detect ELF OS via libc sysdeps .symtab entries

[williballenthin]

Originally posted by @williballenthin in #1402 (comment)

there's a potential new hint: .symtab entries for libc resources related to linux:

    15: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS libc/sysdeps/linux/x86_64/crti.S
    33: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS libc/sysdeps/linux/x86_64/crtn.S
    34: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS libc/sysdeps/linux/x86_64/crt1.S
    48: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS libc/sysdeps/linux/x86_64/vfork.S

we should update our OS detection (here: https://github.com/mandiant/capa/blob/master/capa/features/extractors/elf.py) to use these entries to identify the underlying OS as linux.

[williballenthin]

use UPX unpacked 0a1a8ca1ce27a04bf9618fe0f6bc94e6 as a test case

[ggold7046]

Hi @williballenthin , this problem looks interesting to me , though not sure if I would be able to solve this. Could you tell me how to proceed on this ?

[williballenthin]

most of the details i have at the moment are in the above issue text (which means, there aren't many details fleshed out yet). so, you'll have to do most of the research to figure out how to make this work. i'd recommend using readelf to figure out which structures contain the above entries and then extending the elf.py parser to parse this data and apply the heuristics. unfortunately im not able to provide more guidance at this time.

[ggold7046]

Correct me if I'm wrong. The readelf is used to inspect and display information about the ELF files. Could you please point me to that file ?

[williballenthin]

readelf is a common linux utility, not part of capa

https://man7.org/linux/man-pages/man1/readelf.1.html

[ggold7046]

i'd recommend using readelf to figure out which structures contain the above entries

I tried to convert the https://github.com/mandiant/capa/blob/master/capa/features/extractors/elf.py file using pyinstaller, and ran readelf. But couldn't find any libc/sysdeps/linux/x86_64/crti.S entry there.

[yelhamer]

Hi @williballenthin, I'd love to get assigned this enhancement, I think I know how to implement it.

[williballenthin]

Sure, go ahead and take a stab and open a PR.

[ggold7046]

Could anyone please make me understand how this problem was solved from start ? How did you find out the entries etc...etc.

[williballenthin]

have you read through the changes in https://github.com/mandiant/capa/pull/1422/files and do you understand what they do?