xref: /netbsd-src/external/bsd/file/dist/src/readelf.c (revision 1b9578b8c2c1f848eeb16dabbfd7d1f0d9fdefbd)
1 /*	$NetBSD: readelf.c,v 1.3 2011/05/13 01:52:13 christos Exp $	*/
2 
3 /*
4  * Copyright (c) Christos Zoulas 2003.
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice immediately at the beginning of the file, without modification,
12  *    this list of conditions, and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
21  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 #include "file.h"
30 
31 #ifndef lint
32 #if 0
33 FILE_RCSID("@(#)$File: readelf.c,v 1.86 2010/07/21 16:47:18 christos Exp $")
34 #else
35 __RCSID("$NetBSD: readelf.c,v 1.3 2011/05/13 01:52:13 christos Exp $");
36 #endif
37 #endif
38 
39 #ifdef BUILTIN_ELF
40 #include <string.h>
41 #include <ctype.h>
42 #include <stdlib.h>
43 #ifdef HAVE_UNISTD_H
44 #include <unistd.h>
45 #endif
46 
47 #include "readelf.h"
48 #include "magic.h"
49 
50 #ifdef	ELFCORE
51 private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t,
52     off_t, int *);
53 #endif
54 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
55     off_t, int *, int);
56 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, int *,
57     int);
58 private size_t donote(struct magic_set *, void *, size_t, size_t, int,
59     int, size_t, int *);
60 
61 #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
62 
63 #define isquote(c) (strchr("'\"`", (c)) != NULL)
64 
65 private uint16_t getu16(int, uint16_t);
66 private uint32_t getu32(int, uint32_t);
67 private uint64_t getu64(int, uint64_t);
68 
69 private uint16_t
70 getu16(int swap, uint16_t value)
71 {
72 	union {
73 		uint16_t ui;
74 		char c[2];
75 	} retval, tmpval;
76 
77 	if (swap) {
78 		tmpval.ui = value;
79 
80 		retval.c[0] = tmpval.c[1];
81 		retval.c[1] = tmpval.c[0];
82 
83 		return retval.ui;
84 	} else
85 		return value;
86 }
87 
88 private uint32_t
89 getu32(int swap, uint32_t value)
90 {
91 	union {
92 		uint32_t ui;
93 		char c[4];
94 	} retval, tmpval;
95 
96 	if (swap) {
97 		tmpval.ui = value;
98 
99 		retval.c[0] = tmpval.c[3];
100 		retval.c[1] = tmpval.c[2];
101 		retval.c[2] = tmpval.c[1];
102 		retval.c[3] = tmpval.c[0];
103 
104 		return retval.ui;
105 	} else
106 		return value;
107 }
108 
109 private uint64_t
110 getu64(int swap, uint64_t value)
111 {
112 	union {
113 		uint64_t ui;
114 		char c[8];
115 	} retval, tmpval;
116 
117 	if (swap) {
118 		tmpval.ui = value;
119 
120 		retval.c[0] = tmpval.c[7];
121 		retval.c[1] = tmpval.c[6];
122 		retval.c[2] = tmpval.c[5];
123 		retval.c[3] = tmpval.c[4];
124 		retval.c[4] = tmpval.c[3];
125 		retval.c[5] = tmpval.c[2];
126 		retval.c[6] = tmpval.c[1];
127 		retval.c[7] = tmpval.c[0];
128 
129 		return retval.ui;
130 	} else
131 		return value;
132 }
133 
134 #define elf_getu16(swap, value) getu16(swap, value)
135 #define elf_getu32(swap, value) getu32(swap, value)
136 #ifdef USE_ARRAY_FOR_64BIT_TYPES
137 # define elf_getu64(swap, array) \
138 	((swap ? ((uint64_t)elf_getu32(swap, array[0])) << 32 : elf_getu32(swap, array[0])) + \
139 	 (swap ? elf_getu32(swap, array[1]) : ((uint64_t)elf_getu32(swap, array[1]) << 32)))
140 #else
141 # define elf_getu64(swap, value) getu64(swap, value)
142 #endif
143 
144 #define xsh_addr	(clazz == ELFCLASS32			\
145 			 ? (void *) &sh32			\
146 			 : (void *) &sh64)
147 #define xsh_sizeof	(clazz == ELFCLASS32			\
148 			 ? sizeof sh32				\
149 			 : sizeof sh64)
150 #define xsh_size	(clazz == ELFCLASS32			\
151 			 ? elf_getu32(swap, sh32.sh_size)	\
152 			 : elf_getu64(swap, sh64.sh_size))
153 #define xsh_offset	(clazz == ELFCLASS32			\
154 			 ? elf_getu32(swap, sh32.sh_offset)	\
155 			 : elf_getu64(swap, sh64.sh_offset))
156 #define xsh_type	(clazz == ELFCLASS32			\
157 			 ? elf_getu32(swap, sh32.sh_type)	\
158 			 : elf_getu32(swap, sh64.sh_type))
159 #define xph_addr	(clazz == ELFCLASS32			\
160 			 ? (void *) &ph32			\
161 			 : (void *) &ph64)
162 #define xph_sizeof	(clazz == ELFCLASS32			\
163 			 ? sizeof ph32				\
164 			 : sizeof ph64)
165 #define xph_type	(clazz == ELFCLASS32			\
166 			 ? elf_getu32(swap, ph32.p_type)	\
167 			 : elf_getu32(swap, ph64.p_type))
168 #define xph_offset	(off_t)(clazz == ELFCLASS32		\
169 			 ? elf_getu32(swap, ph32.p_offset)	\
170 			 : elf_getu64(swap, ph64.p_offset))
171 #define xph_align	(size_t)((clazz == ELFCLASS32		\
