1/*
2 * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 *    notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 *    notice, this list of conditions and the following disclaimer in the
11 *    documentation and/or other materials provided with the distribution.
12 * 3. All advertising materials mentioning features or use of this software
13 *    must display the following acknowledgement:
14 *      This product includes software developed by Christopher G. Demetriou
15 *	for the NetBSD Project.
16 * 4. The name of the author may not be used to endorse or promote products
17 *    derived from this software without specific prior written permission
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 */
30
31#include <sys/cdefs.h>
32#ifndef lint
33#if 0
34__RCSID("$NetBSD: exec_elf32.c,v 1.6 1999/09/20 04:12:16 christos Exp $");
35#endif
36#endif
37__FBSDID("$FreeBSD: stable/10/usr.sbin/crunch/crunchide/exec_elf32.c 309077 2016-11-24 00:46:34Z emaste $");
38
39#ifndef ELFSIZE
40#define ELFSIZE         32
41#endif
42
43#include <sys/types.h>
44#include <sys/endian.h>
45#include <sys/stat.h>
46
47#include <errno.h>
48#include <limits.h>
49#include <stddef.h>
50#include <stdio.h>
51#include <stdlib.h>
52#include <string.h>
53#include <unistd.h>
54
55#include "extern.h"
56
57#if (defined(NLIST_ELF32) && (ELFSIZE == 32)) || \
58    (defined(NLIST_ELF64) && (ELFSIZE == 64))
59
60#define	__ELF_WORD_SIZE ELFSIZE
61#if (ELFSIZE == 32)
62#include <sys/elf32.h>
63#define	xewtoh(x)	((data == ELFDATA2MSB) ? be32toh(x) : le32toh(x))
64#define	htoxew(x)	((data == ELFDATA2MSB) ? htobe32(x) : htole32(x))
65#define	wewtoh(x)	((data == ELFDATA2MSB) ? be32toh(x) : le32toh(x))
66#define	htowew(x)	((data == ELFDATA2MSB) ? htobe32(x) : htole32(x))
67#elif (ELFSIZE == 64)
68#include <sys/elf64.h>
69#define	xewtoh(x)	((data == ELFDATA2MSB) ? be64toh(x) : le64toh(x))
70#define	htoxew(x)	((data == ELFDATA2MSB) ? htobe64(x) : htole64(x))
71/* elf64 Elf64_Word are 32 bits */
72#define	wewtoh(x)	((data == ELFDATA2MSB) ? be32toh(x) : le32toh(x))
73#define	htowew(x)	((data == ELFDATA2MSB) ? htobe32(x) : htole32(x))
74#endif
75#include <sys/elf_generic.h>
76
77#define CONCAT(x,y)     __CONCAT(x,y)
78#define ELFNAME(x)      CONCAT(elf,CONCAT(ELFSIZE,CONCAT(_,x)))
79#define ELFNAME2(x,y)   CONCAT(x,CONCAT(_elf,CONCAT(ELFSIZE,CONCAT(_,y))))
80#define ELFNAMEEND(x)   CONCAT(x,CONCAT(_elf,ELFSIZE))
81#define ELFDEFNNAME(x)  CONCAT(ELF,CONCAT(ELFSIZE,CONCAT(_,x)))
82#ifndef ELFCLASS
83#define ELFCLASS	CONCAT(ELFCLASS,ELFSIZE)
84#endif
85
86#define	xe16toh(x)	((data == ELFDATA2MSB) ? be16toh(x) : le16toh(x))
87#define	xe32toh(x)	((data == ELFDATA2MSB) ? be32toh(x) : le32toh(x))
88#define	htoxe32(x)	((data == ELFDATA2MSB) ? htobe32(x) : htole32(x))
89
90struct shlayout {
91	Elf_Shdr *shdr;
92	void *bufp;
93};
94
95static ssize_t
96xreadatoff(int fd, void *buf, off_t off, size_t size, const char *fn)
97{
98	ssize_t rv;
99
100	if (lseek(fd, off, SEEK_SET) != off) {
101		perror(fn);
102		return -1;
103	}
104	if ((size_t)(rv = read(fd, buf, size)) != size) {
105		fprintf(stderr, "%s: read error: %s\n", fn,
106		    rv == -1 ? strerror(errno) : "short read");
107		return -1;
108	}
109	return size;
110}
111
112static ssize_t
113xwriteatoff(int fd, void *buf, off_t off, size_t size, const char *fn)
114{
115	ssize_t rv;
116
117	if (lseek(fd, off, SEEK_SET) != off) {
118		perror(fn);
119		return -1;
120	}
121	if ((size_t)(rv = write(fd, buf, size)) != size) {
122		fprintf(stderr, "%s: write error: %s\n", fn,
123		    rv == -1 ? strerror(errno) : "short write");
124		return -1;
125	}
126	return size;
127}
128
129static void *
130xmalloc(size_t size, const char *fn, const char *use)
131{
132	void *rv;
133
134	rv = malloc(size);
135	if (rv == NULL)
136		fprintf(stderr, "%s: out of memory (allocating for %s)\n",
137		    fn, use);
138	return (rv);
139}
140
141static void *
142xrealloc(void *ptr, size_t size, const char *fn, const char *use)
143{
144	void *rv;
145
146	rv = realloc(ptr, size);
147	if (rv == NULL) {
148		free(ptr);
149		fprintf(stderr, "%s: out of memory (reallocating for %s)\n",
150		    fn, use);
151	}
152	return (rv);
153}
154
155int
156ELFNAMEEND(check)(int fd, const char *fn)
157{
158	Elf_Ehdr eh;
159	struct stat sb;
160	unsigned char data;
161
162	/*
163	 * Check the header to maek sure it's an ELF file (of the
164	 * appropriate size).
