1 /* 2 * Copyright (c) Christos Zoulas 2003. 3 * All Rights Reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice immediately at the beginning of the file, without modification, 10 * this list of conditions, and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 19 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 #include "file.h" 28 29 #ifndef lint 30 FILE_RCSID("@(#)$File: readelf.c,v 1.103 2014/05/02 02:25:10 christos Exp $") 31 #endif 32 33 #ifdef BUILTIN_ELF 34 #include <string.h> 35 #include <ctype.h> 36 #include <stdlib.h> 37 #ifdef HAVE_UNISTD_H 38 #include <unistd.h> 39 #endif 40 41 #include "readelf.h" 42 #include "magic.h" 43 44 #ifdef ELFCORE 45 private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t, 46 off_t, int *); 47 #endif 48 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t, 49 off_t, int *, int); 50 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, 51 off_t, int *, int, int); 52 private size_t donote(struct magic_set *, void *, size_t, size_t, int, 53 int, size_t, int *); 54 55 #define ELF_ALIGN(a) ((((a) + align - 1) / align) * align) 56 57 #define isquote(c) (strchr("'\"`", (c)) != NULL) 58 59 private uint16_t getu16(int, uint16_t); 60 private uint32_t getu32(int, uint32_t); 61 private uint64_t getu64(int, uint64_t); 62 63 #define MAX_PHNUM 256 64 #define MAX_SHNUM 1024 65 66 private int 67 toomany(struct magic_set *ms, const char *name, uint16_t num) 68 { 69 if (file_printf(ms, ", too many %s header sections (%u)", name, num 70 ) == -1) 71 return -1; 72 return 0; 73 } 74 75 private uint16_t 76 getu16(int swap, uint16_t value) 77 { 78 union { 79 uint16_t ui; 80 char c[2]; 81 } retval, tmpval; 82 83 if (swap) { 84 tmpval.ui = value; 85 86 retval.c[0] = tmpval.c[1]; 87 retval.c[1] = tmpval.c[0]; 88 89 return retval.ui; 90 } else 91 return value; 92 } 93 94 private uint32_t 95 getu32(int swap, uint32_t value) 96 { 97 union { 98 uint32_t ui; 99 char c[4]; 100 } retval, tmpval; 101 102 if (swap) { 103 tmpval.ui = value; 104 105 retval.c[0] = tmpval.c[3]; 106 retval.c[1] = tmpval.c[2]; 107 retval.c[2] = tmpval.c[1]; 108 retval.c[3] = tmpval.c[0]; 109 110 return retval.ui; 111 } else 112 return value; 113 } 114 115 private uint64_t 116 getu64(int swap, uint64_t value) 117 { 118 union { 119 uint64_t ui; 120 char c[8]; 121 } retval, tmpval; 122 123 if (swap) { 124 tmpval.ui = value; 125 126 retval.c[0] = tmpval.c[7]; 127 retval.c[1] = tmpval.c[6]; 128 retval.c[2] = tmpval.c[5]; 129 retval.c[3] = tmpval.c[4]; 130 retval.c[4] = tmpval.c[3]; 131 retval.c[5] = tmpval.c[2]; 132 retval.c[6] = tmpval.c[1]; 133 retval.c[7] = tmpval.c[0]; 134 135 return retval.ui; 136 } else 137 return value; 138 } 139 140 #define elf_getu16(swap, value) getu16(swap, value) 141 #define elf_getu32(swap, value) getu32(swap, value) 142 #define elf_getu64(swap, value) getu64(swap, value) 143 144 #define xsh_addr (clazz == ELFCLASS32 \ 145 ? (void *)&sh32 \ 146 : (void *)&sh64) 147 #define xsh_sizeof (clazz == ELFCLASS32 \ 148 ? sizeof(sh32) \ 149 : sizeof(sh64)) 150 #define xsh_size (size_t)(clazz == ELFCLASS32 \ 151 ? elf_getu32(swap, sh32.sh_size) \ 152 : elf_getu64(swap, sh64.sh_size)) 153 #define xsh_offset (off_t)(clazz == ELFCLASS32 \ 154 ? elf_getu32(swap, sh32.sh_offset) \ 155 : elf_getu64(swap, sh64.sh_offset)) 156 #define xsh_type (clazz == ELFCLASS32 \ 157 ? elf_getu32(swap, sh32.sh_type) \ 158 : elf_getu32(swap, sh64.sh_type)) 159 #define xsh_name (clazz == ELFCLASS32 \ 160 ? elf_getu32(swap, sh32.sh_name) \ 161 : elf_getu32(swap, sh64.sh_name)) 162 #define xph_addr (clazz == ELFCLASS32 \ 163 ? (void *) &ph32 \ 164 : (void *) &ph64) 165 #define xph_sizeof (clazz == ELFCLASS32 \ 166 ? sizeof(ph32) \ 167 : sizeof(ph64)) 168 #define xph_type (clazz == ELFCLASS32 \ 169 ? elf_getu32(swap, ph32.p_type) \ 170 : elf_getu32(swap, ph64.p_type)) 171 #define xph_offset (off_t)(clazz == ELFCLASS32 \ 172 ? elf_getu32(swap, ph32.p_offset) \ 173 : elf_getu64(swap, ph64.p_offset)) 174 #define xph_align (size_t)((clazz == ELFCLASS32 \ 175 ? (off_t) (ph32.p_align ? \ 176 elf_getu32(swap, ph32.p_align) : 4) \ 177 : (off_t) (ph64.p_align ? \ 178 elf_getu64(swap, ph64.p_align) : 4))) 179 #define xph_filesz (size_t)((clazz == ELFCLASS32 \ 180 ? elf_getu32(swap, ph32.p_filesz) \ 181 : elf_getu64(swap, ph64.p_filesz))) 182 #define xnh_addr (clazz == ELFCLASS32 \ 183 ? (void *)&nh32 \ 184 : (void *)&nh64) 185 #define xph_memsz (size_t)((clazz == ELFCLASS32 \ 186 ? elf_getu32(swap, ph32.p_memsz) \ 187 : elf_getu64(swap, ph64.p_memsz))) 188 #define xnh_sizeof (clazz == ELFCLASS32 \ 189 ? sizeof nh32 \ 190 : sizeof nh64) 191 #define xnh_type (clazz == ELFCLASS32 \ 192 ? elf_getu32(swap, nh32.n_type) \ 193 : elf_getu32(swap, nh64.n_type)) 194 #define xnh_namesz (clazz == ELFCLASS32 \ 195 ? elf_getu32(swap, nh32.n_namesz) \ 196 : elf_getu32(swap, nh64.n_namesz)) 197 #define xnh_descsz (clazz == ELFCLASS32 \ 198 ? elf_getu32(swap, nh32.n_descsz) \ 199 : elf_getu32(swap, nh64.n_descsz)) 200 #define prpsoffsets(i) (clazz == ELFCLASS32 \ 201 ? prpsoffsets32[i] \ 202 : prpsoffsets64[i]) 203 #define xcap_addr (clazz == ELFCLASS32 \ 204 ? (void *)&cap32 \ 205 : (void *)&cap64) 206 #define xcap_sizeof (clazz == ELFCLASS32 \ 207 ? sizeof cap32 \ 208 : sizeof cap64) 209 #define xcap_tag (clazz == ELFCLASS32 \ 210 ? elf_getu32(swap, cap32.c_tag) \ 211 : elf_getu64(swap, cap64.c_tag)) 212 #define xcap_val (clazz == ELFCLASS32 \ 213 ? elf_getu32(swap, cap32.c_un.c_val) \ 214 : elf_getu64(swap, cap64.c_un.c_val)) 215 216 #ifdef ELFCORE 217 /* 218 * Try larger offsets first to avoid false matches 219 * from earlier data that happen to look like strings. 220 */ 221 static const size_t prpsoffsets32[] = { 222 #ifdef USE_NT_PSINFO 223 104, /* SunOS 5.x (command line) */ 224 88, /* SunOS 5.x (short name) */ 225 #endif /* USE_NT_PSINFO */ 226 227 100, /* SunOS 5.x (command line) */ 228 84, /* SunOS 5.x (short name) */ 229 230 44, /* Linux (command line) */ 231 28, /* Linux 2.0.36 (short name) */ 232 233 8, /* FreeBSD */ 234 }; 235 236 static const size_t prpsoffsets64[] = { 237 #ifdef USE_NT_PSINFO 238 152, /* SunOS 5.x (command line) */ 239 136, /* SunOS 5.x (short name) */ 240 #endif /* USE_NT_PSINFO */ 241 242 136, /* SunOS 5.x, 64-bit (command line) */ 243 120, /* SunOS 5.x, 64-bit (short name) */ 244 245 56, /* Linux (command line) */ 246 40, /* Linux (tested on core from 2.4.x, short name) */ 247 248 16, /* FreeBSD, 64-bit */ 249 }; 250 251 #define NOFFSETS32 (sizeof prpsoffsets32 / sizeof prpsoffsets32[0]) 252 #define NOFFSETS64 (sizeof prpsoffsets64 / sizeof prpsoffsets64[0]) 253 254 #define NOFFSETS (clazz == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64) 255 256 /* 257 * Look through the program headers of an executable image, searching 258 * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or 259 * "FreeBSD"; if one is found, try looking in various places in its 260 * contents for a 16-character string containing only printable 261 * characters - if found, that string should be the name of the program 262 * that dropped core. Note: right after that 16-character string is, 263 * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and 264 * Linux, a longer string (80 characters, in 5.x, probably other 265 * SVR4-flavored systems, and Linux) containing the start of the 266 * command line for that program. 267 * 268 * SunOS 5.x core files contain two PT_NOTE sections, with the types 269 * NT_PRPSINFO (old) and NT_PSINFO (new). These structs contain the 270 * same info about the command name and command line, so it probably 271 * isn't worthwhile to look for NT_PSINFO, but the offsets are provided 272 * above (see USE_NT_PSINFO), in case we ever decide to do so. The 273 * NT_PRPSINFO and NT_PSINFO sections are always in order and adjacent; 274 * the SunOS 5.x file command relies on this (and prefers the latter). 275 * 276 * The signal number probably appears in a section of type NT_PRSTATUS, 277 * but that's also rather OS-dependent, in ways that are harder to 278 * dissect with heuristics, so I'm not bothering with the signal number. 