172 			 ? (off_t) (ph32.p_align ? 		\
173 			    elf_getu32(swap, ph32.p_align) : 4) \
174 			 : (off_t) (ph64.p_align ?		\
175 			    elf_getu64(swap, ph64.p_align) : 4)))
176 #define xph_filesz	(size_t)((clazz == ELFCLASS32		\
177 			 ? elf_getu32(swap, ph32.p_filesz)	\
178 			 : elf_getu64(swap, ph64.p_filesz)))
179 #define xnh_addr	(clazz == ELFCLASS32			\
180 			 ? (void *) &nh32			\
181 			 : (void *) &nh64)
182 #define xph_memsz	(size_t)((clazz == ELFCLASS32		\
183 			 ? elf_getu32(swap, ph32.p_memsz)	\
184 			 : elf_getu64(swap, ph64.p_memsz)))
185 #define xnh_sizeof	(clazz == ELFCLASS32			\
186 			 ? sizeof nh32				\
187 			 : sizeof nh64)
188 #define xnh_type	(clazz == ELFCLASS32			\
189 			 ? elf_getu32(swap, nh32.n_type)	\
190 			 : elf_getu32(swap, nh64.n_type))
191 #define xnh_namesz	(clazz == ELFCLASS32			\
192 			 ? elf_getu32(swap, nh32.n_namesz)	\
193 			 : elf_getu32(swap, nh64.n_namesz))
194 #define xnh_descsz	(clazz == ELFCLASS32			\
195 			 ? elf_getu32(swap, nh32.n_descsz)	\
196 			 : elf_getu32(swap, nh64.n_descsz))
197 #define prpsoffsets(i)	(clazz == ELFCLASS32			\
198 			 ? prpsoffsets32[i]			\
199 			 : prpsoffsets64[i])
200 #define xcap_addr	(clazz == ELFCLASS32			\
201 			 ? (void *) &cap32			\
202 			 : (void *) &cap64)
203 #define xcap_sizeof	(clazz == ELFCLASS32			\
204 			 ? sizeof cap32				\
205 			 : sizeof cap64)
206 #define xcap_tag	(clazz == ELFCLASS32			\
207 			 ? elf_getu32(swap, cap32.c_tag)	\
208 			 : elf_getu64(swap, cap64.c_tag))
209 #define xcap_val	(clazz == ELFCLASS32			\
210 			 ? elf_getu32(swap, cap32.c_un.c_val)	\
211 			 : elf_getu64(swap, cap64.c_un.c_val))
212 
213 #ifdef ELFCORE
214 /*
215  * Try larger offsets first to avoid false matches
216  * from earlier data that happen to look like strings.
217  */
218 static const size_t	prpsoffsets32[] = {
219 #ifdef USE_NT_PSINFO
220 	104,		/* SunOS 5.x (command line) */
221 	88,		/* SunOS 5.x (short name) */
222 #endif /* USE_NT_PSINFO */
223 
224 	100,		/* SunOS 5.x (command line) */
225 	84,		/* SunOS 5.x (short name) */
226 
227 	44,		/* Linux (command line) */
228 	28,		/* Linux 2.0.36 (short name) */
229 
230 	8,		/* FreeBSD */
231 };
232 
233 static const size_t	prpsoffsets64[] = {
234 #ifdef USE_NT_PSINFO
235 	152,		/* SunOS 5.x (command line) */
236 	136,		/* SunOS 5.x (short name) */
237 #endif /* USE_NT_PSINFO */
238 
239 	136,		/* SunOS 5.x, 64-bit (command line) */
240 	120,		/* SunOS 5.x, 64-bit (short name) */
241 
242 	56,		/* Linux (command line) */
243 	40,             /* Linux (tested on core from 2.4.x, short name) */
244 
245 	16,		/* FreeBSD, 64-bit */
246 };
247 
248 #define	NOFFSETS32	(sizeof prpsoffsets32 / sizeof prpsoffsets32[0])
249 #define NOFFSETS64	(sizeof prpsoffsets64 / sizeof prpsoffsets64[0])
250 
251 #define NOFFSETS	(clazz == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64)
252 
253 /*
254  * Look through the program headers of an executable image, searching
255  * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or
256  * "FreeBSD"; if one is found, try looking in various places in its
257  * contents for a 16-character string containing only printable
258  * characters - if found, that string should be the name of the program
259  * that dropped core.  Note: right after that 16-character string is,
260  * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and
261  * Linux, a longer string (80 characters, in 5.x, probably other
262  * SVR4-flavored systems, and Linux) containing the start of the
263  * command line for that program.
264  *
265  * SunOS 5.x core files contain two PT_NOTE sections, with the types
266  * NT_PRPSINFO (old) and NT_PSINFO (new).  These structs contain the
267  * same info about the command name and command line, so it probably
268  * isn't worthwhile to look for NT_PSINFO, but the offsets are provided
269  * above (see USE_NT_PSINFO), in case we ever decide to do so.  The
270  * NT_PRPSINFO and NT_PSINFO sections are always in order and adjacent;
271  * the SunOS 5.x file command relies on this (and prefers the latter).
272  *
273  * The signal number probably appears in a section of type NT_PRSTATUS,
274  * but that's also rather OS-dependent, in ways that are harder to
275  * dissect with heuristics, so I'm not bothering with the signal number.
