Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Duplicate Symbols #4109

Closed
ElykDeer opened this issue Mar 14, 2023 · 4 comments
Closed

Duplicate Symbols #4109

ElykDeer opened this issue Mar 14, 2023 · 4 comments
Assignees
@xusheng6
Labels
Component: Core Issue needs changes to the core Effort: Trivial Issue should take < 1 day File Format: ELF Impact: Low Issue is a papercut or has a good, supported workaround Type: Bug Issue is a non-crashing bug with repro steps
Milestone
3.5 (Coruscant)

Comments

@ElykDeer
Copy link
Member

I'm seeing this mostly on ExternalSymbols. Screenshot below is demonstrating that BNGetSymbolsByRawName seems to be fine, so I believe it's a core symbol table issue (the internal mapping by address).

image
@ElykDeer ElykDeer added Type: Bug Issue is a non-crashing bug with repro steps Component: Core Issue needs changes to the core Impact: Low Issue is a papercut or has a good, supported workaround Effort: Trivial Issue should take < 1 day labels Mar 14, 2023
@ElykDeer ElykDeer added this to the Braize milestone Mar 14, 2023
@ElykDeer
Copy link
Member Author

Example binary:
babys_first.elf.zip

@plafosse plafosse modified the milestones: Braize, Coruscant Mar 29, 2023
@plafosse plafosse mentioned this issue Jun 20, 2023
Closed
@xusheng6
Copy link
Member

xusheng6 commented Aug 2, 2023

Related to mandiant/capa#1504

The underlying reason for the current behavior is actually #4417. For some reason, we defined two ExternalSymbols at 0x4048. So we are seeing two after we build the cache. For the first line, we are only getting one result because trying to retrieve a symbol by name without the symbol cache only returns the first match.

@xusheng6 xusheng6 closed this as completed Aug 2, 2023
@xusheng6
Copy link
Member

xusheng6 commented Aug 2, 2023 •
edited
Loading

The reason that we are defining the same symbols twice is that the symbol is defined in two symbol tables. We just fail to properly detect that the symbol exists and reject the addition of the second one

@xusheng6
Copy link
Member

xusheng6 commented Aug 2, 2023

Fixed in dev 3.5.4418

@negasora negasora mentioned this issue Jan 24, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@xusheng6 xusheng6

Labels
Component: Core Issue needs changes to the core Effort: Trivial Issue should take < 1 day File Format: ELF Impact: Low Issue is a papercut or has a good, supported workaround Type: Bug Issue is a non-crashing bug with repro steps
Projects
None yet
Milestone
3.5 (Coruscant)
Development

No branches or pull requests
3 participants
@ElykDeer @plafosse @xusheng6