forked from difcareer/010templates
-
Notifications
You must be signed in to change notification settings - Fork 1
/
ELF.bt
4161 lines (3787 loc) · 158 KB
/
ELF.bt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
//------------------------------------------------
//--- 010 Editor v2.0 Binary Template
//
// File: ELF.bt
// Authors: Anon, Tim "diff" Strazzere, feicong
// Version: 2.7
// Purpose: Decode the ELF format for both 32/64 bit in big/little
// endian, decode the elf, program, and section headers.
// Also decode the dynamic symbol table entries. Many
// fields implement custom viewers but do not handle
// writing from those views.
// Category: Executable
// File Mask: *
// ID Bytes: 7F 45 4C 46
// History:
// 2.7 2018-05-28 feicong: Fix Android object file parse error.
// 2.6 2017-12-04 feicong: Use standard ELF struct names.
// Fix is_32bit_elf checking.
// Add sections more checking.
// Add support for DT_GNU_HASH.
// 2.5.9 2017-11-24 feicong: Add support for 360 jiagu packed so(libjiagu.so version 1.5.3.0/1.5.3.1 tested).
// Add support for ijiami packed so(libexecmain.so version 2017.11.16 tested).
// Add support for bangcle packed so(libSecShell.so version 1.7.1 tested).
// Add support for kiwi packed so(libkwscmm.so libkdp.so version 2.1.2.20170914 tested).
// 2.5.8 2017-11-20 feicong: Add Elf32_Sym & Elf64_Sym checking.
// Add Elf32_Shdr checking.
// Add DT_FLAGS_TYPE enum.
// Update section_dynamic info.
// Update the display order of the sections.
// Update section_symtab name.
// Add support for tencent legu packed so(libshella-2.10.7.1.so/libshella-2.10.1.so tested).
// 2.5.7 2017-11-15 feicong: Add section details for:
// section_ARM_attributes,
// section_comment,
// section_hash,
// section_note_gnu_buildid, section_note_gnu_goldversion
// section_gnu_version, section_gnu_version_d, section_gnu_version_r.
// Update Elf32RelRead(), Elf32RelPtrRead(), Elf32RelArrayRead().
// Update s_type32_e.
// 2.5.6 2017-10-28 feicong: Add support for UPX ver 3.94 compressed ELF file(Only Android ELF/SO tested).
// 2.5.5 2017-04-04 feicong: add string_table parser.
// fix Elf32_Phdr warnning.
// add section name output of section_header_table.
// add relocation table parser for support -fPIE elf & relocatable.
// add .xxx_array parser for x86/x86_64/arm/aarch64.
// add .dynamic section parser.
// add .got section parser.
// update enum type & fix some errors.
// 2.5.4 2016-04-14 T Strazzere: Fix overflowing on bad section offset and sizes
// 2.5.3 2016-03-29 T Strazzere: Merge back into 010Editor "repository" formatting
// 2.5.2 T Strazzere: Some typos and added a out of bounds check
// 2.5 T Strazzere: Added ELF file checking
// Fixed indentations
// Minor error checking issues fixed
// 2.4 T Strazzere: Added a ton more ARM, specific GNU ARM style information
// Fixed lots of whitespacing issues and consistency issues
// 2.3.5 T Strazzere: Simple error checking around program headers,
// skip over invalid ones and keep going
// Simple warning logging (taken from my DEXTemplate.bt)
// Lots of comments for template variables to help understand
// wtf is going on, most taken from;
// - http://www.ouah.org/RevEng/x430.htm
// - http://www.uclibc.org/docs/elf-64-gen.pdf
// 2.3 2016-02-11 SweetScape Software: Updated header for repository submission.
// 2.2 T Strazzere: Fixed issues if the section header count is greater
// the actual number of sections that exist.
// More information; http://dustri.org/b/?p=832
// 2.1 T Strazzere: Fixed issue with local variables so it's actually
// runnable inside v4.0.3
// 1.0 Anon: Initial release.