276  * (I suppose the signal number could be of interest in situations where
277  * you don't have the binary of the program that dropped core; if you
278  * *do* have that binary, the debugger will probably tell you what
279  * signal it was.)
280  */
281 
282 #define	OS_STYLE_SVR4		0
283 #define	OS_STYLE_FREEBSD	1
284 #define	OS_STYLE_NETBSD		2
285 
286 private const char os_style_names[][8] = {
287 	"SVR4",
288 	"FreeBSD",
289 	"NetBSD",
290 };
291 
292 #define FLAGS_DID_CORE		1
293 #define FLAGS_DID_NOTE		2
294 #define FLAGS_DID_CORE_STYLE	4
295 #define FLAGS_IS_CORE		8
296 
297 private int
298 dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
299     int num, size_t size, off_t fsize, int *flags)
300 {
301 	Elf32_Phdr ph32;
302 	Elf64_Phdr ph64;
303 	size_t offset;
304 	unsigned char nbuf[BUFSIZ];
305 	ssize_t bufsize;
306 	off_t savedoffset;
307  	struct stat st;
308 
309 	if (fstat(fd, &st) < 0) {
310 		file_badread(ms);
311 		return -1;
312 	}
313 
314 	if (size != xph_sizeof) {
315 		if (file_printf(ms, ", corrupted program header size") == -1)
316 			return -1;
317 		return 0;
318 	}
319 
320 	/*
321 	 * Loop through all the program headers.
322 	 */
323 	for ( ; num; num--) {
324 		if ((savedoffset = lseek(fd, off, SEEK_SET)) == (off_t)-1) {
325 			file_badseek(ms);
326 			return -1;
327 		}
328 		if (read(fd, xph_addr, xph_sizeof) == -1) {
329 			file_badread(ms);
330 			return -1;
331 		}
332 		if (xph_offset > fsize) {
333 			if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
334 				file_badseek(ms);
335 				return -1;
336 			}
337 			continue;
338 		}
339 
340 		off += size;
341 		if (xph_type != PT_NOTE)
342 			continue;
343 
344 		/*
345 		 * This is a PT_NOTE section; loop through all the notes
346 		 * in the section.
347 		 */
348 		if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) {
349 			file_badseek(ms);
350 			return -1;
351 		}
352 		bufsize = read(fd, nbuf,
353 		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
354 		if (bufsize == -1) {
355 			file_badread(ms);
356 			return -1;
357 		}
358 		offset = 0;
359 		for (;;) {
360 			if (offset >= (size_t)bufsize)
361 				break;
362 			offset = donote(ms, nbuf, offset, (size_t)bufsize,
363 			    clazz, swap, 4, flags);
364 			if (offset == 0)
365 				break;
366 
367 		}
368 	}
369 	return 0;
370 }
371 #endif
372 
373 private size_t
374 donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
375     int clazz, int swap, size_t align, int *flags)
376 {
377 	Elf32_Nhdr nh32;
378 	Elf64_Nhdr nh64;
379 	size_t noff, doff;
380 #ifdef ELFCORE
381 	int os_style = -1;
382 #endif
383 	uint32_t namesz, descsz;
384 	unsigned char *nbuf = CAST(unsigned char *, vbuf);
385 
386 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
387 	offset += xnh_sizeof;
388 
389 	namesz = xnh_namesz;
390 	descsz = xnh_descsz;
391 	if ((namesz == 0) && (descsz == 0)) {
392 		/*
393 		 * We're out of note headers.
394 		 */
395 		return (offset >= size) ? offset : size;
396 	}
397 
398 	if (namesz & 0x80000000) {
399 	    (void)file_printf(ms, ", bad note name size 0x%lx",
400 		(unsigned long)namesz);
401 	    return offset;
402 	}
403 
404 	if (descsz & 0x80000000) {
405 	    (void)file_printf(ms, ", bad note description size 0x%lx",
406 		(unsigned long)descsz);
407 	    return offset;
408 	}
409 
410 
411 	noff = offset;
412 	doff = ELF_ALIGN(offset + namesz);
413 
414 	if (offset + namesz > size) {
415 		/*
416 		 * We're past the end of the buffer.
417 		 */
418 		return doff;
419 	}
420 
421 	offset = ELF_ALIGN(doff + descsz);
422 	if (doff + descsz > size) {
423 		/*
424 		 * We're past the end of the buffer.
