Better Support for Relocatable ELF Files

Looking at how the Boomerang ELF loader handles symbols and relocations, I noticed that something was clearly wrong for relocatable files (i.e., .o files). The loader was assuming that the VirtualAddress members of the section table were set as they are in executable images. This is not the case. It is the duty of the loader to choose an arbitary starting address and to load each section at appropriate offsets from that address. I decided that choosing the same default address that IDA Pro uses was probably a good idea. I often switch between Boomerang and IDA Pro to gather information, especially information that Boomerang has gotten wrong. I also decided to delay loading any section that starts with ".rel." until all the other sections are loaded because IDA Pro does so. I don't know why it does it, but I want my addresses to match up with those in IDA Pro, so I have to follow their lead.

After fixing this, I noticed that all the symbols and relocations now point to addresses that are not in any section. That is, all the symbols that point to the .text section now need to have the base address of the section added to their offset. Relocations point to symbols, so they too need to have the base address of the section added to their offset.

Some of this was already in the ELF loader, or at least some attempt had been made to add it.

Relocatable ELF files have no "entrypoints" as such, as they are not typically intended to be executed on their own. Typically the linker combines multiple .o files to produce an executable. So, at first, it would appear that attempting to decompile any .o file that doesn't have the main symbol in it, and where no specific entrypoints have been supplied by the user, would be a bit questionable. However, two examples spring to mind where the decompiler should be able to find an entrypoint. The first is kernel modules, where the initialization and teardown functions are valid entrypoints. The second is X11 modules, which have similar entrypoints. Obviously in both these cases there are interesting targets for decompilation.

Comments

Post a Comment

Popular posts from this blog

Disabling OS-X Device Removal Warnings In Yosemite

Image
If you're anything like me you've probably seen the Disk Not Ejected Properly message so many times that you've forgotten how annoying it is.. despite the fact that you never even wrote anything to the usb drive that you're yanking out of your Mac the operating system insists that you remove it "correctly". You're supposed to click the eject button. Why? I dunno, Apple seems to think that if you can write to it then the operating system might have written to it - and being Apple, they probably have. Well ya know what? Fuck you, I won't do what you tell me. Note: this will not fix your external drive disconnecting when your Mac goes to sleep. For that problem try disabling "put hard drive to sleep when possible" in both the Battery and Power Adapter tabs of the OS energy saver settings. What appears below is a dirty hack for deliberately removing a warning that Apple insists on showing you every single time you yank out a usb stick. ...
Read more

Rebirth Of The Spaceship

Image
Over the last year the space advocate community has splintered into two major groups in answering the question "where should we go next?" Moon First or Mars First . This division was present in the Review of Human Spaceflight (aka Augustine) committee's final report in late 2009, with the surprising conclusion that there isn't the funds for either, suggesting a number of intermediate destinations first - including asteroids. However, as few people consider asteroids to be truly interesting destinations for the human utilization of space ( except me! ), the debate rages on. Many Moon First advocates are "Mars Next" advocates while most Mars First advocates are "Moon Again?" detractors. The former claim that Mars exploration will benefit from lunar exploration, particularly in experience and risk reduction, and perhaps the procurement of propellant. The latter claim that lunar exploration is just a distraction and want to avoid the risk of be...
Read more

Living Inside An Asteroid

Image
Deriders of the new NASA direction have latched on to the announced human asteroid mission in the 2025 timeframe as something they "can't imagine" and therefore is not worth doing. Of course, the administration is talking up the "science" that can be done on an asteroid, and how this could better inform us should the need arise to divert or destroy one that threatens Earth. This is good politics as nothing motivates like fear, but for those of us who think the human spaceflight program is really about preparing us to live at the future homes of humanity, asteroids would seem to be just a stop on the way - I disagree. As I've written previously, the new NASA direction isn't about asteroids - it isn't about destinations - it's about going and specifically, it's about going to Mars. I'm not sure NASA knows yet why they're going to Mars, but they're focusing on the technology to get there and get back safely, and some of the ...
Read more