1/* 2 * Copyright (c) Christos Zoulas 2003. 3 * All Rights Reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice immediately at the beginning of the file, without modification, 10 * this list of conditions, and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR 19 * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 25 * SUCH DAMAGE. 26 */ 27#include "file.h" 28 29#ifndef lint 30FILE_RCSID("@(#)$File: readelf.c,v 1.173 2020/06/07 22:12:54 christos Exp $") 31#endif 32 33#ifdef BUILTIN_ELF 34#include <string.h> 35#include <ctype.h> 36#include <stdlib.h> 37#ifdef HAVE_UNISTD_H 38#include <unistd.h> 39#endif 40 41#include "readelf.h" 42#include "magic.h" 43 44#ifdef ELFCORE 45private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t, 46 off_t, int *, uint16_t *); 47#endif 48private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t, 49 off_t, int, int *, uint16_t *); 50private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, 51 off_t, int, int, int *, uint16_t *); 52private size_t donote(struct magic_set *, void *, size_t, size_t, int, 53 int, size_t, int *, uint16_t *, int, off_t, int, off_t); 54 55#define ELF_ALIGN(a) ((((a) + align - 1) / align) * align) 56 57#define isquote(c) (strchr("'\"`", (c)) != NULL) 58 59private uint16_t getu16(int, uint16_t); 60private uint32_t getu32(int, uint32_t); 61private uint64_t getu64(int, uint64_t); 62 63#define MAX_PHNUM 128 64#define MAX_SHNUM 32768 65#define SIZE_UNKNOWN CAST(off_t, -1) 66 67private int 68toomany(struct magic_set *ms, const char *name, uint16_t num) 69{ 70 if (ms->flags & MAGIC_MIME) 71 return 1; 72 if (file_printf(ms, ", too many %s (%u)", name, num) == -1) 73 return -1; 74 return 1; 75} 76 77private uint16_t 78getu16(int swap, uint16_t value) 79{ 80 union { 81 uint16_t ui; 82 char c[2]; 83 } retval, tmpval; 84 85 if (swap) { 86 tmpval.ui = value; 87 88 retval.c[0] = tmpval.c[1]; 89 retval.c[1] = tmpval.c[0]; 90 91 return retval.ui; 92 } else 93 return value; 94} 95 96private uint32_t 97getu32(int swap, uint32_t value) 98{ 99 union { 100 uint32_t ui; 101 char c[4]; 102 } retval, tmpval; 103 104 if (swap) { 105 tmpval.ui = value; 106 107 retval.c[0] = tmpval.c[3]; 108 retval.c[1] = tmpval.c[2]; 109 retval.c[2] = tmpval.c[1]; 110 retval.c[3] = tmpval.c[0]; 111 112 return retval.ui; 113 } else 114 return value; 115} 116 117private uint64_t 118getu64(int swap, uint64_t value) 119{ 120 union { 121 uint64_t ui; 122 char c[8]; 123 } retval, tmpval; 124 125 if (swap) { 126 tmpval.ui = value; 127 128 retval.c[0] = tmpval.c[7]; 129 retval.c[1] = tmpval.c[6]; 130 retval.c[2] = tmpval.c[5]; 131 retval.c[3] = tmpval.c[4]; 132 retval.c[4] = tmpval.c[3]; 133 retval.c[5] = tmpval.c[2]; 134 retval.c[6] = tmpval.c[1]; 135 retval.c[7] = tmpval.c[0]; 136 137 return retval.ui; 138 } else 139 return value; 140} 141 142#define elf_getu16(swap, value) getu16(swap, value) 143#define elf_getu32(swap, value) getu32(swap, value) 144#define elf_getu64(swap, value) getu64(swap, value) 145 146#define xsh_addr (clazz == ELFCLASS32 \ 147 ? CAST(void *, &sh32) \ 148 : CAST(void *, &sh64)) 149#define xsh_sizeof (clazz == ELFCLASS32 \ 150 ? sizeof(sh32) \ 151 : sizeof(sh64)) 152#define xsh_size CAST(size_t, (clazz == ELFCLASS32 \ 153 ? elf_getu32(swap, sh32.sh_size) \ 154 : elf_getu64(swap, sh64.sh_size))) 155#define xsh_offset CAST(off_t, (clazz == ELFCLASS32 \ 156 ? elf_getu32(swap, sh32.sh_offset) \ 157 : elf_getu64(swap, sh64.sh_offset))) 158#define xsh_type (clazz == ELFCLASS32 \ 159 ? elf_getu32(swap, sh32.sh_type) \ 160 : elf_getu32(swap, sh64.sh_type)) 161#define xsh_name (clazz == ELFCLASS32 \ 162 ? elf_getu32(swap, sh32.sh_name) \ 163 : elf_getu32(swap, sh64.sh_name)) 164 165#define xph_addr (clazz == ELFCLASS32 \ 166 ? CAST(void *, &ph32) \ 167 : CAST(void *, &ph64)) 168#define xph_sizeof (clazz == ELFCLASS32 \ 169 ? sizeof(ph32) \ 170 : sizeof(ph64)) 171#define xph_type (clazz == ELFCLASS32 \ 172 ? elf_getu32(swap, ph32.p_type) \ 173 : elf_getu32(swap, ph64.p_type)) 174#define xph_offset CAST(off_t, (clazz == ELFCLASS32 \ 175 ? elf_getu32(swap, ph32.p_offset) \ 176 : elf_getu64(swap, ph64.p_offset))) 177#define xph_align CAST(size_t, (clazz == ELFCLASS32 \ 178 ? CAST(off_t, (ph32.p_align ? \ 179 elf_getu32(swap, ph32.p_align) : 4))\ 180 : CAST(off_t, (ph64.p_align ? \ 181 elf_getu64(swap, ph64.p_align) : 4)))) 182#define xph_vaddr CAST(size_t, (clazz == ELFCLASS32 \ 183 ? CAST(off_t, (ph32.p_vaddr ? \ 184 elf_getu32(swap, ph32.p_vaddr) : 4))\ 185 : CAST(off_t, (ph64.p_vaddr ? \ 186 elf_getu64(swap, ph64.p_vaddr) : 4)))) 187#define xph_filesz CAST(size_t, (clazz == ELFCLASS32 \ 188 ? elf_getu32(swap, ph32.p_filesz) \ 189 : elf_getu64(swap, ph64.p_filesz))) 190#define xph_memsz CAST(size_t, ((clazz == ELFCLASS32 \ 191 ? elf_getu32(swap, ph32.p_memsz) \ 192 : elf_getu64(swap, ph64.p_memsz)))) 193#define xnh_addr (clazz == ELFCLASS32 \ 194 ? CAST(void *, &nh32) \ 195 : CAST(void *, &nh64)) 196#define xnh_sizeof (clazz == ELFCLASS32 \ 197 ? sizeof(nh32) \ 198 : sizeof(nh64)) 199#define xnh_type (clazz == ELFCLASS32 \ 200 ? elf_getu32(swap, nh32.n_type) \ 201 : elf_getu32(swap, nh64.n_type)) 202#define xnh_namesz (clazz == ELFCLASS32 \ 203 ? elf_getu32(swap, nh32.n_namesz) \ 204 : elf_getu32(swap, nh64.n_namesz)) 205#define xnh_descsz (clazz == ELFCLASS32 \ 206 ? elf_getu32(swap, nh32.n_descsz) \ 207 : elf_getu32(swap, nh64.n_descsz)) 208 209#define xdh_addr (clazz == ELFCLASS32 \ 210 ? CAST(void *, &dh32) \ 211 : CAST(void *, &dh64)) 212#define xdh_sizeof (clazz == ELFCLASS32 \ 213 ? sizeof(dh32) \ 214 : sizeof(dh64)) 215#define xdh_tag (clazz == ELFCLASS32 \ 216 ? elf_getu32(swap, dh32.d_tag) \ 217 : elf_getu64(swap, dh64.d_tag)) 218#define xdh_val (clazz == ELFCLASS32 \ 219 ? elf_getu32(swap, dh32.d_un.d_val) \ 220 : elf_getu64(swap, dh64.d_un.d_val)) 221 222#define xcap_addr (clazz == ELFCLASS32 \ 223 ? CAST(void *, &cap32) \ 224 : CAST(void *, &cap64)) 225#define xcap_sizeof (clazz == ELFCLASS32 \ 226 ? sizeof(cap32) \ 227 : sizeof(cap64)) 228#define xcap_tag (clazz == ELFCLASS32 \ 229 ? elf_getu32(swap, cap32.c_tag) \ 230 : elf_getu64(swap, cap64.c_tag)) 231#define xcap_val (clazz == ELFCLASS32 \ 232 ? elf_getu32(swap, cap32.c_un.c_val) \ 233 : elf_getu64(swap, cap64.c_un.c_val)) 234 235#define xauxv_addr (clazz == ELFCLASS32 \ 236 ? CAST(void *, &auxv32) \ 237 : CAST(void *, &auxv64)) 238#define xauxv_sizeof (clazz == ELFCLASS32 \ 239 ? sizeof(auxv32) \ 240 : sizeof(auxv64)) 241#define xauxv_type (clazz == ELFCLASS32 \ 242 ? elf_getu32(swap, auxv32.a_type) \ 243 : elf_getu64(swap, auxv64.a_type)) 244#define xauxv_val (clazz == ELFCLASS32 \ 245 ? elf_getu32(swap, auxv32.a_v) \ 246 : elf_getu64(swap, auxv64.a_v)) 247 248#define prpsoffsets(i) (clazz == ELFCLASS32 \ 249 ? prpsoffsets32[i] \ 250 : prpsoffsets64[i]) 251 252#ifdef ELFCORE 253/* 254 * Try larger offsets first to avoid false matches 255 * from earlier data that happen to look like strings. 256 */ 257static const size_t prpsoffsets32[] = { 258#ifdef USE_NT_PSINFO 259 104, /* SunOS 5.x (command line) */ 260 88, /* SunOS 5.x (short name) */ 261#endif /* USE_NT_PSINFO */ 262 263 100, /* SunOS 5.x (command line) */ 264 84, /* SunOS 5.x (short name) */ 265 266 44, /* Linux (command line) */ 267 28, /* Linux (short name) */ 268 269 48, /* Linux PowerPC (command line) */ 270 32, /* Linux PowerPC (short name) */ 271 272 8, /* FreeBSD */ 273}; 274 275static const size_t prpsoffsets64[] = { 276#ifdef USE_NT_PSINFO 277 152, /* SunOS 5.x (command line) */ 278 136, /* SunOS 5.x (short name) */ 279#endif /* USE_NT_PSINFO */ 280 281 136, /* SunOS 5.x, 64-bit (command line) */ 282 120, /* SunOS 5.x, 64-bit (short name) */ 283 284 56, /* Linux (command line) */ 285 40, /* Linux (tested on core from 2.4.x, short name) */ 286 287 16, /* FreeBSD, 64-bit */ 288}; 289 290#define NOFFSETS32 __arraycount(prpsoffsets32) 291#define NOFFSETS64 __arraycount(prpsoffsets64) 292 293#define NOFFSETS (clazz == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64) 294 295/* 296 * Look through the program headers of an executable image, searching 297 * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or 298 * "FreeBSD"; if one is found, try looking in various places in its 299 * contents for a 16-character string containing only printable 300 * characters - if found, that string should be the name of the program 301 * that dropped core. Note: right after that 16-character string is, 302 * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and 303 * Linux, a longer string (80 characters, in 5.x, probably other 304 * SVR4-flavored systems, and Linux) containing the start of the 305 * command line for that program. 306 * 307 * SunOS 5.x core files contain two PT_NOTE sections, with the types 308 * NT_PRPSINFO (old) and NT_PSINFO (new). These structs contain the 309 * same info about the command name and command line, so it probably 310 * isn't worthwhile to look for NT_PSINFO, but the offsets are provided 311 * above (see USE_NT_PSINFO), in case we ever decide to do so. The 312 * NT_PRPSINFO and NT_PSINFO sections are always in order and adjacent; 313 * the SunOS 5.x file command relies on this (and prefers the latter). 314 * 315 * The signal number probably appears in a section of type NT_PRSTATUS, 316 * but that's also rather OS-dependent, in ways that are harder to 317 * dissect with heuristics, so I'm not bothering with the signal number. 318 * (I suppose the signal number could be of interest in situations where 319 * you don't have the binary of the program that dropped core; if you 320 * *do* have that binary, the debugger will probably tell you what 321 * signal it was.) 322 */ 323 324#define OS_STYLE_SVR4 0 325#define OS_STYLE_FREEBSD 1 326#define OS_STYLE_NETBSD 2 327 328private const char os_style_names[][8] = { 329 "SVR4", 330 "FreeBSD", 331 "NetBSD", 332}; 333 334#define FLAGS_CORE_STYLE 0x0003 335 336#define FLAGS_DID_CORE 0x0004 337#define FLAGS_DID_OS_NOTE 0x0008 338#define FLAGS_DID_BUILD_ID 0x0010 339#define FLAGS_DID_CORE_STYLE 0x0020 340#define FLAGS_DID_NETBSD_PAX 0x0040 341#define FLAGS_DID_NETBSD_MARCH 0x0080 342#define FLAGS_DID_NETBSD_CMODEL 0x0100 343#define FLAGS_DID_NETBSD_EMULATION 0x0200 344#define FLAGS_DID_NETBSD_UNKNOWN 0x0400 345#define FLAGS_IS_CORE 0x0800 346#define FLAGS_DID_AUXV 0x1000 347 348private int 349dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 350 int num, size_t size, off_t fsize, int *flags, uint16_t *notecount) 351{ 352 Elf32_Phdr ph32; 353 Elf64_Phdr ph64; 354 size_t offset, len; 355 unsigned char nbuf[BUFSIZ]; 356 ssize_t bufsize; 357 off_t ph_off = off; 358 int ph_num = num; 359 360 if (ms->flags & MAGIC_MIME) 361 return 0; 362 363 if (num == 0) { 364 if (file_printf(ms, ", no program header") == -1) 365 return -1; 366 return 0; 367 } 368 if (size != xph_sizeof) { 369 if (file_printf(ms, ", corrupted program header size") == -1) 370 return -1; 371 return 0; 372 } 373 374 /* 375 * Loop through all the program headers. 376 */ 377 for ( ; num; num--) { 378 if (pread(fd, xph_addr, xph_sizeof, off) < 379 CAST(ssize_t, xph_sizeof)) { 380 file_badread(ms); 381 return -1; 382 } 383 off += size; 384 385 if (fsize != SIZE_UNKNOWN && xph_offset > fsize) { 386 /* Perhaps warn here */ 387 continue; 388 } 389 390 if (xph_type != PT_NOTE) 391 continue; 392 393 /* 394 * This is a PT_NOTE section; loop through all the notes 395 * in the section. 