1 /* 2 * Copyright (c) Christos Zoulas 2003. 3 * All Rights Reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice immediately at the beginning of the file, without modification, 10 * this list of conditions, and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 19 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27 #include "file.h" 28 29 #ifndef lint 30 FILE_RCSID("@(#)$File: readelf.c,v 1.102 2014/03/11 21:00:13 christos Exp $") 31 #endif 32 33 #ifdef BUILTIN_ELF 34 #include <string.h> 35 #include <ctype.h> 36 #include <stdlib.h> 37 #ifdef HAVE_UNISTD_H 38 #include <unistd.h> 39 #endif 40 41 #include "readelf.h" 42 #include "magic.h" 43 44 #ifdef ELFCORE 45 private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t, 46 off_t, int *); 47 #endif 48 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t, 49 off_t, int *, int); 50 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, 51 off_t, int *, int, int); 52 private size_t donote(struct magic_set *, void *, size_t, size_t, int, 53 int, size_t, int *); 54 55 #define ELF_ALIGN(a) ((((a) + align - 1) / align) * align) 56 57 #define isquote(c) (strchr("'\"`", (c)) != NULL) 58 59 private uint16_t getu16(int, uint16_t); 60 private uint32_t getu32(int, uint32_t); 61 private uint64_t getu64(int, uint64_t); 62 63 private uint16_t 64 getu16(int swap, uint16_t value) 65 { 66 union { 67 uint16_t ui; 68 char c[2]; 69 } retval, tmpval; 70 71 if (swap) { 72 tmpval.ui = value; 73 74 retval.c[0] = tmpval.c[1]; 75 retval.c[1] = tmpval.c[0]; 76 77 return retval.ui; 78 } else 79 return value; 80 } 81 82 private uint32_t 83 getu32(int swap, uint32_t value) 84 { 85 union { 86 uint32_t ui; 87 char c[4]; 88 } retval, tmpval; 89 90 if (swap) { 91 tmpval.ui = value; 92 93 retval.c[0] = tmpval.c[3]; 94 retval.c[1] = tmpval.c[2]; 95 retval.c[2] = tmpval.c[1]; 96 retval.c[3] = tmpval.c[0]; 97 98 return retval.ui; 99 } else 100 return value; 101 } 102 103 private uint64_t 104 getu64(int swap, uint64_t value) 105 { 106 union { 107 uint64_t ui; 108 char c[8]; 109 } retval, tmpval; 110 111 if (swap) { 112 tmpval.ui = value; 113 114 retval.c[0] = tmpval.c[7]; 115 retval.c[1] = tmpval.c[6]; 116 retval.c[2] = tmpval.c[5]; 117 retval.c[3] = tmpval.c[4]; 118 retval.c[4] = tmpval.c[3]; 119 retval.c[5] = tmpval.c[2]; 120 retval.c[6] = tmpval.c[1]; 121 retval.c[7] = tmpval.c[0]; 122 123 return retval.ui; 124 } else 125 return value; 126 } 127 128 #define elf_getu16(swap, value) getu16(swap, value) 129 #define elf_getu32(swap, value) getu32(swap, value) 130 #define elf_getu64(swap, value) getu64(swap, value) 131 132 #define xsh_addr (clazz == ELFCLASS32 \ 133 ? (void *)&sh32 \ 134 : (void *)&sh64) 135 #define xsh_sizeof (clazz == ELFCLASS32 \ 136 ? sizeof(sh32) \ 137 : sizeof(sh64)) 138 #define xsh_size (size_t)(clazz == ELFCLASS32 \ 139 ? elf_getu32(swap, sh32.sh_size) \ 140 : elf_getu64(swap, sh64.sh_size)) 141 #define xsh_offset (off_t)(clazz == ELFCLASS32 \ 142 ? elf_getu32(swap, sh32.sh_offset) \ 143 : elf_getu64(swap, sh64.sh_offset)) 144 #define xsh_type (clazz == ELFCLASS32 \ 145 ? elf_getu32(swap, sh32.sh_type) \ 146 : elf_getu32(swap, sh64.sh_type)) 147 #define xsh_name (clazz == ELFCLASS32 \ 148 ? elf_getu32(swap, sh32.sh_name) \ 149 : elf_getu32(swap, sh64.sh_name)) 150 #define xph_addr (clazz == ELFCLASS32 \ 151 ? (void *) &ph32 \ 152 : (void *) &ph64) 153 #define xph_sizeof (clazz == ELFCLASS32 \ 154 ? sizeof(ph32) \ 155 : sizeof(ph64)) 156 #define xph_type (clazz == ELFCLASS32 \ 157 ? elf_getu32(swap, ph32.p_type) \ 158 : elf_getu32(swap, ph64.p_type)) 159 #define xph_offset (off_t)(clazz == ELFCLASS32 \ 160 ? elf_getu32(swap, ph32.p_offset) \ 161 : elf_getu64(swap, ph64.p_offset)) 162 #define xph_align (size_t)((clazz == ELFCLASS32 \ 163 ? (off_t) (ph32.p_align ? \ 164 elf_getu32(swap, ph32.p_align) : 4) \ 165 : (off_t) (ph64.p_align ? \ 166 elf_getu64(swap, ph64.p_align) : 4))) 167 #define xph_filesz (size_t)((clazz == ELFCLASS32 \ 168 ? elf_getu32(swap, ph32.p_filesz) \ 169 : elf_getu64(swap, ph64.p_filesz))) 170 #define xnh_addr (clazz == ELFCLASS32 \ 171 ? (void *)&nh32 \ 172 : (void *)&nh64) 173 #define xph_memsz (size_t)((clazz == ELFCLASS32 \ 174 ? elf_getu32(swap, ph32.p_memsz) \ 175 : elf_getu64(swap, ph64.p_memsz))) 176 #define xnh_sizeof (clazz == ELFCLASS32 \ 177 ? sizeof nh32 \ 178 : sizeof nh64) 179 #define xnh_type (clazz == ELFCLASS32 \ 180 ? elf_getu32(swap, nh32.n_type) \ 181 : elf_getu32(swap, nh64.n_type)) 182 #define xnh_namesz (clazz == ELFCLASS32 \ 183 ? elf_getu32(swap, nh32.n_namesz) \ 184 : elf_getu32(swap, nh64.n_namesz)) 185 #define xnh_descsz (clazz == ELFCLASS32 \ 186 ? elf_getu32(swap, nh32.n_descsz) \ 187 : elf_getu32(swap, nh64.n_descsz)) 188 #define prpsoffsets(i) (clazz == ELFCLASS32 \ 189 ? prpsoffsets32[i] \ 190 : prpsoffsets64[i]) 191 #define xcap_addr (clazz == ELFCLASS32 \ 192 ? (void *)&cap32 \ 193 : (void *)&cap64) 194 #define xcap_sizeof (clazz == ELFCLASS32 \ 195 ? sizeof cap32 \ 196 : sizeof cap64) 197 #define xcap_tag (clazz == ELFCLASS32 \ 198 ? elf_getu32(swap, cap32.c_tag) \ 199 : elf_getu64(swap, cap64.c_tag)) 200 #define xcap_val (clazz == ELFCLASS32 \ 201 ? elf_getu32(swap, cap32.c_un.c_val) \ 202 : elf_getu64(swap, cap64.c_un.c_val)) 203 204 #ifdef ELFCORE 205 /* 206 * Try larger offsets first to avoid false matches 207 * from earlier data that happen to look like strings. 208 */ 209 static const size_t prpsoffsets32[] = { 210 #ifdef USE_NT_PSINFO 211 104, /* SunOS 5.x (command line) */ 212 88, /* SunOS 5.x (short name) */ 213 #endif /* USE_NT_PSINFO */ 214 215 100, /* SunOS 5.x (command line) */ 216 84, /* SunOS 5.x (short name) */ 217 218 44, /* Linux (command line) */ 219 28, /* Linux 2.0.36 (short name) */ 220 221 8, /* FreeBSD */ 222 }; 223 224 static const size_t prpsoffsets64[] = { 225 #ifdef USE_NT_PSINFO 226 152, /* SunOS 5.x (command line) */ 227 136, /* SunOS 5.x (short name) */ 228 #endif /* USE_NT_PSINFO */ 229 230 136, /* SunOS 5.x, 64-bit (command line) */ 231 120, /* SunOS 5.x, 64-bit (short name) */ 232 233 56, /* Linux (command line) */ 234 40, /* Linux (tested on core from 2.4.x, short name) */ 235 236 16, /* FreeBSD, 64-bit */ 237 }; 238 239 #define NOFFSETS32 (sizeof prpsoffsets32 / sizeof prpsoffsets32[0]) 240 #define NOFFSETS64 (sizeof prpsoffsets64 / sizeof prpsoffsets64[0]) 241 242 #define NOFFSETS (clazz == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64) 243 244 /* 245 * Look through the program headers of an executable image, searching 246 * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or 247 * "FreeBSD"; if one is found, try looking in various places in its 248 * contents for a 16-character string containing only printable 249 * characters - if found, that string should be the name of the program 250 * that dropped core. Note: right after that 16-character string is, 251 * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and 252 * Linux, a longer string (80 characters, in 5.x, probably other 253 * SVR4-flavored systems, and Linux) containing the start of the 254 * command line for that program. 255 * 256 * SunOS 5.x core files contain two PT_NOTE sections, with the types 257 * NT_PRPSINFO (old) and NT_PSINFO (new). These structs contain the 258 * same info about the command name and command line, so it probably 259 * isn't worthwhile to look for NT_PSINFO, but the offsets are provided 260 * above (see USE_NT_PSINFO), in case we ever decide to do so. The 261 * NT_PRPSINFO and NT_PSINFO sections are always in order and adjacent; 262 * the SunOS 5.x file command relies on this (and prefers the latter). 263 * 264 * The signal number probably appears in a section of type NT_PRSTATUS, 265 * but that's also rather OS-dependent, in ways that are harder to 266 * dissect with heuristics, so I'm not bothering with the signal number. 