165	 */
166	if (fstat(fd, &sb) == -1)
167		return 0;
168	if (sb.st_size < (off_t)(sizeof eh))
169		return 0;
170	if (read(fd, &eh, sizeof eh) != sizeof eh)
171		return 0;
172
173	if (IS_ELF(eh) == 0 || eh.e_ident[EI_CLASS] != ELFCLASS)
174                return 0;
175
176	data = eh.e_ident[EI_DATA];
177
178	switch (xe16toh(eh.e_machine)) {
179	case EM_386: break;
180	case EM_ALPHA: break;
181#ifndef EM_AARCH64
182#define	EM_AARCH64	183
183#endif
184	case EM_AARCH64: break;
185	case EM_ARM: break;
186	case EM_IA_64: break;
187	case EM_MIPS: break;
188	case /* EM_MIPS_RS3_LE */ EM_MIPS_RS4_BE: break;
189	case EM_PPC: break;
190	case EM_PPC64: break;
191#ifndef EM_RISCV
192#define	EM_RISCV	243
193#endif
194	case EM_RISCV: break;
195	case EM_SPARCV9: break;
196	case EM_X86_64: break;
197/*        ELFDEFNNAME(MACHDEP_ID_CASES) */
198
199        default:
200                return 0;
201        }
202
203	return 1;
204}
205
206/*
207 * This function 'hides' (some of) ELF executable file's symbols.
208 * It hides them by renaming them to "_$$hide$$ <filename> <symbolname>".
209 * Symbols in the global keep list, or which are marked as being undefined,
210 * are left alone.
211 *
212 * An old version of this code shuffled various tables around, turning
213 * global symbols to be hidden into local symbols.  That lost on the
214 * mips, because CALL16 relocs must reference global symbols, and, if
215 * those symbols were being hidden, they were no longer global.
216 *
217 * The new renaming behaviour doesn't take global symbols out of the
218 * namespace.  However, it's ... unlikely that there will ever be
219 * any collisions in practice because of the new method.