279 * (I suppose the signal number could be of interest in situations where 280 * you don't have the binary of the program that dropped core; if you 281 * *do* have that binary, the debugger will probably tell you what 282 * signal it was.) 283 */ 284 285 #define OS_STYLE_SVR4 0 286 #define OS_STYLE_FREEBSD 1 287 #define OS_STYLE_NETBSD 2 288 289 private const char os_style_names[][8] = { 290 "SVR4", 291 "FreeBSD", 292 "NetBSD", 293 }; 294 295 #define FLAGS_DID_CORE 0x01 296 #define FLAGS_DID_NOTE 0x02 297 #define FLAGS_DID_BUILD_ID 0x04 298 #define FLAGS_DID_CORE_STYLE 0x08 299 #define FLAGS_IS_CORE 0x10 300 301 private int 302 dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 303 int num, size_t size, off_t fsize, int *flags) 304 { 305 Elf32_Phdr ph32; 306 Elf64_Phdr ph64; 307 size_t offset, len; 308 unsigned char nbuf[BUFSIZ]; 309 ssize_t bufsize; 310 311 if (size != xph_sizeof) { 312 if (file_printf(ms, ", corrupted program header size") == -1) 313 return -1; 314 return 0; 315 } 316 317 /* 318 * Loop through all the program headers. 319 */ 320 for ( ; num; num--) { 321 if (pread(fd, xph_addr, xph_sizeof, off) == -1) { 322 file_badread(ms); 323 return -1; 324 } 325 off += size; 326 327 if (xph_offset > fsize) { 328 /* Perhaps warn here */ 329 continue; 330 } 331 332 if (xph_type != PT_NOTE) 333 continue; 334 335 /* 336 * This is a PT_NOTE section; loop through all the notes 337 * in the section. 338 */ 339 len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf); 340 if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) { 341 file_badread(ms); 342 return -1; 343 } 344 offset = 0; 345 for (;;) { 346 if (offset >= (size_t)bufsize) 347 break; 348 offset = donote(ms, nbuf, offset, (size_t)bufsize, 349 clazz, swap, 4, flags); 350 if (offset == 0) 351 break; 352 353 } 354 } 355 return 0; 356 } 357 #endif 358 359 static void 360 do_note_netbsd_version(struct magic_set *ms, int swap, void *v) 361 { 362 uint32_t desc; 363 (void)memcpy(&desc, v, sizeof(desc)); 364 desc = elf_getu32(swap, desc); 365 366 if (file_printf(ms, ", for NetBSD") == -1) 367 return; 368 /* 369 * The version number used to be stuck as 199905, and was thus 370 * basically content-free. Newer versions of NetBSD have fixed 371 * this and now use the encoding of __NetBSD_Version__: 372 * 373 * MMmmrrpp00 374 * 375 * M = major version 376 * m = minor version 377 * r = release ["",A-Z,Z[A-Z] but numeric] 378 * p = patchlevel 379 */ 380 if (desc > 100000000U) { 381 uint32_t ver_patch = (desc / 100) % 100; 382 uint32_t ver_rel = (desc / 10000) % 100; 383 uint32_t ver_min = (desc / 1000000) % 100; 384 uint32_t ver_maj = desc / 100000000; 385 386 if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1) 387 return; 388 if (ver_rel == 0 && ver_patch != 0) { 389 if (file_printf(ms, ".%u", ver_patch) == -1) 390 return; 391 } else if (ver_rel != 0) { 392 while (ver_rel > 26) { 393 if (file_printf(ms, "Z") == -1) 394 return; 395 ver_rel -= 26; 396 } 397 if (file_printf(ms, "%c", 'A' + ver_rel - 1) 398 == -1) 399 return; 400 } 401 } 402 } 403 404 static void 405 do_note_freebsd_version(struct magic_set *ms, int swap, void *v) 406 { 407 uint32_t desc; 408 409 (void)memcpy(&desc, v, sizeof(desc)); 410 desc = elf_getu32(swap, desc); 411 if (file_printf(ms, ", for FreeBSD") == -1) 412 return; 413 414 /* 415 * Contents is __FreeBSD_version, whose relation to OS 416 * versions is defined by a huge table in the Porter's 417 * Handbook. This is the general scheme: 418 * 419 * Releases: 420 * Mmp000 (before 4.10) 421 * Mmi0p0 (before 5.0) 422 * Mmm0p0 423 * 424 * Development branches: 425 * Mmpxxx (before 4.6) 426 * Mmp1xx (before 4.10) 427 * Mmi1xx (before 5.0) 428 * M000xx (pre-M.0) 429 * Mmm1xx 430 * 431 * M = major version 432 * m = minor version 433 * i = minor version increment (491000 -> 4.10) 434 * p = patchlevel 435 * x = revision 436 * 437 * The first release of FreeBSD to use ELF by default 438 * was version 3.0. 439 */ 440 if (desc == 460002) { 441 if (file_printf(ms, " 4.6.2") == -1) 442 return; 443 } else if (desc < 460100) { 444 if (file_printf(ms, " %d.%d", desc / 100000, 445 desc / 10000 % 10) == -1) 446 return; 447 if (desc / 1000 % 10 > 0) 448 if (file_printf(ms, ".%d", desc / 1000 % 10) == -1) 449 return; 450 if ((desc % 1000 > 0) || (desc % 100000 == 0)) 451 if (file_printf(ms, " (%d)", desc) == -1) 452 return; 453 } else if (desc < 500000) { 454 if (file_printf(ms, " %d.%d", desc / 100000, 455 desc / 10000 % 10 + desc / 1000 % 10) == -1) 456 return; 457 if (desc / 100 % 10 > 0) { 458 if (file_printf(ms, " (%d)", desc) == -1) 459 return; 460 } else if (desc / 10 % 10 > 0) { 461 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 462 return; 463 } 464 } else { 465 if (file_printf(ms, " %d.