267 * (I suppose the signal number could be of interest in situations where 268 * you don't have the binary of the program that dropped core; if you 269 * *do* have that binary, the debugger will probably tell you what 270 * signal it was.) 271 */ 272 273 #define OS_STYLE_SVR4 0 274 #define OS_STYLE_FREEBSD 1 275 #define OS_STYLE_NETBSD 2 276 277 private const char os_style_names[][8] = { 278 "SVR4", 279 "FreeBSD", 280 "NetBSD", 281 }; 282 283 #define FLAGS_DID_CORE 0x01 284 #define FLAGS_DID_NOTE 0x02 285 #define FLAGS_DID_BUILD_ID 0x04 286 #define FLAGS_DID_CORE_STYLE 0x08 287 #define FLAGS_IS_CORE 0x10 288 289 private int 290 dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 291 int num, size_t size, off_t fsize, int *flags) 292 { 293 Elf32_Phdr ph32; 294 Elf64_Phdr ph64; 295 size_t offset, len; 296 unsigned char nbuf[BUFSIZ]; 297 ssize_t bufsize; 298 299 if (size != xph_sizeof) { 300 if (file_printf(ms, ", corrupted program header size") == -1) 301 return -1; 302 return 0; 303 } 304 305 /* 306 * Loop through all the program headers. 307 */ 308 for ( ; num; num--) { 309 if (pread(fd, xph_addr, xph_sizeof, off) == -1) { 310 file_badread(ms); 311 return -1; 312 } 313 off += size; 314 315 if (xph_offset > fsize) { 316 /* Perhaps warn here */ 317 continue; 318 } 319 320 if (xph_type != PT_NOTE) 321 continue; 322 323 /* 324 * This is a PT_NOTE section; loop through all the notes 325 * in the section. 326 */ 327 len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf); 328 if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) { 329 file_badread(ms); 330 return -1; 331 } 332 offset = 0; 333 for (;;) { 334 if (offset >= (size_t)bufsize) 335 break; 336 offset = donote(ms, nbuf, offset, (size_t)bufsize, 337 clazz, swap, 4, flags); 338 if (offset == 0) 339 break; 340 341 } 342 } 343 return 0; 344 } 345 #endif 346 347 static void 348 do_note_netbsd_version(struct magic_set *ms, int swap, void *v) 349 { 350 uint32_t desc; 351 (void)memcpy(&desc, v, sizeof(desc)); 352 desc = elf_getu32(swap, desc); 353 354 if (file_printf(ms, ", for NetBSD") == -1) 355 return; 356 /* 357 * The version number used to be stuck as 199905, and was thus 358 * basically content-free. Newer versions of NetBSD have fixed 359 * this and now use the encoding of __NetBSD_Version__: 360 * 361 * MMmmrrpp00 362 * 363 * M = major version 364 * m = minor version 365 * r = release ["",A-Z,Z[A-Z] but numeric] 366 * p = patchlevel 367 */ 368 if (desc > 100000000U) { 369 uint32_t ver_patch = (desc / 100) % 100; 370 uint32_t ver_rel = (desc / 10000) % 100; 371 uint32_t ver_min = (desc / 1000000) % 100; 372 uint32_t ver_maj = desc / 100000000; 373 374 if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1) 375 return; 376 if (ver_rel == 0 && ver_patch != 0) { 377 if (file_printf(ms, ".%u", ver_patch) == -1) 378 return; 379 } else if (ver_rel != 0) { 380 while (ver_rel > 26) { 381 if (file_printf(ms, "Z") == -1) 382 return; 383 ver_rel -= 26; 384 } 385 if (file_printf(ms, "%c", 'A' + ver_rel - 1) 386 == -1) 387 return; 388 } 389 } 390 } 391 392 static void 393 do_note_freebsd_version(struct magic_set *ms, int swap, void *v) 394 { 395 uint32_t desc; 396 397 (void)memcpy(&desc, v, sizeof(desc)); 398 desc = elf_getu32(swap, desc); 399 if (file_printf(ms, ", for FreeBSD") == -1) 400 return; 401 402 /* 403 * Contents is __FreeBSD_version, whose relation to OS 404 * versions is defined by a huge table in the Porter's 405 * Handbook. This is the general scheme: 406 * 407 * Releases: 408 * Mmp000 (before 4.10) 409 * Mmi0p0 (before 5.0) 410 * Mmm0p0 411 * 412 * Development branches: 413 * Mmpxxx (before 4.6) 414 * Mmp1xx (before 4.10) 415 * Mmi1xx (before 5.0) 416 * M000xx (pre-M.0) 417 * Mmm1xx 418 * 419 * M = major version 420 * m = minor version 421 * i = minor version increment (491000 -> 4.10) 422 * p = patchlevel 423 * x = revision 424 * 425 * The first release of FreeBSD to use ELF by default 426 * was version 3.0. 427 */ 428 if (desc == 460002) { 429 if (file_printf(ms, " 4.6.2") == -1) 430 return; 431 } else if (desc < 460100) { 432 if (file_printf(ms, " %d.%d", desc / 100000, 433 desc / 10000 % 10) == -1) 434 return; 435 if (desc / 1000 % 10 > 0) 436 if (file_printf(ms, ".%d", desc / 1000 % 10) == -1) 437 return; 438 if ((desc % 1000 > 0) || (desc % 100000 == 0)) 439 if (file_printf(ms, " (%d)", desc) == -1) 440 return; 441 } else if (desc < 500000) { 442 if (file_printf(ms, " %d.