396 */ 397 len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf); 398 if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) { 399 file_badread(ms); 400 return -1; 401 } 402 offset = 0; 403 for (;;) { 404 if (offset >= CAST(size_t, bufsize)) 405 break; 406 offset = donote(ms, nbuf, offset, CAST(size_t, bufsize), 407 clazz, swap, 4, flags, notecount, fd, ph_off, 408 ph_num, fsize); 409 if (offset == 0) 410 break; 411 412 } 413 } 414 return 0; 415} 416#endif 417 418static int 419do_note_netbsd_version(struct magic_set *ms, int swap, void *v) 420{ 421 uint32_t desc; 422 memcpy(&desc, v, sizeof(desc)); 423 desc = elf_getu32(swap, desc); 424 425 if (file_printf(ms, ", for NetBSD") == -1) 426 return -1; 427 /* 428 * The version number used to be stuck as 199905, and was thus 429 * basically content-free. Newer versions of NetBSD have fixed 430 * this and now use the encoding of __NetBSD_Version__: 431 * 432 * MMmmrrpp00 433 * 434 * M = major version 435 * m = minor version 436 * r = release ["",A-Z,Z[A-Z] but numeric] 437 * p = patchlevel 438 */ 439 if (desc > 100000000U) { 440 uint32_t ver_patch = (desc / 100) % 100; 441 uint32_t ver_rel = (desc / 10000) % 100; 442 uint32_t ver_min = (desc / 1000000) % 100; 443 uint32_t ver_maj = desc / 100000000; 444 445 if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1) 446 return -1; 447 if (ver_rel == 0 && ver_patch != 0) { 448 if (file_printf(ms, ".%u", ver_patch) == -1) 449 return -1; 450 } else if (ver_rel != 0) { 451 while (ver_rel > 26) { 452 if (file_printf(ms, "Z") == -1) 453 return -1; 454 ver_rel -= 26; 455 } 456 if (file_printf(ms, "%c", 'A' + ver_rel - 1) 457 == -1) 458 return -1; 459 } 460 } 461 return 0; 462} 463 464static int 465do_note_freebsd_version(struct magic_set *ms, int swap, void *v) 466{ 467 uint32_t desc; 468 469 memcpy(&desc, v, sizeof(desc)); 470 desc = elf_getu32(swap, desc); 471 if (file_printf(ms, ", for FreeBSD") == -1) 472 return -1; 473 474 /* 475 * Contents is __FreeBSD_version, whose relation to OS 476 * versions is defined by a huge table in the Porter's 477 * Handbook. This is the general scheme: 478 * 479 * Releases: 480 * Mmp000 (before 4.10) 481 * Mmi0p0 (before 5.0) 482 * Mmm0p0 483 * 484 * Development branches: 485 * Mmpxxx (before 4.6) 486 * Mmp1xx (before 4.10) 487 * Mmi1xx (before 5.0) 488 * M000xx (pre-M.0) 489 * Mmm1xx 490 * 491 * M = major version 492 * m = minor version 493 * i = minor version increment (491000 -> 4.10) 494 * p = patchlevel 495 * x = revision 496 * 497 * The first release of FreeBSD to use ELF by default 498 * was version 3.0. 499 */ 500 if (desc == 460002) { 501 if (file_printf(ms, " 4.6.2") == -1) 502 return -1; 503 } else if (desc < 460100) { 504 if (file_printf(ms, " %d.%d", desc / 100000, 505 desc / 10000 % 10) == -1) 506 return -1; 507 if (desc / 1000 % 10 > 0) 508 if (file_printf(ms, ".%d", desc / 1000 % 10) == -1) 509 return -1; 510 if ((desc % 1000 > 0) || (desc % 100000 == 0)) 511 if (file_printf(ms, " (%d)", desc) == -1) 512 return -1; 513 } else if (desc < 500000) { 514 if (file_printf(ms, " %d.%d", desc / 100000, 515 desc / 10000 % 10 + desc / 1000 % 10) == -1) 516 return -1; 517 if (desc / 100 % 10 > 0) { 518 if (file_printf(ms, " (%d)", desc) == -1) 519 return -1; 520 } else if (desc / 10 % 10 > 0) { 521 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 522 return -1; 523 } 524 } else { 525 if (file_printf(ms, " %d.%d", desc / 100000, 526 desc / 1000 % 100) == -1) 527 return -1; 528 if ((desc / 100 % 10 > 0) || 529 (desc % 100000 / 100 == 0)) { 530 if (file_printf(ms, " (%d)", desc) == -1) 531 return -1; 532 } else if (desc / 10 % 10 > 0) { 533 if (file_printf(ms, ".%d", desc / 10 % 10) == -1) 534 return -1; 535 } 536 } 537 return 0; 538} 539 540private int 541/*ARGSUSED*/ 542do_bid_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 543 int swap __attribute__((__unused__)), uint32_t namesz, uint32_t descsz, 544 size_t noff, size_t doff, int *flags) 545{ 546 if (namesz == 4 && strcmp(RCAST(char *, &nbuf[noff]), "GNU") == 0 && 547 type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) { 548 uint8_t desc[20]; 549 const char *btype; 550 uint32_t i; 551 *flags |= FLAGS_DID_BUILD_ID; 552 switch (descsz) { 553 case 8: 554 btype = "xxHash"; 555 break; 556 case 16: 557 btype = "md5/uuid"; 558 break; 559 case 20: 560 btype = "sha1"; 561 break; 562 default: 563 btype = "unknown"; 564 break; 565 } 566 if (file_printf(ms, ", BuildID[%s]=", btype) == -1) 567 return -1; 568 memcpy(desc, &nbuf[doff], descsz); 569 for (i = 0; i < descsz; i++) 570 if (file_printf(ms, "%02x", desc[i]) == -1) 571 return -1; 572 return 1; 573 } 574 if (namesz == 4 && strcmp(RCAST(char *, &nbuf[noff]), "Go") == 0 && 575 type == NT_GO_BUILD_ID && descsz < 128) { 576 char buf[256]; 577 if (file_printf(ms, ", Go BuildID=%s", 578 file_copystr(buf, sizeof(buf), descsz, 579 RCAST(const char *, &nbuf[doff]))) == -1) 580 return -1; 581 return 1; 582 } 583 return 0; 584} 585 586private int 587do_os_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 588 int swap, uint32_t namesz, uint32_t descsz, 589 size_t noff, size_t doff, int *flags) 590{ 591 const char *name = RCAST(const char *, &nbuf[noff]); 592 593 if (namesz == 5 && strcmp(name, "SuSE") == 0 && 594 type == NT_GNU_VERSION && descsz == 2) { 595 *flags |= FLAGS_DID_OS_NOTE; 596 if (file_printf(ms, ", for SuSE %d.%d", nbuf[doff], 597 nbuf[doff + 1]) == -1) 598 return -1; 599 return 1; 600 } 601 602 if (namesz == 4 && strcmp(name, "GNU") == 0 && 603 type == NT_GNU_VERSION && descsz == 16) { 604 uint32_t desc[4]; 605 memcpy(desc, &nbuf[doff], sizeof(desc)); 606 607 *flags |= FLAGS_DID_OS_NOTE; 608 if (file_printf(ms, ", for GNU/") == -1) 609 return -1; 610 switch (elf_getu32(swap, desc[0])) { 611 case GNU_OS_LINUX: 612 if (file_printf(ms, "Linux") == -1) 613 return -1; 614 break; 615 case GNU_OS_HURD: 616 if (file_printf(ms, "Hurd") == -1) 617 return -1; 618 break; 619 case GNU_OS_SOLARIS: 620 if (file_printf(ms, "Solaris") == -1) 621 return -1; 622 break; 623 case GNU_OS_KFREEBSD: 624 if (file_printf(ms, "kFreeBSD") == -1) 625 return -1; 626 break; 627 case GNU_OS_KNETBSD: 628 if (file_printf(ms, "kNetBSD") == -1) 629 return -1; 630 break; 631 default: 632 if (file_printf(ms, "<unknown>") == -1) 633 return -1; 634 } 635 if (file_printf(ms, " %d.%d.