220 */
221int
222ELFNAMEEND(hide)(int fd, const char *fn)
223{
224	Elf_Ehdr ehdr;
225	struct shlayout *layoutp = NULL;
226	Elf_Shdr *shdrp = NULL, *symtabshdr, *strtabshdr, *shstrtabshdr;
227	Elf_Shdr shdrshdr;
228	Elf_Sym *symtabp = NULL;
229	char *shstrtabp = NULL, *strtabp = NULL;
230	Elf_Size nsyms, ewi;
231	Elf_Off off;
232	ssize_t shdrsize;
233	int rv, i, weird, l, m, r, strtabidx;
234	size_t nstrtab_size, nstrtab_nextoff, fn_size, size;
235	char *nstrtabp = NULL;
236	unsigned char data;
237	const char *weirdreason = NULL;
238	void *buf;
239	Elf_Half shnum;
240
241	rv = 0;
242	if (xreadatoff(fd, &ehdr, 0, sizeof ehdr, fn) != sizeof ehdr)
243		goto bad;
244
245	data = ehdr.e_ident[EI_DATA];
246	shnum = xe16toh(ehdr.e_shnum);
247
248	shdrsize = shnum * xe16toh(ehdr.e_shentsize);
249	if ((shdrp = xmalloc(shdrsize, fn, "section header table")) == NULL)
250		goto bad;
251	if (xreadatoff(fd, shdrp, xewtoh(ehdr.e_shoff), shdrsize, fn) !=
252	    shdrsize)
253		goto bad;
254
255	symtabshdr = strtabshdr = shstrtabshdr = NULL;
256	weird = 0;
257	for (i = 0; i < shnum; i++) {
258		switch (xe32toh(shdrp[i].sh_type)) {
259		case SHT_SYMTAB:
260			if (symtabshdr != NULL) {
261				weird = 1;
262				weirdreason = "multiple symbol tables";
263			}
264			symtabshdr = &shdrp[i];
265			strtabshdr = &shdrp[xe32toh(shdrp[i].sh_link)];
266			break;
267		case SHT_STRTAB:
268			if (i == xe16toh(ehdr.e_shstrndx))
269				shstrtabshdr = &shdrp[i];
270			break;
271		}
272	}
273	if (symtabshdr == NULL)
274		goto out;
275	if (strtabshdr == NULL) {
276		weird = 1;
277		weirdreason = "string table does not exist";
278	}
279	if (shstrtabshdr == NULL) {
280		weird = 1;
281		weirdreason = "section header string table does not exist";
282	}
283	if (strtabshdr == shstrtabshdr) {
284		weird = 1;
285		weirdreason = "combined strtab and shstrtab not supported";
286	}
287	if (weirdreason == NULL)
288		weirdreason = "unsupported";
289	if (weird) {
290		fprintf(stderr, "%s: weird executable (%s)\n", fn, weirdreason);
291		goto bad;
292	}
293
294	/*
295	 * sort section layout table by offset
296	 */
297	layoutp = xmalloc((shnum + 1) * sizeof(struct shlayout),
298	    fn, "layout table");
299	if (layoutp == NULL)
300		goto bad;
301
302	/* add a pseudo entry to represent the section header table */
303	shdrshdr.sh_offset = ehdr.e_shoff;
304	shdrshdr.sh_size = htoxew(shdrsize);
305	shdrshdr.sh_addralign = htoxew(ELFSIZE / 8);
306	layoutp[shnum].shdr = &shdrshdr;
307
308	/* insert and sort normal section headers */
309	for (i = shnum; i-- != 0;) {
310		l = i + 1;
311		r = shnum;
312		while (l <= r) {
313			m = ( l + r) / 2;
314			if (xewtoh(shdrp[i].sh_offset) >
315			    xewtoh(layoutp[m].shdr->sh_offset))
316				l = m + 1;
317			else
318				r = m - 1;
319		}
320
321		if (r != i) {
322			memmove(&layoutp[i], &layoutp[i + 1],
323			    sizeof(struct shlayout) * (r - i));
324		}
325
326		layoutp[r].shdr = &shdrp[i];
327		layoutp[r].bufp = NULL;
328	}
329	++shnum;
330
331	/*
332	 * load up everything we need
333	 */
334
335	/* load section string table for debug use */
336	if ((size = xewtoh(shstrtabshdr->sh_size)) == 0)
337		goto bad;
338	if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL)
339		goto bad;
340	if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset),
341	    size, fn) != size)
342		goto bad;
343	if (shstrtabp[size - 1] != '\0')
344		goto bad;
345
346	/* we need symtab, strtab, and everything behind strtab */
347	strtabidx = INT_MAX;
348	for (i = 0; i < shnum; i++) {
349		if (layoutp[i].shdr == &shdrshdr) {
350			/* not load section header again */
351			layoutp[i].bufp = shdrp;
352			continue;
353		}
354		if (layoutp[i].shdr == shstrtabshdr) {
355			/* not load section string table again */
356			layoutp[i].bufp = shstrtabp;
357			continue;
358		}
359
360		if (layoutp[i].shdr == strtabshdr)
361			strtabidx = i;
362		if (layoutp[i].shdr == symtabshdr || i >= strtabidx) {
363			off = xewtoh(layoutp[i].shdr->sh_offset);
364			if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0)
365				goto bad;
366			layoutp[i].bufp = xmalloc(size, fn,
367			    shstrtabp + xewtoh(layoutp[i].shdr->sh_name));
368			if (layoutp[i].bufp == NULL)
369				goto bad;
370			if ((size_t)xreadatoff(fd, layoutp[i].bufp, off, size, fn) !=
371			    size)
372				goto bad;
373
374			/* set symbol table and string table */
375			if (layoutp[i].shdr == symtabshdr) {
376				symtabp = layoutp[i].bufp;
377			} else if (layoutp[i].shdr == strtabshdr) {
378				strtabp = layoutp[i].bufp;
379				if (strtabp[size - 1] != '\0')
380					goto bad;
381			}
382		}
383	}
384
385	nstrtab_size = 256;
386	nstrtabp = xmalloc(nstrtab_size, fn, "new string table");
387	if (nstrtabp == NULL)
388		goto bad;
389	nstrtab_nextoff = 0;
390
391	fn_size = strlen(fn);
392
393	/* Prepare data structures for symbol movement. */
394	nsyms = xewtoh(symtabshdr->sh_size) / xewtoh(symtabshdr->sh_entsize);
395
396	/* move symbols, making them local */
397	for (ewi = 0; ewi < nsyms; ewi++) {
398		Elf_Sym *sp = &symtabp[ewi];
399		const char *symname = strtabp + xe32toh(sp->st_name);
400		size_t newent_len;
401		/*
402		 * make sure there's size for the next entry, even if it's
403		 * as large as it can be.