//------------------------------------------------
// Define structures used in ELF files
// ELF Header Types
// ELF identification element
local int warnings = 0;
local string temp_warning;
local int is_32bit_elf = 1;
// A hack to get warning messages to both "Warn" (show in status) and output to the "output" window
void PrintWarning(string message) {
Warning(temp_warning);
// Ensure new-line, "Warning" statuses should not have them
SPrintf(temp_warning, "%s\n", message);
Printf(temp_warning);
// Hack to trigger a more generic "look at warnings in output"
warnings++;
}
void PrintWarning2(string fmt, uint64 message) {
Warning(temp_warning);
SPrintf(temp_warning, fmt, message);
Printf(temp_warning);
// Hack to trigger a more generic "look at warnings in output"
warnings++;
}
// Accelerate a slow lookup with an array
local int sec_tbl_elem[255];
typedef enum <uchar> {
ELFCLASSNONE = 0x0,
ELFCLASS32 = 0x1,
ELFCLASS64 = 0x2,
ELFCLASSNUM = 0x3
} ei_class_2_e;
typedef enum <uchar> {
ELFDATANONE = 0x0,
ELFDATA2LSB = 0x1,
ELFDATA2MSB = 0x2,
ELFDATANUM = 0x3
} ei_data_e;
typedef enum <uchar> {
E_NONE = 0x0,
E_CURRENT = 0x1,
E_NUM = 0x2
} ei_version_e;
typedef enum <uchar> {
ELFOSABI_NONE = 0x0, //No extensions or unspecified
ELFOSABI_HPUX = 0x1, //Hewlett-Packard HP-UX
ELFOSABI_NETBSD = 0x2, //NetBSD
ELFOSABI_LINUX = 0x3, //Linux
ELFOSABI_SOLARIS = 0x6, //Sun Solaris
ELFOSABI_AIX = 0x7, //AIX
ELFOSABI_IRIX = 0x8, //IRIX
ELFOSABI_FREEBSD = 0x9, //FreeBSD
ELFOSABI_TRU64 = 0xA, //Compaq TRU64 UNIX
ELFOSABI_MODESTO = 0xB, //Novell Modesto
ELFOSABI_OPENBSD = 0xC, //Open BSD
ELFOSABI_OPENVMS = 0xD, //Open VMS
ELFOSABI_NSK = 0xE, //Hewlett-Packard Non-Stop Kernel
ELFOSABI_AROS = 0xF, //Amiga Research OS
ELFOSABI_FENIXOS = 0x10, // FenixOS
ELFOSABI_ARM_AEABI = 0x40, //ARM EABI
ELFOSABI_ARM = 0x61, //ARM
ELFOSABI_STANDALONE = 0xFF //Standalone (embedded applications)
} ei_osabi_e;
typedef struct {
char file_identification[4];
if (Strcmp(file_identification, "\x7FELF")) {
PrintWarning("Invalid ELF file");
return -1;
}
ei_class_2_e ei_class_2;
ei_data_e ei_data;
if (ei_data == ELFDATA2LSB) {
LittleEndian();
} else {
BigEndian();
}
ei_version_e ei_version;
ei_osabi_e ei_osabi;
uchar ei_abiversion;
uchar ei_pad[6];
uchar ei_nident_SIZE;
} e_ident_t;
// Elf Data Types for 32/64 bit
//32 bit
typedef uint32 Elf32_Word;
typedef uint32 Elf32_Off;
typedef uint32 Elf32_Addr <read=VAddr32>;
typedef uint16 Elf32_Half;
typedef uint32 Elf32_Xword;
typedef int32 Elf32_Sword;
typedef int64 Elf32_Sxword;
//64 bit
typedef uint32 Elf64_Word;
typedef uint64 Elf64_Off;
typedef uint64 Elf64_Addr <read=VAddr64>;
typedef uint16 Elf64_Half;
typedef uint64 Elf64_Xword;
typedef int32 Elf64_Sword;
typedef int64 Elf64_Sxword;
string VAddr32(Elf32_Addr &addr) {
local char buf[128];
SPrintf(buf, "0x%08X", addr);
return buf;
}
string VAddr64(Elf64_Addr &addr) {
local char buf[128];
SPrintf(buf, "0x%016X", addr); // TODO: Wtf? LX should work fine here?
return buf;
}
typedef enum <Elf32_Half> {
ET_NONE = 0x0,
ET_REL = 0x1,
ET_EXEC = 0x2,
ET_DYN = 0x3,
ET_CORE = 0x4,
ET_LOOS = 0xfe00,
ET_HIOS = 0xfeff,
ET_LOPROC = 0xff00,
ET_HIPROC = 0xffff
} e_type32_e;
typedef e_type32_e e_type64_e;
typedef enum <Elf32_Half> { // list has to to be completed
EM_NONE = 0, //No machine
EM_M32 = 1, //AT&T WE 32100
EM_SPARC = 2, //SPARC
EM_386 = 3, //Intel 80386
EM_68K = 4, //Motorola 68000
EM_88K = 5, //Motorola 88000
reserved6 = 6, //Reserved for future use (was EM_486)
EM_860 = 7, //Intel 80860
EM_MIPS = 8, //MIPS I Architecture
EM_S370 = 9, //IBM System/370 Processor
EM_MIPS_RS3_LE = 10, //MIPS RS3000 Little-endian
reserved11 = 11, //Reserved for future use
reserved12 = 12, //Reserved for future use
reserved13 = 13, //Reserved for future use
reserved14 = 14, //Reserved for future use
EM_PARISC = 15, //Hewlett-Packard PA-RISC
reserved16 = 16, //Reserved for future use
EM_VPP500 = 17, //Fujitsu VPP500
EM_SPARC32PLUS = 18, //Enhanced instruction set SPARC
EM_960 = 19, //Intel 80960
EM_PPC = 20, //PowerPC
EM_PPC64 = 21, //64-bit PowerPC
EM_S390 = 22, //IBM System/390 Processor
reserved23 = 23, //Reserved for future use
reserved24 = 24, //Reserved for future use
reserved25 = 25, //Reserved for future use
reserved26 = 26, //Reserved for future use
reserved27 = 27, //Reserved for future use
reserved28 = 28, //Reserved for future use
reserved29 = 29, //Reserved for future use
reserved30 = 30, //Reserved for future use
reserved31 = 31, //Reserved for future use
reserved32 = 32, //Reserved for future use
reserved33 = 33, //Reserved for future use
reserved34 = 34, //Reserved for future use
reserved35 = 35, //Reserved for future use
EM_V800 = 36, //NEC V800
EM_FR20 = 37, //Fujitsu FR20
EM_RH32 = 38, //TRW RH-32
EM_RCE = 39, //Motorola RCE
EM_ARM = 40, //Advanced RISC Machines ARM
EM_ALPHA = 41, //Digital Alpha
EM_SH = 42, //Hitachi SH
EM_SPARCV9 = 43, //SPARC Version 9
EM_TRICORE = 44, //Siemens TriCore embedded processor
EM_ARC = 45, //Argonaut RISC Core, Argonaut Technologies Inc.