425 		 */
426 		return (offset >= size) ? offset : size;
427 	}
428 
429 	if (*flags & FLAGS_DID_NOTE)
430 		goto core;
431 
432 	if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
433 	    xnh_type == NT_GNU_VERSION && descsz == 16) {
434 		uint32_t desc[4];
435 		(void)memcpy(desc, &nbuf[doff], sizeof(desc));
436 
437 		if (file_printf(ms, ", for GNU/") == -1)
438 			return size;
439 		switch (elf_getu32(swap, desc[0])) {
440 		case GNU_OS_LINUX:
441 			if (file_printf(ms, "Linux") == -1)
442 				return size;
443 			break;
444 		case GNU_OS_HURD:
445 			if (file_printf(ms, "Hurd") == -1)
446 				return size;
447 			break;
448 		case GNU_OS_SOLARIS:
449 			if (file_printf(ms, "Solaris") == -1)
450 				return size;
451 			break;
452 		case GNU_OS_KFREEBSD:
453 			if (file_printf(ms, "kFreeBSD") == -1)
454 				return size;
455 			break;
456 		case GNU_OS_KNETBSD:
457 			if (file_printf(ms, "kNetBSD") == -1)
458 				return size;
459 			break;
460 		default:
461 			if (file_printf(ms, "<unknown>") == -1)
462 				return size;
463 		}
464 		if (file_printf(ms, " %d.%d.%d", elf_getu32(swap, desc[1]),
465 		    elf_getu32(swap, desc[2]), elf_getu32(swap, desc[3])) == -1)
466 			return size;
467 		*flags |= FLAGS_DID_NOTE;
468 		return size;
469 	}
470 
471 	if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 &&
472 	    xnh_type == NT_NETBSD_VERSION && descsz == 4) {
473 		uint32_t desc;
474 		(void)memcpy(&desc, &nbuf[doff], sizeof(desc));
475 		desc = elf_getu32(swap, desc);
476 
477 		if (file_printf(ms, ", for NetBSD") == -1)
478 			return size;
479 		/*
480 		 * The version number used to be stuck as 199905, and was thus
481 		 * basically content-free.  Newer versions of NetBSD have fixed
482 		 * this and now use the encoding of __NetBSD_Version__:
483 		 *
484 		 *	MMmmrrpp00
485 		 *
486 		 * M = major version
487 		 * m = minor version
488 		 * r = release ["",A-Z,Z[A-Z] but numeric]
489 		 * p = patchlevel
490 		 */
491 		if (desc > 100000000U) {
492 			uint32_t ver_patch = (desc / 100) % 100;
493 			uint32_t ver_rel = (desc / 10000) % 100;
494 			uint32_t ver_min = (desc / 1000000) % 100;
495 			uint32_t ver_maj = desc / 100000000;
496 
497 			if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1)
498 				return size;
499 			if (ver_rel == 0 && ver_patch != 0) {
500 				if (file_printf(ms, ".%u", ver_patch) == -1)
501 					return size;
502 			} else if (ver_rel != 0) {
503 				while (ver_rel > 26) {
504 					if (file_printf(ms, "Z") == -1)
505 						return size;
506 					ver_rel -= 26;
507 				}
508 				if (file_printf(ms, "%c", 'A' + ver_rel - 1)
509 				    == -1)
510 					return size;
511 			}
512 		}
513 		*flags |= FLAGS_DID_NOTE;
514 		return size;
515 	}
516 
517 	if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 &&
518 	    xnh_type == NT_FREEBSD_VERSION && descsz == 4) {
519 		uint32_t desc;
520 		(void)memcpy(&desc, &nbuf[doff], sizeof(desc));
521 		desc = elf_getu32(swap, desc);
522 		if (file_printf(ms, ", for FreeBSD") == -1)
523 			return size;
524 
525 		/*
526 		 * Contents is __FreeBSD_version, whose relation to OS
527 		 * versions is defined by a huge table in the Porter's
528 		 * Handbook.  This is the general scheme:
529 		 *
530 		 * Releases:
531 		 * 	Mmp000 (before 4.10)
532 		 * 	Mmi0p0 (before 5.0)
533 		 * 	Mmm0p0
534 		 *
535 		 * Development branches:
536 		 * 	Mmpxxx (before 4.6)
537 		 * 	Mmp1xx (before 4.10)
538 		 * 	Mmi1xx (before 5.0)
539 		 * 	M000xx (pre-M.0)
540 		 * 	Mmm1xx
541 		 *
542 		 * M = major version
543 		 * m = minor version
544 		 * i = minor version increment (491000 -> 4.10)
545 		 * p = patchlevel
546 		 * x = revision
547 		 *
548 		 * The first release of FreeBSD to use ELF by default
549 		 * was version 3.0.
550 		 */
551 		if (desc == 460002) {
552 			if (file_printf(ms, " 4.6.2") == -1)
553 				return size;
554 		} else if (desc < 460100) {
555 			if (file_printf(ms, " %d.%d", desc / 100000,
556 			    desc / 10000 % 10) == -1)
557 				return size;
558 			if (desc / 1000 % 10 > 0)
559 				if (file_printf(ms, ".%d", desc / 1000 % 10)
560 				    == -1)
561 					return size;
562 			if ((desc % 1000 > 0) || (desc % 100000 == 0))
563 				if (file_printf(ms, " (%d)", desc) == -1)
564 					return size;
565 		} else if (desc < 500000) {
566 			if (file_printf(ms, " %d.%d", desc / 100000,
567 			    desc / 10000 % 10 + desc / 1000 % 10) == -1)
568 				return size;
569 			if (desc / 100 % 10 > 0) {
570 				if (file_printf(ms, " (%d)", desc) == -1)
571 					return size;
572 			} else if (desc / 10 % 10 > 0) {
573 				if (file_printf(ms, ".%d", desc / 10 % 10)
574 				    == -1)
575 					return size;
576 			}
577 		} else {
578 			if (file_printf(ms, " %d.%d", desc / 100000,
579 			    desc / 1000 % 100) == -1)
580 				return size;
581 			if ((desc / 100 % 10 > 0) ||
582 			    (desc % 100000 / 100 == 0)) {
583 				if (file_printf(ms, " (%d)", desc) == -1)
584 					return size;
585 			} else if (desc / 10 % 10 > 0) {
586 				if (file_printf(ms, ".%d", desc / 10 % 10)
587 				    == -1)
588 					return size;
589 			}
590 		}
591 		*flags |= FLAGS_DID_NOTE;
592 		return size;
593 	}
594 
595 	if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 &&
596 	    xnh_type == NT_OPENBSD_VERSION && descsz == 4) {
597 		if (file_printf(ms, ", for OpenBSD") == -1)
598 			return size;
599 		/* Content of note is always 0 */
600 		*flags |= FLAGS_DID_NOTE;
601 		return size;
602 	}
603 
604 	if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 &&
605 	    xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
606 		uint32_t desc;
607 		if (file_printf(ms, ", for DragonFly") == -1)
608 			return size;
609 		(void)memcpy(&desc, &nbuf[doff], sizeof(desc));
610 		desc = elf_getu32(swap, desc);
611 		if (file_printf(ms, " %d.%d.%d", desc / 100000,
612 		    desc / 10000 % 10, desc % 10000) == -1)
613 			return size;
614 		*flags |= FLAGS_DID_NOTE;
615 		return size;
616 	}
617 
618 core:
619 	/*
620 	 * Sigh.  The 2.0.36 kernel in Debian 2.1, at
621 	 * least, doesn't correctly implement name
622 	 * sections, in core dumps, as specified by
623 	 * the "Program Linking" section of "UNIX(R) System
624 	 * V Release 4 Programmer's Guide: ANSI C and
625 	 * Programming Support Tools", because my copy
626 	 * clearly says "The first 'namesz' bytes in 'name'
627 	 * contain a *null-terminated* [emphasis mine]
628 	 * character representation of the entry's owner
629 	 * or originator", but the 2.0.36 kernel code
630 	 * doesn't include the terminating null in the
631 	 * name....
