Elfspy/ELFInfo.cpp

342 lines
9.9 KiB
C++
Raw Normal View History

2016-09-16 17:45:35 +02:00
#include "elfspy/ELFInfo.h"
#include <sys/mman.h>
#include <elf.h>
#include <unistd.h>
#include <string.h>
#include <dirent.h>
2018-03-16 23:39:49 +01:00
#include <unordered_map>
2016-09-16 17:45:35 +02:00
#include "elfspy/Report.h"
#include "elfspy/Fail.h"
#include "elfspy/MFile.h"
#include "elfspy/SectionHeader.h"
2016-09-16 17:45:35 +02:00
#ifdef __x86_64__
using Elf_Phdr = Elf64_Phdr;
using Elf_Ehdr = Elf64_Ehdr;
using Elf_Rel = Elf64_Rel;
using Elf_Rela = Elf64_Rela;
using Elf_Sym = Elf64_Sym;
#define ELF_STTYPE(X) ELF64_ST_TYPE(X)
#define ELF_STBIND(X) ELF64_ST_BIND(X)
#define ELF_R_SYM(X) ELF64_R_SYM(X)
#define ELF_R_TYPE(X) ELF64_R_TYPE(X)
#else
using Elf_Phdr = Elf32_Phdr;
using Elf_Ehdr = Elf32_Ehdr;
using Elf_Rel = Elf32_Rel;
using Elf_Rela = Elf32_Rela;
using Elf_Sym = Elf32_Sym;
#define ELF_STTYPE(X) ELF32_ST_TYPE(X)
#define ELF_STBIND(X) ELF32_ST_BIND(X)
#define ELF_R_SYM(X) ELF32_R_SYM(X)
#define ELF_R_TYPE(X) ELF32_R_TYPE(X)
#endif
namespace
{
long page_size = sysconf(_SC_PAGESIZE);
union Address
{
unsigned char* pointer_;
size_t value_;
void round_down();
void round_up();
};
inline void Address::round_down()
{
value_ /= page_size;
value_ *= page_size;
}
inline void Address::round_up()
{
value_ += page_size - 1;
value_ /= page_size;
value_ *= page_size;
}
2018-03-16 23:39:49 +01:00
std::string get_lib_core_name(const char* file_name)
{
// strip trailing [-major[.minor]].so[.n[.n]]
const char* root_end = nullptr;
const char* pos;
for (pos = file_name; *pos; ++pos) {
if (*pos == '-') {
root_end = pos;
} else if (strncmp(pos, ".so", 3) == 0) {
break;
}
}
if (!*pos) {
return { }; // no .so extension - not a shared lib
}
if (root_end) {
for (const char* c = root_end + 1; c != pos; ++c) {
if (!isdigit(*c) && *c != '.') {
// this is not major.minor format so don't exclude it
root_end = pos;
break;
}
}
} else {
root_end = pos;
}
return { file_name, root_end };
}
using Listing = std::unordered_map<std::string, std::string>;
std::unordered_map<std::string, Listing> debug_files;
// see if a library has a corresponding debug file where the symbols are kept
std::string get_debug_file_name(const char* file_name)
{
const char* slash = nullptr;
for (const char* seek = file_name; *seek; ++seek) {
if (*seek == '/') slash = seek;
}
if (!slash) return { };
2018-03-16 23:39:49 +01:00
// see if directory has already been scanned
std::string dir_name(file_name, slash);
auto insert = debug_files.emplace(std::move(dir_name), std::move(Listing{}));
auto& listing = *insert.first;
auto& entries = listing.second;
if (insert.second) {
const std::string& dir_name = listing.first;
std::string name;
name.reserve(1024); // reasonable unscientific value
name = "/usr/lib/debug";
name.append(dir_name);
DIR* dir = opendir(name.c_str());
if (!dir) return { };
name.push_back('/');
struct dirent* entry;
while ((entry = readdir(dir))) {
std::string root_name = get_lib_core_name(entry->d_name);
if (!root_name.empty()) {
entries.emplace(std::move(root_name), std::move(name + entry->d_name));
}
}
2018-03-16 23:39:49 +01:00
closedir(dir);
}
auto seek = entries.find(get_lib_core_name(slash + 1));
if (seek != entries.end()) {
return seek->second;
}
return { };
}
2016-09-16 17:45:35 +02:00
} // namespace