%d", desc / 100000, 466 desc / 1000 % 100) == -1) 467 return; 468 if ((desc / 100 % 10 > 0) || 469 (desc % 100000 / 100 == 0)) { 470 if (file_printf(ms, " (%d)", desc) == -1) 471 return; 472 } else if (desc / 10 % 10 > 0) { 473 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 474 return; 475 } 476 } 477 } 478 479 private size_t 480 donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, 481 int clazz, int swap, size_t align, int *flags) 482 { 483 Elf32_Nhdr nh32; 484 Elf64_Nhdr nh64; 485 size_t noff, doff; 486 #ifdef ELFCORE 487 int os_style = -1; 488 #endif 489 uint32_t namesz, descsz; 490 unsigned char *nbuf = CAST(unsigned char *, vbuf); 491 492 if (xnh_sizeof + offset > size) { 493 /* 494 * We're out of note headers. 495 */ 496 return xnh_sizeof + offset; 497 } 498 499 (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); 500 offset += xnh_sizeof; 501 502 namesz = xnh_namesz; 503 descsz = xnh_descsz; 504 if ((namesz == 0) && (descsz == 0)) { 505 /* 506 * We're out of note headers. 507 */ 508 return (offset >= size) ? offset : size; 509 } 510 511 if (namesz & 0x80000000) { 512 (void)file_printf(ms, ", bad note name size 0x%lx", 513 (unsigned long)namesz); 514 return 0; 515 } 516 517 if (descsz & 0x80000000) { 518 (void)file_printf(ms, ", bad note description size 0x%lx", 519 (unsigned long)descsz); 520 return 0; 521 } 522 523 524 noff = offset; 525 doff = ELF_ALIGN(offset + namesz); 526 527 if (offset + namesz > size) { 528 /* 529 * We're past the end of the buffer. 530 */ 531 return doff; 532 } 533 534 offset = ELF_ALIGN(doff + descsz); 535 if (doff + descsz > size) { 536 /* 537 * We're past the end of the buffer. 538 */ 539 return (offset >= size) ? offset : size; 540 } 541 542 if ((*flags & (FLAGS_DID_NOTE|FLAGS_DID_BUILD_ID)) == 543 (FLAGS_DID_NOTE|FLAGS_DID_BUILD_ID)) 544 goto core; 545 546 if (namesz == 5 && strcmp((char *)&nbuf[noff], "SuSE") == 0 && 547 xnh_type == NT_GNU_VERSION && descsz == 2) { 548 file_printf(ms, ", for SuSE %d.%d", nbuf[doff], nbuf[doff + 1]); 549 } 550 if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && 551 xnh_type == NT_GNU_VERSION && descsz == 16) { 552 uint32_t desc[4]; 553 (void)memcpy(desc, &nbuf[doff], sizeof(desc)); 554 555 if (file_printf(ms, ", for GNU/") == -1) 556 return size; 557 switch (elf_getu32(swap, desc[0])) { 558 case GNU_OS_LINUX: 559 if (file_printf(ms, "Linux") == -1) 560 return size; 561 break; 562 case GNU_OS_HURD: 563 if (file_printf(ms, "Hurd") == -1) 564 return size; 565 break; 566 case GNU_OS_SOLARIS: 567 if (file_printf(ms, "Solaris") == -1) 568 return size; 569 break; 570 case GNU_OS_KFREEBSD: 571 if (file_printf(ms, "kFreeBSD") == -1) 572 return size; 573 break; 574 case GNU_OS_KNETBSD: 575 if (file_printf(ms, "kNetBSD") == -1) 576 return size; 577 break; 578 default: 579 if (file_printf(ms, "<unknown>") == -1) 580 return size; 581 } 582 if (file_printf(ms, " %d.%d.%d", elf_getu32(swap, desc[1]), 583 elf_getu32(swap, desc[2]), elf_getu32(swap, desc[3])) == -1) 584 return size; 585 *flags |= FLAGS_DID_NOTE; 586 return size; 587 } 588 589 if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && 590 xnh_type == NT_GNU_BUILD_ID && (descsz == 16 || descsz == 20)) { 591 uint8_t desc[20]; 592 uint32_t i; 593 if (file_printf(ms, ", BuildID[%s]=", descsz == 16 ? "md5/uuid" : 594 "sha1") == -1) 595 return size; 596 (void)memcpy(desc, &nbuf[doff], descsz); 597 for (i = 0; i < descsz; i++) 598 if (file_printf(ms, "%02x", desc[i]) == -1) 599 return size; 600 *flags |= FLAGS_DID_BUILD_ID; 601 } 602 603 if (namesz == 4 && strcmp((char *)&nbuf[noff], "PaX") == 0 && 604 xnh_type == NT_NETBSD_PAX && descsz == 4) { 605 static const char *pax[] = { 606 "+mprotect", 607 "-mprotect", 608 "+segvguard", 609 "-segvguard", 610 "+ASLR", 611 "-ASLR", 612 }; 613 uint32_t desc; 614 size_t i; 615 int did = 0; 616 617 (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); 618 desc = elf_getu32(swap, desc); 619 620 if (desc && file_printf(ms, ", PaX: ") == -1) 621 return size; 622 623 for (i = 0; i < __arraycount(pax); i++) { 624 if (((1 << i) & desc) == 0) 625 continue; 626 if (file_printf(ms, "%s%s", did++ ? "," : "", 627 pax[i]) == -1) 628 return size; 629 } 630 } 631 632 if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0) { 633 switch (xnh_type) { 634 case NT_NETBSD_VERSION: 635 if (descsz == 4) { 636 do_note_netbsd_version(ms, swap, &nbuf[doff]); 637 *flags |= FLAGS_DID_NOTE; 638 return size; 639 } 640 break; 641 case NT_NETBSD_MARCH: 642 if (file_printf(ms, ", compiled for: %.