%d", elf_getu32(swap, desc[1]), 636 elf_getu32(swap, desc[2]), elf_getu32(swap, desc[3])) == -1) 637 return -1; 638 return 1; 639 } 640 641 if (namesz == 7 && strcmp(name, "NetBSD") == 0) { 642 if (type == NT_NETBSD_VERSION && descsz == 4) { 643 *flags |= FLAGS_DID_OS_NOTE; 644 if (do_note_netbsd_version(ms, swap, &nbuf[doff]) == -1) 645 return -1; 646 return 1; 647 } 648 } 649 650 if (namesz == 8 && strcmp(name, "FreeBSD") == 0) { 651 if (type == NT_FREEBSD_VERSION && descsz == 4) { 652 *flags |= FLAGS_DID_OS_NOTE; 653 if (do_note_freebsd_version(ms, swap, &nbuf[doff]) 654 == -1) 655 return -1; 656 return 1; 657 } 658 } 659 660 if (namesz == 8 && strcmp(name, "OpenBSD") == 0 && 661 type == NT_OPENBSD_VERSION && descsz == 4) { 662 *flags |= FLAGS_DID_OS_NOTE; 663 if (file_printf(ms, ", for OpenBSD") == -1) 664 return -1; 665 /* Content of note is always 0 */ 666 return 1; 667 } 668 669 if (namesz == 10 && strcmp(name, "DragonFly") == 0 && 670 type == NT_DRAGONFLY_VERSION && descsz == 4) { 671 uint32_t desc; 672 *flags |= FLAGS_DID_OS_NOTE; 673 if (file_printf(ms, ", for DragonFly") == -1) 674 return -1; 675 memcpy(&desc, &nbuf[doff], sizeof(desc)); 676 desc = elf_getu32(swap, desc); 677 if (file_printf(ms, " %d.%d.%d", desc / 100000, 678 desc / 10000 % 10, desc % 10000) == -1) 679 return -1; 680 return 1; 681 } 682 return 0; 683} 684 685private int 686do_pax_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 687 int swap, uint32_t namesz, uint32_t descsz, 688 size_t noff, size_t doff, int *flags) 689{ 690 const char *name = RCAST(const char *, &nbuf[noff]); 691 692 if (namesz == 4 && strcmp(name, "PaX") == 0 && 693 type == NT_NETBSD_PAX && descsz == 4) { 694 static const char *pax[] = { 695 "+mprotect", 696 "-mprotect", 697 "+segvguard", 698 "-segvguard", 699 "+ASLR", 700 "-ASLR", 701 }; 702 uint32_t desc; 703 size_t i; 704 int did = 0; 705 706 *flags |= FLAGS_DID_NETBSD_PAX; 707 memcpy(&desc, &nbuf[doff], sizeof(desc)); 708 desc = elf_getu32(swap, desc); 709 710 if (desc && file_printf(ms, ", PaX: ") == -1) 711 return -1; 712 713 for (i = 0; i < __arraycount(pax); i++) { 714 if (((1 << CAST(int, i)) & desc) == 0) 715 continue; 716 if (file_printf(ms, "%s%s", did++ ? "," : "", 717 pax[i]) == -1) 718 return -1; 719 } 720 return 1; 721 } 722 return 0; 723} 724 725private int 726do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 727 int swap, uint32_t namesz, uint32_t descsz, 728 size_t noff, size_t doff, int *flags, size_t size, int clazz) 729{ 730#ifdef ELFCORE 731 char buf[256]; 732 const char *name = RCAST(const char *, &nbuf[noff]); 733 734 int os_style = -1; 735 /* 736 * Sigh. The 2.0.36 kernel in Debian 2.1, at 737 * least, doesn't correctly implement name 738 * sections, in core dumps, as specified by 739 * the "Program Linking" section of "UNIX(R) System 740 * V Release 4 Programmer's Guide: ANSI C and 741 * Programming Support Tools", because my copy 742 * clearly says "The first 'namesz' bytes in 'name' 743 * contain a *null-terminated* [emphasis mine] 744 * character representation of the entry's owner 745 * or originator", but the 2.0.36 kernel code 746 * doesn't include the terminating null in the 747 * name.... 748 */ 749 if ((namesz == 4 && strncmp(name, "CORE", 4) == 0) || 750 (namesz == 5 && strcmp(name, "CORE") == 0)) { 751 os_style = OS_STYLE_SVR4; 752 } 753 754 if ((namesz == 8 && strcmp(name, "FreeBSD") == 0)) { 755 os_style = OS_STYLE_FREEBSD; 756 } 757 758 if ((namesz >= 11 && strncmp(name, "NetBSD-CORE", 11) 759 == 0)) { 760 os_style = OS_STYLE_NETBSD; 761 } 762 763 if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) { 764 if (file_printf(ms, ", %s-style", os_style_names[os_style]) 765 == -1) 766 return -1; 767 *flags |= FLAGS_DID_CORE_STYLE; 768 *flags |= os_style; 769 } 770 771 switch (os_style) { 772 case OS_STYLE_NETBSD: 773 if (type == NT_NETBSD_CORE_PROCINFO) { 774 char sbuf[512]; 775 struct NetBSD_elfcore_procinfo pi; 776 memset(&pi, 0, sizeof(pi)); 777 memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi))); 778 779 if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, " 780 "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)", 781 file_printable(sbuf, sizeof(sbuf), 782 RCAST(char *, pi.cpi_name), sizeof(pi.cpi_name)), 783 elf_getu32(swap, CAST(uint32_t, pi.cpi_pid)), 784 elf_getu32(swap, pi.cpi_euid), 785 elf_getu32(swap, pi.cpi_egid), 786 elf_getu32(swap, pi.cpi_nlwps), 787 elf_getu32(swap, CAST(uint32_t, pi.cpi_siglwp)), 788 elf_getu32(swap, pi.cpi_signo), 789 elf_getu32(swap, pi.cpi_sigcode)) == -1) 790 return -1; 791 792 *flags |= FLAGS_DID_CORE; 793 return 1; 794 } 795 break; 796 797 case OS_STYLE_FREEBSD: 798 if (type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) { 799 size_t argoff, pidoff; 800 801 if (clazz == ELFCLASS32) 802 argoff = 4 + 4 + 17; 803 else 804 argoff = 4 + 4 + 8 + 17; 805 if (file_printf(ms, ", from '%.80s'", nbuf + doff + 806 argoff) == -1) 807 return -1; 808 pidoff = argoff + 81 + 2; 809 if (doff + pidoff + 4 <= size) { 810 if (file_printf(ms, ", pid=%u", 811 elf_getu32(swap, *RCAST(uint32_t *, (nbuf + 812 doff + pidoff)))) == -1) 813 return -1; 814 } 815 *flags |= FLAGS_DID_CORE; 816 } 817 break; 818 819 default: 820 if (type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) { 821 size_t i, j; 822 unsigned char c; 823 /* 824 * Extract the program name. We assume 825 * it to be 16 characters (that's what it 826 * is in SunOS 5.x and Linux). 827 * 828 * Unfortunately, it's at a different offset 829 * in various OSes, so try multiple offsets. 830 * If the characters aren't all printable, 831 * reject it. 832 */ 833 for (i = 0; i < NOFFSETS; i++) { 834 unsigned char *cname, *cp; 835 size_t reloffset = prpsoffsets(i); 836 size_t noffset = doff + reloffset; 837 size_t k; 838 for (j = 0; j < 16; j++, noffset++, 839 reloffset++) { 840 /* 841 * Make sure we're not past 842 * the end of the buffer; if 843 * we are, just give up. 844 */ 845 if (noffset >= size) 846 goto tryanother; 847 848 /* 849 * Make sure we're not past 850 * the end of the contents; 851 * if we are, this obviously 852 * isn't the right offset. 853 */ 854 if (reloffset >= descsz) 855 goto tryanother; 856 857 c = nbuf[noffset]; 858 if (c == '\0') { 859 /* 860 * A '\0' at the 861 * beginning is 862 * obviously wrong. 