namespace spy
{
ELFInfo::ELFInfo(const char* name)
2016-09-16 17:45:35 +02:00
{
name_ = name;
files_.emplace_back(std::make_unique<MFile>(name));
std::string debug_file_name = get_debug_file_name(name);
if (!debug_file_name.empty()) {
files_.emplace_back(std::make_unique<MFile>(debug_file_name.c_str()));
}
2016-09-16 17:45:35 +02:00
if (!is_elf()) {
Fail() << "Not ELF data - no ELF header found in " << name;
}
}
ELFInfo::~ELFInfo()
{
}
ELFObject ELFInfo::prepare_object(unsigned char* base) const
{
ELFObject object;
object.name_ = name_;
object.base_ = base;
object.size_ = files_[0]->size();
unprotect(base);
return object;
}
2016-09-16 17:45:35 +02:00
bool ELFInfo::is_elf() const
{
auto elf = reinterpret_cast<const Elf_Ehdr*>(files_[0]->address());
2016-09-16 17:45:35 +02:00
return elf->e_ident[EI_MAG0] == ELFMAG0
&& elf->e_ident[EI_MAG1] == ELFMAG1
&& elf->e_ident[EI_MAG2] == ELFMAG2
&& elf->e_ident[EI_MAG3] == ELFMAG3;
}
SectionHeader ELFInfo::find_header(const char* name) const
2016-09-16 17:45:35 +02:00
{
for (auto& file : files_) {
auto elf = reinterpret_cast<const Elf_Ehdr*>(file->address());
auto header = file->address() + elf->e_shoff;
auto section_names =
reinterpret_cast<const Elf_Shdr*>(header + elf->e_shstrndx * elf->e_shentsize);
auto names = reinterpret_cast<const char*>(elf) + section_names->sh_offset;
// .shstrtab is the "section header" string table
// it is indexed in elf header
for (size_t n = 0; n != elf->e_shnum; ++n, header += elf->e_shentsize) {
auto section = reinterpret_cast<const Elf_Shdr*>(header);
if (strcmp(names + section->sh_name, name) == 0) {
return { file->address(), section };
}
2016-09-16 17:45:35 +02:00
}
}
if (strncmp(name_, "/lib", 4) != 0 && strncmp(name_, "/usr", 4) != 0) {
Report() << "no " << name << " section found in " << name_;
}
return { };
2016-09-16 17:45:35 +02:00
}
void ELFInfo::unprotect(unsigned char* base, const char* name) const
2016-09-16 17:45:35 +02:00
{
SectionHeader section = find_header(name);
2016-09-16 17:45:35 +02:00
if (section) {
Address begin;
Address end;
begin.pointer_ = base + section.header_->sh_addr;
end.pointer_ = begin.pointer_ + section.header_->sh_size;
2016-09-16 17:45:35 +02:00
begin.round_down();
end.round_up();
size_t size = end.value_ - begin.value_;
if (mprotect(begin.pointer_, size,
PROT_READ | PROT_WRITE | PROT_EXEC) != 0) {
spy::Fail() << "Cannot set " << name << " to writable for " << name_;
}
}
}
void ELFInfo::unprotect(unsigned char* base) const
2016-09-16 17:45:35 +02:00
{
// by default this memory is read only - ELFspy needs to change it
unprotect(base, ".got");
unprotect(base, ".got.plt");
}
const char* ELFInfo::find_name(size_t name_offset) const
2016-09-16 17:45:35 +02:00
{
SectionHeader str_tab = find_header(".dynstr");
2016-09-16 17:45:35 +02:00
if (!str_tab) {
return nullptr;
2016-09-16 17:45:35 +02:00
}
return reinterpret_cast<const char*>(str_tab.begin()) + name_offset;
}
ELFInfo::Symbol ELFInfo::get_symbol_rela(size_t value) const
{
Symbol result;
2016-09-16 17:45:35 +02:00
// find symbol by value in dynamic symbol table
size_t index = 0;
for (auto& symbol : find_header(".dynsym").as_section<Elf_Sym>()) {
if (ELF_STTYPE(symbol.st_info) == STT_FUNC && symbol.st_value == value) {
2016-09-16 17:45:35 +02:00
// the symbol is defined in this file as 0 is undefined.
