Skip to content

Add nologin decompiler regression fixture - #195

Open
zardus wants to merge 1 commit into
masterfrom
feature/syslog-varargs-recovery
Open

Add nologin decompiler regression fixture#195
zardus wants to merge 1 commit into
masterfrom
feature/syslog-varargs-recovery

Conversation

@zardus

@zardus zardus commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Problem

The variadic-callsite regression needs the real main function from the x86-64 nologin program to verify recovery of arguments passed to syslog. The binaries baseline has no suitable fixture.

Root cause

The reproducer lived only in public DecBench. A consumer test cannot fetch that dataset or build a substitute at run time, and a fabricated byte string would not exercise the compiler-produced callsite.

Fix

Add tests/x86_64/decompiler/nologin, stripped with GNU Binutils, plus a README that pins the DecBench and upstream source revisions, both hashes, the transformation, and BSD 2-Clause terms.

Testing

GNU Binutils 2.46 strip --strip-all reproduces the committed fixture byte-for-byte, and the focused consumer regression passes on it. The validation record contains the full consumer and workspace results plus content-identical rebase evidence.

Validation: #195 (comment)

session: sharpen

@zardus

zardus commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Validation record for head 4d0e683dbce78b988ec97dc797bc3432ce1cf91d against baseline 003e82a2bfa641530924055695b36cec8af483ab.

  • Exact PR shape: the own-merge-base/head scan verifies the added compiler-produced fixture and its load-bearing format/address shape: Stripped ELF64 x86-64 executable; recovered main is at 0x401229 and contains the public syslog call path.
  • Provenance/reproduction: GNU Binutils 2.46 strip --strip-all of DecBench O0 shadow nologin was rerun twice in separate fresh directories; both outputs byte-compare with each other and with the committed bytes.
  • Input/native identity: committed SHA-256 e368a4f622a05943dcc1cdb1fb0d7a22e79b894794489b17b547e68230eaa38d; rustylib mapped from the isolated consumer worktrees on both arms, SHA-256 6cc4d9f576ebff26e0d99d3d2a03dd2f351ff4f8db0a3b59904f73df34301c85.
  • Real consumer: Decompiler: Recover syslog variadic arguments angr#6945 at baseline 829ea98f577ac04d9cd3927ddc868713a5b0a1ab and head 7ae7bf06e228c5e925a1e3bba861a407b02a677f loaded the committed fixture and produced the complete output linked in this PR's output record.
  • Repeat/order control: A/B/B/A, ASLR disabled and PYTHONHASHSEED=0; same-arm output is byte-identical and the cross-arm delta is nonempty.
  • Local scope: this recapture validates fixture bytes, fixture shape, and the actual consumer path only. It does not claim a fresh full-workspace gate.
  • Hosted status: fresh hosted dependency validation for this exact binaries head has not been observed in this recapture; it remains pending and no hosted success is claimed here.

Rebased 2026-09-06; this record is re-keyed to the new head. The branch was replayed from 3de2c41a297606c45be7985aa09b3ae615424d61..8be65dcee949927c514e88111e2a8e073b67c9b3 onto binaries master 003e82a2bfa641530924055695b36cec8af483ab, giving 4d0e683dbce78b988ec97dc797bc3432ce1cf91d: git range-diff marks every commit =, the two git diff <merge-base>...<head> outputs hash to the same object, and every path the branch touches has the same blob at the old and the new head, so master left those paths alone. The figures above therefore describe the same bytes on a new base. It moved because a pull request that pins this one is checked out by CI at this branch's tip rather than merged with master, so the consumer was building against a binaries tree missing fixtures that were already on master. angr/binaries runs no pull-request workflow, so there is no run at the new head to cite — check-runs and actions/runs report 0 there, as they do for every pull request in this repository.

@zardus zardus mentioned this pull request Aug 25, 2026
Open
@zardus
zardus force-pushed the feature/syslog-varargs-recovery branch from 3f0142a to 7afaf47 Compare August 28, 2026 13:05
@zardus

zardus commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS

Exact fixture-shape and consumer-output record for #195.