*s", (int)descsz, 643 (const char *)&nbuf[doff]) == -1) 644 return size; 645 break; 646 case NT_NETBSD_CMODEL: 647 if (file_printf(ms, ", compiler model: %.*s", 648 (int)descsz, (const char *)&nbuf[doff]) == -1) 649 return size; 650 break; 651 default: 652 if (file_printf(ms, ", note=%u", xnh_type) == -1) 653 return size; 654 break; 655 } 656 return size; 657 } 658 659 if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0) { 660 if (xnh_type == NT_FREEBSD_VERSION && descsz == 4) { 661 do_note_freebsd_version(ms, swap, &nbuf[doff]); 662 *flags |= FLAGS_DID_NOTE; 663 return size; 664 } 665 } 666 667 if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 && 668 xnh_type == NT_OPENBSD_VERSION && descsz == 4) { 669 if (file_printf(ms, ", for OpenBSD") == -1) 670 return size; 671 /* Content of note is always 0 */ 672 *flags |= FLAGS_DID_NOTE; 673 return size; 674 } 675 676 if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 && 677 xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) { 678 uint32_t desc; 679 if (file_printf(ms, ", for DragonFly") == -1) 680 return size; 681 (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); 682 desc = elf_getu32(swap, desc); 683 if (file_printf(ms, " %d.%d.%d", desc / 100000, 684 desc / 10000 % 10, desc % 10000) == -1) 685 return size; 686 *flags |= FLAGS_DID_NOTE; 687 return size; 688 } 689 690 core: 691 /* 692 * Sigh. The 2.0.36 kernel in Debian 2.1, at 693 * least, doesn't correctly implement name 694 * sections, in core dumps, as specified by 695 * the "Program Linking" section of "UNIX(R) System 696 * V Release 4 Programmer's Guide: ANSI C and 697 * Programming Support Tools", because my copy 698 * clearly says "The first 'namesz' bytes in 'name' 699 * contain a *null-terminated* [emphasis mine] 700 * character representation of the entry's owner 701 * or originator", but the 2.0.36 kernel code 702 * doesn't include the terminating null in the 703 * name.... 704 */ 705 if ((namesz == 4 && strncmp((char *)&nbuf[noff], "CORE", 4) == 0) || 706 (namesz == 5 && strcmp((char *)&nbuf[noff], "CORE") == 0)) { 707 os_style = OS_STYLE_SVR4; 708 } 709 710 if ((namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0)) { 711 os_style = OS_STYLE_FREEBSD; 712 } 713 714 if ((namesz >= 11 && strncmp((char *)&nbuf[noff], "NetBSD-CORE", 11) 715 == 0)) { 716 os_style = OS_STYLE_NETBSD; 717 } 718 719 #ifdef ELFCORE 720 if ((*flags & FLAGS_DID_CORE) != 0) 721 return size; 722 723 if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) { 724 if (file_printf(ms, ", %s-style", os_style_names[os_style]) 725 == -1) 726 return size; 727 *flags |= FLAGS_DID_CORE_STYLE; 728 } 729 730 switch (os_style) { 731 case OS_STYLE_NETBSD: 732 if (xnh_type == NT_NETBSD_CORE_PROCINFO) { 733 uint32_t signo; 734 /* 735 * Extract the program name. It is at 736 * offset 0x7c, and is up to 32-bytes, 737 * including the terminating NUL. 738 */ 739 if (file_printf(ms, ", from '%.31s'", 740 &nbuf[doff + 0x7c]) == -1) 741 return size; 742 743 /* 744 * Extract the signal number. It is at 745 * offset 0x08. 746 */ 747 (void)memcpy(&signo, &nbuf[doff + 0x08], 748 sizeof(signo)); 749 if (file_printf(ms, " (signal %u)", 750 elf_getu32(swap, signo)) == -1) 751 return size; 752 *flags |= FLAGS_DID_CORE; 753 return size; 754 } 755 break; 756 757 default: 758 if (xnh_type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) { 759 size_t i, j; 760 unsigned char c; 761 /* 762 * Extract the program name. We assume 763 * it to be 16 characters (that's what it 764 * is in SunOS 5.x and Linux). 765 * 766 * Unfortunately, it's at a different offset 767 * in various OSes, so try multiple offsets. 