EM_H8_300 = 46, //Hitachi H8/300
EM_H8_300H = 47, //Hitachi H8/300H
EM_H8S = 48, //Hitachi H8S
EM_H8_500 = 49, //Hitachi H8/500
EM_IA_64 = 50, //Intel IA-64 processor architecture
EM_MIPS_X = 51, //Stanford MIPS-X
EM_COLDFIRE = 52, //Motorola ColdFire
EM_68HC12 = 53, //Motorola M68HC12
EM_MMA = 54, //Fujitsu MMA Multimedia Accelerator
EM_PCP = 55, //Siemens PCP
EM_NCPU = 56, //Sony nCPU embedded RISC processor
EM_NDR1 = 57, //Denso NDR1 microprocessor
EM_STARCORE = 58, //Motorola Star*Core processor
EM_ME16 = 59, //Toyota ME16 processor
EM_ST100 = 60, //STMicroelectronics ST100 processor
EM_TINYJ = 61, //Advanced Logic Corp. TinyJ embedded processor family
EM_X86_64 = 62, //AMD x86-64 architecture
EM_PDSP = 63, //Sony DSP Processor
EM_PDP10 = 64, //Digital Equipment Corp. PDP-10
EM_PDP11 = 65, //Digital Equipment Corp. PDP-11
EM_FX66 = 66, //Siemens FX66 microcontroller
EM_ST9PLUS = 67, //STMicroelectronics ST9+ 8/16 bit microcontroller
EM_ST7 = 68, //STMicroelectronics ST7 8-bit microcontroller
EM_68HC16 = 69, //Motorola MC68HC16 Microcontroller
EM_68HC11 = 70, //Motorola MC68HC11 Microcontroller
EM_68HC08 = 71, //Motorola MC68HC08 Microcontroller
EM_68HC05 = 72, //Motorola MC68HC05 Microcontroller
EM_SVX = 73, //Silicon Graphics SVx
EM_ST19 = 75, //Digital VAX
EM_CRIS = 76, //Axis Communications 32-bit embedded processor
EM_JAVELIN = 77, //Infineon Technologies 32-bit embedded processor
EM_FIREPATH = 78, //Element 14 64-bit DSP Processor
EM_ZSP = 79, //LSI Logic 16-bit DSP Processor
EM_MMIX = 80, //Donald Knuth's educational 64-bit processor
EM_HUANY = 81, //Harvard University machine-independent object files
EM_PRISM = 82, //SiTera Prism
EM_AVR = 83, //Atmel AVR 8-bit microcontroller
EM_FR30 = 84, //Fujitsu FR30
EM_D10V = 85, //Mitsubishi D10V
EM_D30V = 86, //Mitsubishi D30V
EM_V850 = 87, //NEC v850
EM_M32R = 88, //Mitsubishi M32R
EM_MN10300 = 89, //Matsushita MN10300
EM_MN10200 = 90, //Matsushita MN10200
EM_PJ = 91, //picoJava
EM_OPENRISC = 92, //OpenRISC 32-bit embedded processor
EM_ARC_A5 = 93, //ARC Cores Tangent-A5
EM_XTENSA = 94, //Tensilica Xtensa Architecture
EM_VIDEOCORE = 95, //Alphamosaic VideoCore processor
EM_TMM_GPP = 96, //Thompson Multimedia General Purpose Processor
EM_NS32K = 97, //National Semiconductor 32000 series
EM_TPC = 98, //Tenor Network TPC processor
EM_SNP1K = 99, //Trebia SNP 1000 processor
EM_ST200 = 100, //STMicroelectronics (www.st.com) ST200 microcontroller
EM_IP2K = 101, //Ubicom IP2xxx microcontroller family
EM_MAX = 102, //MAX Processor
EM_CR = 103, //National Semiconductor CompactRISC microprocessor
EM_F2MC16 = 104, //Fujitsu F2MC16
EM_MSP430 = 105, //Texas Instruments embedded microcontroller msp430
EM_BLACKFIN = 106, //Analog Devices Blackfin (DSP) processor
EM_SE_C33 = 107, //S1C33 Family of Seiko Epson processors
EM_SEP = 108, //Sharp embedded microprocessor
EM_ARCA = 109, //Arca RISC Microprocessor
EM_UNICORE = 110, //Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University
EM_EXCESS = 111, // eXcess: 16/32/64-bit configurable embedded CPU
EM_DXP = 112, // Icera Semiconductor Inc. Deep Execution Processor
EM_ALTERA_NIOS2 = 113, // Altera Nios II soft-core processor
EM_CRX = 114, // National Semiconductor CompactRISC CRX
EM_XGATE = 115, // Motorola XGATE embedded processor
EM_C166 = 116, // Infineon C16x/XC16x processor
EM_M16C = 117, // Renesas M16C series microprocessors
EM_DSPIC30F = 118, // Microchip Technology dsPIC30F Digital Signal
// Controller
EM_CE = 119, // Freescale Communication Engine RISC core
EM_M32C = 120, // Renesas M32C series microprocessors
EM_TSK3000 = 131, // Altium TSK3000 core