863 * Any other '\0' 864 * means we're done. 865 */ 866 if (j == 0) 867 goto tryanother; 868 else 869 break; 870 } else { 871 /* 872 * A nonprintable 873 * character is also 874 * wrong. 875 */ 876 if (!isprint(c) || isquote(c)) 877 goto tryanother; 878 } 879 } 880 /* 881 * Well, that worked. 882 */ 883 884 /* 885 * Try next offsets, in case this match is 886 * in the middle of a string. 887 */ 888 for (k = i + 1 ; k < NOFFSETS; k++) { 889 size_t no; 890 int adjust = 1; 891 if (prpsoffsets(k) >= prpsoffsets(i)) 892 continue; 893 for (no = doff + prpsoffsets(k); 894 no < doff + prpsoffsets(i); no++) 895 adjust = adjust 896 && isprint(nbuf[no]); 897 if (adjust) 898 i = k; 899 } 900 901 cname = CAST(unsigned char *, 902 &nbuf[doff + prpsoffsets(i)]); 903 for (cp = cname; cp < nbuf + size && *cp 904 && isprint(*cp); cp++) 905 continue; 906 /* 907 * Linux apparently appends a space at the end 908 * of the command line: remove it. 909 */ 910 while (cp > cname && isspace(cp[-1])) 911 cp--; 912 if (file_printf(ms, ", from '%s'", 913 file_copystr(buf, sizeof(buf), 914 CAST(size_t, cp - cname), 915 CAST(const char *, cname))) == -1) 916 return -1; 917 *flags |= FLAGS_DID_CORE; 918 return 1; 919 920 tryanother: 921 ; 922 } 923 } 924 break; 925 } 926#endif 927 return 0; 928} 929 930private off_t 931get_offset_from_virtaddr(struct magic_set *ms, int swap, int clazz, int fd, 932 off_t off, int num, off_t fsize, uint64_t virtaddr) 933{ 934 Elf32_Phdr ph32; 935 Elf64_Phdr ph64; 936 937 /* 938 * Loop through all the program headers and find the header with 939 * virtual address in which the "virtaddr" belongs to. 940 */ 941 for ( ; num; num--) { 942 if (pread(fd, xph_addr, xph_sizeof, off) < 943 CAST(ssize_t, xph_sizeof)) { 944 file_badread(ms); 945 return -1; 946 } 947 off += xph_sizeof; 948 949 if (fsize != SIZE_UNKNOWN && xph_offset > fsize) { 950 /* Perhaps warn here */ 951 continue; 952 } 953 954 if (virtaddr >= xph_vaddr && virtaddr < xph_vaddr + xph_filesz) 955 return xph_offset + (virtaddr - xph_vaddr); 956 } 957 return 0; 958} 959 960private size_t 961get_string_on_virtaddr(struct magic_set *ms, 962 int swap, int clazz, int fd, off_t ph_off, int ph_num, 963 off_t fsize, uint64_t virtaddr, char *buf, ssize_t buflen) 964{ 965 char *bptr; 966 off_t offset; 967 968 if (buflen == 0) 969 return 0; 970 971 offset = get_offset_from_virtaddr(ms, swap, clazz, fd, ph_off, ph_num, 972 fsize, virtaddr); 973 if (offset < 0 || 974 (buflen = pread(fd, buf, CAST(size_t, buflen), offset)) <= 0) { 975 file_badread(ms); 976 return 0; 977 } 978 979 buf[buflen - 1] = '\0'; 980 981 /* We expect only printable characters, so return if buffer contains 982 * non-printable character before the '\0' or just '\0'. */ 983 for (bptr = buf; *bptr && isprint(CAST(unsigned char, *bptr)); bptr++) 984 continue; 985 if (*bptr != '\0') 986 return 0; 987 988 return bptr - buf; 989} 990 991 992/*ARGSUSED*/ 993private int 994do_auxv_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type, 995 int swap, uint32_t namesz __attribute__((__unused__)), 996 uint32_t descsz __attribute__((__unused__)), 997 size_t noff __attribute__((__unused__)), size_t doff, 998 int *flags, size_t size __attribute__((__unused__)), int clazz, 999 int fd, off_t ph_off, int ph_num, off_t fsize) 1000{ 1001#ifdef ELFCORE 1002 Aux32Info auxv32; 1003 Aux64Info auxv64; 1004 size_t elsize = xauxv_sizeof; 1005 const char *tag; 1006 int is_string; 1007 size_t nval; 1008 1009 if ((*flags & (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE)) != 1010 (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE)) 1011 return 0; 1012 1013 switch (*flags & FLAGS_CORE_STYLE) { 1014 case OS_STYLE_SVR4: 1015 if (type != NT_AUXV) 1016 return 0; 1017 break; 1018#ifdef notyet 1019 case OS_STYLE_NETBSD: 1020 if (type != NT_NETBSD_CORE_AUXV) 1021 return 0; 1022 break; 1023 case OS_STYLE_FREEBSD: 1024 if (type != NT_FREEBSD_PROCSTAT_AUXV) 1025 return 0; 1026 break; 1027#endif 1028 default: 1029 return 0; 1030 } 1031 1032 *flags |= FLAGS_DID_AUXV; 1033 1034 nval = 0; 1035 for (size_t off = 0; off + elsize <= descsz; off += elsize) { 1036 memcpy(xauxv_addr, &nbuf[doff + off], xauxv_sizeof); 1037 /* Limit processing to 50 vector entries to prevent DoS */ 1038 if (nval++ >= 50) { 1039 file_error(ms, 0, "Too many ELF Auxv elements"); 1040 return 1; 1041 } 1042 1043 switch(xauxv_type) { 1044 case AT_LINUX_EXECFN: 1045 is_string = 1; 1046 tag = "execfn"; 1047 break; 1048 case AT_LINUX_PLATFORM: 1049 is_string = 1; 1050 tag = "platform"; 1051 break; 1052 case AT_LINUX_UID: 1053 is_string = 0; 1054 tag = "real uid"; 1055 break; 1056 case AT_LINUX_GID: 1057 is_string = 0; 1058 tag = "real gid"; 1059 break; 1060 case AT_LINUX_EUID: 1061 is_string = 0; 1062 tag = "effective uid"; 1063 break; 1064 case AT_LINUX_EGID: 1065 is_string = 0; 1066 tag = "effective gid"; 1067 break; 1068 default: 1069 is_string = 0; 1070 tag = NULL; 1071 break; 1072 } 1073 1074 if (tag == NULL) 1075 continue; 1076 1077 if (is_string) { 1078 char buf[256]; 1079 ssize_t buflen; 1080 buflen = get_string_on_virtaddr(ms, swap, clazz, fd, 1081 ph_off, ph_num, fsize, xauxv_val, buf, sizeof(buf)); 1082 1083 if (buflen == 0) 1084 continue; 1085 1086 if (file_printf(ms, ", %s: '%s'", tag, buf) == -1) 1087 return -1; 1088 } else { 1089 if (file_printf(ms, ", %s: %d", tag, 1090 CAST(int, xauxv_val)) == -1) 1091 return -1; 1092 } 1093 } 1094 return 1; 1095#else 1096 return 0; 1097#endif 1098} 1099 1100private size_t 1101dodynamic(struct magic_set *ms, void *vbuf, size_t offset, size_t size, 1102 int clazz, int swap) 1103{ 1104 Elf32_Dyn dh32; 1105 Elf64_Dyn dh64; 1106 unsigned char *dbuf = CAST(unsigned char *, vbuf); 1107 1108 if (xdh_sizeof + offset > size) { 1109 /* 1110 * We're out of note headers. 