1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
|
# frozen_string_literal: true
module Sass
# The {ELF} class.
#
# It parses ELF header to extract interpreter.
# @see https://github.com/torvalds/linux/blob/HEAD/include/uapi/linux/elf.h
# @see https://github.com/torvalds/linux/blob/HEAD/kernel/kexec_elf.c
class ELF
# The {PackInfo} class.
class PackInfo
def initialize(format:, sizeof:, struct:)
@format_le = format.freeze
@format_be = format.tr('<', '>').freeze
@sizeof = sizeof.freeze
@struct = struct.freeze
end
attr_reader :sizeof
def pack(io, data, little_endian)
raise ArgumentError if io.write(data.values_at(*@struct).pack(format(little_endian))) != @sizeof
end
def unpack(io, little_endian)
@struct.zip(io.read(@sizeof).unpack(format(little_endian))).to_h
end
private
def format(little_endian)
little_endian ? @format_le : @format_be
end
end
private_constant :PackInfo
# These constants are for the segment types stored in the image headers
PT_NULL = 0
PT_LOAD = 1
PT_DYNAMIC = 2
PT_INTERP = 3
PT_NOTE = 4
PT_SHLIB = 5
PT_PHDR = 6
PT_TLS = 7
PT_LOOS = 0x60000000
PT_HIOS = 0x6fffffff
PT_LOPROC = 0x70000000
PT_HIPROC = 0x7fffffff
PN_XNUM = 0xffff
# These constants define the different elf file types
ET_NONE = 0
ET_REL = 1
ET_EXEC = 2
ET_DYN = 3
ET_CORE = 4
ET_LOPROC = 0xff00
ET_HIPROC = 0xffff
EI_NIDENT = 16
Elf32_Ehdr = PackInfo.new(
format: "a#{EI_NIDENT}S<2L<5S<6",
sizeof: 52,
struct: %i[
e_ident
e_type
e_machine
e_version
e_entry
e_phoff
e_shoff
e_flags
e_ehsize
e_phentsize
e_phnum
e_shentsize
e_shnum
e_shstrndx
]
).freeze
Elf64_Ehdr = PackInfo.new(
format: "a#{EI_NIDENT}S<2L<Q<3L<S<6",
sizeof: 64,
struct: %i[
e_ident
e_type
e_machine
e_version
e_entry
e_phoff
e_shoff
e_flags
e_ehsize
e_phentsize
e_phnum
e_shentsize
e_shnum
e_shstrndx
]
).freeze
# These constants define the permissions on sections in the program header, p_flags.
PF_R = 0x4
PF_W = 0x2
PF_X = 0x1
Elf32_Phdr = PackInfo.new(
format: 'L<8',
sizeof: 32,
struct: %i[
p_type
p_offset
p_vaddr
p_paddr
p_filesz
p_memsz
p_flags
p_align
]
).freeze
Elf64_Phdr = PackInfo.new(
format: 'L<2Q<6',
sizeof: 56,
struct: %i[
p_type
p_flags
p_offset
p_vaddr
p_paddr
p_filesz
p_memsz
p_align
]
).freeze
# sh_type
SHT_NULL = 0
SHT_PROGBITS = 1
SHT_SYMTAB = 2
SHT_STRTAB = 3
SHT_RELA = 4
SHT_HASH = 5
SHT_DYNAMIC = 6
SHT_NOTE = 7
SHT_NOBITS = 8
SHT_REL = 9
SHT_SHLIB = 10
SHT_DYNSYM = 11
SHT_NUM = 12
SHT_LOPROC = 0x70000000
SHT_HIPROC = 0x7fffffff
SHT_LOUSER = 0x80000000
SHT_HIUSER = 0xffffffff
# sh_flags
SHF_WRITE = 0x1
SHF_ALLOC = 0x2
SHF_EXECINSTR = 0x4
SHF_RELA_LIVEPATCH = 0x00100000
SHF_RO_AFTER_INIT = 0x00200000
SHF_MASKPROC = 0xf0000000
# special section indexes
SHN_UNDEF = 0
SHN_LORESERVE = 0xff00
SHN_LOPROC = 0xff00
SHN_HIPROC = 0xff1f
SHN_LIVEPATCH = 0xff20
SHN_ABS = 0xfff1
SHN_COMMON = 0xfff2
SHN_HIRESERVE = 0xffff
Elf32_Shdr = PackInfo.new(
format: 'L<10',
sizeof: 40,
struct: %i[
sh_name
sh_type
sh_flags
sh_addr
sh_offset
sh_size
sh_link
sh_info
sh_addralign
sh_entsize
]
).freeze
Elf64_Shdr = PackInfo.new(
format: 'L<2Q<4L<2Q<2',
sizeof: 64,
struct: %i[
sh_name