EM_RS08 = 132, // Freescale RS08 embedded processor
EM_SHARC = 133, // Analog Devices SHARC family of 32-bit DSP
// processors
EM_ECOG2 = 134, // Cyan Technology eCOG2 microprocessor
EM_SCORE7 = 135, // Sunplus S+core7 RISC processor
EM_DSP24 = 136, // New Japan Radio (NJR) 24-bit DSP Processor
EM_VIDEOCORE3 = 137, // Broadcom VideoCore III processor
EM_LATTICEMICO32 = 138, // RISC processor for Lattice FPGA architecture
EM_SE_C17 = 139, // Seiko Epson C17 family
EM_TI_C6000 = 140, // The Texas Instruments TMS320C6000 DSP family
EM_TI_C2000 = 141, // The Texas Instruments TMS320C2000 DSP family
EM_TI_C5500 = 142, // The Texas Instruments TMS320C55x DSP family
EM_MMDSP_PLUS = 160, // STMicroelectronics 64bit VLIW Data Signal Processor
EM_CYPRESS_M8C = 161, // Cypress M8C microprocessor
EM_R32C = 162, // Renesas R32C series microprocessors
EM_TRIMEDIA = 163, // NXP Semiconductors TriMedia architecture family
EM_HEXAGON = 164, // Qualcomm Hexagon processor
EM_8051 = 165, // Intel 8051 and variants
EM_STXP7X = 166, // STMicroelectronics STxP7x family of configurable
// and extensible RISC processors
EM_NDS32 = 167, // Andes Technology compact code size embedded RISC
// processor family
EM_ECOG1 = 168, // Cyan Technology eCOG1X family
EM_ECOG1X = 168, // Cyan Technology eCOG1X family
EM_MAXQ30 = 169, // Dallas Semiconductor MAXQ30 Core Micro-controllers
EM_XIMO16 = 170, // New Japan Radio (NJR) 16-bit DSP Processor
EM_MANIK = 171, // M2000 Reconfigurable RISC Microprocessor
EM_CRAYNV2 = 172, // Cray Inc. NV2 vector architecture
EM_RX = 173, // Renesas RX family
EM_METAG = 174, // Imagination Technologies META processor
// architecture
EM_MCST_ELBRUS = 175, // MCST Elbrus general purpose hardware architecture
EM_ECOG16 = 176, // Cyan Technology eCOG16 family
EM_CR16 = 177, // National Semiconductor CompactRISC CR16 16-bit
// microprocessor
EM_ETPU = 178, // Freescale Extended Time Processing Unit
EM_SLE9X = 179, // Infineon Technologies SLE9X core
EM_L10M = 180, // Intel L10M
EM_K10M = 181, // Intel K10M
EM_AARCH64 = 183, // ARM AArch64
EM_AVR32 = 185, // Atmel Corporation 32-bit microprocessor family
EM_STM8 = 186, // STMicroeletronics STM8 8-bit microcontroller
EM_TILE64 = 187, // Tilera TILE64 multicore architecture family
EM_TILEPRO = 188, // Tilera TILEPro multicore architecture family
EM_CUDA = 190, // NVIDIA CUDA architecture
EM_TILEGX = 191, // Tilera TILE-Gx multicore architecture family
EM_CLOUDSHIELD = 192, // CloudShield architecture family
EM_COREA_1ST = 193, // KIPO-KAIST Core-A 1st generation processor family
EM_COREA_2ND = 194, // KIPO-KAIST Core-A 2nd generation processor family
EM_ARC_COMPACT2 = 195, // Synopsys ARCompact V2
EM_OPEN8 = 196, // Open8 8-bit RISC soft processor core
EM_RL78 = 197, // Renesas RL78 family
EM_VIDEOCORE5 = 198, // Broadcom VideoCore V processor
EM_78KOR = 199, // Renesas 78KOR family
EM_56800EX = 200 // Freescale 56800EX Digital Signal Controller (DSC)
} e_machine32_e;
typedef e_machine32_e e_machine64_e;
typedef enum <Elf32_Word> {
EV_NONE = 0x0,
EV_CURRENT = 0x1
} e_version32_e;
typedef e_version32_e e_version64_e;
// Program Header Types
typedef enum <Elf32_Word> {
PT_NULL = 0x0,
PT_LOAD = 0x1,
PT_DYNAMIC = 0x2,
PT_INERP = 0x3,
PT_NOTE = 0x4,
PT_SHLIB = 0x5,
PT_PHDR = 0x6,
PT_TLS = 0x7,
PT_NUM = 0x8,
PT_LOOS = 0x60000000,
PT_GNU_EH_FRAME = 0x6474e550,
PT_GNU_STACK = 0x6474e551,
PT_GNU_RELRO = 0x6474e552,
PT_LOSUNW = 0x6ffffffa,
PT_SUNWBSS = 0x6ffffffa,
PT_SUNWSTACK = 0x6ffffffb,
PT_HISUNW = 0x6fffffff,
PT_HIOS = 0x6fffffff,
PT_LOPROC = 0x70000000,
PT_HIPROC = 0x7fffffff,
// ARM Sections
