Exemple #1
0
 public GlobalDataWorkItem(IScanner scanner, Program program, Address addr, DataType dt) : base(addr)
 {
     this.scanner = scanner;
     this.program = program;
     this.dt = dt;
     this.rdr = program.CreateImageReader(addr);
 }
Exemple #2
0
 public override void RelocateEntry(Program program, ElfSymbol sym, ElfSection referringSection, Elf32_Rela rela)
 {
     if (loader.Sections.Count <= sym.SectionIndex)
         return;
     if (sym.SectionIndex == 0)
         return;
     var symSection = loader.Sections[(int)sym.SectionIndex];
     uint S = (uint)sym.Value + symSection.Address.ToUInt32();
     int A = 0;
     int sh = 0;
     uint mask = ~0u;
     var addr = referringSection.Address + rela.r_offset;
     uint P = (uint)addr.ToLinear();
     uint PP = P;
     var relR = program.CreateImageReader(addr);
     var relW = program.CreateImageWriter(addr);
     var rt = (i386Rt)(rela.r_info & 0xFF);
     switch (rt)
     {
     case i386Rt.R_386_NONE: //  just ignore (common)
         break;
     case i386Rt.R_386_32: // S + A
                           // Read the symTabIndex'th symbol.
         A = rela.r_addend;
         P = 0;
         break;
     case i386Rt.R_386_PC32: // S + A - P
         if (sym.Value == 0)
         {
             // This means that the symbol doesn't exist in this module, and is not accessed
             // through the PLT, i.e. it will be statically linked, e.g. strcmp. We have the
             // name of the symbol right here in the symbol table entry, but the only way
             // to communicate with the loader is through the target address of the call.
             // So we use some very improbable addresses (e.g. -1, -2, etc) and give them entries
             // in the symbol table
             //S = nextFakeLibAddr--; // Allocate a new fake address
             //loader.AddSymbol(S, sym.Name);
             //}
         }
         A = rela.r_addend;
         P = ~P + 1;
         break;
     case i386Rt.R_386_GLOB_DAT:
         // This relocation type is used to set a global offset table entry to the address of the
         // specified symbol. The special relocation type allows one to determine the
         // correspondence between symbols and global offset table entries.
         P = 0;
         break;
     default:
         throw new NotImplementedException(string.Format(
             "i386 ELF relocation type {0} not implemented yet.",
             rt));
     }
     var w = relR.ReadBeUInt32();
     w += ((uint)(S + A + P) >> sh) & mask;
     relW.WriteBeUInt32(w);
 }
Exemple #3
0
        public override void RelocateEntry(Program program, ElfSymbol sym, ElfSection referringSection, Elf32_Rela rela)
        {
            if (loader.Sections.Count <= sym.SectionIndex)
                return; 
            if (sym.SectionIndex == 0)
                return;
            var symSection = loader.Sections[(int)sym.SectionIndex];
            uint S = (uint)sym.Value + symSection.Address.ToUInt32();
            int A = 0;
            int sh = 0;
            uint mask = ~0u;
            var addr = referringSection.Address + rela.r_offset;
            uint P = (uint)addr.ToLinear();
            uint PP = P;

            Debug.Print("  off:{0:X8} type:{1,-16} add:{3,-20} {4,3} {2} {5}",
                rela.r_offset,
                (SparcRt)(rela.r_info & 0xFF),
                sym.Name,
                rela.r_addend,
                (int)(rela.r_info >> 8),
                symSection.Name);

