diff options
Diffstat (limited to 'plugins')
| -rw-r--r-- | plugins/Makefile.am | 2 | ||||
| -rw-r--r-- | plugins/readelf/Makefile.am | 15 | ||||
| -rw-r--r-- | plugins/readelf/header.c | 481 | ||||
| -rw-r--r-- | plugins/readelf/header.h | 37 | ||||
| -rw-r--r-- | plugins/readelf/program.c | 363 | ||||
| -rw-r--r-- | plugins/readelf/program.h | 37 | ||||
| -rw-r--r-- | plugins/readelf/reader.c | 66 | ||||
| -rw-r--r-- | plugins/readelf/reader.h | 39 | ||||
| -rw-r--r-- | plugins/readelf/section.c | 441 | ||||
| -rw-r--r-- | plugins/readelf/section.h | 37 |
10 files changed, 1517 insertions, 1 deletions
diff --git a/plugins/Makefile.am b/plugins/Makefile.am index 5eadf0c..de8fa29 100644 --- a/plugins/Makefile.am +++ b/plugins/Makefile.am @@ -1,2 +1,2 @@ -SUBDIRS = androhelpers devdbg mobicore pychrysa python stackvars +SUBDIRS = androhelpers devdbg mobicore pychrysa python readelf stackvars diff --git a/plugins/readelf/Makefile.am b/plugins/readelf/Makefile.am new file mode 100644 index 0000000..f6b3d5e --- /dev/null +++ b/plugins/readelf/Makefile.am @@ -0,0 +1,15 @@ + +lib_LTLIBRARIES = libreadelf.la + +libreadelf_la_SOURCES = \ + header.h header.c \ + program.h program.c \ + reader.h reader.c \ + section.h section.c + +libreadelf_la_CFLAGS = $(AM_CFLAGS) + + +AM_CPPFLAGS = $(LIBGTK_CFLAGS) $(LIBXML_CFLAGS) -I../../src + +AM_CFLAGS = $(DEBUG_CFLAGS) $(WARNING_FLAGS) $(COMPLIANCE_FLAGS) diff --git a/plugins/readelf/header.c b/plugins/readelf/header.c new file mode 100644 index 0000000..5fbd769 --- /dev/null +++ b/plugins/readelf/header.c @@ -0,0 +1,481 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.c - annotation des en-têtes de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "header.h" + + +#include <i18n.h> +#include <arch/raw.h> +#include <format/symbol.h> + + + +/****************************************************************************** +* * +* Paramètres : format = description de l'exécutable à compléter. * +* * +* Description : Charge tous les symboles de l'en-tête ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +bool annotate_elf_header(GElfFormat *format) +{ + GBinContent *content; /* Contenu binaire à lire */ + const elf_header *header; /* En-tête principale */ + SourceEndian endian; /* Boutisme utilisé */ + vmpa2t pos; /* Tête de lecture des symboles*/ + vmpa2t start; /* Localisation des symboles */ + GArchInstruction *instr; /* Instruction décodée */ + GArchOperand *operand; /* Opérande à venir modifier */ + GDbComment *comment; /* Définition de commentaire */ + GBinSymbol *symbol; /* Symbole à intégrer */ + const char *text; /* Texte constant à insérer */ + + content = g_binary_format_get_conten_(G_BIN_FORMAT(format)); + + header = g_elf_format_get_header(format); + endian = g_elf_format_get_endianness(format); + + init_vmpa(&pos, 0, 0x3333); + + /* ELFMAG (0) */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 4, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 1, IOD_CHAR); + SET_IMM_DISPLAY(instr, operand, 2, IOD_CHAR); + SET_IMM_DISPLAY(instr, operand, 3, IOD_CHAR); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("ELF magic number")); + + /* EI_CLASS (4) */ + + switch (header->hdr32.e_ident[EI_CLASS]) + { + case EV_NONE: + text = _("File class: invalid"); + break; + case ELFCLASS32: + text = _("File class: 32-bit objects"); + break; + case ELFCLASS64: + text = _("File class: 64-bit objects"); + break; + default: + text = _("File class: unknown"); + break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* EI_DATA (5) */ + + switch (header->hdr32.e_ident[EI_DATA]) + { + case ELFDATANONE: + text = _("Data encoding: invalid"); + break; + case ELFDATA2LSB: + text = _("Data encoding: 2's complement, little endian"); + break; + case ELFDATA2MSB: + text = _("Data encoding: 2's complement, big endian"); + break; + default: + text = _("Data encoding: unknown"); + break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* EI_VERSION (6) */ + + switch (header->hdr32.e_ident[EI_VERSION]) + { + case EV_NONE: + text = _("File version: invalid"); + break; + case EV_CURRENT: + text = _("File version: current"); + break; + default: + text = _("File version: unknown"); + break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* EI_OSABI (7) */ + + switch (header->hdr32.e_ident[EI_OSABI]) + { + case ELFOSABI_SYSV: + text = _("OS ABI: UNIX System V"); + break; + case ELFOSABI_HPUX: + text = _("OS ABI: HP-UX"); + break; + case ELFOSABI_NETBSD: + text = _("OS ABI: NetBSD"); + break; + case ELFOSABI_GNU: + text = _("OS ABI: object uses GNU ELF extensions"); + break; + case ELFOSABI_SOLARIS: + text = _("OS ABI: Sun Solaris"); + break; + case ELFOSABI_AIX: + text = _("OS ABI: IBM AIX"); + break; + case ELFOSABI_IRIX: + text = _("OS ABI: SGI Irix"); + break; + case ELFOSABI_FREEBSD: + text = _("OS ABI: FreeBSD"); + break; + case ELFOSABI_TRU64: + text = _("OS ABI: Compaq TRU64 UNIX"); + break; + case ELFOSABI_MODESTO: + text = _("OS ABI: Novell Modesto"); + break; + case ELFOSABI_OPENBSD: + text = _("OS ABI: OpenBSD"); + break; + case ELFOSABI_ARM_AEABI: + text = _("OS ABI: ARM EABI"); + break; + case ELFOSABI_ARM: + text = _("OS ABI: ARM"); + break; + case ELFOSABI_STANDALONE: + text = _("OS ABI: standalone (embedded) application"); + break; + default: + text = _("OS ABI: unknown"); + break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* EI_ABIVERSION (8) */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("ABI version")); + + /* Padding */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_8_BITS, 7, &pos, endian); + + g_raw_instruction_mark_as_padding(G_RAW_INSTRUCTION(instr), true); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Padding")); + + /* Champ "e_type" */ + + switch (header->hdr32.e_type) + { + case ET_NONE: + text = _("Object file type: no file type"); + break; + case ET_REL: + text = _("Object file type: relocatable file"); + break; + case ET_EXEC: + text = _("Object file type: executable file"); + break; + case ET_DYN: + text = _("Object file type: shared object file"); + break; + case ET_CORE: + text = _("Object file type: core file"); + break; + case ET_LOOS ... ET_HIOS: + text = _("Object file type: OS-specific"); + break; + case ET_LOPROC ... ET_HIPROC: + text = _("Object file type: processor-specific"); + break; + default: + text = _("Object file type: unkown"); + break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* Champ "e_machine" */ + + switch (header->hdr32.e_machine) + { + case EM_NONE: text = _("Architecture: No machine"); break; + case EM_M32: text = _("Architecture: AT&T WE 32100"); break; + case EM_SPARC: text = _("Architecture: SUN SPARC"); break; + case EM_386: text = _("Architecture: Intel 80386"); break; + case EM_68K: text = _("Architecture: Motorola m68k family"); break; + case EM_88K: text = _("Architecture: Motorola m88k family"); break; + case EM_860: text = _("Architecture: Intel 80860"); break; + case EM_MIPS: text = _("Architecture: MIPS R3000 big-endian"); break; + case EM_S370: text = _("Architecture: IBM System/370"); break; + case EM_MIPS_RS3_LE:text = _("Architecture: MIPS R3000 little-endian"); break; + case EM_PARISC: text = _("Architecture: HPPA"); break; + case EM_VPP500: text = _("Architecture: Fujitsu VPP500"); break; + case EM_SPARC32PLUS:text = _("Architecture: Sun's \"v8plus\""); break; + case EM_960: text = _("Architecture: Intel 80960"); break; + case EM_PPC: text = _("Architecture: PowerPC"); break; + case EM_PPC64: text = _("Architecture: PowerPC 64-bit"); break; + case EM_S390: text = _("Architecture: IBM S390"); break; + case EM_V800: text = _("Architecture: NEC V800 series"); break; + case EM_FR20: text = _("Architecture: Fujitsu FR20"); break; + case EM_RH32: text = _("Architecture: TRW RH-32"); break; + case EM_RCE: text = _("Architecture: Motorola RCE"); break; + case EM_ARM: text = _("Architecture: ARM"); break; + case EM_FAKE_ALPHA: text = _("Architecture: Digital Alpha"); break; + case EM_SH: text = _("Architecture: Hitachi SH"); break; + case EM_SPARCV9: text = _("Architecture: SPARC v9 64-bit"); break; + case EM_TRICORE: text = _("Architecture: Siemens Tricore"); break; + case EM_ARC: text = _("Architecture: Argonaut RISC Core"); break; + case EM_H8_300: text = _("Architecture: Hitachi H8/300"); break; + case EM_H8_300H: text = _("Architecture: Hitachi H8/300H"); break; + case EM_H8S: text = _("Architecture: Hitachi H8S"); break; + case EM_H8_500: text = _("Architecture: Hitachi H8/500"); break; + case EM_IA_64: text = _("Architecture: Intel Merced"); break; + case EM_MIPS_X: text = _("Architecture: Stanford MIPS-X"); break; + case EM_COLDFIRE: text = _("Architecture: Motorola Coldfire"); break; + case EM_68HC12: text = _("Architecture: Motorola M68HC12"); break; + case EM_MMA: text = _("Architecture: Fujitsu MMA Multimedia Accelerator"); break; + case EM_PCP: text = _("Architecture: Siemens PCP"); break; + case EM_NCPU: text = _("Architecture: Sony nCPU embeeded RISC"); break; + case EM_NDR1: text = _("Architecture: Denso NDR1 microprocessor"); break; + case EM_STARCORE: text = _("Architecture: Motorola Start*Core processor"); break; + case EM_ME16: text = _("Architecture: Toyota ME16 processor"); break; + case EM_ST100: text = _("Architecture: STMicroelectronic ST100 processor"); break; + case EM_TINYJ: text = _("Architecture: Advanced Logic Corp. Tinyj emb.fam"); break; + case EM_X86_64: text = _("Architecture: AMD x86-64 architecture"); break; + case EM_PDSP: text = _("Architecture: Sony DSP Processor"); break; + case EM_FX66: text = _("Architecture: Siemens FX66 microcontroller"); break; + case EM_ST9PLUS: text = _("Architecture: STMicroelectronics ST9+ 8/16 mc"); break; + case EM_ST7: text = _("Architecture: STmicroelectronics ST7 8 bit mc"); break; + case EM_68HC16: text = _("Architecture: Motorola MC68HC16 microcontroller"); break; + case EM_68HC11: text = _("Architecture: Motorola MC68HC11 microcontroller"); break; + case EM_68HC08: text = _("Architecture: Motorola MC68HC08 microcontroller"); break; + case EM_68HC05: text = _("Architecture: Motorola MC68HC05 microcontroller"); break; + case EM_SVX: text = _("Architecture: Silicon Graphics SVx"); break; + case EM_ST19: text = _("Architecture: STMicroelectronics ST19 8 bit mc"); break; + case EM_VAX: text = _("Architecture: Digital VAX"); break; + case EM_CRIS: text = _("Architecture: Axis Communications 32-bit embedded processor"); break; + case EM_JAVELIN: text = _("Architecture: Infineon Technologies 32-bit embedded processor"); break; + case EM_FIREPATH: text = _("Architecture: Element 14 64-bit DSP Processor"); break; + case EM_ZSP: text = _("Architecture: LSI Logic 16-bit DSP Processor"); break; + case EM_MMIX: text = _("Architecture: Donald Knuth's educational 64-bit processor"); break; + case EM_HUANY: text = _("Architecture: Harvard University machine-independent object files"); break; + case EM_PRISM: text = _("Architecture: SiTera Prism"); break; + case EM_AVR: text = _("Architecture: Atmel AVR 8-bit microcontroller"); break; + case EM_FR30: text = _("Architecture: Fujitsu FR30"); break; + case EM_D10V: text = _("Architecture: Mitsubishi D10V"); break; + case EM_D30V: text = _("Architecture: Mitsubishi D30V"); break; + case EM_V850: text = _("Architecture: NEC v850"); break; + case EM_M32R: text = _("Architecture: Mitsubishi M32R"); break; + case EM_MN10300: text = _("Architecture: Matsushita MN10300"); break; + case EM_MN10200: text = _("Architecture: Matsushita MN10200"); break; + case EM_PJ: text = _("Architecture: picoJava"); break; + case EM_OPENRISC: text = _("Architecture: OpenRISC 32-bit embedded processor"); break; + case EM_ARC_A5: text = _("Architecture: ARC Cores Tangent-A5"); break; + case EM_XTENSA: text = _("Architecture: Tensilica Xtensa Architecture"); break; + case EM_AARCH64: text = _("Architecture: ARM AARCH64"); break; + case EM_TILEPRO: text = _("Architecture: Tilera TILEPro"); break; + case EM_MICROBLAZE: text = _("Architecture: Xilinx MicroBlaze"); break; + case EM_TILEGX: text = _("Architecture: Tilera TILE-Gx"); break; + default: text = _("Architecture: unknown"); break; + } + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* Champ "e_version" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Object file version")); + + if (header->hdr32.e_ident[EI_CLASS] == ELFCLASS32) + { + /* Champ "e_entry" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Entry point virtual address")); + + /* Champ "e_phoff" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Program header table file offset")); + + /* Champ "e_shoff" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section header table file offset")); + + } + + else if (header->hdr32.e_ident[EI_CLASS] == ELFCLASS64) + { + /* Champ "e_entry" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Entry point virtual address")); + + /* Champ "e_phoff" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Program header table file offset")); + + /* Champ "e_shoff" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, &pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section