Elfspy/ELFInfo.cpp

#include "elfspy/ELFInfo.h"

#include <sys/mman.h>
#include <elf.h>
#include <unistd.h>
#include <string.h>
#include <dirent.h>

#include "elfspy/Report.h"
#include "elfspy/Fail.h"
#include "elfspy/MFile.h"
#include "elfspy/SectionHeader.h"

#ifdef __x86_64__
using Elf_Phdr = Elf64_Phdr;
using Elf_Ehdr = Elf64_Ehdr;
using Elf_Rel = Elf64_Rel;
using Elf_Rela = Elf64_Rela;
using Elf_Sym = Elf64_Sym;
#define ELF_STTYPE(X) ELF64_ST_TYPE(X)
#define ELF_STBIND(X) ELF64_ST_BIND(X)
#define ELF_R_SYM(X) ELF64_R_SYM(X)
#define ELF_R_TYPE(X) ELF64_R_TYPE(X)
#else
using Elf_Phdr = Elf32_Phdr;
using Elf_Ehdr = Elf32_Ehdr;
using Elf_Rel = Elf32_Rel;
using Elf_Rela = Elf32_Rela;
using Elf_Sym = Elf32_Sym;
#define ELF_STTYPE(X) ELF32_ST_TYPE(X)
#define ELF_STBIND(X) ELF32_ST_BIND(X)
#define ELF_R_SYM(X) ELF32_R_SYM(X)
#define ELF_R_TYPE(X) ELF32_R_TYPE(X)
#endif

namespace
{
long page_size = sysconf(_SC_PAGESIZE);
union Address
{
  unsigned char* pointer_;
  size_t value_;
  void round_down();
  void round_up();
};

inline void Address::round_down()
{
  value_ /= page_size;
  value_ *= page_size;
}

inline void Address::round_up()
{
  value_ += page_size - 1;
  value_ /= page_size;
  value_ *= page_size;
}

// see if a library has a corresponding debug file where the symbols are kept
std::string get_debug_file_name(const char* file_name)
{
  const char* slash = nullptr;
  for (const char* seek = file_name; *seek; ++seek) {
    if (*seek == '/') slash = seek;
  }
  if (!slash) return { };
  std::string name;
  name = "/usr/lib/debug";
  name.append(file_name, slash - file_name);
  DIR* dir = opendir(name.c_str());
  if (!dir) return { };
  const char* period = nullptr;
  for (const char* seek = slash; *seek; ++seek) {
    if (*seek == '.') {
      period = seek;
      break;
    }
  }
  if (!period) return { };
  const char* base_name = slash + 1;
  size_t name_root_len = period - base_name;
  struct dirent* entry;
  while ((entry = readdir(dir))) {
    if (strncmp(entry->d_name, base_name, name_root_len) == 0) {
      const char* after_root = entry->d_name + name_root_len;
      // files in debug dir seem to be named libxxx-major.minor.so
      if (*after_root == '-' || *after_root == '.') {
        closedir(dir);
        name += '/';
        name += entry->d_name;
        return name;
      }
    }
  }
  closedir(dir);
  return { };
}

} // namespace

namespace spy
{

ELFInfo::ELFInfo(const char* name)
{
  name_ = name;
  files_.emplace_back(std::make_unique<MFile>(name));
  std::string debug_file_name = get_debug_file_name(name);
  if (!debug_file_name.empty()) {
    files_.emplace_back(std::make_unique<MFile>(debug_file_name.c_str()));
  }
  if (!is_elf()) {
    Fail() << "Not ELF data - no ELF header found in " << name;
  }
}

ELFInfo::~ELFInfo()
{
}

ELFObject ELFInfo::prepare_object(unsigned char* base) const
{
  ELFObject object;
  object.name_ = name_;
  object.base_ = base;
  object.size_ = files_[0]->size();
  unprotect(base);
  return object;
}

bool ELFInfo::is_elf() const
{
  auto elf = reinterpret_cast<const Elf_Ehdr*>(files_[0]->address());
  return elf->e_ident[EI_MAG0] == ELFMAG0
      && elf->e_ident[EI_MAG1] == ELFMAG1
      && elf->e_ident[EI_MAG2] == ELFMAG2
      && elf->e_ident[EI_MAG3] == ELFMAG3;
}

SectionHeader ELFInfo::find_header(const char* name) const
{
  for (auto& file : files_) {
    auto elf = reinterpret_cast<const Elf_Ehdr*>(file->address());
    auto header = file->address() + elf->e_shoff;
    auto section_names =
        reinterpret_cast<const Elf_Shdr*>(header + elf->e_shstrndx * elf->e_shentsize);
    auto names = reinterpret_cast<const char*>(elf) + section_names->sh_offset;
    // .shstrtab is the "section header" string table
    // it is indexed in elf header
    for (size_t n = 0; n != elf->e_shnum; ++n, header += elf->e_shentsize) {
      auto section = reinterpret_cast<const Elf_Shdr*>(header);
      if (strcmp(names + section->sh_name, name) == 0) {
        return { file->address(), section };
      }
    }
  }
  if (strncmp(name_, "/lib", 4) != 0 && strncmp(name_, "/usr", 4) != 0) {
    Report() << "no " << name << " section found in " << name_;
  }
  return { };
}