            var rt = (SparcRt)(rela.r_info & 0xFF);
            switch (rt)
            {
            case 0:
                return;
            case SparcRt.R_SPARC_HI22:
                A = rela.r_addend;
                sh = 10;
                P = 0;
                break;
            case SparcRt.R_SPARC_LO10:
                A = rela.r_addend;
                mask = 0x3FF;
                P = 0;
                break;
            case SparcRt.R_SPARC_WDISP30:
                A = rela.r_addend;
                P = ~P + 1;
                sh = 2;
                break;
            case SparcRt.R_SPARC_COPY:
                Debug.Print("Relocation type {0} not handled yet.", rt);
                return;
            default:
                throw new NotImplementedException(string.Format(
                    "SPARC ELF relocation type {0} not implemented yet.",
                    rt));
            }
            var relR = program.CreateImageReader(addr);
            var relW = program.CreateImageWriter(addr);

            var w = relR.ReadBeUInt32();
            w += ((uint)(S + A + P) >> sh) & mask;
            relW.WriteBeUInt32(w);
        }
Exemple #4
0
 private static string BuildBytes(Program program, MachineInstruction instr)
 {
     var sb = new StringBuilder();
     var rdr = program.CreateImageReader(instr.Address);
     for (int i = 0; i < instr.Length; ++i)
     {
         sb.AppendFormat("{0:X2} ", rdr.ReadByte());
     }
     return sb.ToString();
 }
Exemple #5
0
 public override void RelocateEntry(Program program, ElfSymbol sym, ElfSection referringSection, Elf64_Rela rela)
 {
     if (loader.Sections.Count <= sym.SectionIndex)
         return;
     if (sym.SectionIndex == 0)
         return;
     var symSection = loader.Sections[(int)sym.SectionIndex];
     ulong S = (ulong)sym.Value + symSection.Address.ToLinear();
     long A = 0;
     int sh = 0;
     uint mask = ~0u;
     Address addr;
     ulong P;
     ImageReader relR;
     ImageWriter relW;
     if (referringSection.Address != null)
     {
         addr = referringSection.Address + rela.r_offset;
         P = addr.ToLinear();
         relR = program.CreateImageReader(addr);
         relW = program.CreateImageWriter(addr);
     }
     else
     {
         addr = null;
         P = 0;
         relR = null;
         relW = null;
     }
     ulong PP = P;
     var rt = (x86_64Rt)(rela.r_info & 0xFF);
     switch (rt)
     {
     case x86_64Rt.R_X86_64_NONE: //  just ignore (common)
         break;
     case x86_64Rt.R_X86_64_COPY:
         break;
     default:
         Debug.Print("x86_64 ELF relocation type {0} not implemented yet.",
             rt);
         break;
         //throw new NotImplementedException(string.Format(
         //    "x86_64 ELF relocation type {0} not implemented yet.",
         //    rt));
     }
     if (relR != null)
     {
         var w = relR.ReadUInt64();
         w += ((ulong)(S + (ulong)A + P) >> sh) & mask;
         relW.WriteUInt64(w);
     }
 }
Exemple #6
0
        public override void LocateGotPointers(Program program, SortedList<Address, ImageSymbol> symbols)
        {
            // Locate the GOT
            //$REVIEW: there doesn't seem to be a reliable way to get that
            // information.
            var got = program.SegmentMap.Segments.Values.FirstOrDefault(s => s.Name == ".got");
            if (got == null)
                return;

            var rdr = program.CreateImageReader(got.Address);
            while (rdr.Address < got.EndAddress)
            {
                var addrGot = rdr.Address;
                ulong uAddrSym;
                if (!rdr.TryReadUInt64(out uAddrSym))
                    break;

                var addrSym = Address.Ptr64(uAddrSym);
                ImageSymbol symbol;
                if (symbols.TryGetValue(addrSym, out symbol))
                {
                    // This GOT entry is a known symbol!
                    if (symbol.Type == SymbolType.Procedure)
                    {
                        //$TODO: look up function signature.
                        var gotSym = new ImageSymbol(addrGot, symbol.Name + "_GOT", new Pointer(new CodeType(), 4));
                        symbols[addrGot] = gotSym;
                        Debug.Print("Found GOT entry at {0}, changing symbol at {1}", gotSym, symbol);
                    }
                }
            }
        }