header table file offset")); + + } + + else return false; + + /* Champ "e_flags" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, &pos, endian); + + //SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Processor-specific flags")); + + /* Champ "e_ehsize" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("ELF header size in bytes")); + + /* Champ "e_phentsize" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Program header table entry size")); + + /* Champ "e_phnum" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Program header table entry count")); + + /* Champ "e_shentsize" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section header table entry size")); + + /* Champ "e_shnum" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section header table entry count")); + + /* Champ "e_shstrndx" */ + + copy_vmpa(&start, &pos); + instr = g_raw_instruction_new_array(content, MDS_16_BITS, 1, &pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section header string table index")); + + g_object_unref(G_OBJECT(content)); + + return true; + +} diff --git a/plugins/readelf/header.h b/plugins/readelf/header.h new file mode 100644 index 0000000..c86b07f --- /dev/null +++ b/plugins/readelf/header.h @@ -0,0 +1,37 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.h - prototypes pour l'annotation des en-têtes de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _PLUGINS_READELF_HEADER_H +#define _PLUGINS_READELF_HEADER_H + + +#include <format/elf/elf.h> + + + +/* Charge tous les symboles de l'en-tête ELF. */ +bool annotate_elf_header(GElfFormat *); + + + +#endif /* _PLUGINS_READELF_HEADER_H */ diff --git a/plugins/readelf/program.c b/plugins/readelf/program.c new file mode 100644 index 0000000..6912828 --- /dev/null +++ b/plugins/readelf/program.c @@ -0,0 +1,363 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.c - annotation des en-têtes de programme de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "program.h" + + +#include <i18n.h> +#include <arch/raw.h> +#include <common/extstr.h> +#include <format/symbol.h> +#include <format/elf/elf-int.h> + + + +/* Charge tous les symboles liés à un en-tête de programme ELF. */ +static bool annotate_elf_program_header(GElfFormat *, SourceEndian, vmpa2t *); + + + +/****************************************************************************** +* * +* Paramètres : format = description de l'exécutable à compléter. * +* endian = boutisme présentement utilisé. * +* pos = tête de lecture à déplacer. [OUT] * +* * +* Description : Charge tous les symboles liés à un en-tête de programme ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static bool annotate_elf_program_header(GElfFormat *format, SourceEndian endian, vmpa2t *pos) +{ + elf_phdr phdr; /* En-tête de programme ELF */ + GBinContent *content; /* Contenu binaire à lire */ + ImmOperandDisplay disp; /* Afficahge de valeur */ + const char *text; /* Texte constant à insérer */ + vmpa2t start; /* Localisation des symboles */ + GArchInstruction *instr; /* Instruction décodée */ + GArchOperand *operand; /* Opérande à venir modifier */ + GDbComment *comment; /* Définition de commentaire */ + GBinSymbol *symbol; /* Symbole à intégrer */ + char *dtext; /* Texte dynamique à créer */ + bool filled; /* Suivi de mise en place */ + + if (!read_elf_program_header(format, get_phy_addr(pos), &phdr)) + return false; + + content = g_binary_format_get_conten_(G_BIN_FORMAT(format)); + + /* Champ "p_type" */ + + disp = IOD_DEC; + + switch (ELF_PHDR(format, phdr, p_type)) + { + case PT_NULL: + text = _("Segment type: unused"); + break; + case PT_LOAD: + text = _("Segment type: loadable program segment"); + break; + case PT_DYNAMIC: + text = _("Segment type: dynamic linking information"); + break; + case PT_INTERP: + text = _("Segment type: program interpreter"); + break; + case PT_NOTE: + text = _("Segment type: auxiliary information"); + break; + case PT_SHLIB: + text = _("Segment type: reserved"); + break; + case PT_PHDR: + text = _("Segment type: entry for header table itself"); + break; + case PT_TLS: + text = _("Segment type: thread-local storage segment"); + break; + case PT_LOOS ... PT_HIOS: + disp = IOD_HEX; + switch (ELF_PHDR(format, phdr, p_type)) + { + case PT_GNU_EH_FRAME: + text = _("Segment type: GCC .eh_frame_hdr segment"); + break; + case