUE tmp = rb_funcall( config , rb_intern("to_s") , 0 );

If I switch the order of those calls, the process runs fine ( there's other
issues, which I'm trying to debug.  could be related ).

Stepping through the debugger, the crash fails in rb_rescue2() in the
JUMP_TAG() macro when prot_tag is dereferenced ( it is null ).

This is proving to be a nasty bug to pin down, and I'm just wondering if
anybody has any comments/suggestions about the situation.

Let me give you an outline of what I'm trying to do:

We have a protocol fuzzer built with ruby. One of the features of our
product is that we give the user the option to download a single executable
P.O.C. to re-produce a crash.  Since we're using ( and loving ) ruby, we
need a scheme that will allow us to both give the user that single
executable _and_ protect our I.P.  The first iteration of this project is to
simply embed the scripts into the resulting executable, and override
Kernel.require.  We call the various Init_* functions for extensions, and
eval() the strings when they are needed.  Eventually we're gonna try to use
YARV instructions ( we've even looked into adding an opcode representation
other than SimpledataFormat ).

The sample code is below (no errors -- runs fine).  I'm wondering if the
design is just too naive.  Does anybody see any problems with our general
approach?  I'm sorry if this whole post is a bit vague, i just really don't
know where to start with this one.  If there are any requests for more
information, i'd be happy to answer them.

Thanks,
-Adam

#include<ruby.h>

struct test_resource {
    char path[1024];
    char loaded;
    char * src;
} test_resources[] = {

/* ble.rb */
    { "ble" , 0 ,
"require \"foo\"\n"
"puts Foo.new.inspect\n"
} ,

/* foo.rb */
    { "foo" , 0 ,
"require \"bar\"\n"
"class Foo < Bar\n"
"  hidden_method :baz\n"
"end\n"
} ,

/* bar.rb */
    { "bar" , 0 ,
"class Bar\n"
"  def self.hidden_method(*args)\n"
"    args.each do |meth|\n"
"      define_method(meth) do \n"
"        puts meth\n"
"      end\n"
"    end\n"
"  end\n"
"end"
} ,
    { }
};

static VALUE resource_require_path( VALUE str ) {
    char * path ;
    VALUE binding, ret ;
    struct test_resource * res;

    /* Find the source code */
    path    = StringValueCStr(str);
    for( res = &test_resources[0] ; res->path[0] ; res++ )
        if(!strcmp(res->path,path))
            break;
    if(!res->path[0])
        rb_bug("can't find path %s",res->path);
    if( res->loaded ) return Qtrue;

    /* Evaluate the string */
    binding = rb_const_get(rb_mKernel,rb_intern("TOPLEVEL_BINDING"));
    VALUE argv[4] = {
        rb_str_new2( res->src ) ,
        binding ,
        rb_str_new2( res->path ) ,
        INT2FIX(1)
    };

    ret = rb_funcall2( rb_mKernel , rb_intern("eval") , 4 , argv );
    res->loaded = 1;
    return ret;
}

static VALUE hooked_require( VALUE self , VALUE str ) {
    return resource_require_path( str );
}

/* set the require hook */
static void hook_require() {
    rb_define_global_function( "require" , hooked_require , 1 );
}

int main( int argc , char * argv[] ) {
    ruby_init();
    ruby_script("Test");
    ruby_init_loadpath();
    hook_require();
    resource_require_path( rb_str_new2("ble") );
    return 0;
}