// an STT_GNU_IFUNC will not match here as the function value will be the
// the resulting function of the resolver function and therefore at a
// different address
result.name_ = find_name(symbol.st_name);
2016-09-16 17:45:35 +02:00
break;
}
++index;
}
if (!result.name_) {
return result; // not found
}
// attempt to find symbol in .rela.plt using index from symbol table
for (auto& reloc : find_header(".rela.plt").as_section<Elf_Rela>()) {
if (ELF_R_TYPE(reloc.r_info) == R_X86_64_JUMP_SLOT) {
2016-09-16 17:45:35 +02:00
// find symbol by index
size_t symbol_index = ELF_R_SYM(reloc.r_info);
2016-09-16 17:45:35 +02:00
if (symbol_index == index) {
result.rela_offset_ = reloc.r_offset;
2016-09-16 17:45:35 +02:00
break;
}
}
}
// a symbol will only be present in .rela.plt iff it was used in the ELF
// object - otherwise only .dynsym and .symtab will contain it
// this means, no GOT entry for function and in this case result.rela_plt
// returns 0
return result;
}
// look for STT_IFUNC symbols by finding the function address in the relocated
// .rela.plt entries. STT_IFUNC are rare, but time(time_t*) is one of them
ELFInfo::Symbol ELFInfo::get_indirect_symbol_rela(const unsigned char* base,
2016-09-16 17:45:35 +02:00
void* function)
{
Symbol result;
// find function in relocated GOT
for (auto& reloc : find_header(".rela.plt").as_section<Elf_Rela>()) {
if (ELF_R_TYPE(reloc.r_info) == R_X86_64_IRELATIVE &&
*reinterpret_cast<void* const*>(base + reloc.r_offset) == function) {
result.rela_offset_ = reloc.r_offset;
2016-09-16 17:45:35 +02:00
// find symbol by r_addend in dynamic symbol table
for (auto& symbol : find_header(".dynsym").as_section<Elf_Sym>()) {
if (ELF_STTYPE(symbol.st_info) == STT_GNU_IFUNC
&& symbol.st_value == reloc.r_addend) {
result.name_ = find_name(symbol.st_name);
2016-09-16 17:45:35 +02:00
break;
}
}
break;
}
}
return result; // whether found or not
}
size_t ELFInfo::get_symbol_rela_dyn(const char* name)
{
// find symbol table
auto symbol_table = find_header(".dynsym").as_section<Elf_Sym>();
2016-09-16 17:45:35 +02:00
// find symbol in .rela.dyn
for (const char* section : { ".rela.dyn", ".rela.plt" }) {
for (auto& reloc : find_header(section).as_section<Elf_Rel>()) {
size_t symbol_index = ELF_R_SYM(reloc.r_info);
if (symbol_index < symbol_table.entries()) {
auto& symbol = symbol_table[symbol_index];
const char* symbol_name = find_name(symbol.st_name);
if (symbol_name && strcmp(name, symbol_name) == 0) {
return reloc.r_offset;
2016-09-16 17:45:35 +02:00
}
}
}
}
return 0;
}
std::unordered_map<std::string, unsigned char*>
ELFInfo::get_vtables(unsigned char* base)
{
if (!is_elf()) {
return { };
}
// get string table by finding the right strtab section
// .dynstr is for DYNSYM section (it has a non-zero address)
// .shstrtab is the "section header" string table, it is indexed in elf header
// .strtab is for SYMTAB, which is what we want here
SectionHeader str_tab = find_header(".strtab");
2016-09-16 17:45:35 +02:00
if (!str_tab) {
return { };
}
auto strings = reinterpret_cast<const char*>(str_tab.begin());
2016-09-16 17:45:35 +02:00
std::unordered_map<std::string, unsigned char*> vtables;
// look for virtual tables in symbol table
for (auto& symbol : find_header(".symtab").as_section<Elf_Sym>()) {
2016-09-16 17:45:35 +02:00
// check if is defined (value != 0)
if (symbol.st_value && ELF_STTYPE(symbol.st_info) == STT_OBJECT) {
2016-09-16 17:45:35 +02:00
// check if it is a virtual table (starts with "_ZTV")
auto name = strings + symbol.st_name;
2016-09-16 17:45:35 +02:00
if (strncmp(name, "_ZTV", 4) == 0) {
vtables[name + 4] = base + symbol.st_value;
2016-09-16 17:45:35 +02:00
}
}
}
return vtables;
}
} // namespace spy