768 * If the characters aren't all printable, 769 * reject it. 770 */ 771 for (i = 0; i < NOFFSETS; i++) { 772 unsigned char *cname, *cp; 773 size_t reloffset = prpsoffsets(i); 774 size_t noffset = doff + reloffset; 775 size_t k; 776 for (j = 0; j < 16; j++, noffset++, 777 reloffset++) { 778 /* 779 * Make sure we're not past 780 * the end of the buffer; if 781 * we are, just give up. 782 */ 783 if (noffset >= size) 784 goto tryanother; 785 786 /* 787 * Make sure we're not past 788 * the end of the contents; 789 * if we are, this obviously 790 * isn't the right offset. 791 */ 792 if (reloffset >= descsz) 793 goto tryanother; 794 795 c = nbuf[noffset]; 796 if (c == '\0') { 797 /* 798 * A '\0' at the 799 * beginning is 800 * obviously wrong. 801 * Any other '\0' 802 * means we're done. 803 */ 804 if (j == 0) 805 goto tryanother; 806 else 807 break; 808 } else { 809 /* 810 * A nonprintable 811 * character is also 812 * wrong. 813 */ 814 if (!isprint(c) || isquote(c)) 815 goto tryanother; 816 } 817 } 818 /* 819 * Well, that worked. 820 */ 821 822 /* 823 * Try next offsets, in case this match is 824 * in the middle of a string. 825 */ 826 for (k = i + 1 ; k < NOFFSETS ; k++) { 827 size_t no; 828 int adjust = 1; 829 if (prpsoffsets(k) >= prpsoffsets(i)) 830 continue; 831 for (no = doff + prpsoffsets(k); 832 no < doff + prpsoffsets(i); no++) 833 adjust = adjust 834 && isprint(nbuf[no]); 835 if (adjust) 836 i = k; 837 } 838 839 cname = (unsigned char *) 840 &nbuf[doff + prpsoffsets(i)]; 841 for (cp = cname; *cp && isprint(*cp); cp++) 842 continue; 843 /* 844 * Linux apparently appends a space at the end 845 * of the command line: remove it. 846 */ 847 while (cp > cname && isspace(cp[-1])) 848 cp--; 849 if (file_printf(ms, ", from '%.*s'", 850 (int)(cp - cname), cname) == -1) 851 return size; 852 *flags |= FLAGS_DID_CORE; 853 return size; 854 855 tryanother: 856 ; 857 } 858 } 859 break; 860 } 861 #endif 862 return offset; 863 } 864 865 /* SunOS 5.x hardware capability descriptions */ 866 typedef struct cap_desc { 867 uint64_t cd_mask; 868 const char *cd_name; 869 } cap_desc_t; 870 871 static const cap_desc_t cap_desc_sparc[] = { 872 { AV_SPARC_MUL32, "MUL32" }, 873 { AV_SPARC_DIV32, "DIV32" }, 874 { AV_SPARC_FSMULD, "FSMULD" }, 875 { AV_SPARC_V8PLUS, "V8PLUS" }, 876 { AV_SPARC_POPC, "POPC" }, 877 { AV_SPARC_VIS, "VIS" }, 878 { AV_SPARC_VIS2, "VIS2" }, 879 { AV_SPARC_ASI_BLK_INIT, "ASI_BLK_INIT" }, 880 { AV_SPARC_FMAF, "FMAF" }, 881 { AV_SPARC_FJFMAU, "FJFMAU" }, 882 { AV_SPARC_IMA, "IMA" }, 883 { 0, NULL } 884 }; 885 886 static const cap_desc_t cap_desc_386[] = { 887 { AV_386_FPU, "FPU" }, 888 { AV_386_TSC, "TSC" }, 889 { AV_386_CX8, "CX8" }, 890 { AV_386_SEP, "SEP" }, 891 { AV_386_AMD_SYSC, "AMD_SYSC" }, 892 { AV_386_CMOV, "CMOV" }, 893 { AV_386_MMX, "MMX" }, 894 { AV_386_AMD_MMX, "AMD_MMX" }, 895 { AV_386_AMD_3DNow, "AMD_3DNow" }, 896 { AV_386_AMD_3DNowx, "AMD_3DNowx" }, 897 { AV_386_FXSR, "FXSR" }, 898 { AV_386_SSE, "SSE" }, 899 { AV_386_SSE2, "SSE2" }, 900 { AV_386_PAUSE, "PAUSE" }, 901 { AV_386_SSE3, "SSE3" }, 902 { AV_386_MON, "MON" }, 903 { AV_386_CX16, "CX16" }, 904 { AV_386_AHF, "AHF" }, 905 { AV_386_TSCP, "TSCP" }, 906 { AV_386_AMD_SSE4A, "AMD_SSE4A" }, 907 { AV_386_POPCNT, "POPCNT" }, 908 { AV_386_AMD_LZCNT, "AMD_LZCNT" }, 909 { AV_386_SSSE3, "SSSE3" }, 910 { AV_386_SSE4_1, "SSE4.1" }, 911 { AV_386_SSE4_2, "SSE4.2" }, 912 { 0, NULL } 913 }; 914 915 private int 916 doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num, 917 size_t size, off_t fsize, int *flags, int mach, int strtab) 918 { 919 Elf32_Shdr sh32; 920 Elf64_Shdr sh64; 921 int stripped = 1; 922 size_t nbadcap = 0; 923 void *nbuf; 924 off_t noff, coff, name_off; 925 uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilites */ 926 uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilites */ 927 char name[50]; 928 929 if (size != xsh_sizeof) { 930 if (file_printf(ms, ", corrupted section header size") == -1) 931 return -1; 932 return 0; 933 } 934 935 /* Read offset of name section to be able to read section names later */ 936 if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) { 937 file_badread(ms); 938 return -1; 939 } 940 name_off = xsh_offset; 941 942 for ( ; num; num--) { 943 /* Read the name of this section. */ 944 if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) { 945 file_badread(ms); 946 return -1; 947 } 948 name[sizeof(name) - 1] = '\0'; 949 if (strcmp(name, ".debug_info") == 0) 950 stripped = 0; 951 952 if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) { 953 file_badread(ms); 954 return -1; 955 } 956 off += size; 957 958 /* Things we can determine before we seek */ 959 switch (xsh_type) { 960 case SHT_SYMTAB: 961 #if 0 962 case SHT_DYNSYM: 963 #endif 964 stripped = 0; 965 break; 966 default: 967 if (xsh_offset > fsize) { 968 /* Perhaps warn here */ 969 continue; 970 } 971 break; 972 } 973 974 /* Things we can determine when we seek */ 975 switch (xsh_type) { 976 case SHT_NOTE: 977 if ((nbuf = malloc(xsh_size)) == NULL) { 978 file_error(ms, errno, "Cannot allocate memory" 979 " for note"); 980 return -1; 981 } 982 if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) { 983 file_badread(ms); 984 free(nbuf); 985 return -1; 986 } 987 988 noff = 0; 989 for (;;) { 990 if (noff >= (off_t)xsh_size) 991 break; 992 noff = donote(ms, nbuf, (size_t)noff, 993 xsh_size, clazz, swap, 4, flags); 994 if (noff == 0) 995 break; 996 } 997 free(nbuf); 998 break; 999 case SHT_SUNW_cap: 1000 switch (mach) { 1001 case EM_SPARC: 1002 case EM_SPARCV9: 1003 case EM_IA_64: 1004 case EM_386: 1005 case EM_AMD64: 1006 break; 1007 default: 1008 goto skip; 1009 } 1010 1011 if (nbadcap > 5) 1012 break; 1013 if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) { 1014 file_badseek(ms); 1015 return -1; 1016 } 1017 coff = 0; 1018 for (;;) { 1019 Elf32_Cap cap32; 1020 Elf64_Cap cap64; 1021 char cbuf[/*CONSTCOND*/ 1022 MAX(sizeof cap32, sizeof cap64)]; 1023 if ((coff += xcap_sizeof) > (off_t)xsh_size) 1024 break; 1025 if (read(fd, cbuf, (size_t)xcap_sizeof) != 1026 (ssize_t)xcap_sizeof) { 1027 file_badread(ms); 1028 return -1; 1029 } 1030 if (cbuf[0] == 'A') { 1031 #ifdef notyet 1032 char *p = cbuf + 1; 1033 uint32_t len, tag; 1034 memcpy(&len, p, sizeof(len)); 1035 p += 4; 1036 len = getu32(swap, len); 1037 if (memcmp("gnu", p, 3) != 0) { 1038 if (file_printf(ms, 1039 ", unknown capability %.3s", p) 1040 == -1) 1041 return -1; 1042 break; 1043 } 1044 p += strlen(p) + 1; 1045 tag = *p++; 1046 memcpy(&len, p, sizeof(len)); 1047 p += 4; 1048 len = getu32(swap, len); 1049 if (tag != 1) { 1050 if (file_printf(ms, ", unknown gnu" 1051 " capability tag %d", tag) 1052 == -1) 1053 return -1; 1054 break; 1055 } 1056 // gnu attributes 1057 #endif 1058 break; 1059 } 1060 (void)memcpy(xcap_addr, cbuf, xcap_sizeof); 1061 switch (xcap_tag) { 1062 case CA_SUNW_NULL: 1063 break; 1064 case CA_SUNW_HW_1: 1065 cap_hw1 |= xcap_val; 1066 break; 1067 case CA_SUNW_SF_1: 1068 cap_sf1 |= xcap_val; 1069 break; 1070 default: 1071 if (file_printf(ms, 1072 ", with unknown capability " 1073 "0x%" INT64_T_FORMAT "x = 0x%" 1074 INT64_T_FORMAT "x", 1075 (unsigned long long)xcap_tag, 1076 (unsigned long long)xcap_val) == -1) 1077 return -1; 1078 if (nbadcap++ > 2) 1079 coff = xsh_size; 1080 break; 1081 } 1082 } 1083 /*FALLTHROUGH*/ 1084 skip: 1085 default: 1086 break; 1087 } 1088 } 1089 1090 if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1) 1091 return -1; 1092 if (cap_hw1) { 1093 const cap_desc_t *cdp; 1094 switch (mach) { 1095 case EM_SPARC: 1096 case EM_SPARC32PLUS: 1097 case EM_SPARCV9: 1098 cdp = cap_desc_sparc; 1099 break; 1100 case EM_386: 1101 case EM_IA_64: 1102 case EM_AMD64: 1103 cdp = cap_desc_386; 1104 break; 1105 default: 1106 cdp = NULL; 1107 break; 1108 } 1109 if (file_printf(ms, ", uses") == -1) 1110 return -1; 1111 if (cdp) { 1112 while (cdp->cd_name) { 1113 if (cap_hw1 & cdp->cd_mask) { 1114 if (file_printf(ms, 1115 " %s", cdp->cd_name) == -1) 1116 return -1; 1117 cap_hw1 &= ~cdp->cd_mask; 1118 } 1119 ++cdp; 1120 } 1121 if (cap_hw1) 1122 if (file_printf(ms, 1123 " unknown hardware capability 0x%" 1124 INT64_T_FORMAT "x", 1125 (unsigned long long)cap_hw1) == -1) 1126 return -1; 1127 } else { 1128 if (file_printf(ms, 1129 " hardware capability 0x%" INT64_T_FORMAT "x", 1130 (unsigned long long)cap_hw1) == -1) 1131 return -1; 1132 } 1133 } 1134 if (cap_sf1) { 1135 if (cap_sf1 & SF1_SUNW_FPUSED) { 1136 if (file_printf(ms, 1137 (cap_sf1 & SF1_SUNW_FPKNWN) 1138 ? ", uses frame pointer" 1139 : ", not known to use frame pointer") == -1) 1140 return -1; 1141 } 1142 cap_sf1 &= ~SF1_SUNW_MASK; 1143 if (cap_sf1) 1144 if (file_printf(ms, 1145 ", with unknown software capability 0x%" 1146 INT64_T_FORMAT "x", 1147 (unsigned long long)cap_sf1) == -1) 1148 return -1; 1149 } 1150 return 0; 1151 } 1152 1153 /* 1154 * Look through the program headers of an executable image, searching 1155 * for a PT_INTERP section; if one is found, it's dynamically linked, 1156 * otherwise it's statically linked. 