Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Can't Detect MIPS64 ELFs By Default #4555

Closed
fuzyll opened this issue Aug 8, 2023 · 2 comments
Closed

Can't Detect MIPS64 ELFs By Default #4555

fuzyll opened this issue Aug 8, 2023 · 2 comments
Assignees
Labels
Arch: MIPS Issues with the MIPS architecture plugin Component: Core Issue needs changes to the core File Format: ELF Impact: Medium Issue is impactful with a bad, or no, workaround Type: Bug Issue is a non-crashing bug with repro steps
Milestone

Comments

@fuzyll
Copy link
Contributor

fuzyll commented Aug 8, 2023

Bug Description:
We appear to be unable to accurately detect that an ELF is mips64 instead of mips32 by default. I suspect this is because the e_machine does not make a distinction between the two, and we rely on that to determine the default architecture.

You can work around this by using Open with Options and changing architecture and platform to mips64. But, it's easy to miss, and even easier if you don't have apriori knowledge of which architecture is correct.

Steps To Reproduce:

  1. Open any MIPS64 binary.
  2. Observe that it defaults to mips32.

Expected Behavior:
We open things as mips64 when they are.

@fuzyll fuzyll added Type: Bug Issue is a non-crashing bug with repro steps Component: Core Issue needs changes to the core File Format: ELF Arch: MIPS Issues with the MIPS architecture plugin Impact: Medium Issue is impactful with a bad, or no, workaround labels Aug 8, 2023
@lwerdna lwerdna self-assigned this Aug 8, 2023
@lwerdna
Copy link
Contributor

lwerdna commented Aug 8, 2023

repro:

busybox-mips64.zip

then in the python window:

>>> bv.arch
<arch: mips32>

(should be mips64)

The Elf64_hdr .e_machine field is just EM_MIPS (so nothing to distinguish the 32/64 on), but we should look also to the .e_ident[EI_CLASS] field which has value 0x2 (marking 64-bit).

@lwerdna
Copy link
Contributor

lwerdna commented Aug 9, 2023

I was expecting to add some code that would look to .e_ident[EI_CLASS]. Instead, we're going to mix that field into the identifier when we register the architecture.

Currently, we use .e_machine as an architecture ID when we call RegisterArchitecture(). Now for those architectures whose ID here is not selective enough (like for MIPS, 8 is used by both 32-bit and 64-bit elfs), their ID will be augmented with .e_ident[EI_CLASS] shifted to bit position 16.

So instead of calling RegisterArchitecture() with EM_MIPS (8) all alone, we call it with 0x10008 for 32-bit and 0x20008 for 64-bit.

Commit in arch-mips: Vector35/arch-mips@c8e2d4a
Commit in view-elf: Vector35/view-elf@b651c02
Commit in binja: https://github.com/Vector35/binaryninja/commit/138c8688527f71fe0120a0751cb9c08053a00a35

@lwerdna lwerdna closed this as completed Aug 9, 2023
@plafosse plafosse added this to the Coruscant milestone Aug 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Arch: MIPS Issues with the MIPS architecture plugin Component: Core Issue needs changes to the core File Format: ELF Impact: Medium Issue is impactful with a bad, or no, workaround Type: Bug Issue is a non-crashing bug with repro steps
Projects
None yet
Development

No branches or pull requests

3 participants