632 	 */
633 	if ((namesz == 4 && strncmp((char *)&nbuf[noff], "CORE", 4) == 0) ||
634 	    (namesz == 5 && strcmp((char *)&nbuf[noff], "CORE") == 0)) {
635 		os_style = OS_STYLE_SVR4;
636 	}
637 
638 	if ((namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0)) {
639 		os_style = OS_STYLE_FREEBSD;
640 	}
641 
642 	if ((namesz >= 11 && strncmp((char *)&nbuf[noff], "NetBSD-CORE", 11)
643 	    == 0)) {
644 		os_style = OS_STYLE_NETBSD;
645 	}
646 
647 #ifdef ELFCORE
648 	if ((*flags & FLAGS_DID_CORE) != 0)
649 		return size;
650 
651 	if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) {
652 		if (file_printf(ms, ", %s-style", os_style_names[os_style])
653 		    == -1)
654 			return size;
655 		*flags |= FLAGS_DID_CORE_STYLE;
656 	}
657 
658 	switch (os_style) {
659 	case OS_STYLE_NETBSD:
660 		if (xnh_type == NT_NETBSD_CORE_PROCINFO) {
661 			uint32_t signo;
662 			/*
663 			 * Extract the program name.  It is at
664 			 * offset 0x7c, and is up to 32-bytes,
665 			 * including the terminating NUL.
666 			 */
667 			if (file_printf(ms, ", from '%.31s'",
668 			    &nbuf[doff + 0x7c]) == -1)
669 				return size;
670 
671 			/*
672 			 * Extract the signal number.  It is at
673 			 * offset 0x08.
674 			 */
675 			(void)memcpy(&signo, &nbuf[doff + 0x08],
676 			    sizeof(signo));
677 			if (file_printf(ms, " (signal %u)",
678 			    elf_getu32(swap, signo)) == -1)
679 				return size;
680 			*flags |= FLAGS_DID_CORE;
681 			return size;
682 		}
683 		break;
684 
685 	default:
686 		if (xnh_type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) {
687 			size_t i, j;
688 			unsigned char c;
689 			/*
690 			 * Extract the program name.  We assume
691 			 * it to be 16 characters (that's what it
692 			 * is in SunOS 5.x and Linux).
693 			 *
694 			 * Unfortunately, it's at a different offset
695 			 * in various OSes, so try multiple offsets.
696 			 * If the characters aren't all printable,
697 			 * reject it.
698 			 */
699 			for (i = 0; i < NOFFSETS; i++) {
700 				unsigned char *cname, *cp;
701 				size_t reloffset = prpsoffsets(i);
702 				size_t noffset = doff + reloffset;
703 				size_t k;
704 				for (j = 0; j < 16; j++, noffset++,
705 				    reloffset++) {
706 					/*
707 					 * Make sure we're not past
708 					 * the end of the buffer; if
709 					 * we are, just give up.
710 					 */
711 					if (noffset >= size)
712 						goto tryanother;
713 
714 					/*
715 					 * Make sure we're not past
716 					 * the end of the contents;
717 					 * if we are, this obviously
718 					 * isn't the right offset.
719 					 */
720 					if (reloffset >= descsz)
721 						goto tryanother;
722 
723 					c = nbuf[noffset];
724 					if (c == '\0') {
725 						/*
726 						 * A '\0' at the
727 						 * beginning is
728 						 * obviously wrong.
729 						 * Any other '\0'
730 						 * means we're done.
731 						 */
732 						if (j == 0)
733 							goto tryanother;
734 						else
735 							break;
736 					} else {
737 						/*
738 						 * A nonprintable
739 						 * character is also
740 						 * wrong.
741 						 */
742 						if (!isprint(c) || isquote(c))
743 							goto tryanother;
744 					}
745 				}
746 				/*
747 				 * Well, that worked.