------=_Part_23176_4242455.1178173811625
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hello All.<br><br>I&#39;m developing a ruby-packer type of thing ( i&#39;ll give more details below ), and have run into a problem where I keep getting core dumps.&nbsp; <br><br>I guess I&#39;ll lay out the problem area first.<br>
<br>I&#39;ve isolated the coredump issue to this spot:<br><br>&nbsp;&nbsp;&nbsp; rb_funcall( rb_cModule&nbsp; ,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rb_intern(&quot;require&quot;) , 1 , rb_str_new2(&quot;mu/loader&quot;) );<br>&nbsp;&nbsp;&nbsp; VALUE tmp = rb_funcall( config , rb_intern(&quot;to_s&quot;) , 0 );
<br><br>If I switch the order of those calls, the process runs fine ( there&#39;s other issues, which I&#39;m trying to debug.&nbsp; could be related ).<br><br>Stepping through the debugger, the crash fails in rb_rescue2() in the JUMP_TAG() macro when prot_tag is dereferenced ( it is null ).
<br><br>This is proving to be a nasty bug to pin down, and I&#39;m just wondering if anybody has any comments/suggestions about the situation.<br><br>Let me give you an outline of what I&#39;m trying to do:<br><br>We have a protocol fuzzer built with ruby. One of the features of our product is that we give the user the option to download a single executable 
P.O.C. to re-produce a crash.&nbsp; Since we&#39;re using ( and loving ) ruby, we need a scheme that will allow us to both give the user that single executable _and_ protect our I.P.&nbsp; The first iteration of this project is to simply embed the scripts into the resulting executable, and override 
Kernel.require.&nbsp; We call the various Init_* functions for extensions, and eval() the strings when they are needed.&nbsp; Eventually we&#39;re gonna try to use YARV instructions ( we&#39;ve even looked into adding an opcode representation other than SimpledataFormat ).
<br><br>The sample code is below (no errors -- runs fine).&nbsp; I&#39;m wondering if the design is just too naive.&nbsp; Does anybody see any problems with our general approach?&nbsp; I&#39;m sorry if this whole post is a bit vague, i just really don&#39;t know where to start with this one.&nbsp; If there are any requests for more information, i&#39;d be happy to answer them.
<br><br>Thanks,<br>-Adam<br><br>#include&lt;ruby.h&gt;<br><br>struct test_resource {<br>&nbsp;&nbsp;&nbsp; char path[1024];<br>&nbsp;&nbsp;&nbsp; char loaded;<br>&nbsp;&nbsp;&nbsp; char * src;<br>} test_resources[] = {<br><br>/* ble.rb */<br>&nbsp;&nbsp;&nbsp; { &quot;ble&quot; , 0 , 
<br>&quot;require \&quot;foo\&quot;\n&quot;<br>&quot;puts Foo.new.inspect\n&quot;<br>} , <br><br>/* foo.rb */<br>&nbsp;&nbsp;&nbsp; { &quot;foo&quot; , 0 , <br>&quot;require \&quot;bar\&quot;\n&quot;<br>&quot;class Foo &lt; Bar\n&quot;<br>
&quot;&nbsp; hidden_method :baz\n&quot;<br>&quot;end\n&quot;<br>} , <br><br>/* bar.rb */<br>&nbsp;&nbsp;&nbsp; { &quot;bar&quot; , 0 , <br>&quot;class Bar\n&quot;<br>&quot;&nbsp; def self.hidden_method(*args)\n&quot;<br>&quot;&nbsp;&nbsp;&nbsp; args.each do |meth|\n&quot;
<br>&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; define_method(meth) do \n&quot;<br>&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; puts meth\n&quot;<br>&quot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; end\n&quot;<br>&quot;&nbsp;&nbsp;&nbsp; end\n&quot;<br>&quot;&nbsp; end\n&quot;<br>&quot;end&quot;<br>} , <br>&nbsp;&nbsp;&nbsp; { }<br>};<br><br>static VALUE resource_require_path( VALUE str ) {
<br>&nbsp;&nbsp;&nbsp; char * path ;<br>&nbsp;&nbsp;&nbsp; VALUE binding, ret ;<br>&nbsp;&nbsp;&nbsp; struct test_resource * res;<br><br>&nbsp;&nbsp;&nbsp; /* Find the source code */<br>&nbsp;&nbsp;&nbsp; path&nbsp;&nbsp;&nbsp; = StringValueCStr(str);<br>&nbsp;&nbsp;&nbsp; for( res = &amp;test_resources[0] ; res-&gt;path[0] ; res++ ) 
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if(!strcmp(res-&gt;path,path))<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; break;<br>&nbsp;&nbsp;&nbsp; if(!res-&gt;path[0])<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rb_bug(&quot;can&#39;t find path %s&quot;,res-&gt;path);<br>&nbsp;&nbsp;&nbsp; if( res-&gt;loaded ) return Qtrue;<br><br>&nbsp;&nbsp;&nbsp; /* Evaluate the string */
<br>&nbsp;&nbsp;&nbsp; binding = rb_const_get(rb_mKernel,rb_intern(&quot;TOPLEVEL_BINDING&quot;));<br>&nbsp;&nbsp;&nbsp; VALUE argv[4] = { <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rb_str_new2( res-&gt;src ) , <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; binding , <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; rb_str_new2( res-&gt;path ) , <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; INT2FIX(1) 
<br>&nbsp;&nbsp;&nbsp; };<br><br>&nbsp;&nbsp;&nbsp; ret = rb_funcall2( rb_mKernel , rb_intern(&quot;eval&quot;) , 4 , argv );<br>&nbsp;&nbsp;&nbsp; res-&gt;loaded = 1;<br>&nbsp;&nbsp;&nbsp; return ret;<br>}<br><br>static VALUE hooked_require( VALUE self , VALUE str ) {<br>&nbsp;&nbsp;&nbsp; return resource_require_path( str );
<br>}<br><br>/* set the require hook */<br>static void hook_require() { <br>&nbsp;&nbsp;&nbsp; rb_define_global_function( &quot;require&quot; , hooked_require , 1 );<br>}<br><br>int main( int argc , char * argv[] ) {<br>&nbsp;&nbsp;&nbsp; ruby_init();
<br>&nbsp;&nbsp;&nbsp; ruby_script(&quot;Test&quot;);<br>&nbsp;&nbsp;&nbsp; ruby_init_loadpath();<br>&nbsp;&nbsp;&nbsp; hook_require();<br>&nbsp;&nbsp;&nbsp; resource_require_path( rb_str_new2(&quot;ble&quot;) );<br>&nbsp;&nbsp;&nbsp; return 0;<br>}<br>

------=_Part_23176_4242455.1178173811625--