1111 */ 1112 return xdh_sizeof + offset; 1113 } 1114 1115 memcpy(xdh_addr, &dbuf[offset], xdh_sizeof); 1116 offset += xdh_sizeof; 1117 1118 switch (xdh_tag) { 1119 case DT_FLAGS_1: 1120 if (xdh_val & DF_1_PIE) 1121 ms->mode |= 0111; 1122 else 1123 ms->mode &= ~0111; 1124 break; 1125 default: 1126 break; 1127 } 1128 return offset; 1129} 1130 1131 1132private size_t 1133donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size, 1134 int clazz, int swap, size_t align, int *flags, uint16_t *notecount, 1135 int fd, off_t ph_off, int ph_num, off_t fsize) 1136{ 1137 Elf32_Nhdr nh32; 1138 Elf64_Nhdr nh64; 1139 size_t noff, doff; 1140 uint32_t namesz, descsz; 1141 char buf[256]; 1142 unsigned char *nbuf = CAST(unsigned char *, vbuf); 1143 1144 if (*notecount == 0) 1145 return 0; 1146 --*notecount; 1147 1148 if (xnh_sizeof + offset > size) { 1149 /* 1150 * We're out of note headers. 1151 */ 1152 return xnh_sizeof + offset; 1153 } 1154 /*XXX: GCC */ 1155 memset(&nh32, 0, sizeof(nh32)); 1156 memset(&nh64, 0, sizeof(nh64)); 1157 1158 memcpy(xnh_addr, &nbuf[offset], xnh_sizeof); 1159 offset += xnh_sizeof; 1160 1161 namesz = xnh_namesz; 1162 descsz = xnh_descsz; 1163 1164 if ((namesz == 0) && (descsz == 0)) { 1165 /* 1166 * We're out of note headers. 1167 */ 1168 return (offset >= size) ? offset : size; 1169 } 1170 1171 if (namesz & 0x80000000) { 1172 if (file_printf(ms, ", bad note name size %#lx", 1173 CAST(unsigned long, namesz)) == -1) 1174 return -1; 1175 return 0; 1176 } 1177 1178 if (descsz & 0x80000000) { 1179 if (file_printf(ms, ", bad note description size %#lx", 1180 CAST(unsigned long, descsz)) == -1) 1181 return -1; 1182 return 0; 1183 } 1184 1185 noff = offset; 1186 doff = ELF_ALIGN(offset + namesz); 1187 1188 if (offset + namesz > size) { 1189 /* 1190 * We're past the end of the buffer. 1191 */ 1192 return doff; 1193 } 1194 1195 offset = ELF_ALIGN(doff + descsz); 1196 if (doff + descsz > size) { 1197 /* 1198 * We're past the end of the buffer. 1199 */ 1200 return (offset >= size) ? offset : size; 1201 } 1202 1203 1204 if ((*flags & FLAGS_DID_OS_NOTE) == 0) { 1205 if (do_os_note(ms, nbuf, xnh_type, swap, 1206 namesz, descsz, noff, doff, flags)) 1207 return offset; 1208 } 1209 1210 if ((*flags & FLAGS_DID_BUILD_ID) == 0) { 1211 if (do_bid_note(ms, nbuf, xnh_type, swap, 1212 namesz, descsz, noff, doff, flags)) 1213 return offset; 1214 } 1215 1216 if ((*flags & FLAGS_DID_NETBSD_PAX) == 0) { 1217 if (do_pax_note(ms, nbuf, xnh_type, swap, 1218 namesz, descsz, noff, doff, flags)) 1219 return offset; 1220 } 1221 1222 if ((*flags & FLAGS_DID_CORE) == 0) { 1223 if (do_core_note(ms, nbuf, xnh_type, swap, 1224 namesz, descsz, noff, doff, flags, size, clazz)) 1225 return offset; 1226 } 1227 1228 if ((*flags & FLAGS_DID_AUXV) == 0) { 1229 if (do_auxv_note(ms, nbuf, xnh_type, swap, 1230 namesz, descsz, noff, doff, flags, size, clazz, 1231 fd, ph_off, ph_num, fsize)) 1232 return offset; 1233 } 1234 1235 if (namesz == 7 && strcmp(RCAST(char *, &nbuf[noff]), "NetBSD") == 0) { 1236 int descw, flag; 1237 const char *str, *tag; 1238 if (descsz > 100) 1239 descsz = 100; 1240 switch (xnh_type) { 1241 case NT_NETBSD_VERSION: 1242 return offset; 1243 case NT_NETBSD_MARCH: 1244 flag = FLAGS_DID_NETBSD_MARCH; 1245 tag = "compiled for"; 1246 break; 1247 case NT_NETBSD_CMODEL: 1248 flag = FLAGS_DID_NETBSD_CMODEL; 1249 tag = "compiler model"; 1250 break; 1251 case NT_NETBSD_EMULATION: 1252 flag = FLAGS_DID_NETBSD_EMULATION; 1253 tag = "emulation:"; 1254 break; 1255 default: 1256 if (*flags & FLAGS_DID_NETBSD_UNKNOWN) 1257 return offset; 1258 *flags |= FLAGS_DID_NETBSD_UNKNOWN; 1259 if (file_printf(ms, ", note=%u", xnh_type) == -1) 1260 return offset; 1261 return offset; 1262 } 1263 1264 if (*flags & flag) 1265 return offset; 1266 str = RCAST(const char *, &nbuf[doff]); 1267 descw = CAST(int, descsz); 1268 *flags |= flag; 1269 file_printf(ms, ", %s: %s", tag, 1270 file_copystr(buf, sizeof(buf), descw, str)); 1271 return offset; 1272 } 1273 1274 return offset; 1275} 1276 1277/* SunOS 5.x hardware capability descriptions */ 1278typedef struct cap_desc { 1279 uint64_t cd_mask; 1280 const char *cd_name; 1281} cap_desc_t; 1282 1283static const cap_desc_t cap_desc_sparc[] = { 1284 { AV_SPARC_MUL32, "MUL32" }, 1285 { AV_SPARC_DIV32, "DIV32" }, 1286 { AV_SPARC_FSMULD, "FSMULD" }, 1287 { AV_SPARC_V8PLUS, "V8PLUS" }, 1288 { AV_SPARC_POPC, "POPC" }, 1289 { AV_SPARC_VIS, "VIS" }, 1290 { AV_SPARC_VIS2, "VIS2" }, 1291 { AV_SPARC_ASI_BLK_INIT, "ASI_BLK_INIT" }, 1292 { AV_SPARC_FMAF, "FMAF" }, 1293 { AV_SPARC_FJFMAU, "FJFMAU" }, 1294 { AV_SPARC_IMA, "IMA" }, 1295 { 0, NULL } 1296}; 1297 1298static const cap_desc_t cap_desc_386[] = { 1299 { AV_386_FPU, "FPU" }, 1300 { AV_386_TSC, "TSC" }, 1301 { AV_386_CX8, "CX8" }, 1302 { AV_386_SEP, "SEP" }, 1303 { AV_386_AMD_SYSC, "AMD_SYSC" }, 1304 { AV_386_CMOV, "CMOV" }, 1305 { AV_386_MMX, "MMX" }, 1306 { AV_386_AMD_MMX, "AMD_MMX" }, 1307 { AV_386_AMD_3DNow, "AMD_3DNow" }, 1308 { AV_386_AMD_3DNowx, "AMD_3DNowx" }, 1309 { AV_386_FXSR, "FXSR" }, 1310 { AV_386_SSE, "SSE" }, 1311 { AV_386_SSE2, "SSE2" }, 1312 { AV_386_PAUSE, "PAUSE" }, 1313 { AV_386_SSE3, "SSE3" }, 1314 { AV_386_MON, "MON" }, 1315 { AV_386_CX16, "CX16" }, 1316 { AV_386_AHF, "AHF" }, 1317 { AV_386_TSCP, "TSCP" }, 1318 { AV_386_AMD_SSE4A, "AMD_SSE4A" }, 1319 { AV_386_POPCNT, "POPCNT" }, 1320 { AV_386_AMD_LZCNT, "AMD_LZCNT" }, 1321 { AV_386_SSSE3, "SSSE3" }, 1322 { AV_386_SSE4_1, "SSE4.1" }, 1323 { AV_386_SSE4_2, "SSE4.2" }, 1324 { 0, NULL } 1325}; 1326 1327private int 1328doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num, 1329 size_t size, off_t fsize, int mach, int strtab, int *flags, 1330 uint16_t *notecount) 1331{ 1332 Elf32_Shdr sh32; 1333 Elf64_Shdr sh64; 1334 int stripped = 1, has_debug_info = 0; 1335 size_t nbadcap = 0; 1336 void *nbuf; 1337 off_t noff, coff, name_off; 1338 uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilities */ 1339 uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilities */ 1340 char name[50]; 1341 ssize_t namesize; 1342 1343 if (ms->flags & MAGIC_MIME) 1344 return 0; 1345 1346 if (num == 0) { 1347 if (file_printf(ms, ", no section header") == -1) 