748 				 */
749 
750 				/*
751 				 * Try next offsets, in case this match is
752 				 * in the middle of a string.
753 				 */
754 				for (k = i + 1 ; k < NOFFSETS ; k++) {
755 					size_t no;
756 					int adjust = 1;
757 					if (prpsoffsets(k) >= prpsoffsets(i))
758 						continue;
759 					for (no = doff + prpsoffsets(k);
760 					     no < doff + prpsoffsets(i); no++)
761 						adjust = adjust
762 						         && isprint(nbuf[no]);
763 					if (adjust)
764 						i = k;
765 				}
766 
767 				cname = (unsigned char *)
768 				    &nbuf[doff + prpsoffsets(i)];
769 				for (cp = cname; *cp && isprint(*cp); cp++)
770 					continue;
771 				/*
772 				 * Linux apparently appends a space at the end
773 				 * of the command line: remove it.
774 				 */
775 				while (cp > cname && isspace(cp[-1]))
776 					cp--;
777 				if (file_printf(ms, ", from '%.*s'",
778 				    (int)(cp - cname), cname) == -1)
779 					return size;
780 				*flags |= FLAGS_DID_CORE;
781 				return size;
782 
783 			tryanother:
784 				;
785 			}
786 		}
787 		break;
788 	}
789 #endif
790 	return offset;
791 }
792 
793 /* SunOS 5.x hardware capability descriptions */
794 typedef struct cap_desc {
795 	uint64_t cd_mask;
796 	const char *cd_name;
797 } cap_desc_t;
798 
799 static const cap_desc_t cap_desc_sparc[] = {
800 	{ AV_SPARC_MUL32,		"MUL32" },
801 	{ AV_SPARC_DIV32,		"DIV32" },
802 	{ AV_SPARC_FSMULD,		"FSMULD" },
803 	{ AV_SPARC_V8PLUS,		"V8PLUS" },
804 	{ AV_SPARC_POPC,		"POPC" },
805 	{ AV_SPARC_VIS,			"VIS" },
806 	{ AV_SPARC_VIS2,		"VIS2" },
807 	{ AV_SPARC_ASI_BLK_INIT,	"ASI_BLK_INIT" },
808 	{ AV_SPARC_FMAF,		"FMAF" },
809 	{ AV_SPARC_FJFMAU,		"FJFMAU" },
810 	{ AV_SPARC_IMA,			"IMA" },
811 	{ 0, NULL }
812 };
813 
814 static const cap_desc_t cap_desc_386[] = {
815 	{ AV_386_FPU,			"FPU" },
816 	{ AV_386_TSC,			"TSC" },
817 	{ AV_386_CX8,			"CX8" },
818 	{ AV_386_SEP,			"SEP" },
819 	{ AV_386_AMD_SYSC,		"AMD_SYSC" },
820 	{ AV_386_CMOV,			"CMOV" },
821 	{ AV_386_MMX,			"MMX" },
822 	{ AV_386_AMD_MMX,		"AMD_MMX" },
823 	{ AV_386_AMD_3DNow,		"AMD_3DNow" },
824 	{ AV_386_AMD_3DNowx,		"AMD_3DNowx" },
825 	{ AV_386_FXSR,			"FXSR" },
826 	{ AV_386_SSE,			"SSE" },
827 	{ AV_386_SSE2,			"SSE2" },
828 	{ AV_386_PAUSE,			"PAUSE" },
829 	{ AV_386_SSE3,			"SSE3" },
830 	{ AV_386_MON,			"MON" },
831 	{ AV_386_CX16,			"CX16" },
832 	{ AV_386_AHF,			"AHF" },
833 	{ AV_386_TSCP,			"TSCP" },
834 	{ AV_386_AMD_SSE4A,		"AMD_SSE4A" },
835 	{ AV_386_POPCNT,		"POPCNT" },
836 	{ AV_386_AMD_LZCNT,		"AMD_LZCNT" },
837 	{ AV_386_SSSE3,			"SSSE3" },
838 	{ AV_386_SSE4_1,		"SSE4.1" },
839 	{ AV_386_SSE4_2,		"SSE4.2" },
840 	{ 0, NULL }
841 };
842 
843 private int
844 doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
845     size_t size, int *flags, int mach)
846 {
847 	Elf32_Shdr sh32;
848 	Elf64_Shdr sh64;
849 	int stripped = 1;
850 	void *nbuf;
851 	off_t noff;
852 	uint64_t cap_hw1 = 0;	/* SunOS 5.x hardware capabilites */
853 	uint64_t cap_sf1 = 0;	/* SunOS 5.x software capabilites */
854 
855 	if (size != xsh_sizeof) {
856 		if (file_printf(ms, ", corrupted section header size") == -1)
857 			return -1;
858 		return 0;
859 	}
860 
861 	if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
862 		file_badseek(ms);
863 		return -1;
864 	}
865 
866 	for ( ; num; num--) {
867 		if (read(fd, xsh_addr, xsh_sizeof) == -1) {
868 			file_badread(ms);
869 			return -1;
870 		}
871 		switch (xsh_type) {
872 		case SHT_SYMTAB:
873 #if 0
874 		case SHT_DYNSYM:
875 #endif
876 			stripped = 0;
877 			break;
878 		case SHT_NOTE:
879 			if ((off = lseek(fd, (off_t)0, SEEK_CUR)) ==
880 			    (off_t)-1) {
881 				file_badread(ms);
882 				return -1;
883 			}
884 			if ((nbuf = malloc((size_t)xsh_size)) == NULL) {
885 				file_error(ms, errno, "Cannot allocate memory"
886 				    " for note");
887 				return -1;
888 			}
889 			if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) ==
890 			    (off_t)-1) {