404		 *
405		 * "_$$hide$$ <filename> <symname><NUL>" ->
406		 *    9 + 3 + sizes of fn and sym name
407		 */
408		while ((nstrtab_size - nstrtab_nextoff) <
409		    strlen(symname) + fn_size + 12) {
410			nstrtab_size *= 2;
411			nstrtabp = xrealloc(nstrtabp, nstrtab_size, fn,
412			    "new string table");
413			if (nstrtabp == NULL)
414				goto bad;
415		}
416
417		sp->st_name = htowew(nstrtab_nextoff);
418
419		/* if it's a keeper or is undefined, don't rename it. */
420		if (in_keep_list(symname) ||
421		    (xe16toh(sp->st_shndx) == SHN_UNDEF)) {
422			newent_len = sprintf(nstrtabp + nstrtab_nextoff,
423			    "%s", symname) + 1;
424		} else {
425			newent_len = sprintf(nstrtabp + nstrtab_nextoff,
426			    "_$$hide$$ %s %s", fn, symname) + 1;
427		}
428		nstrtab_nextoff += newent_len;
429	}
430	strtabshdr->sh_size = htoxew(nstrtab_nextoff);
431
432	/*
433	 * update section header table in ascending order of offset
434	 */
435	for (i = strtabidx + 1; i < shnum; i++) {
436		Elf_Off off, align;
437		off = xewtoh(layoutp[i - 1].shdr->sh_offset) +
438		    xewtoh(layoutp[i - 1].shdr->sh_size);
439		align = xewtoh(layoutp[i].shdr->sh_addralign);
440		off = (off + (align - 1)) & ~(align - 1);
441		layoutp[i].shdr->sh_offset = htoxew(off);
442	}
443
444	/*
445	 * write data to the file in descending order of offset
446	 */
447	for (i = shnum; i-- != 0;) {
448		if (layoutp[i].shdr == strtabshdr) {
449			/* new string table */
450			buf = nstrtabp;
451		} else
452			buf = layoutp[i].bufp;
453
454		if (layoutp[i].shdr == &shdrshdr ||
455		    layoutp[i].shdr == symtabshdr || i >= strtabidx) {
456			if (buf == NULL)
457				goto bad;
458
459			/*
460			 * update the offset of section header table in elf
461			 * header if needed.
462			 */
463			if (layoutp[i].shdr == &shdrshdr &&
464			    ehdr.e_shoff != shdrshdr.sh_offset) {
465				ehdr.e_shoff = shdrshdr.sh_offset;
466				off = offsetof(Elf_Ehdr, e_shoff);
467				size = sizeof(Elf_Off);
468				if ((size_t)xwriteatoff(fd, &ehdr.e_shoff, off, size,
469				    fn) != size)
470					goto bad;
471			}
472
473			off = xewtoh(layoutp[i].shdr->sh_offset);
474			size = xewtoh(layoutp[i].shdr->sh_size);
475			if ((size_t)xwriteatoff(fd, buf, off, size, fn) != size)
476				goto bad;
477		}
478	}
479
480out:
481	if (layoutp != NULL) {
482		for (i = 0; i < shnum; i++) {
483			if (layoutp[i].bufp != NULL)
484				free(layoutp[i].bufp);
485		}
486		free(layoutp);
487	}
488	free(nstrtabp);
489	return (rv);
490
491bad:
492	rv = 1;
493	goto out;
494}
495
496#endif /* include this size of ELF */
497