PT_SHT_ARM_EXIDX = 0x70000001,
PT_SHT_ARM_PREEMPTMAP = 0x70000002,
PT_SHT_ARM_ATTRIBUTES = 0x70000003,
PT_SHT_ARM_DEBUGOVERLAY = 0x70000004,
PT_SHT_ARM_OVERLAYSECTION = 0x70000005
} p_type32_e;
typedef p_type32_e p_type64_e;
typedef enum <Elf32_Word> {
PF_None = 0x0,
PF_Exec = 0x1,
PF_Write = 0x2,
PF_Write_Exec = 0x3,
PF_Read = 0x4,
PF_Read_Exec = 0x5,
PF_Read_Write = 0x6,
PF_Read_Write_Exec = 0x7
} p_flags32_e;
typedef p_flags32_e p_flags64_e;
typedef enum <Elf32_Word> {
SHN_UNDEF = 0x0, /* undefined, e.g. undefined symbol */
SHN_LORESERVE = 0xff00, /* Lower bound of reserved indices */
SHN_LOPROC = 0xff00, /* Lower bound processor-specific index */
SHN_BEFORE = 0xff00, /* Order section before all others (Solaris) */
SHN_AFTER = 0xff01, /* Order section after all others (Solaris) */
SHN_HIPROC = 0xff1f, /* Upper bound processor-specific index */
SHN_LOOS = 0xff20, /* Lower bound OS-specific index */
SHN_HIOS = 0xff3f, /* Upper bound OS-specific index */
SHN_ABS = 0xfff1, /* Absolute value, not relocated */
SHN_COMMON = 0xfff2, /* FORTRAN common or unallocated C */
SHN_XINDEX = 0xffff, /* Index is in extra table */
SHN_HIRESERVE = 0xffff /* Upper bound of reserved indices */
} s_name32_e;
typedef s_name32_e s_name64_e;
typedef enum <Elf32_Word> {
SHT_NULL = 0x0, /* Inactive section header */
SHT_PROGBITS = 0x1, /* Information defined by the program */
SHT_SYMTAB = 0x2, /* Symbol table - not DLL */
SHT_STRTAB = 0x3, /* String table */
SHT_RELA = 0x4, /* Explicit addend relocations, Elf64_Rela */
SHT_HASH = 0x5, /* Symbol hash table */
SHT_DYNAMIC = 0x6, /* Information for dynamic linking */
SHT_NOTE = 0x7, /* A Note section */
SHT_NOBITS = 0x8, /* Like SHT_PROGBITS with no data */
SHT_REL = 0x9, /* Implicit addend relocations, Elf64_Rel */
SHT_SHLIB = 0xA, /* Currently unspecified semantics */
SHT_DYNSYM = 0xB, /* Symbol table for a DLL */
SHT_INIT_ARRAY = 0xE, /* Array of constructors */
SHT_FINI_ARRAY = 0xF, /* Array of deconstructors */
SHT_PREINIT_ARRAY = 0x10, /* Array of pre-constructors */
SHT_GROUP = 0x11, /* Section group */
SHT_SYMTAB_SHNDX = 0x12, /* Extended section indeces */
SHT_NUM = 0x13, /* Number of defined types */
SHT_LOOS = 0x60000000, /* Lowest OS-specific section type */
SHT_GNU_ATTRIBUTES = 0x6ffffff5, /* Object attribuytes */
SHT_GNU_HASH = 0x6ffffff6, /* GNU-style hash table */
SHT_GNU_LIBLIST = 0x6ffffff7, /* Prelink library list */
SHT_CHECKSUM = 0x6ffffff8, /* Checksum for DSO content */
SHT_LOSUNW = 0x6ffffffa, /* Sun-specific low bound */
SHT_SUNW_move = 0x6ffffffa, // Same thing
SHT_SUNW_COMDAT = 0x6ffffffb,
SHT_SUNW_syminfo = 0x6ffffffc,
SHT_GNU_verdef = 0x6ffffffd, /* Version definition section */
SHT_GNU_verdneed = 0x6ffffffe, /* Version needs section */
SHT_GNY_versym = 0x6fffffff, /* Version symbol table */
SHT_HISUNW = 0x6fffffff, /* Sun-specific high bound */
SHT_HIOS = 0x6fffffff, /* Highest OS-specific section type */
SHT_LOPROC = 0x70000000, /* Start of processor-specific section type */
SHT_ARM_EXIDX = 0x70000001, /* Section holds ARM unwind info. */
SHT_ARM_PREEMPTMAP = 0x70000002, /* Section pre-emption details. */
SHT_ARM_ATTRIBUTES = 0x70000003, /* Section holds attributes. */
SHT_ARM_DEBUGOVERLAY = 0x70000004, /* Section holds overlay debug info. */
SHT_ARM_OVERLAYSECTION = 0x70000005, /* Section holds GDB and overlay integration info. */
SHT_HIPROC = 0x7fffffff, /* End of processor-specific section type */
SHT_LOUSER = 0x80000000, /* Start of application-specific */
SHT_HIUSER = 0x8fffffff /* Ennd of application-specific */
//SHT_HIUSER = 0xffffffff // Highest type reserved for applications.