1348 return -1; 1349 return 0; 1350 } 1351 if (size != xsh_sizeof) { 1352 if (file_printf(ms, ", corrupted section header size") == -1) 1353 return -1; 1354 return 0; 1355 } 1356 1357 /* Read offset of name section to be able to read section names later */ 1358 if (pread(fd, xsh_addr, xsh_sizeof, CAST(off_t, (off + size * strtab))) 1359 < CAST(ssize_t, xsh_sizeof)) { 1360 if (file_printf(ms, ", missing section headers") == -1) 1361 return -1; 1362 return 0; 1363 } 1364 name_off = xsh_offset; 1365 1366 if (fsize != SIZE_UNKNOWN && fsize < name_off) { 1367 if (file_printf(ms, ", too large section header offset %jd", 1368 (intmax_t)name_off) == -1) 1369 return -1; 1370 return 0; 1371 } 1372 1373 for ( ; num; num--) { 1374 /* Read the name of this section. */ 1375 if ((namesize = pread(fd, name, sizeof(name) - 1, 1376 name_off + xsh_name)) == -1) { 1377 file_badread(ms); 1378 return -1; 1379 } 1380 name[namesize] = '\0'; 1381 if (strcmp(name, ".debug_info") == 0) { 1382 has_debug_info = 1; 1383 stripped = 0; 1384 } 1385 1386 if (pread(fd, xsh_addr, xsh_sizeof, off) < 1387 CAST(ssize_t, xsh_sizeof)) { 1388 file_badread(ms); 1389 return -1; 1390 } 1391 off += size; 1392 1393 /* Things we can determine before we seek */ 1394 switch (xsh_type) { 1395 case SHT_SYMTAB: 1396#if 0 1397 case SHT_DYNSYM: 1398#endif 1399 stripped = 0; 1400 break; 1401 default: 1402 if (fsize != SIZE_UNKNOWN && xsh_offset > fsize) { 1403 /* Perhaps warn here */ 1404 continue; 1405 } 1406 break; 1407 } 1408 1409 1410 /* Things we can determine when we seek */ 1411 switch (xsh_type) { 1412 case SHT_NOTE: 1413 if (CAST(uintmax_t, (xsh_size + xsh_offset)) > 1414 CAST(uintmax_t, fsize)) { 1415 if (file_printf(ms, 1416 ", note offset/size %#" INTMAX_T_FORMAT 1417 "x+%#" INTMAX_T_FORMAT "x exceeds" 1418 " file size %#" INTMAX_T_FORMAT "x", 1419 CAST(uintmax_t, xsh_offset), 1420 CAST(uintmax_t, xsh_size), 1421 CAST(uintmax_t, fsize)) == -1) 1422 return -1; 1423 return 0; 1424 } 1425 if ((nbuf = malloc(xsh_size)) == NULL) { 1426 file_error(ms, errno, "Cannot allocate memory" 1427 " for note"); 1428 return -1; 1429 } 1430 if (pread(fd, nbuf, xsh_size, xsh_offset) < 1431 CAST(ssize_t, xsh_size)) { 1432 file_badread(ms); 1433 free(nbuf); 1434 return -1; 1435 } 1436 1437 noff = 0; 1438 for (;;) { 1439 if (noff >= CAST(off_t, xsh_size)) 1440 break; 1441 noff = donote(ms, nbuf, CAST(size_t, noff), 1442 xsh_size, clazz, swap, 4, flags, notecount, 1443 fd, 0, 0, 0); 1444 if (noff == 0) 1445 break; 1446 } 1447 free(nbuf); 1448 break; 1449 case SHT_SUNW_cap: 1450 switch (mach) { 1451 case EM_SPARC: 1452 case EM_SPARCV9: 1453 case EM_IA_64: 1454 case EM_386: 1455 case EM_AMD64: 1456 break; 1457 default: 1458 goto skip; 1459 } 1460 1461 if (nbadcap > 5) 1462 break; 1463 if (lseek(fd, xsh_offset, SEEK_SET) 1464 == CAST(off_t, -1)) { 1465 file_badseek(ms); 1466 return -1; 1467 } 1468 coff = 0; 1469 for (;;) { 1470 Elf32_Cap cap32; 1471 Elf64_Cap cap64; 1472 char cbuf[/*CONSTCOND*/ 1473 MAX(sizeof(cap32), sizeof(cap64))]; 1474 if ((coff += xcap_sizeof) > 1475 CAST(off_t, xsh_size)) 1476 break; 1477 if (read(fd, cbuf, CAST(size_t, xcap_sizeof)) != 1478 CAST(ssize_t, xcap_sizeof)) { 1479 file_badread(ms); 1480 return -1; 1481 } 1482 if (cbuf[0] == 'A') { 1483#ifdef notyet 1484 char *p = cbuf + 1; 1485 uint32_t len, tag; 1486 memcpy(&len, p, sizeof(len)); 1487 p += 4; 1488 len = getu32(swap, len); 1489 if (memcmp("gnu", p, 3) != 0) { 1490 if (file_printf(ms, 1491 ", unknown capability %.3s", p) 1492 == -1) 1493 return -1; 1494 break; 1495 } 1496 p += strlen(p) + 1; 1497 tag = *p++; 1498 memcpy(&len, p, sizeof(len)); 1499 p += 4; 1500 len = getu32(swap, len); 1501 if (tag != 1) { 1502 if (file_printf(ms, ", unknown gnu" 1503 " capability tag %d", tag) 1504 == -1) 1505 return -1; 1506 break; 1507 } 1508 // gnu attributes 1509#endif 1510 break; 1511 } 1512 memcpy(xcap_addr, cbuf, xcap_sizeof); 1513 switch (xcap_tag) { 1514 case CA_SUNW_NULL: 1515 break; 1516 case CA_SUNW_HW_1: 1517 cap_hw1 |= xcap_val; 1518 break; 1519 case CA_SUNW_SF_1: 1520 cap_sf1 |= xcap_val; 1521 break; 1522 default: 1523 if (file_printf(ms, 1524 ", with unknown capability " 1525 "%#" INT64_T_FORMAT "x = %#" 1526 INT64_T_FORMAT "x", 1527 CAST(unsigned long long, xcap_tag), 1528 CAST(unsigned long long, xcap_val)) 1529 == -1) 1530 return -1; 1531 if (nbadcap++ > 2) 1532 coff = xsh_size; 1533 break; 1534 } 1535 } 1536 /*FALLTHROUGH*/ 1537 skip: 1538 default: 1539 break; 1540 } 1541 } 1542 1543 if (has_debug_info) { 1544 if (file_printf(ms, ", with debug_info") == -1) 1545 return -1; 1546 } 1547 if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1) 1548 return -1; 1549 if (cap_hw1) { 1550 const cap_desc_t *cdp; 1551 switch (mach) { 1552 case EM_SPARC: 1553 case EM_SPARC32PLUS: 1554 case EM_SPARCV9: 1555 cdp = cap_desc_sparc; 1556 break; 1557 case EM_386: 1558 case EM_IA_64: 1559 case EM_AMD64: 1560 cdp = cap_desc_386; 1561 break; 1562 default: 1563 cdp = NULL; 1564 break; 1565 } 1566 if (file_printf(ms, ", uses") == -1) 1567 return -1; 1568 if (cdp) { 1569 while (cdp->cd_name) { 1570 if (cap_hw1 & cdp->cd_mask) { 1571 if (file_printf(ms, 1572 " %s", cdp->cd_name) == -1) 1573 return -1; 1574 cap_hw1 &= ~cdp->cd_mask; 1575 } 1576 ++cdp; 1577 } 1578 if (cap_hw1) 1579 if (file_printf(ms, 1580 " unknown hardware capability %#" 1581 INT64_T_FORMAT "x", 1582 CAST(unsigned long long, cap_hw1)) == -1) 1583 return -1; 1584 } else { 1585 if (file_printf(ms, 1586 " hardware capability %#" INT64_T_FORMAT "x", 1587 CAST(unsigned long long, cap_hw1)) == -1) 1588 return -1; 1589 } 1590 } 1591 if (cap_sf1) { 1592 if (cap_sf1 & SF1_SUNW_FPUSED) { 1593 if (file_printf(ms, 1594 (cap_sf1 & SF1_SUNW_FPKNWN) 1595 ? ", uses frame pointer" 1596 : ", not known to use frame pointer") == -1) 1597 return -1; 1598 } 1599 cap_sf1 &= ~SF1_SUNW_MASK; 1600 if (cap_sf1) 1601 if (file_printf(ms, 1602 ", with unknown software capability %#" 1603 INT64_T_FORMAT "x", 1604 CAST(unsigned long long, cap_sf1)) == -1) 1605 return -1; 1606 } 1607 return 0; 1608} 1609 1610/* 1611 * Look through the program headers of an executable image, searching 1612 * for a PT_INTERP section; if one is found, it's dynamically linked, 1613 * otherwise it's statically linked. 