%d", desc / 100000, 443 desc / 10000 % 10 + desc / 1000 % 10) == -1) 444 return; 445 if (desc / 100 % 10 > 0) { 446 if (file_printf(ms, " (%d)", desc) == -1) 447 return; 448 } else if (desc / 10 % 10 > 0) { 449 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 450 return; 451 } 452 } else { 453 if (file_printf(ms, " %d.%d", desc / 100000, 454 desc / 1000 % 100) == -1) 455 return; 456 if ((desc / 100 % 10 > 0) || 457 (desc % 100000 / 100 == 0)) { 458 if (file_printf(ms, " (%d)", desc) == -1) 459 return; 460 } else if (desc / 10 % 10 > 0) { 461 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 462 return; 463 } 464 } 465 } 466 467 private size_t 468 donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, 469 int clazz, int swap, size_t align, int *flags) 470 { 471 Elf32_Nhdr nh32; 472 Elf64_Nhdr nh64; 473 size_t noff, doff; 474 #ifdef ELFCORE 475 int os_style = -1; 476 #endif 477 uint32_t namesz, descsz; 478 unsigned char *nbuf = CAST(unsigned char *, vbuf); 479 480 (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); 481 offset += xnh_sizeof; 482 483 namesz = xnh_namesz; 484 descsz = xnh_descsz; 485 if ((namesz == 0) && (descsz == 0)) { 486 /* 487 * We're out of note headers. 488 */ 489 return (offset >= size) ? offset : size; 490 } 491 492 if (namesz & 0x80000000) { 493 (void)file_printf(ms, ", bad note name size 0x%lx", 494 (unsigned long)namesz); 495 return offset; 496 } 497 498 if (descsz & 0x80000000) { 499 (void)file_printf(ms, ", bad note description size 0x%lx", 500 (unsigned long)descsz); 501 return offset; 502 } 503 504 505 noff = offset; 506 doff = ELF_ALIGN(offset + namesz); 507 508 if (offset + namesz > size) { 509 /* 510 * We're past the end of the buffer. 511 */ 512 return doff; 513 } 514 515 offset = ELF_ALIGN(doff + descsz); 516 if (doff + descsz > size) { 517 /* 518 * We're past the end of the buffer. 519 */ 520 return (offset >= size) ? offset : size; 521 } 522 523 if ((*flags & (FLAGS_DID_NOTE|FLAGS_DID_BUILD_ID)) == 524 (FLAGS_DID_NOTE|FLAGS_DID_BUILD_ID)) 525 goto core; 526 527 if (namesz == 5 && strcmp((char *)&nbuf[noff], "SuSE") == 0 && 528 xnh_type == NT_GNU_VERSION && descsz == 2) { 529 file_printf(ms, ", for SuSE %d.%d", nbuf[doff], nbuf[doff + 1]); 530 } 531 if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && 532 xnh_type == NT_GNU_VERSION && descsz == 16) { 533 uint32_t desc[4]; 534 (void)memcpy(desc, &nbuf[doff], sizeof(desc)); 535 536 if (file_printf(ms, ", for GNU/") == -1) 537 return size; 538 switch (elf_getu32(swap, desc[0])) { 539 case GNU_OS_LINUX: 540 if (file_printf(ms, "Linux") == -1) 541 return size; 542 break; 543 case GNU_OS_HURD: 544 if (file_printf(ms, "Hurd") == -1) 545 return size; 546 break; 547 case GNU_OS_SOLARIS: 548 if (file_printf(ms, "Solaris") == -1) 549 return size; 550 break; 551 case GNU_OS_KFREEBSD: 552 if (file_printf(ms, "kFreeBSD") == -1) 553 return size; 554 break; 555 case GNU_OS_KNETBSD: 556 if (file_printf(ms, "kNetBSD") == -1) 557 return size; 558 break; 559 default: 560 if (file_printf(ms, "<unknown>") == -1) 561 return size; 562 } 563 if (file_printf(ms, " %d.%d.%d", elf_getu32(swap, desc[1]), 564 elf_getu32(swap, desc[2]), elf_getu32(swap, desc[3])) == -1) 565 return size; 566 *flags |= FLAGS_DID_NOTE; 567 return size; 568 } 569 570 if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 && 571 xnh_type == NT_GNU_BUILD_ID && (descsz == 16 || descsz == 20)) { 572 uint8_t desc[20]; 573 uint32_t i; 574 if (file_printf(ms, ", BuildID[%s]=", descsz == 16 ? "md5/uuid" : 575 "sha1") == -1) 576 return size; 577 (void)memcpy(desc, &nbuf[doff], descsz); 578 for (i = 0; i < descsz; i++) 579 if (file_printf(ms, "%02x", desc[i]) == -1) 580 return size; 581 *flags |= FLAGS_DID_BUILD_ID; 582 } 583 584 if (namesz == 4 && strcmp((char *)&nbuf[noff], "PaX") == 0 && 585 xnh_type == NT_NETBSD_PAX && descsz == 4) { 586 static const char *pax[] = { 587 "+mprotect", 588 "-mprotect", 589 "+segvguard", 590 "-segvguard", 591 "+ASLR", 592 "-ASLR", 593 }; 594 uint32_t desc; 595 size_t i; 596 int did = 0; 597 598 (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); 