} s_type32_e;
typedef s_type32_e s_type64_e;
typedef struct elf32_note {
Elf32_Word n_namesz;
Elf32_Word n_descsz;
Elf32_Word n_type;
} Elf32_Nhdr;
typedef struct elf64_note {
Elf64_Word n_namesz;
Elf64_Word n_descsz;
Elf64_Word n_type;
} Elf64_Nhdr;
// TODO : Add new sections
string ReservedSectionName(s_name32_e id) {
local char buf[255];
switch(id) {
case SHN_UNDEF:
return "SHN_UNDEF";
case SHN_ABS:
return "SHN_ABS";
case SHN_COMMON:
return "SHN_COMMON";
}
if (id >= SHN_LOPROC && id <= SHN_HIPROC) {
SPrintf(buf, "SHN_PROC_%02X", id - SHN_LOPROC);
return buf;
}
if (id >= SHN_LOOS && id <= SHN_HIOS) {
SPrintf(buf, "SHN_OS_%02X", id - SHN_LOOS);
return buf;
}
SPrintf(buf, "SHN_RESERVE_%02X", id - SHN_LORESERVE);
return buf;
}
// Program Table 32/64 bit
typedef struct { //32bit
local int64 off = FTell();
p_type32_e p_type <comment="Segment type">;
if (ReadUInt(FTell()) > FileSize()) {
PrintWarning("Program section offset starts after the end of the file!");
SetBackColor(cLtRed);
}
Elf32_Off p_offset <format=hex, comment="Segment file offset">;
// Ensure we reset color to not bleed
SetBackColor(cWhite);
Elf32_Addr p_vaddr <comment="Segment virtual address">;
Elf32_Addr p_paddr <comment="Segment physical address">;
if (ReadUInt(FTell()) + p_offset > FileSize()) {
PrintWarning("Program section data seems to be larger than file size");
SetBackColor(cLtRed);
}
Elf32_Word p_filesz <comment="Segment size in file">;
// Ensure we reset color to not bleed
SetBackColor(cWhite);
Elf32_Word p_memsz <comment="Segment size in memory">;
p_flags32_e p_flags <comment="Segment flags">;
Elf32_Word p_align <comment="Segment alignment">;
// Ensure we're not trying to map ourside of the file (prevent error)
if (p_filesz > 0 && p_filesz < FileSize() &&
p_offset > 0 && p_offset + p_filesz < FileSize()) {
FSeek(p_offset);
char p_data[p_filesz] <comment="Segment data">;
} else {
if ((p_filesz == 0) && (p_offset == 0)) {
// empty segment, maybe PT_GNU_STACK
} else if ((p_vaddr == 0) || (p_paddr == 0)) {
// first PT_LOAD segment.
} else if ((p_filesz == 0) && (p_memsz == 0)) {
PrintWarning("compressed segment, maybe compressed by UPX.!");
} else {
PrintWarning("Segment data appears to either overlap with header, exist after the end of the file or overlap with the end of the file!");
Printf("p_filesz:%ld, FileSize():%ld, p_offset:%ld\n", p_filesz, FileSize(), p_offset);
}
}
FSeek(off + file.elf_header.e_phentsize);
} Elf32_Phdr <read=ProgramInfo32, optimize=false>;
typedef struct { //64bit
local int64 off = FTell();
p_type64_e p_type <comment="Segment type">;
p_flags64_e p_flags <comment="Segment attributes">;
Elf64_Off p_offset <format=hex, comment="Segment offset in file">;
Elf64_Addr p_vaddr <comment="Segment virtual address">;
Elf64_Addr p_paddr <comment="Reserved (Segment physical address?)">;
Elf64_Xword p_filesz <comment="Segment size in file">;
Elf64_Xword p_memsz <comment="Segment size in ram">;
Elf64_Xword p_align <comment="Segment alignment">;
if (p_filesz > 0 && p_filesz < (uint64) FileSize() &&
p_offset > 0 && p_offset + p_filesz < (uint64) FileSize()) {
FSeek(p_offset);
char p_data[p_filesz] <comment="Segment data">;
} // skip first PT_LOAD Elf64_Phdr.
FSeek(off + file.elf_header.e_phentsize);
} Elf64_Phdr <read=ProgramInfo64,optimize=false>;
string ProgramType( p_type64_e type ) {
switch(type) {
case PT_NULL:
return "NULL";
case PT_LOAD:
return "Loadable Segment";
case PT_DYNAMIC:
return "Dynamic Segment";
case PT_INERP:
return "Interpreter Path";
case PT_NOTE:
return "Note";
case PT_SHLIB:
return "PT_SHLIB";
case PT_PHDR:
return "Program Header";
case PT_TLS:
return "Thread-local Storage";
case PT_NUM:
return "Number of defined sections";
case PT_LOOS:
return "OS-specific start";
case PT_GNU_EH_FRAME:
return "GCC .eh_frame_hdr Segment";
case PT_GNU_STACK:
return "GNU Stack (executability)";
case PT_GNU_RELRO:
return "GNU Read-only After Relocation";
case PT_SHT_ARM_EXIDX:
return "Exception Index table";
case PT_SHT_ARM_PREEMPTMAP:
return "BPABI DLL dynamic linking pre-emption map";
case PT_SHT_ARM_ATTRIBUTES:
return "Object file compatibility attributes";
case PT_SHT_ARM_DEBUGOVERLAY:
return "Debug Overlay (1)";
case PT_SHT_ARM_OVERLAYSECTION:
return "Debug Overlay (2)";
default:
return "Unknown Section";
}
}
string ProgramFlags(p_flags64_e flags) {
local string rv = "(";
rv += (flags & PF_Read) ? "R" : "_";