891 				file_badread(ms);
892 				free(nbuf);
893 				return -1;
894 			}
895 			if (read(fd, nbuf, (size_t)xsh_size) !=
896 			    (ssize_t)xsh_size) {
897 				free(nbuf);
898 				file_badread(ms);
899 				return -1;
900 			}
901 
902 			noff = 0;
903 			for (;;) {
904 				if (noff >= (off_t)xsh_size)
905 					break;
906 				noff = donote(ms, nbuf, (size_t)noff,
907 				    (size_t)xsh_size, clazz, swap, 4,
908 				    flags);
909 				if (noff == 0)
910 					break;
911 			}
912 			if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) {
913 				free(nbuf);
914 				file_badread(ms);
915 				return -1;
916 			}
917 			free(nbuf);
918 			break;
919 		case SHT_SUNW_cap:
920 		    {
921 			off_t coff;
922 			if ((off = lseek(fd, (off_t)0, SEEK_CUR)) ==
923 			    (off_t)-1) {
924 				file_badread(ms);
925 				return -1;
926 			}
927 			if (lseek(fd, (off_t)xsh_offset, SEEK_SET) ==
928 			    (off_t)-1) {
929 				file_badread(ms);
930 				return -1;
931 			}
932 			coff = 0;
933 			for (;;) {
934 				Elf32_Cap cap32;
935 				Elf64_Cap cap64;
936 				char cbuf[/*CONSTCOND*/
937 				    MAX(sizeof cap32, sizeof cap64)];
938 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
939 					break;
940 				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
941 				    (ssize_t)xcap_sizeof) {
942 					file_badread(ms);
943 					return -1;
944 				}
945 				(void)memcpy(xcap_addr, cbuf, xcap_sizeof);
946 				switch (xcap_tag) {
947 				case CA_SUNW_NULL:
948 					break;
949 				case CA_SUNW_HW_1:
950 					cap_hw1 |= xcap_val;
951 					break;
952 				case CA_SUNW_SF_1:
953 					cap_sf1 |= xcap_val;
954 					break;
955 				default:
956 					if (file_printf(ms,
957 					    ", with unknown capability "
958 					    "0x%" INT64_T_FORMAT "x = 0x%"
959 					    INT64_T_FORMAT "x",
960 					    (unsigned long long)xcap_tag,
961 					    (unsigned long long)xcap_val) == -1)
962 						return -1;
963 					break;
964 				}
965 			}
966 			if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
967 				file_badread(ms);
968 				return -1;
969 			}
970 			break;
971 		    }
972 		}
973 	}
974 	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
975 		return -1;
976 	if (cap_hw1) {
977 		const cap_desc_t *cdp;
978 		switch (mach) {
979 		case EM_SPARC:
980 		case EM_SPARC32PLUS:
981 		case EM_SPARCV9:
982 			cdp = cap_desc_sparc;
983 			break;
984 		case EM_386:
985 		case EM_IA_64:
986 		case EM_AMD64:
987 			cdp = cap_desc_386;
988 			break;
989 		default:
990 			cdp = NULL;
991 			break;
992 		}
993 		if (file_printf(ms, ", uses") == -1)
994 			return -1;
995 		if (cdp) {
996 			while (cdp->cd_name) {
997 				if (cap_hw1 & cdp->cd_mask) {
998 					if (file_printf(ms,
999 					    " %s", cdp->cd_name) == -1)
1000 						return -1;
1001 					cap_hw1 &= ~cdp->cd_mask;
1002 				}
1003 				++cdp;
1004 			}
1005 			if (cap_hw1)
1006 				if (file_printf(ms,
1007 				    " unknown hardware capability 0x%"
1008 				    INT64_T_FORMAT "x",
1009 				    (unsigned long long)cap_hw1) == -1)
1010 					return -1;
1011 		} else {
1012 			if (file_printf(ms,
1013 			    " hardware capability 0x%" INT64_T_FORMAT "x",
1014 			    (unsigned long long)cap_hw1) == -1)
1015 				return -1;
1016 		}
1017 	}
1018 	if (cap_sf1) {
1019 		if (cap_sf1 & SF1_SUNW_FPUSED) {
1020 			if (file_printf(ms,
1021 			    (cap_sf1 & SF1_SUNW_FPKNWN)
1022 			    ? ", uses frame pointer"
1023 			    : ", not known to use frame pointer") == -1)
1024 				return -1;
1025 		}
1026 		cap_sf1 &= ~SF1_SUNW_MASK;
1027 		if (cap_sf1)
1028 			if (file_printf(ms,
1029 			    ", with unknown software capability 0x%"
1030 			    INT64_T_FORMAT "x",
1031 			    (unsigned long long)cap_sf1) == -1)
1032 				return -1;
1033 	}
1034 	return 0;
1035 }
1036 
1037 /*
1038  * Look through the program headers of an executable image, searching
1039  * for a PT_INTERP section; if one is found, it's dynamically linked,
1040  * otherwise it's statically linked.