void ELFInfo::unprotect(unsigned char* base, const char* name) const
{
  SectionHeader section = find_header(name);
  if (section) {
    Address begin;
    Address end;
    begin.pointer_ = base + section.header_->sh_addr;
    end.pointer_ = begin.pointer_ + section.header_->sh_size;
    begin.round_down();
    end.round_up();
    size_t size = end.value_ - begin.value_;
    if (mprotect(begin.pointer_, size,
                 PROT_READ | PROT_WRITE | PROT_EXEC) != 0) {
      spy::Fail() << "Cannot set " << name << " to writable for " << name_;
    }
  }
}

void ELFInfo::unprotect(unsigned char* base) const
{
  // by default this memory is read only - ELFspy needs to change it
  unprotect(base, ".got");
  unprotect(base, ".got.plt");
}

const char* ELFInfo::find_name(size_t name_offset) const
{
  SectionHeader str_tab = find_header(".dynstr");
  if (!str_tab) {
    return nullptr;
  }
  return reinterpret_cast<const char*>(str_tab.begin()) + name_offset;
}

ELFInfo::Symbol ELFInfo::get_symbol_rela(size_t value) const
{
  Symbol result;
  // find symbol by value in dynamic symbol table
  size_t index = 0;
  for (auto& symbol : find_header(".dynsym").as_section<Elf_Sym>()) {
    if (ELF_STTYPE(symbol.st_info) == STT_FUNC && symbol.st_value == value) {
      // the symbol is defined in this file as 0 is undefined.
      // an STT_GNU_IFUNC will not match here as the function value will be the
      // the resulting function of the resolver function and therefore at a
      // different address
      result.name_ = find_name(symbol.st_name);
      break;
    }
    ++index;
  }
  if (!result.name_) {
    return result; // not found
  }
  // attempt to find symbol in .rela.plt using index from symbol table
  for (auto& reloc : find_header(".rela.plt").as_section<Elf_Rela>()) {
    if (ELF_R_TYPE(reloc.r_info) == R_X86_64_JUMP_SLOT) {
      // find symbol by index
      size_t symbol_index = ELF_R_SYM(reloc.r_info);
      if (symbol_index == index) {
        result.rela_offset_ = reloc.r_offset;
        break;
      }
    }
  }
  // a symbol will only be present in .rela.plt iff it was used in the ELF
  // object - otherwise only .dynsym and .symtab will contain it
  // this means, no GOT entry for function and in this case result.rela_plt
  // returns 0
  return result;
}

// look for STT_IFUNC symbols by finding the function address in the relocated
// .rela.plt entries. STT_IFUNC are rare, but time(time_t*) is one of them
ELFInfo::Symbol ELFInfo::get_indirect_symbol_rela(const unsigned char* base,
                                                  void* function)
{
  Symbol result;
  // find function in relocated GOT
  for (auto& reloc : find_header(".rela.plt").as_section<Elf_Rela>()) {
    if (ELF_R_TYPE(reloc.r_info) == R_X86_64_IRELATIVE &&
        *reinterpret_cast<void* const*>(base + reloc.r_offset) == function) {
      result.rela_offset_ = reloc.r_offset;
      // find symbol by r_addend in dynamic symbol table
      for (auto& symbol : find_header(".dynsym").as_section<Elf_Sym>()) {
        if (ELF_STTYPE(symbol.st_info) == STT_GNU_IFUNC
            && symbol.st_value == reloc.r_addend) {
          result.name_ = find_name(symbol.st_name);
          break;
        }
      }
      break;
    }
  }
  return result; // whether found or not
}

size_t ELFInfo::get_symbol_rela_dyn(const char* name)
{
  // find symbol table
  auto symbol_table = find_header(".dynsym").as_section<Elf_Sym>();
  // find symbol in .rela.dyn
  for (const char* section : { ".rela.dyn", ".rela.plt" }) {
    for (auto& reloc : find_header(section).as_section<Elf_Rel>()) {
      size_t symbol_index = ELF_R_SYM(reloc.r_info);
      if (symbol_index < symbol_table.entries()) {
        auto& symbol = symbol_table[symbol_index];
        const char* symbol_name = find_name(symbol.st_name);
        if (symbol_name && strcmp(name, symbol_name) == 0) {
          return reloc.r_offset;
        }
      }
    }
  }
  return 0;
}

std::unordered_map<std::string, unsigned char*>
ELFInfo::get_vtables(unsigned char* base)
{
  if (!is_elf()) {
    return { };
  }
  // get string table by finding the right strtab section
  // .dynstr is for DYNSYM section (it has a non-zero address)
  // .shstrtab is the "section header" string table, it is indexed in elf header
  // .strtab is for SYMTAB, which is what we want here
  SectionHeader str_tab = find_header(".strtab");
  if (!str_tab) {
    return { };
  }
  auto strings = reinterpret_cast<const char*>(str_tab.begin());
  std::unordered_map<std::string, unsigned char*> vtables;
  // look for virtual tables in symbol table
  for (auto& symbol : find_header(".symtab").as_section<Elf_Sym>()) {
    // check if is defined (value != 0)
    if (symbol.st_value && ELF_STTYPE(symbol.st_info) == STT_OBJECT) {
      // check if it is a virtual table (starts with "_ZTV")
      auto name = strings + symbol.st_name;
      if (strncmp(name, "_ZTV", 4) == 0) {
        vtables[name + 4] = base + symbol.st_value;
      }
    }
  }
  return vtables;
}

} // namespace spy