rv += (flags & PF_Write) ? "W" : "_";
rv += (flags & PF_Exec) ? "X" : "_";
rv += ")";
return rv;
}
string ProgramInfo64(Elf64_Phdr &ent) {
return ProgramFlags(ent.p_flags) + " " + ProgramType(ent.p_type);
}
string ProgramInfo32(Elf32_Phdr &ent) {
return ProgramFlags(ent.p_flags) + " " + ProgramType(ent.p_type);
}
// ************************************* Section Table ***************************************
typedef enum <Elf32_Xword> {
SF32_None = 0x0,
SF32_Exec = 0x1,
SF32_Alloc = 0x2,
SF32_Alloc_Exec = 0x3,
SF32_Write = 0x4,
SF32_Write_Exec = 0x5,
SF32_Write_Alloc = 0x6,
SF32_Write_Alloc_Exec = 0x7
} s_flags32_e;
typedef enum <Elf64_Xword> {
SF64_None = 0x0,
SF64_Exec = 0x1,
SF64_Alloc = 0x2,
SF64_Alloc_Exec = 0x3,
SF64_Write = 0x4,
SF64_Write_Exec = 0x5,
SF64_Write_Alloc = 0x6,
SF64_Write_Alloc_Exec = 0x7
} s_flags64_e;
typedef enum <Elf32_Xword> {
SHF32_WRITE = 0x1,
SHF32_ALLOC = 0x2,
SHF32_ALLOC_WRITE = 0x3,
SHF32_EXECINSTR = 0x4,
SHF32_EXECINSTR_WRITE = 0x5,
SHF32_EXECINSTR_ALLOC = 0x6,
SHF32_EXECINSTR_ALLOC_WRITE = 0x7,
SHF32_MERGE = 0x10,
SHF32_STRINGS = 0x20,
SHF32_INFO_LINK = 0x40,
SHF32_LINK_ORDER = 0x80,
SHF32_OS_NONCONFORMING = 0x100,
SHF32_GROUP = 0x200,
SHF32_TLS = 0x400,
SHF32_EXCLUDE = 0x80000000
} sh_flags32_e;
typedef enum <Elf64_Xword> {
SHF64_WRITE = 0x1,
SHF64_ALLOC = 0x2,
SHF64_ALLOC_WRITE = 0x3,
SHF64_EXECINSTR = 0x4,
SHF64_EXECINSTR_WRITE = 0x5,
SHF64_EXECINSTR_ALLOC = 0x6,
SHF64_EXECINSTR_ALLOC_WRITE = 0x7,
SHF64_MERGE = 0x10,
SHF64_STRINGS = 0x20,
SHF64_INFO_LINK = 0x40,
SHF64_LINK_ORDER = 0x80,
SHF64_OS_NONCONFORMING = 0x100,
SHF64_GROUP = 0x200,
SHF64_TLS = 0x400,
SHF64_EXCLUDE = 0x80000000
} sh_flags64_e;
// Pointer to where the next name is located
local quad section_name_block_off;
typedef struct {
s_name32_e s_name_off <format=hex>;
local int64 off = FTell();
FSeek(section_name_block_off + s_name_off);
string s_name_str;
FSeek(off);
} s_name32_t <read=SectionName>;
typedef s_name32_t s_name64_t;
string SectionName(s_name32_t §) {
if (sect.s_name_off > SHN_UNDEF && sect.s_name_off < SHN_LORESERVE) {
return sect.s_name_str;
}
return ReservedSectionName(sect.s_name_off);
}
// Section Table 32/64 bit
typedef struct { //64bit
local int64 off = FTell();
s_name64_t sh_name; /* Section name */
s_type64_e sh_type; /* Section type */
sh_flags64_e sh_flags; /* Section attributes */
Elf64_Addr sh_addr; /* Virtual address in memory */
Elf64_Off sh_offset <format=hex>; /* Offset in file */
Elf64_Xword sh_size; /* Size of section */
Elf64_Word sh_link <read=SHLinkRead64, optimize=false>; /* Link to other section */
Elf64_Word sh_info <read=SHInfoRead64, optimize=false>; /* Miscellaneous information */
Elf64_Xword sh_addralign; /* Address alignment boundary */
Elf64_Xword sh_entsize; /* Entry size, if section has table */
if (sh_type != SHT_NOBITS && sh_type != SHT_NULL
&& sh_size > 0 && sh_offset < FileSize() && sh_size <= (FileSize() - sh_offset)) {
FSeek(sh_offset);
char data[sh_size];
}
FSeek(off + file.elf_header.e_shentsize);
} Elf64_Shdr <read=SecTableNameRead, optimize=false>;
string SecTableNameRead(Elf64_Shdr &ref) {
return SectionName(ref.sh_name);
}
typedef struct { //32bit
local int64 off = FTell();
s_name32_t sh_name; /* Section name */
s_type32_e sh_type; /* Section type */
sh_flags32_e sh_flags; /* Section attributes */
Elf32_Addr sh_addr; /* Virtual address in memory */
Elf32_Off sh_offset <format=hex>; /* Offset in file */
Elf32_Xword sh_size; /* Size of section */
Elf32_Word sh_link <read=SHLinkRead32, optimize=false>; /* Link to other section */
Elf32_Word sh_info <read=SHInfoRead32, optimize=false>; /* Miscellaneous information */
Elf32_Xword sh_addralign; /* Address alignment boundary*/
Elf32_Xword sh_entsize; /* Entry size, if section has table */
if (sh_type != SHT_NOBITS && sh_type != SHT_NULL && (sh_size > 0)
&& (sh_offset < FileSize()) && (sh_size <= (FileSize() - sh_offset))) {
FSeek(sh_offset);
char s_data[sh_size];
}
FSeek(off + file.elf_header.e_shentsize);
} Elf32_Shdr <read=SectionName32,optimize=false>;
string SHLinkRead64(Elf64_Word sh_link) {
return SectionName(file.section_header_table.section_table_element[sh_link].sh_name) + " section";
}
string SHInfoRead64(Elf64_Word sh_info) {
if (sh_info >= file.elf_header.e_shnum) {
string tmp;
SPrintf(tmp, "%ld", sh_info);
return tmp;
}
return SectionName(file.section_header_table.section_table_element[sh_info].sh_name) + " section";