PT_GNU_STACK: + text = _("Segment type: indicates stack executability"); + break; + case PT_GNU_RELRO: + text = _("Segment type: read-only after relocation"); + break; + case PT_LOSUNW ... PT_HISUNW: + switch (ELF_PHDR(format, phdr, p_type)) + { + case PT_SUNWSTACK: + text = _("Segment type: Sun Stack segment"); + break; + default: + text = _("Segment type: Sun specific segment"); + break; + } + break; + default: + text = _("Segment type: OS-specific"); + break; + } + break; + case PT_LOPROC ... PT_HIPROC: + disp = IOD_HEX; + text = _("Segment type: processor-specific"); + break; + default: + disp = IOD_HEX; + text = _("Segment type: unknown"); + break; + } + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, disp); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, text); + + if (format->is_32b) + { + /* Champ "p_offset" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment file offset")); + + /* Champ "p_vaddr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment virtual address")); + + /* Champ "p_paddr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment physical address")); + + /* Champ "p_filesz" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment size in file")); + + /* Champ "p_memsz" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment size in memory")); + + /* Champ "p_flags" */ + + dtext = strdup(_("Segment flags: ")); + filled = false; + + if (ELF_PHDR(format, phdr, p_flags) & PF_R) + { + dtext = stradd(dtext, "R"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_W) + { + dtext = stradd(dtext, "W"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_X) + { + dtext = stradd(dtext, "X"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_MASKOS) + /* TODO */; + + if (ELF_PHDR(format, phdr, p_flags) & PF_MASKPROC) + /* TODO */; + + if (!filled) + dtext = stradd(dtext, _("none")); + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, dtext); + + free(dtext); + + /* Champ "p_align" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment alignment")); + + } + else + { + /* Champ "p_flags" */ + + dtext = strdup(_("Segment flags: ")); + filled = false; + + if (ELF_PHDR(format, phdr, p_flags) & PF_R) + { + dtext = stradd(dtext, "R"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_W) + { + dtext = stradd(dtext, "W"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_X) + { + dtext = stradd(dtext, "X"); + filled = true; + } + + if (ELF_PHDR(format, phdr, p_flags) & PF_MASKOS) + /* TODO */; + + if (ELF_PHDR(format, phdr, p_flags) & PF_MASKPROC) + /* TODO */; + + if (!filled) + dtext = stradd(dtext, _("none")); + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, dtext); + + free(dtext); + + /* Champ "p_offset" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment file offset")); + + /* Champ "p_vaddr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment virtual address")); + + /* Champ "p_paddr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment physical address")); + + /* Champ "p_filesz" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment size in file")); + + /* Champ "p_memsz" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment size in memory")); + + /* Champ "p_align" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, pos, instr, comment, _("Segment alignment")); + + } + + g_object_unref(G_OBJECT(content)); + + return true; + +} + + +/****************************************************************************** +* * +* Paramètres : format = description de l'exécutable à compléter. * +* * +* Description : Charge tous les symboles liés aux en-têtes de programme ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +bool annotate_elf_program_header_table(GElfFormat *format) +{ + bool result; /* Bilan à retourner */ + const elf_header *header; /* En-tête principale */ + SourceEndian endian; /* Boutisme utilisé */ + off_t offset; /* Tête de lecture du bbinaire */ + vmpa2t pos; /* Localisation des symboles */ + uint16_t e_phnum; /* Nombre d'éléments 'Program' */ + uint16_t i; /* Boucle de parcours */ + + result = true; + + header = g_elf_format_get_header(format); + endian = g_elf_format_get_endianness(format); + + offset = ELF_HDR(format, *header, e_phoff); + + init_vmpa(&pos, offset, 0x5500); + + e_phnum = ELF_HDR(format, *header, e_phnum); + + for (i = 0; i < e_phnum && result; i++) + result = annotate_elf_program_header(format, endian, &pos); + + return true; + +} diff --git a/plugins/readelf/program.h b/plugins/readelf/program.h new file mode 100644 index 0000000..b1f3a6d --- /dev/null +++ b/plugins/readelf/program.h @@ -0,0 +1,37 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.h - prototypes pour l'annotation des en-têtes de programme de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _PLUGINS_READELF_PROGRAM_H +#define _PLUGINS_READELF_PROGRAM_H + + +#include <format/elf/elf.h> + + + +/* Charge tous les symboles liés aux en-têtes de programme ELF. */ +bool annotate_elf_program_header_table(GElfFormat *); + + + +#endif /* _PLUGINS_READELF_PROGRAM_H */ diff --git a/plugins/readelf/reader.c b/plugins/readelf/reader.c new file mode 100644 index 0000000..5da60b7 --- /dev/null +++ b/plugins/readelf/reader.c @@ -0,0 +1,66 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * reader.c - interprétation des informations secondaires contenues dans un fichier ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "reader.h" + + +#include <plugins/plugin-def.h> + + +#include "header.h" +#include "program.h" +#include "section.h" + + + +DEFINE_CHRYSALIDE_ACTIVE_PLUGIN("readelf", "Displays information about ELF files", "0.1.0", + PGA_FORMAT_LOADER_LAST); + + +/****************************************************************************** +* * +* Paramètres : plugin = greffon à manipuler. * +* action = type d'action attendue. * +* format = description de l'exécutable à compléter. * +* * +* Description : Etablit des symboles complémentaires dans un format ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +G_MODULE_EXPORT bool handle_binary_format(const GPluginModule *plugin, PluginAction action, GElfFormat *format) +{ + bool result; /* Bilan à retourner */ + + result = annotate_elf_header(format); + + result &= annotate_elf_program_header_table(format); + + result &= annotate_elf_section_header_table(format); + + return result; + +} diff --git a/plugins/readelf/reader.h b/plugins/readelf/reader.h new file mode 100644 index 0000000..fe997b6 --- /dev/null +++ b/plugins/readelf/reader.h @@ -0,0 +1,39 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * reader.h - prototypes pour l'interprétation des informations secondaires contenues dans un fichier ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _PLUGINS_READELF_READER_H +#define _PLUGINS_READELF_READER_H + + +#include <format/elf/elf.h> +#include <plugins/plugin.h> +#include <plugins/plugin-int.h> + + + +/* Etablit des symboles complémentaires dans un format ELF. */ +G_MODULE_EXPORT bool handle_binary_format(const GPluginModule *, PluginAction, GElfFormat *); + + + +#endif /* _PLUGINS_READELF_READER_H */ diff --git a/plugins/readelf/section.c b/plugins/readelf/section.c new file mode 100644 index 0000000..3884818 --- /dev/null +++ b/plugins/readelf/section.c @@ -0,0 +1,441 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.c - annotation des en-têtes de section de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#include "section.h" + + +#include <i18n.h> +#include <arch/raw.h> +#include <common/extstr.h> +#include <format/symbol.h> +#include <format/elf/elf-int.h> +#include <format/elf/section.h> + + + +/* Charge tous les symboles liés à un en-tête de section ELF. */ +static bool annotate_elf_section_header(GElfFormat *, SourceEndian, const elf_shdr *, vmpa2t *); + + + +/****************************************************************************** +* * +* Paramètres : format = description de l'exécutable à compléter. * +* endian = boutisme présentement utilisé. * +* strings = section renvoyant vers des chaînes de caractères. * +* pos = tête de lecture à déplacer. [OUT] * +* * +* Description : Charge tous les symboles liés à un en-tête de section ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +static bool annotate_elf_section_header(GElfFormat *format, SourceEndian endian, const elf_shdr *strings, vmpa2t *pos) +{ + elf_shdr shdr; /* En-tête de programme ELF */ + GBinContent *content; /* Contenu binaire à lire */ + const char *secname; /* Nom d'une section analysée */ + ImmOperandDisplay disp; /* Afficahge de valeur */ + const char *text; /* Texte constant à insérer */ + vmpa2t start; /* Localisation des symboles */ + GArchInstruction *instr; /* Instruction décodée */ + GArchOperand *operand; /* Opérande