599 desc = elf_getu32(swap, desc); 600 601 if (desc && file_printf(ms, ", PaX: ") == -1) 602 return size; 603 604 for (i = 0; i < __arraycount(pax); i++) { 605 if (((1 << i) & desc) == 0) 606 continue; 607 if (file_printf(ms, "%s%s", did++ ? "," : "", 608 pax[i]) == -1) 609 return size; 610 } 611 } 612 613 if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0) { 614 switch (xnh_type) { 615 case NT_NETBSD_VERSION: 616 if (descsz == 4) { 617 do_note_netbsd_version(ms, swap, &nbuf[doff]); 618 *flags |= FLAGS_DID_NOTE; 619 return size; 620 } 621 break; 622 case NT_NETBSD_MARCH: 623 if (file_printf(ms, ", compiled for: %.*s", (int)descsz, 624 (const char *)&nbuf[doff]) == -1) 625 return size; 626 break; 627 case NT_NETBSD_CMODEL: 628 if (file_printf(ms, ", compiler model: %.*s", 629 (int)descsz, (const char *)&nbuf[doff]) == -1) 630 return size; 631 break; 632 default: 633 if (file_printf(ms, ", note=%u", xnh_type) == -1) 634 return size; 635 break; 636 } 637 return size; 638 } 639 640 if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0) { 641 if (xnh_type == NT_FREEBSD_VERSION && descsz == 4) { 642 do_note_freebsd_version(ms, swap, &nbuf[doff]); 643 *flags |= FLAGS_DID_NOTE; 644 return size; 645 } 646 } 647 648 if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 && 649 xnh_type == NT_OPENBSD_VERSION && descsz == 4) { 650 if (file_printf(ms, ", for OpenBSD") == -1) 651 return size; 652 /* Content of note is always 0 */ 653 *flags |= FLAGS_DID_NOTE; 654 return size; 655 } 656 657 if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 && 658 xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) { 659 uint32_t desc; 660 if (file_printf(ms, ", for DragonFly") == -1) 661 return size; 662 (void)memcpy(&desc, &nbuf[doff], sizeof(desc)); 663 desc = elf_getu32(swap, desc); 664 if (file_printf(ms, " %d.%d.%d", desc / 100000, 665 desc / 10000 % 10, desc % 10000) == -1) 666 return size; 667 *flags |= FLAGS_DID_NOTE; 668 return size; 669 } 670 671 core: 672 /* 673 * Sigh. The 2.0.36 kernel in Debian 2.1, at 674 * least, doesn't correctly implement name 675 * sections, in core dumps, as specified by 676 * the "Program Linking" section of "UNIX(R) System 677 * V Release 4 Programmer's Guide: ANSI C and 678 * Programming Support Tools", because my copy 679 * clearly says "The first 'namesz' bytes in 'name' 680 * contain a *null-terminated* [emphasis mine] 681 * character representation of the entry's owner 682 * or originator", but the 2.0.36 kernel code 683 * doesn't include the terminating null in the 684 * name.... 685 */ 686 if ((namesz == 4 && strncmp((char *)&nbuf[noff], "CORE", 4) == 0) || 687 (namesz == 5 && strcmp((char *)&nbuf[noff], "CORE") == 0)) { 688 os_style = OS_STYLE_SVR4; 689 } 690 691 if ((namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0)) { 692 os_style = OS_STYLE_FREEBSD; 693 } 694 695 if ((namesz >= 11 && strncmp((char *)&nbuf[noff], "NetBSD-CORE", 11) 696 == 0)) { 697 os_style = OS_STYLE_NETBSD; 698 } 699 700 #ifdef ELFCORE 701 if ((*flags & FLAGS_DID_CORE) != 0) 702 return size; 703 704 if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) { 705 if (file_printf(ms, ", %s-style", os_style_names[os_style]) 706 == -1) 707 return size; 708 *flags |= FLAGS_DID_CORE_STYLE; 709 } 710 711 switch (os_style) { 712 case OS_STYLE_NETBSD: 713 if (xnh_type == NT_NETBSD_CORE_PROCINFO) { 714 uint32_t signo; 715 /* 716 * Extract the program name. It is at 717 * offset 0x7c, and is up to 32-bytes, 718 * including the terminating NUL. 719 */ 720 if (file_printf(ms, ", from '%.31s'", 721 &nbuf[doff + 0x7c]) == -1) 722 return size; 723 724 /* 725 * Extract the signal number. It is at 726 * offset 0x08. 727 */ 728 (void)memcpy(&signo, &nbuf[doff + 0x08], 729 sizeof(signo)); 730 if (file_printf(ms, " (signal %u)", 731 elf_getu32(swap, signo)) == -1) 732 return size; 733 *flags |= FLAGS_DID_CORE; 734 return size; 735 } 736 break; 737 738 default: 739 if (xnh_type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) { 740 size_t i, j; 741 unsigned char c; 742 /* 743 * Extract the program name. We assume 744 * it to be 16 characters (that's what it 745 * is in SunOS 5.x and Linux). 