  • Fixture comparison: own merge base a87538bc248531d2a1d22434143e8b9752459bac versus exact head c5cc24bb824bdf5f04a9e1dff0309b5d891040a8. The target path/shape is absent on the merge base and present on the head. Stripped ELF64 x86-64 executable; recovered main is at 0x401229 and contains the public syslog call path.
  • Fixture identity: SHA-256 e368a4f622a05943dcc1cdb1fb0d7a22e79b894794489b17b547e68230eaa38d; source provenance: DecBench revision e5eb576d66ee36793b800a4dd45e291e0add4472, O0/shadow/nologin (source object SHA-256 e5f129967f4cc6980359cee7bf892f104edd183848507f8b30c5d808f7999b40). The complete readelf/objdump scan is retained with the exact script. The recorded recipe (GNU Binutils 2.46 strip --strip-all of DecBench O0 shadow nologin) was rerun twice in fresh directories; both runs are byte-identical to the committed fixture.
  • Actual consumer: Decompiler: Recover syslog variadic arguments angr#6945, exact baseline 829ea98f577ac04d9cd3927ddc868713a5b0a1ab versus exact head 7ae7bf06e228c5e925a1e3bba861a407b02a677f; target main; configuration full / SAILR.
  • Native identity: rustylib mapped from the isolated consumer worktrees on both arms, SHA-256 6cc4d9f576ebff26e0d99d3d2a03dd2f351ff4f8db0a3b59904f73df34301c85.
  • Determinism: fresh A/B/B/A order, ASLR disabled and PYTHONHASHSEED=0; each same-arm pair is byte-identical and every base/head comparison below is nonempty. Absolute checkout prefixes in tracebacks are normalized to <workspace> for publication; raw output is retained unchanged.

Before — main

Exact consumer baseline 
extern char g_40202d;

unsigned int main(void)
{
    char *v6;  // rax
    char *v0;  // [bp-0x38]
    unsigned int v1;  // [bp-0x24]
    char *v2;  // [bp-0x20], Other Possible Types: unsigned long long
    char *v3;  // [bp-0x18], Other Possible Types: unsigned long long
    char *v4;  // [bp-0x10]

    v3 = ttyname(0);
    if (!v3)
        v3 = "UNKNOWN";
    v2 = getlogin();
    if (!v2)
        v2 = "UNKNOWN";
    v4 = getenv("SSH_ORIGINAL_COMMAND");
    v1 = getuid();
    openlog("nologin", 2, 32);
    if (v4)
        v6 = v4;
    else
        v6 = &g_40202d;
    v0 = v6;
    syslog(2, "Attempted login by %s (UID: %d) on %s%s%s");
    closelog();
    printf("%s", "This account is currently not available.\n");
    return 1;
}

After — main

Exact consumer head 
extern char g_40202d;

unsigned int main(void)
{
    char *v5;  // rax
    unsigned int v0;  // [bp-0x24]
    char *v1;  // [bp-0x20]
    char *v2;  // [bp-0x18]
    char *v3;  // [bp-0x10]

    v2 = ttyname(0);
    if (!v2)
        v2 = "UNKNOWN";
    v1 = getlogin();
    if (!v1)
        v1 = "UNKNOWN";
    v3 = getenv("SSH_ORIGINAL_COMMAND");
    v0 = getuid();
    openlog("nologin", 2, 32);
    if (v3)
        v5 = v3;
    else
        v5 = &g_40202d;
    syslog(2, "Attempted login by %s (UID: %d) on %s%s%s", v1, v0, v2, (!v3 ? &g_40202d : " SSH_ORIGINAL_COMMAND="), v5);
    closelog();
    printf("%s", "This account is currently not available.\n");
    return 1;
}

@zardus
zardus force-pushed the feature/syslog-varargs-recovery branch from 7afaf47 to c5cc24b Compare August 28, 2026 16:47
@zardus
zardus force-pushed the feature/syslog-varargs-recovery branch from 8be65dc to 4d0e683 Compare September 6, 2026 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@zardus