1157 */ 1158 private int 1159 dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 1160 int num, size_t size, off_t fsize, int *flags, int sh_num) 1161 { 1162 Elf32_Phdr ph32; 1163 Elf64_Phdr ph64; 1164 const char *linking_style = "statically"; 1165 const char *shared_libraries = ""; 1166 unsigned char nbuf[BUFSIZ]; 1167 ssize_t bufsize; 1168 size_t offset, align, len; 1169 1170 if (size != xph_sizeof) { 1171 if (file_printf(ms, ", corrupted program header size") == -1) 1172 return -1; 1173 return 0; 1174 } 1175 1176 for ( ; num; num--) { 1177 if (pread(fd, xph_addr, xph_sizeof, off) == -1) { 1178 file_badread(ms); 1179 return -1; 1180 } 1181 1182 off += size; 1183 1184 /* Things we can determine before we seek */ 1185 switch (xph_type) { 1186 case PT_DYNAMIC: 1187 linking_style = "dynamically"; 1188 break; 1189 case PT_INTERP: 1190 shared_libraries = " (uses shared libs)"; 1191 break; 1192 default: 1193 if (xph_offset > fsize) { 1194 /* Maybe warn here? */ 1195 continue; 1196 } 1197 break; 1198 } 1199 1200 /* Things we can determine when we seek */ 1201 switch (xph_type) { 1202 case PT_NOTE: 1203 if ((align = xph_align) & 0x80000000UL) { 1204 if (file_printf(ms, 1205 ", invalid note alignment 0x%lx", 1206 (unsigned long)align) == -1) 1207 return -1; 1208 align = 4; 1209 } 1210 if (sh_num) 1211 break; 1212 /* 1213 * This is a PT_NOTE section; loop through all the notes 1214 * in the section. 1215 */ 1216 len = xph_filesz < sizeof(nbuf) ? xph_filesz 1217 : sizeof(nbuf); 1218 bufsize = pread(fd, nbuf, len, xph_offset); 1219 if (bufsize == -1) { 1220 file_badread(ms); 1221 return -1; 1222 } 1223 offset = 0; 1224 for (;;) { 1225 if (offset >= (size_t)bufsize) 1226 break; 1227 offset = donote(ms, nbuf, offset, 1228 (size_t)bufsize, clazz, swap, align, 1229 flags); 1230 if (offset == 0) 1231 break; 1232 } 1233 break; 1234 default: 1235 break; 1236 } 1237 } 1238 if (file_printf(ms, ", %s linked%s", linking_style, shared_libraries) 1239 == -1) 1240 return -1; 1241 return 0; 1242 } 1243 1244 1245 protected int 1246 file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, 1247 size_t nbytes) 1248 { 1249 union { 1250 int32_t l; 1251 char c[sizeof (int32_t)]; 1252 } u; 1253 int clazz; 1254 int swap; 1255 struct stat st; 1256 off_t fsize; 1257 int flags = 0; 1258 Elf32_Ehdr elf32hdr; 1259 Elf64_Ehdr elf64hdr; 1260 uint16_t type, phnum, shnum; 1261 1262 if (ms->flags & (MAGIC_MIME|MAGIC_APPLE)) 1263 return 0; 1264 /* 1265 * ELF executables have multiple section headers in arbitrary 1266 * file locations and thus file(1) cannot determine it from easily. 1267 * Instead we traverse thru all section headers until a symbol table 1268 * one is found or else the binary is stripped. 1269 * Return immediately if it's not ELF (so we avoid pipe2file unless needed). 1270 */ 1271 if (buf[EI_MAG0] != ELFMAG0 1272 || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1) 1273 || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3) 1274 return 0; 1275 1276 /* 1277 * If we cannot seek, it must be a pipe, socket or fifo. 1278 */ 1279 if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE)) 1280 fd = file_pipe2file(ms, fd, buf, nbytes); 1281 1282 if (fstat(fd, &st) == -1) { 1283 file_badread(ms); 1284 return -1; 1285 } 1286 fsize = st.st_size; 1287 1288 clazz = buf[EI_CLASS]; 1289 1290 switch (clazz) { 1291 case ELFCLASS32: 1292 #undef elf_getu 1293 #define elf_getu(a, b) elf_getu32(a, b) 1294 #undef elfhdr 1295 #define elfhdr elf32hdr 1296 #include "elfclass.h" 1297 case ELFCLASS64: 1298 #undef elf_getu 1299 #define elf_getu(a, b) elf_getu64(a, b) 1300 #undef elfhdr 1301 #define elfhdr elf64hdr 1302 #include "elfclass.h" 1303 default: 1304 if (file_printf(ms, ", unknown class %d", clazz) == -1) 1305 return -1; 1306 break; 1307 } 1308 return 0; 1309 } 1310 #endif 1311