746 * 747 * Unfortunately, it's at a different offset 748 * in various OSes, so try multiple offsets. 749 * If the characters aren't all printable, 750 * reject it. 751 */ 752 for (i = 0; i < NOFFSETS; i++) { 753 unsigned char *cname, *cp; 754 size_t reloffset = prpsoffsets(i); 755 size_t noffset = doff + reloffset; 756 size_t k; 757 for (j = 0; j < 16; j++, noffset++, 758 reloffset++) { 759 /* 760 * Make sure we're not past 761 * the end of the buffer; if 762 * we are, just give up. 763 */ 764 if (noffset >= size) 765 goto tryanother; 766 767 /* 768 * Make sure we're not past 769 * the end of the contents; 770 * if we are, this obviously 771 * isn't the right offset. 772 */ 773 if (reloffset >= descsz) 774 goto tryanother; 775 776 c = nbuf[noffset]; 777 if (c == '\0') { 778 /* 779 * A '\0' at the 780 * beginning is 781 * obviously wrong. 782 * Any other '\0' 783 * means we're done. 784 */ 785 if (j == 0) 786 goto tryanother; 787 else 788 break; 789 } else { 790 /* 791 * A nonprintable 792 * character is also 793 * wrong. 794 */ 795 if (!isprint(c) || isquote(c)) 796 goto tryanother; 797 } 798 } 799 /* 800 * Well, that worked. 801 */ 802 803 /* 804 * Try next offsets, in case this match is 805 * in the middle of a string. 806 */ 807 for (k = i + 1 ; k < NOFFSETS ; k++) { 808 size_t no; 809 int adjust = 1; 810 if (prpsoffsets(k) >= prpsoffsets(i)) 811 continue; 812 for (no = doff + prpsoffsets(k); 813 no < doff + prpsoffsets(i); no++) 814 adjust = adjust 815 && isprint(nbuf[no]); 816 if (adjust) 817 i = k; 818 } 819 820 cname = (unsigned char *) 821 &nbuf[doff + prpsoffsets(i)]; 822 for (cp = cname; *cp && isprint(*cp); cp++) 823 continue; 824 /* 825 * Linux apparently appends a space at the end 826 * of the command line: remove it. 827 */ 828 while (cp > cname && isspace(cp[-1])) 829 cp--; 830 if (file_printf(ms, ", from '%.*s'", 831 (int)(cp - cname), cname) == -1) 832 return size; 833 *flags |= FLAGS_DID_CORE; 834 return size; 835 836 tryanother: 837 ; 838 } 839 } 840 break; 841 } 842 #endif 843 return offset; 844 } 845 846 /* SunOS 5.x hardware capability descriptions */ 847 typedef struct cap_desc { 848 uint64_t cd_mask; 849 const char *cd_name; 850 } cap_desc_t; 851 852 static const cap_desc_t cap_desc_sparc[] = { 853 { AV_SPARC_MUL32, "MUL32" }, 854 { AV_SPARC_DIV32, "DIV32" }, 855 { AV_SPARC_FSMULD, "FSMULD" }, 856 { AV_SPARC_V8PLUS, "V8PLUS" }, 857 { AV_SPARC_POPC, "POPC" }, 858 { AV_SPARC_VIS, "VIS" }, 859 { AV_SPARC_VIS2, "VIS2" }, 860 { AV_SPARC_ASI_BLK_INIT, "ASI_BLK_INIT" }, 861 { AV_SPARC_FMAF, "FMAF" }, 862 { AV_SPARC_FJFMAU, "FJFMAU" }, 863 { AV_SPARC_IMA, "IMA" }, 864 { 0, NULL } 865 }; 866 867 static const cap_desc_t cap_desc_386[] = { 868 { AV_386_FPU, "FPU" }, 869 { AV_386_TSC, "TSC" }, 870 { AV_386_CX8, "CX8" }, 871 { AV_386_SEP, "SEP" }, 872 { AV_386_AMD_SYSC, "AMD_SYSC" }, 873 { AV_386_CMOV, "CMOV" }, 874 { AV_386_MMX, "MMX" }, 875 { AV_386_AMD_MMX, "AMD_MMX" }, 876 { AV_386_AMD_3DNow, "AMD_3DNow" }, 877 { AV_386_AMD_3DNowx, "AMD_3DNowx" }, 878 { AV_386_FXSR, "FXSR" }, 879 { AV_386_SSE, "SSE" }, 880 { AV_386_SSE2, "SSE2" }, 881 { AV_386_PAUSE, "PAUSE" }, 882 { AV_386_SSE3, "SSE3" }, 883 { AV_386_MON, "MON" }, 884 { AV_386_CX16, "CX16" }, 885 { AV_386_AHF, "AHF" }, 886 { AV_386_TSCP, "TSCP" }, 887 { AV_386_AMD_SSE4A, "AMD_SSE4A" }, 888 { AV_386_POPCNT, "POPCNT" }, 889 { AV_386_AMD_LZCNT, "AMD_LZCNT" }, 890 { AV_386_SSSE3, "SSSE3" }, 891 { AV_386_SSE4_1, "SSE4.1" }, 892 { AV_386_SSE4_2, "SSE4.2" }, 893 { 0, NULL } 894 }; 895 896 private int 897 doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num, 898 size_t size, off_t fsize, int *flags, int mach, int strtab) 899 { 900 Elf32_Shdr sh32; 901 Elf64_Shdr sh64; 902 int stripped = 1; 903 void *nbuf; 904 off_t noff, coff, name_off; 905 uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilites */ 906 uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilites */ 907 char name[50]; 908 909 if (size != xsh_sizeof) { 910 if (file_printf(ms, ", corrupted