1614 */ 1615private int 1616dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off, 1617 int num, size_t size, off_t fsize, int sh_num, int *flags, 1618 uint16_t *notecount) 1619{ 1620 Elf32_Phdr ph32; 1621 Elf64_Phdr ph64; 1622 const char *linking_style = "statically"; 1623 unsigned char nbuf[BUFSIZ]; 1624 char ibuf[BUFSIZ]; 1625 char interp[BUFSIZ]; 1626 ssize_t bufsize; 1627 size_t offset, align, len; 1628 1629 if (num == 0) { 1630 if (file_printf(ms, ", no program header") == -1) 1631 return -1; 1632 return 0; 1633 } 1634 if (size != xph_sizeof) { 1635 if (file_printf(ms, ", corrupted program header size") == -1) 1636 return -1; 1637 return 0; 1638 } 1639 1640 interp[0] = '\0'; 1641 for ( ; num; num--) { 1642 int doread; 1643 if (pread(fd, xph_addr, xph_sizeof, off) < 1644 CAST(ssize_t, xph_sizeof)) { 1645 file_badread(ms); 1646 return -1; 1647 } 1648 1649 off += size; 1650 bufsize = 0; 1651 align = 4; 1652 1653 /* Things we can determine before we seek */ 1654 switch (xph_type) { 1655 case PT_DYNAMIC: 1656 doread = 1; 1657 linking_style = "dynamically"; 1658 break; 1659 case PT_NOTE: 1660 if (sh_num) /* Did this through section headers */ 1661 continue; 1662 if (((align = xph_align) & 0x80000000UL) != 0 || 1663 align < 4) { 1664 if (file_printf(ms, 1665 ", invalid note alignment %#lx", 1666 CAST(unsigned long, align)) == -1) 1667 return -1; 1668 align = 4; 1669 } 1670 /*FALLTHROUGH*/ 1671 case PT_INTERP: 1672 doread = 1; 1673 break; 1674 default: 1675 doread = 0; 1676 if (fsize != SIZE_UNKNOWN && xph_offset > fsize) { 1677 /* Maybe warn here? */ 1678 continue; 1679 } 1680 break; 1681 } 1682 1683 if (doread) { 1684 len = xph_filesz < sizeof(nbuf) ? xph_filesz 1685 : sizeof(nbuf); 1686 bufsize = pread(fd, nbuf, len, xph_offset); 1687 if (bufsize == -1) { 1688 file_badread(ms); 1689 return -1; 1690 } 1691 } else 1692 len = 0; 1693 1694 /* Things we can determine when we seek */ 1695 switch (xph_type) { 1696 case PT_DYNAMIC: 1697 offset = 0; 1698 // Let DF_1 determine if we are PIE or not. 1699 ms->mode &= ~0111; 1700 for (;;) { 1701 if (offset >= CAST(size_t, bufsize)) 1702 break; 1703 offset = dodynamic(ms, nbuf, offset, 1704 CAST(size_t, bufsize), clazz, swap); 1705 if (offset == 0) 1706 break; 1707 } 1708 if (ms->flags & MAGIC_MIME) 1709 continue; 1710 break; 1711 1712 case PT_INTERP: 1713 if (ms->flags & MAGIC_MIME) 1714 continue; 1715 if (bufsize && nbuf[0]) { 1716 nbuf[bufsize - 1] = '\0'; 1717 memcpy(interp, nbuf, CAST(size_t, bufsize)); 1718 } else 1719 strlcpy(interp, "*empty*", sizeof(interp)); 1720 break; 1721 case PT_NOTE: 1722 if (ms->flags & MAGIC_MIME) 1723 return 0; 1724 /* 1725 * This is a PT_NOTE section; loop through all the notes 1726 * in the section. 1727 */ 1728 offset = 0; 1729 for (;;) { 1730 if (offset >= CAST(size_t, bufsize)) 1731 break; 1732 offset = donote(ms, nbuf, offset, 1733 CAST(size_t, bufsize), clazz, swap, align, 1734 flags, notecount, fd, 0, 0, 0); 1735 if (offset == 0) 1736 break; 1737 } 1738 break; 1739 default: 1740 if (ms->flags & MAGIC_MIME) 1741 continue; 1742 break; 1743 } 1744 } 1745 if (ms->flags & MAGIC_MIME) 1746 return 0; 1747 if (file_printf(ms, ", %s linked", linking_style) 1748 == -1) 1749 return -1; 1750 if (interp[0]) 1751 if (file_printf(ms, ", interpreter %s", 1752 file_printable(ibuf, sizeof(ibuf), interp, sizeof(interp))) 1753 == -1) 1754 return -1; 1755 return 0; 1756} 1757 1758 1759protected int 1760file_tryelf(struct magic_set *ms, const struct buffer *b) 1761{ 1762 int fd = b->fd; 1763 const unsigned char *buf = CAST(const unsigned char *, b->fbuf); 1764 size_t nbytes = b->flen; 1765 union { 1766 int32_t l; 1767 char c[sizeof(int32_t)]; 1768 } u; 1769 int clazz; 1770 int swap; 1771 struct stat st; 1772 const struct stat *stp; 1773 off_t fsize; 1774 int flags = 0; 1775 Elf32_Ehdr elf32hdr; 1776 Elf64_Ehdr elf64hdr; 1777 uint16_t type, phnum, shnum, notecount; 1778 1779 if (ms->flags & (MAGIC_APPLE|MAGIC_EXTENSION)) 1780 return 0; 1781 /* 1782 * ELF executables have multiple section headers in arbitrary 1783 * file locations and thus file(1) cannot determine it from easily. 1784 * Instead we traverse thru all section headers until a symbol table 1785 * one is found or else the binary is stripped. 1786 * Return immediately if it's not ELF (so we avoid pipe2file unless 1787 * needed). 1788 */ 1789 if (buf[EI_MAG0] != ELFMAG0 1790 || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1) 1791 || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3) 1792 return 0; 1793 1794 /* 1795 * If we cannot seek, it must be a pipe, socket or fifo. 1796 */ 1797 if((lseek(fd, CAST(off_t, 0), SEEK_SET) == CAST(off_t, -1)) 1798 && (errno == ESPIPE)) 1799 fd = file_pipe2file(ms, fd, buf, nbytes); 1800 1801 if (fd == -1) { 1802 file_badread(ms); 1803 return -1; 1804 } 1805 1806 stp = &b->st; 1807 /* 1808 * b->st.st_size != 0 if previous fstat() succeeded, 1809 * which is likely, we can avoid extra stat() call. 1810 */ 1811 if (b->st.st_size == 0) { 1812 stp = &st; 1813 if (fstat(fd, &st) == -1) { 1814 file_badread(ms); 1815 return -1; 1816 } 1817 } 1818 if (S_ISREG(stp->st_mode) || stp->st_size != 0) 1819 fsize = stp->st_size; 1820 else 1821 fsize = SIZE_UNKNOWN; 1822 1823 clazz = buf[EI_CLASS]; 1824 1825 switch (clazz) { 1826 case ELFCLASS32: 1827#undef elf_getu 1828#define elf_getu(a, b) elf_getu32(a, b) 1829#undef elfhdr 1830#define elfhdr elf32hdr 1831#include "elfclass.h" 1832 case ELFCLASS64: 1833#undef elf_getu 1834#define elf_getu(a, b) elf_getu64(a, b) 1835#undef elfhdr 1836#define elfhdr elf64hdr 1837#include "elfclass.h" 1838 default: 1839 if (file_printf(ms, ", unknown class %d", clazz) == -1) 1840 return -1; 1841 break; 1842 } 1843 return 0; 1844} 1845#endif 1846