à venir modifier */ + GDbComment *comment; /* Définition de commentaire */ + GBinSymbol *symbol; /* Symbole à intégrer */ + char *dtext; /* Texte dynamique à créer */ + bool filled; /* Suivi de mise en place */ + + if (!read_elf_section_header(format, get_phy_addr(pos), &shdr)) + return false; + + content = g_binary_format_get_conten_(G_BIN_FORMAT(format)); + + /* Champ "sh_name" */ + + secname = extract_name_from_elf_string_section(format, strings, + ELF_SHDR(format, shdr, sh_name)); + + if (secname == NULL) + dtext = strdup(_("Section name: <invalid>")); + else + { + dtext = strdup(_("Section name: '")); + dtext = stradd(dtext, secname); + dtext = stradd(dtext, "'"); + } + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, dtext); + + free(dtext); + + /* Champ "sh_type" */ + + disp = IOD_DEC; + + switch (ELF_SHDR(format, shdr, sh_type)) + { + case SHT_NULL: + text = _("Section type: unused"); + break; + case SHT_PROGBITS: + text = _("Section type: program data"); + break; + case SHT_SYMTAB: + text = _("Section type: symbol table"); + break; + case SHT_STRTAB: + text = _("Section type: string table"); + break; + case SHT_RELA: + text = _("Section type: relocation entries with addends"); + break; + case SHT_HASH: + text = _("Section type: symbol hash table"); + break; + case SHT_DYNAMIC: + text = _("Section type: dynamic linking information"); + break; + case SHT_NOTE: + text = _("Section type: notes"); + break; + case SHT_NOBITS: + text = _("Section type: program space with no data (bss)"); + break; + case SHT_REL: + text = _("Section type: relocation entries, no addends"); + break; + case SHT_SHLIB: + text = _("Section type: reserved"); + break; + case SHT_DYNSYM: + text = _("Section type: dynamic linker symbol table"); + break; + case SHT_INIT_ARRAY: + text = _("Section type: array of constructors"); + break; + case SHT_FINI_ARRAY: + text = _("Section type: array of destructors"); + break; + case SHT_PREINIT_ARRAY: + text = _("Section type: array of pre-constructors"); + break; + case SHT_GROUP: + text = _("Section type: section group"); + break; + case SHT_SYMTAB_SHNDX: + text = _("Section type: extended section indeces"); + break; + case SHT_LOOS ... SHT_HIOS: + disp = IOD_HEX; + switch (ELF_SHDR(format, shdr, sh_type)) + { + case SHT_GNU_ATTRIBUTES: + text = _("Section type: object attributes"); + break; + case SHT_GNU_HASH: + text = _("Section type: GNU-style hash table"); + break; + case SHT_GNU_LIBLIST: + text = _("Section type: prelink library list"); + break; + case SHT_CHECKSUM: + text = _("Section type: checksum for DSO content"); + break; + case SHT_LOSUNW ... SHT_HISUNW: + switch (ELF_SHDR(format, shdr, sh_type)) + { + case SHT_SUNW_move: + text = _("Section type: SHT_SUNW_move"); + break; + case SHT_SUNW_COMDAT: + text = _("Section type: SHT_SUNW_COMDAT"); + break; + case SHT_SUNW_syminfo: + text = _("Section type: SHT_SUNW_syminfo"); + break; + case SHT_GNU_verdef: + text = _("Section type: version definition section"); + break; + case SHT_GNU_verneed: + text = _("Section type: version needs section"); + break; + case SHT_GNU_versym: + text = _("Section type: version symbol table"); + break; + default: + text = _("Section type: Sun-specific"); + break; + } + break; + default: + text = _("Section type: OS-specific"); + break; + } + break; + case SHT_LOPROC ... SHT_HIPROC: + disp = IOD_HEX; + text = _("Section type: processor-specific"); + break; + case SHT_LOUSER ... SHT_HIUSER: + disp = IOD_HEX; + text = _("Section type: application-specific"); + break; + default: + disp = IOD_HEX; + text = _("Section type: unknown"); + break; + } + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, disp); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, text); + + /* Champ "sh_flags"... */ + + dtext = strdup(_("Section flags: ")); + filled = false; + + if (ELF_SHDR(format, shdr, sh_type) & SHF_WRITE) + { + dtext = stradd(dtext, "W"); + filled = true; + } + + if (ELF_SHDR(format, shdr, sh_type) & SHF_ALLOC) + { + dtext = stradd(dtext, "A"); + filled = true; + } + + if (ELF_SHDR(format, shdr, sh_type) & SHF_EXECINSTR) + { + dtext = stradd(dtext, "X"); + filled = true; + } + + if (ELF_SHDR(format, shdr, sh_type) & SHF_MERGE) + { + dtext = stradd(dtext, "M"); + filled = true; + } + + if (ELF_SHDR(format, shdr, sh_type) & SHF_LINK_ORDER) + { + dtext = stradd(dtext, "L"); + filled = true; + } + + if (ELF_SHDR(format, shdr, sh_type) & SHF_TLS) + { + dtext = stradd(dtext, "T"); + filled = true; + } + + if (!filled) + dtext = stradd(dtext, _("none")); + + if (format->is_32b) + { + /* Champ "sh_flags" (suite) */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, dtext); + + free(dtext); + + /* Champ "sh_addr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section virtual addr at execution")); + + /* Champ "sh_offset" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section file offset")); + + /* Champ "sh_size" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section size in bytes")); + + } + else + { + /* Champ "sh_flags" (suite) */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, dtext); + + free(dtext); + + /* Champ "sh_addr" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section virtual addr at execution")); + + /* Champ "sh_offset" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section file offset")); + + /* Champ "sh_size" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section size in bytes")); + + } + + /* Champ "sh_link" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Link to another section")); + + /* Champ "sh_info" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Additional section information")); + + if (format->is_32b) + { + /* Champ "sh_addralign" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section alignment")); + + /* Champ "sh_entsize" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_32_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Entry size if section holds table")); + + } + else + { + /* Champ "sh_addralign" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Section alignment")); + + /* Champ "sh_entsize" */ + + copy_vmpa(&start, pos); + instr = g_raw_instruction_new_array(content, MDS_64_BITS, 1, pos, endian); + + SET_IMM_DISPLAY(instr, operand, 0, IOD_DEC); + + ADD_RAW_AS_SYM(format, symbol, &start, instr, comment, _("Entry size if section holds table")); + + } + + g_object_unref(G_OBJECT(content)); + + return true; + +} + + +/****************************************************************************** +* * +* Paramètres : format = description de l'exécutable à compléter. * +* * +* Description : Charge tous les symboles liés aux en-têtes de section ELF. * +* * +* Retour : Bilan de l'opération. * +* * +* Remarques : - * +* * +******************************************************************************/ + +bool annotate_elf_section_header_table(GElfFormat *format) +{ + bool result; /* Bilan à retourner */ + const elf_header *header; /* En-tête principale */ + SourceEndian endian; /* Boutisme utilisé */ + elf_shdr strings; /* Section des descriptions */ + off_t offset; /* Tête de lecture du binaire */ + vmpa2t pos; /* Localisation des symboles */ + uint16_t e_shnum; /* Nombre d'éléments 'Program' */ + uint16_t i; /* Boucle de parcours */ + + result = true; + + header = g_elf_format_get_header(format); + endian = g_elf_format_get_endianness(format); + + if (!find_elf_section_by_index(format, ELF_HDR(format, *header, e_shstrndx), &strings)) + return false; + + offset = ELF_HDR(format, *header, e_shoff); + + init_vmpa(&pos, offset, 0x9900); + + e_shnum = ELF_HDR(format, *header, e_shnum); + + for (i = 0; i < e_shnum && result; i++) + result = annotate_elf_section_header(format, endian, &strings, &pos); + + return true; + +} diff --git a/plugins/readelf/section.h b/plugins/readelf/section.h new file mode 100644 index 0000000..ab0e50b --- /dev/null +++ b/plugins/readelf/section.h @@ -0,0 +1,37 @@ + +/* Chrysalide - Outil d'analyse de fichiers binaires + * header.h - prototypes pour l'annotation des en-têtes de section de binaires ELF + * + * Copyright (C) 2015 Cyrille Bagard + * + * This file is part of Chrysalide. + * + * OpenIDA is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 3 of the License, or + * (at your option) any later version. + * + * OpenIDA is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Foobar. If not, see <http://www.gnu.org/licenses/>. + */ + + +#ifndef _PLUGINS_READELF_SECTION_H +#define _PLUGINS_READELF_SECTION_H + + +#include <format/elf/elf.h> + + + +/* Charge tous les symboles liés aux en-têtes de section ELF. */ +bool annotate_elf_section_header_table(GElfFormat *); + + + +#endif /* _PLUGINS_READELF_SECTION_H */ |