section header size") == -1) 911 return -1; 912 return 0; 913 } 914 915 /* Read offset of name section to be able to read section names later */ 916 if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) { 917 file_badread(ms); 918 return -1; 919 } 920 name_off = xsh_offset; 921 922 for ( ; num; num--) { 923 /* Read the name of this section. */ 924 if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) { 925 file_badread(ms); 926 return -1; 927 } 928 name[sizeof(name) - 1] = '\0'; 929 if (strcmp(name, ".debug_info") == 0) 930 stripped = 0; 931 932 if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) { 933 file_badread(ms); 934 return -1; 935 } 936 off += size; 937 938 /* Things we can determine before we seek */ 939 switch (xsh_type) { 940 case SHT_SYMTAB: 941 #if 0 942 case SHT_DYNSYM: 943 #endif 944 stripped = 0; 945 break; 946 default: 947 if (xsh_offset > fsize) { 948 /* Perhaps warn here */ 949 continue; 950 } 951 break; 952 } 953 954 /* Things we can determine when we seek */ 955 switch (xsh_type) { 956 case SHT_NOTE: 957 if ((nbuf = malloc(xsh_size)) == NULL) { 958 file_error(ms, errno, "Cannot allocate memory" 959 " for note"); 960 return -1; 961 } 962 if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) { 963 file_badread(ms); 964 free(nbuf); 965 return -1; 966 } 967 968 noff = 0; 969 for (;;) { 970 if (noff >= (off_t)xsh_size) 971 break; 972 noff = donote(ms, nbuf, (size_t)noff, 973 xsh_size, clazz, swap, 4, flags); 974 if (noff == 0) 975 break; 976 } 977 free(nbuf); 978 break; 979 case SHT_SUNW_cap: 980 switch (mach) { 981 case EM_SPARC: 982 case EM_SPARCV9: 983 case EM_IA_64: 984 case EM_386: 985 case EM_AMD64: 986 break; 987 default: 988 goto skip; 989 } 990 991 if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) { 992 file_badseek(ms); 993 return -1; 994 } 995 coff = 0; 996 for (;;) { 997 Elf32_Cap cap32; 998 Elf64_Cap cap64; 999 char cbuf[/*CONSTCOND*/ 1000 MAX(sizeof cap32, sizeof cap64)]; 1001 if ((coff += xcap_sizeof) > (off_t)xsh_size) 1002 break; 1003 if (read(fd, cbuf, (size_t)xcap_sizeof) != 1004 (ssize_t)xcap_sizeof) { 1005 file_badread(ms); 1006 return -1; 1007 } 1008 (void)memcpy(xcap_addr, cbuf, xcap_sizeof); 1009 switch (xcap_tag) { 1010 case CA_SUNW_NULL: 1011 break; 1012 case CA_SUNW_HW_1: 1013 cap_hw1 |= xcap_val; 1014 break; 1015 case CA_SUNW_SF_1: 1016 cap_sf1 |= xcap_val; 1017 break; 1018 default: 1019 if (file_printf(ms, 1020 ", with unknown capability " 1021 "0x%" INT64_T_FORMAT "x = 0x%" 1022 INT64_T_FORMAT "x", 1023 (unsigned long long)xcap_tag, 1024 (unsigned long long)xcap_val) == -1) 1025 return -1; 1026 break; 1027 } 1028 } 1029 /*FALLTHROUGH*/ 1030 skip: 1031 default: 1032 break; 1033 } 1034 } 1035 1036 if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1) 1037 return -1; 1038 if (cap_hw1) { 1039 const cap_desc_t *cdp; 1040 switch (mach) { 1041 case EM_SPARC: 1042 case EM_SPARC32PLUS: 1043 case EM_SPARCV9: 1044 cdp = cap_desc_sparc; 1045 break; 1046 case EM_386: 1047 case EM_IA_64: 1048 case EM_AMD64: 1049 cdp = cap_desc_386; 1050 break; 1051 default: 1052 cdp = NULL; 1053 break; 1054 } 1055 if (file_printf(ms, ", uses") == -1) 1056 return -1; 1057 if (cdp) { 1058 while (cdp->cd_name) { 1059 if (cap_hw1 & cdp->cd_mask) { 1060 if (file_printf(ms, 1061 " %s", cdp->cd_name) == -1) 1062 return -1; 1063 cap_hw1 &= ~cdp->cd_mask; 1064 } 1065 ++cdp; 1066 } 1067 if (cap_hw1) 1068 if (file_printf(ms, 1069 " unknown hardware capability 0x%" 1070 INT64_T_FORMAT "x", 1071 (unsigned long long)cap_hw1) == -1) 1072 return -1; 1073 } else { 1074 if (file_printf(ms, 1075 " hardware capability 0x%" INT64_T_FORMAT "x", 1076 (unsigned long long)cap_hw1) == -1) 1077 return -1; 1078 } 1079 } 1080 if (cap_sf1) { 1081 if (cap_sf1 & SF1_SUNW_FPUSED) { 1082 if (file_printf(ms, 1083 (cap_sf1 & SF1_SUNW_FPKNWN) 1084 ? ", uses frame pointer" 1085 : ", not known to use frame pointer") == -1) 1086 return -1; 1087 } 1088 cap_sf1 &= ~SF1_SUNW_MASK; 1089 if (cap_sf1) 1090 if (file_printf(ms, 1091 ", with unknown software capability 0x%" 1092 INT64_T_FORMAT "x", 1093 (unsigned long long)cap_sf1) == -1) 1094 return -1; 1095 } 1096 return 0; 1097 } 1098 1099 /* 1100 * Look through the program headers of an executable image, searching 1101 * for a PT_INTERP section; if one is found, it's dynamically linked, 1102 * otherwise it's statically linked. 