}
string SHLinkRead32(Elf32_Word sh_link) {
if (sh_link >= file.elf_header.e_shnum) {
string tmp;
SPrintf(tmp, "%ld", sh_link);
return tmp;
}
return SectionName(file.section_header_table.section_table_element[sh_link].sh_name) + " section";
}
string SHInfoRead32(Elf32_Word sh_info) {
if (sh_info >= file.elf_header.e_shnum) {
string tmp;
SPrintf(tmp, "%ld", sh_info);
return tmp;
}
return SectionName(file.section_header_table.section_table_element[sh_info].sh_name) + " section";
}
string SectionName64(Elf64_Shdr §) {
return SectionName(sect.sh_name);
}
string SectionName32(Elf32_Shdr §) {
return SectionName(sect.sh_name);
}
// ************************************** Symbol Table ***************************************
local quad symbol_name_block_off;
typedef struct {
Elf32_Word st_name <format=hex>; /* Symbol table name offset */
local int64 off = FTell();
FSeek(symbol_name_block_off + st_name);
string sym_name_str;
FSeek(off);
} sym_name32_t <read=SymbolName,optimize=false>;
typedef sym_name32_t sym_name64_t;
string SymbolName(sym_name32_t &sym) {
if (sym.st_name > 0) {
return sym.sym_name_str;
}
return "<Undefined>";
}
typedef enum <unsigned char> {
STB_LOCAL = 0x0,
STB_GLOBAL = 0x1,
STB_WEAK = 0x2,
STB_NUM = 0x3,
STB_LOOS = 0xA,
STB_GNU_UNIQUE = 0xA,
STB_HIOS = 0xC,
STB_LOPROC = 0xD,
STB_HIPROC = 0xE,
STB_UNKNOWN = 0xF
} sym_info_bind_e;
typedef enum <unsigned char> {
STT_NOTYPE = 0x0,
STT_OBJECT = 0x1,
STT_FUNC = 0x2,
STT_SECTION = 0x3,
STT_FILE = 0x4,
STT_COMMON = 0x5,
STT_TLS = 0x6,
STT_NUM = 0x7,
STT_LOOS = 0xA,
STT_GNU_IFUNC = 0xA,
STT_HIOS = 0xC,
STT_LOPROC = 0xD,
STT_HIPROC = 0xF
} sym_info_type_e;
typedef struct {
BitfieldDisablePadding();
if (IsBigEndian()) {
uchar sym_info_bind:4;
uchar sym_info_type:4;
} else {
uchar sym_info_type:4;
uchar sym_info_bind:4;
}
BitfieldEnablePadding();
} sym_info_t <read=SymInfoEnums>;
string SymInfoEnums(sym_info_t &info) {
local sym_info_bind_e x = info.sym_info_bind;
local sym_info_type_e y = info.sym_info_type;
return EnumToString(x) + " | " + EnumToString(y);
}
typedef struct {
Elf64_Word sym_name; /* Symbol name */
unsigned char st_info; /* Type and Binding attributes */
unsigned char st_other; /* Reserved */
Elf64_Half st_shndx; /* Section table index */
Elf64_Addr st_value; /* Symbol value */
Elf64_Xword st_size; /* Size of object (e.g., common) */
} Elf64_Sym_fixed;
typedef struct {
Elf32_Word sym_name; /* Symbol name */
Elf32_Addr st_value; /* Symbol value */
Elf32_Xword st_size; /* Size of object (e.g., common) */
unsigned char st_info; /* Type and Binding attributes */
unsigned char st_other; /* Reserved */
Elf32_Half st_shndx; /* Section table index */
} Elf32_Sym_fixed;
typedef struct {
sym_name64_t sym_name; /* Symbol name */
sym_info_t st_info; /* Type and Binding attributes */
unsigned char st_other; /* Reserved */
Elf64_Half st_shndx; /* Section table index */
Elf64_Addr st_value; /* Symbol value */
Elf64_Xword st_size; /* Size of object (e.g., common) */
if (st_size && (st_value < FileSize()) && SectionHasData(st_shndx)) {
local int64 off = FTell();
FSeek(SectionVAddrOffset(st_shndx, st_value));
if (FTell() + st_size <= FileSize())
char sym_data[st_size];
FSeek(off);
}
} Elf64_Sym <read=SymbolName64,optimize=false>;
typedef struct {
sym_name32_t sym_name; /* Symbol name */
Elf32_Addr st_value; /* Symbol value */
Elf32_Xword st_size; /* Size of object (e.g., common) */
sym_info_t st_info; /* Type and Binding attributes */
unsigned char st_other; /* Reserved */
Elf32_Half st_shndx; /* Section table index */
if (st_size && (st_value < FileSize()) && SectionHasData(st_shndx)) {
local int64 off = FTell();
FSeek(SectionVAddrOffset(st_shndx, st_value));
if (FTell() + st_size <= FileSize())
char sym_data[st_size];
FSeek(off);
}
} Elf32_Sym <read=SymbolName32,optimize=false>;
string SymbolName64(Elf64_Sym &sym) {
return (sym.st_size ? "" : "[U] ") + SymbolName(sym.sym_name);
}
string SymbolName32(Elf32_Sym &sym) {
return (sym.st_size ? "" : "[U] ") + SymbolName(sym.sym_name);
}
// **************************************** ELF File *****************************************
local int iter;
int FindNamedSection(string sect) {
for(iter=0; iter < file.elf_header.e_shnum; iter++) {
if (Strcmp(file.section_header_table.section_table_element[ iter ].sh_name.s_name_str, sect) == 0) {
return iter;
}
}
return -1;
}