This commit is contained in:
Willi Ballenthin
2023-04-03 13:00:02 +02:00
parent 7387c073fb
commit d230780443
2 changed files with 29 additions and 15 deletions

View File

@@ -605,11 +605,20 @@ class SHNote:
class SymTab:
def __init__(self, endian: str, bitness: int, symtab_buf: bytes, symtab_entsize: int, symtab_sz: int, strtab_buf: bytes, strtab_sz: int) -> None:
def __init__(
self,
endian: str,
bitness: int,
symtab_buf: bytes,
symtab_entsize: int,
symtab_sz: int,
strtab_buf: bytes,
strtab_sz: int,
) -> None:
self.symbols = []
self.symnum = int(symtab_sz / symtab_entsize)
self.entsize = symtab_entsize
self.strings = strtab_buf
self.strings_sz = strtab_sz
@@ -617,14 +626,18 @@ class SymTab:
def _parse(self, endian: str, bitness: int, symtab_buf: bytes) -> None:
"""
return the symbol's information in
return the symbol's information in
the order specified by sys/elf32.h
"""
for i in range(self.symnum):
if bitness == 32:
name, value, size, info, other, shndx = struct.unpack_from(endian+"IIIBBH", symtab_buf, i*self.entsize)
name, value, size, info, other, shndx = struct.unpack_from(
endian + "IIIBBH", symtab_buf, i * self.entsize
)
elif bitness == 64:
name, info, other, shndx, value, size = struct.unpack_from(endian+"IBBBQQ", symtab_buf, i*self.entsize)
name, info, other, shndx, value, size = struct.unpack_from(
endian + "IBBBQQ", symtab_buf, i * self.entsize
)
self.symbols.append((name, value, size, info, other, shndx))
@@ -780,7 +793,7 @@ def guess_os_from_symtab(elf) -> Optional[OS]:
for shdr in elf.section_headers:
if shdr.type == SHT_STRTAB:
strtab_buf, strtab_sz= shdr.buf, shdr.size
strtab_buf, strtab_sz = shdr.buf, shdr.size
elif shdr.type == SHT_SYMTAB:
symtab_buf, symtab_entsize, symtab_sz = shdr.buf, shdr.entsize, shdr.size
@@ -789,22 +802,23 @@ def guess_os_from_symtab(elf) -> Optional[OS]:
# executable does not contain a symbol table
# or the symbol's names are stripped
return None
symtab = SymTab(
elf.endian, elf.bitness, symtab_buf, symtab_entsize, symtab_sz, strtab_buf, strtab_sz
)
symtab = SymTab(elf.endian, elf.bitness, symtab_buf, symtab_entsize, symtab_sz, strtab_buf, strtab_sz)
keywords = {
OS.LINUX: ['linux', '/linux/',],
OS.LINUX: [
"linux",
"/linux/",
],
}
for name, *_ in symtab.get_symbols():
sym_name = symtab.fetch_str(name)
for os, hints in keywords.items():
if any(map(lambda x: x in sym_name, hints)):
return os
return None
@@ -832,7 +846,7 @@ def detect_elf_os(f) -> str:
needed_dependencies_guess = guess_os_from_needed_dependencies(elf)
logger.debug("guess: needed dependencies: %s", needed_dependencies_guess)
symtab_guess = guess_os_from_symtab(elf)
symtab_guess = guess_os_from_symtab(elf)
logger.debug("guess: pertinent symbol name: %s", symtab_guess)
ret = None

View File

@@ -92,7 +92,7 @@ def get_file_imports() -> Dict[int, Tuple[str, str, int]]:
# IDA uses section names for the library of ELF imports, like ".dynsym".
# These are not useful to us, we may need to expand this list over time
# TODO: exhaust this list, see #1419
# TODO: exhaust this list, see #1419
if library == ".dynsym":
library = ""