sh_type
sh_flags
sh_addr
sh_offset
sh_size
sh_link
sh_info
sh_addralign
sh_entsize
]
).freeze
# e_ident[] indexes
EI_MAG0 = 0
EI_MAG1 = 1
EI_MAG2 = 2
EI_MAG3 = 3
EI_CLASS = 4
EI_DATA = 5
EI_VERSION = 6
EI_OSABI = 7
EI_PAD = 8
# EI_MAG
ELFMAG0 = 0x7f
ELFMAG1 = 0x45
ELFMAG2 = 0x4c
ELFMAG3 = 0x46
ELFMAG = [ELFMAG0, ELFMAG1, ELFMAG2, ELFMAG3].pack('C*')
SELFMAG = 4
# e_ident[EI_CLASS]
ELFCLASSNONE = 0
ELFCLASS32 = 1
ELFCLASS64 = 2
ELFCLASSNUM = 3
# e_ident[EI_DATA]
ELFDATANONE = 0
ELFDATA2LSB = 1
ELFDATA2MSB = 2
def initialize(io, program_headers: true, section_headers: false)
io.rewind
e_ident = io.read(EI_NIDENT).unpack('C*')
raise ArgumentError unless e_ident.slice(EI_MAG0, SELFMAG).pack('C*') == ELFMAG
case e_ident[EI_CLASS]
when ELFCLASS32
elf_ehdr = Elf32_Ehdr
elf_phdr = Elf32_Phdr
elf_shdr = Elf32_Shdr
when ELFCLASS64
elf_ehdr = Elf64_Ehdr
elf_phdr = Elf64_Phdr
elf_shdr = Elf64_Shdr
else
raise EncodingError
end
case e_ident[EI_DATA]
when ELFDATA2LSB
little_endian = true
when ELFDATA2MSB
little_endian = false
else
raise EncodingError
end
io.rewind
ehdr = elf_ehdr.unpack(io, little_endian)
ehdr[:e_ident] = e_ident
phdrs = if program_headers && ehdr[:e_phnum].positive?
io.seek(ehdr[:e_phoff], IO::SEEK_SET)
Array.new(ehdr[:e_phnum]) do
elf_phdr.unpack(io, little_endian)
end
else
[]
end
shdrs = if section_headers && ehdr[:e_shnum].positive?
io.seek(ehdr[:e_shoff], IO::SEEK_SET)
Array.new(ehdr[:e_shnum]) do
elf_shdr.unpack(io, little_endian)
end
else
[]
end
@io = io
@ehdr = ehdr
@phdrs = phdrs
@shdrs = shdrs
end
def dump(io)
e_ident = @ehdr[:e_ident]
raise ArgumentError unless e_ident.slice(EI_MAG0, SELFMAG).pack('C*') == ELFMAG
ehdr = @ehdr.dup
ehdr[:e_ident] = e_ident.pack('C*')
phdrs = @phdrs
shdrs = @shdrs
case e_ident[EI_CLASS]
when ELFCLASS32
elf_ehdr = Elf32_Ehdr
elf_phdr = Elf32_Phdr
elf_shdr = Elf32_Shdr
when ELFCLASS64
elf_ehdr = Elf64_Ehdr
elf_phdr = Elf64_Phdr
elf_shdr = Elf64_Shdr
else
raise EncodingError
end
case e_ident[EI_DATA]
when ELFDATA2LSB
little_endian = true
when ELFDATA2MSB
little_endian = false
else
raise EncodingError
end
io.rewind
elf_ehdr.pack(io, ehdr, little_endian)
io.seek(ehdr[:e_phoff], IO::SEEK_SET) if ehdr[:e_phnum].positive?
phdrs.each do |phdr|
elf_phdr.pack(io, phdr, little_endian)
end
io.seek(ehdr[:e_shoff], IO::SEEK_SET) if ehdr[:e_shnum].positive?
shdrs.each do |shdr|
elf_shdr.pack(io, shdr, little_endian)
end
io.flush
end
def relocatable?
@ehdr[:e_type] == ET_REL
end
def executable?
@ehdr[:e_type] == ET_EXEC
end
def shared_object?
@ehdr[:e_type] == ET_DYN
end
def core?
@ehdr[:e_type] == ET_CORE
end
def interpreter
phdr = @phdrs.find { |p| p[:p_type] == PT_INTERP }
return if phdr.nil?
@io.seek(phdr[:p_offset], IO::SEEK_SET)
@io.read(phdr[:p_filesz]).unpack1('Z*')
end
INTERPRETER = begin
proc_self_exe = '/proc/self/exe'
if File.exist?(proc_self_exe)
File.open(proc_self_exe, 'rb') do |file|
elf = ELF.new(file)
interpreter = elf.interpreter
if interpreter.nil? && elf.shared_object?
File.readlink(proc_self_exe)
else
interpreter
end
end
end
end.freeze
end
private_constant :ELF
end
|