Better Support for Relocatable ELF Files

Looking at how the Boomerang ELF loader handles symbols and relocations, I noticed that something was clearly wrong for relocatable files (i.e., .o files). The loader was assuming that the VirtualAddress members of the section table were set as they are in executable images. This is not the case. It is the duty of the loader to choose an arbitary starting address and to load each section at appropriate offsets from that address. I decided that choosing the same default address that IDA Pro uses was probably a good idea. I often switch between Boomerang and IDA Pro to gather information, especially information that Boomerang has gotten wrong. I also decided to delay loading any section that starts with ".rel." until all the other sections are loaded because IDA Pro does so. I don't know why it does it, but I want my addresses to match up with those in IDA Pro, so I have to follow their lead.

After fixing this, I noticed that all the symbols and relocations now point to addresses that are not in any section. That is, all the symbols that point to the .text section now need to have the base address of the section added to their offset. Relocations point to symbols, so they too need to have the base address of the section added to their offset.

Some of this was already in the ELF loader, or at least some attempt had been made to add it.

Relocatable ELF files have no "entrypoints" as such, as they are not typically intended to be executed on their own. Typically the linker combines multiple .o files to produce an executable. So, at first, it would appear that attempting to decompile any .o file that doesn't have the main symbol in it, and where no specific entrypoints have been supplied by the user, would be a bit questionable. However, two examples spring to mind where the decompiler should be able to find an entrypoint. The first is kernel modules, where the initialization and teardown functions are valid entrypoints. The second is X11 modules, which have similar entrypoints. Obviously in both these cases there are interesting targets for decompilation.

Comments

Post a Comment

Popular posts from this blog

Disabling OS-X Device Removal Warnings In Yosemite

Image
If you're anything like me you've probably seen the Disk Not Ejected Properly message so many times that you've forgotten how annoying it is.. despite the fact that you never even wrote anything to the usb drive that you're yanking out of your Mac the operating system insists that you remove it "correctly". You're supposed to click the eject button. Why? I dunno, Apple seems to think that if you can write to it then the operating system might have written to it - and being Apple, they probably have. Well ya know what? Fuck you, I won't do what you tell me. Note: this will not fix your external drive disconnecting when your Mac goes to sleep. For that problem try disabling "put hard drive to sleep when possible" in both the Battery and Power Adapter tabs of the OS energy saver settings. What appears below is a dirty hack for deliberately removing a warning that Apple insists on showing you every single time you yank out a usb stick.
Read more

Rebirth Of The Spaceship

Image
Over the last year the space advocate community has splintered into two major groups in answering the question "where should we go next?" Moon First or Mars First . This division was present in the Review of Human Spaceflight (aka Augustine) committee's final report in late 2009, with the surprising conclusion that there isn't the funds for either, suggesting a number of intermediate destinations first - including asteroids. However, as few people consider asteroids to be truly interesting destinations for the human utilization of space ( except me! ), the debate rages on. Many Moon First advocates are "Mars Next" advocates while most Mars First advocates are "Moon Again?" detractors. The former claim that Mars exploration will benefit from lunar exploration, particularly in experience and risk reduction, and perhaps the procurement of propellant. The latter claim that lunar exploration is just a distraction and want to avoid the risk of be
Read more

Mars Direct Without Super Heavy Lift

Image
For a decade or two now the proponents of Bob Zubrin's Mars Direct have been bemoaning the lack of super heavy lift (any vehicle that can lift more than 50 ton to LEO). While few advocates claim a heavy lift launch vehicle is the only component of the Mars Direct plan which is missing, most consider it a necessary prerequisite. Before I tell you why I think that's simply wrong, let's just make a quick list of all the other things we still need: decent life support, space suits for Mars, rovers that run on methane/LOX, the ISRU propellant production system, bigger entry/descent/landing systems than have ever been flown, portable field equipment for the science mission, artificial gravity generation, and the habitat itself. Oh yeah, and a space rated nuclear reactor. The beautiful innovation of the Mars Direct plan was the use of the Mars atmosphere to produce the return propellant so it doesn't need to be carried all the way from Earth. Without this simple idea t
Read more