1041  */
1042 private int
1043 dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
1044     int num, size_t size, off_t fsize, int *flags, int sh_num)
1045 {
1046 	Elf32_Phdr ph32;
1047 	Elf64_Phdr ph64;
1048 	const char *linking_style = "statically";
1049 	const char *shared_libraries = "";
1050 	unsigned char nbuf[BUFSIZ];
1051 	ssize_t bufsize;
1052 	size_t offset, align;
1053 	off_t savedoffset = (off_t)-1;
1054 	struct stat st;
1055 
1056 	if (fstat(fd, &st) < 0) {
1057 		file_badread(ms);
1058 		return -1;
1059 	}
1060 
1061 	if (size != xph_sizeof) {
1062 		if (file_printf(ms, ", corrupted program header size") == -1)
1063 			return -1;
1064 		return 0;
1065 	}
1066 
1067 	if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
1068 		file_badseek(ms);
1069 		return -1;
1070 	}
1071 
1072   	for ( ; num; num--) {
1073   		if (read(fd, xph_addr, xph_sizeof) == -1) {
1074   			file_badread(ms);
1075 			return -1;
1076 		}
1077 		if (xph_offset > st.st_size && savedoffset != (off_t)-1) {
1078 			if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
1079 				file_badseek(ms);
1080 				return -1;
1081 			}
1082 			continue;
1083 		}
1084 
1085 		if ((savedoffset = lseek(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) {
1086   			file_badseek(ms);
1087 			return -1;
1088 		}
1089 
1090 		if (xph_offset > fsize) {
1091 			if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
1092 				file_badseek(ms);
1093 				return -1;
1094 			}
1095 			continue;
1096 		}
1097 
1098 		switch (xph_type) {
1099 		case PT_DYNAMIC:
1100 			linking_style = "dynamically";
1101 			break;
1102 		case PT_INTERP:
1103 			shared_libraries = " (uses shared libs)";
1104 			break;
1105 		case PT_NOTE:
1106 			if ((align = xph_align) & 0x80000000UL) {
1107 				if (file_printf(ms,
1108 				    ", invalid note alignment 0x%lx",
1109 				    (unsigned long)align) == -1)
1110 					return -1;
1111 				align = 4;
1112 			}
1113 			if (sh_num)
1114 				break;
1115 			/*
1116 			 * This is a PT_NOTE section; loop through all the notes
1117 			 * in the section.
1118 			 */
1119 			if (lseek(fd, xph_offset, SEEK_SET)
1120 			    == (off_t)-1) {
1121 				file_badseek(ms);
1122 				return -1;
1123 			}
1124 			bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
1125 			    xph_filesz : sizeof(nbuf)));
1126 			if (bufsize == -1) {
1127 				file_badread(ms);
1128 				return -1;
1129 			}
1130 			offset = 0;
1131 			for (;;) {
1132 				if (offset >= (size_t)bufsize)
1133 					break;
1134 				offset = donote(ms, nbuf, offset,
1135 				    (size_t)bufsize, clazz, swap, align,
1136 				    flags);
1137 				if (offset == 0)
1138 					break;
1139 			}
1140 			if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
1141 				file_badseek(ms);
1142 				return -1;
1143 			}
1144 			break;
1145 		default:
1146 			break;
1147 		}
1148 	}
1149 	if (file_printf(ms, ", %s linked%s", linking_style, shared_libraries)
1150 	    == -1)
1151 	    return -1;
1152 	return 0;
1153 }
1154 
1155 
1156 protected int
1157 file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
1158     size_t nbytes)
1159 {
1160 	union {
1161 		int32_t l;
1162 		char c[sizeof (int32_t)];
1163 	} u;
1164 	int clazz;
1165 	int swap;
1166 	struct stat st;
1167 	off_t fsize;
1168 	int flags = 0;
1169 	Elf32_Ehdr elf32hdr;
1170 	Elf64_Ehdr elf64hdr;
1171 	uint16_t type;
1172 
1173 	if (ms->flags & (MAGIC_MIME|MAGIC_APPLE))
1174 		return 0;
1175 	/*
1176 	 * ELF executables have multiple section headers in arbitrary
1177 	 * file locations and thus file(1) cannot determine it from easily.
1178 	 * Instead we traverse thru all section headers until a symbol table
1179 	 * one is found or else the binary is stripped.
1180 	 * Return immediately if it's not ELF (so we avoid pipe2file unless needed).
1181 	 */
1182 	if (buf[EI_MAG0] != ELFMAG0
1183 	    || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
1184 	    || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
1185 		return 0;
1186 
1187 	/*
1188 	 * If we cannot seek, it must be a pipe, socket or fifo.
1189 	 */
1190 	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
1191 		fd = file_pipe2file(ms, fd, buf, nbytes);
1192 
1193 	if (fstat(fd, &st) == -1) {
1194   		file_badread(ms);
1195 		return -1;
1196 	}
1197 	fsize = st.st_size;
1198 
1199 	clazz = buf[EI_CLASS];
1200 
1201 	switch (clazz) {
1202 	case ELFCLASS32:
1203 #undef elf_getu
1204 #define elf_getu(a, b)	elf_getu32(a, b)
1205 #undef elfhdr
1206 #define elfhdr elf32hdr
1207 #include "elfclass.h"
1208 	case ELFCLASS64:
1209 #undef elf_getu
1210 #define elf_getu(a, b)	elf_getu64(a, b)
1211 #undef elfhdr
1212 #define elfhdr elf64hdr
1213 #include "elfclass.h"
1214 	default:
1215 	    if (file_printf(ms, ", unknown class %d", clazz) == -1)
1216 		    return -1;
1217 	    break;
1218 	}
1219 	return 0;
1220 }
1221 #endif
1222