1103 */ 1104 private int 1105 dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 1106 int num, size_t size, off_t fsize, int *flags, int sh_num) 1107 { 1108 Elf32_Phdr ph32; 1109 Elf64_Phdr ph64; 1110 const char *linking_style = "statically"; 1111 const char *shared_libraries = ""; 1112 unsigned char nbuf[BUFSIZ]; 1113 ssize_t bufsize; 1114 size_t offset, align, len; 1115 1116 if (size != xph_sizeof) { 1117 if (file_printf(ms, ", corrupted program header size") == -1) 1118 return -1; 1119 return 0; 1120 } 1121 1122 for ( ; num; num--) { 1123 if (pread(fd, xph_addr, xph_sizeof, off) == -1) { 1124 file_badread(ms); 1125 return -1; 1126 } 1127 1128 off += size; 1129 1130 /* Things we can determine before we seek */ 1131 switch (xph_type) { 1132 case PT_DYNAMIC: 1133 linking_style = "dynamically"; 1134 break; 1135 case PT_INTERP: 1136 shared_libraries = " (uses shared libs)"; 1137 break; 1138 default: 1139 if (xph_offset > fsize) { 1140 /* Maybe warn here? */ 1141 continue; 1142 } 1143 break; 1144 } 1145 1146 /* Things we can determine when we seek */ 1147 switch (xph_type) { 1148 case PT_NOTE: 1149 if ((align = xph_align) & 0x80000000UL) { 1150 if (file_printf(ms, 1151 ", invalid note alignment 0x%lx", 1152 (unsigned long)align) == -1) 1153 return -1; 1154 align = 4; 1155 } 1156 if (sh_num) 1157 break; 1158 /* 1159 * This is a PT_NOTE section; loop through all the notes 1160 * in the section. 1161 */ 1162 len = xph_filesz < sizeof(nbuf) ? xph_filesz 1163 : sizeof(nbuf); 1164 bufsize = pread(fd, nbuf, len, xph_offset); 1165 if (bufsize == -1) { 1166 file_badread(ms); 1167 return -1; 1168 } 1169 offset = 0; 1170 for (;;) { 1171 if (offset >= (size_t)bufsize) 1172 break; 1173 offset = donote(ms, nbuf, offset, 1174 (size_t)bufsize, clazz, swap, align, 1175 flags); 1176 if (offset == 0) 1177 break; 1178 } 1179 break; 1180 default: 1181 break; 1182 } 1183 } 1184 if (file_printf(ms, ", %s linked%s", linking_style, shared_libraries) 1185 == -1) 1186 return -1; 1187 return 0; 1188 } 1189 1190 1191 protected int 1192 file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf, 1193 size_t nbytes) 1194 { 1195 union { 1196 int32_t l; 1197 char c[sizeof (int32_t)]; 1198 } u; 1199 int clazz; 1200 int swap; 1201 struct stat st; 1202 off_t fsize; 1203 int flags = 0; 1204 Elf32_Ehdr elf32hdr; 1205 Elf64_Ehdr elf64hdr; 1206 uint16_t type; 1207 1208 if (ms->flags & (MAGIC_MIME|MAGIC_APPLE)) 1209 return 0; 1210 /* 1211 * ELF executables have multiple section headers in arbitrary 1212 * file locations and thus file(1) cannot determine it from easily. 1213 * Instead we traverse thru all section headers until a symbol table 1214 * one is found or else the binary is stripped. 1215 * Return immediately if it's not ELF (so we avoid pipe2file unless needed). 1216 */ 1217 if (buf[EI_MAG0] != ELFMAG0 1218 || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1) 1219 || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3) 1220 return 0; 1221 1222 /* 1223 * If we cannot seek, it must be a pipe, socket or fifo. 1224 */ 1225 if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE)) 1226 fd = file_pipe2file(ms, fd, buf, nbytes); 1227 1228 if (fstat(fd, &st) == -1) { 1229 file_badread(ms); 1230 return -1; 1231 } 1232 fsize = st.st_size; 1233 1234 clazz = buf[EI_CLASS]; 1235 1236 switch (clazz) { 1237 case ELFCLASS32: 1238 #undef elf_getu 1239 #define elf_getu(a, b) elf_getu32(a, b) 1240 #undef elfhdr 1241 #define elfhdr elf32hdr 1242 #include "elfclass.h" 1243 case ELFCLASS64: 1244 #undef elf_getu 1245 #define elf_getu(a, b) elf_getu64(a, b) 1246 #undef elfhdr 1247 #define elfhdr elf64hdr 1248 #include "elfclass.h" 1249 default: 1250 if (file_printf(ms, ", unknown class %d", clazz) == -1) 1251 return -1; 1252 break; 1253 } 1254 return 0; 1255 } 1256 #endif 1257