ELF Parser locating imports incorrectly (PPC) #9825

ogre2007 · 2018-04-07T13:33:31Z

Work environment

Arch Linux x86-64
PPC-32 ELF
radare2 2.5.0-git 17805 @ linux-x86-64 git.2.4.0-282-g43af9e3bb
commit: 43af9e3 build: 2018-04-06__23:16:3

I've compiled a simple hello world binary with toolchain for ppc build via crosstools-ng , and tried to analyze it with R2.

Expected behavior

Imports of file (printf func) is actually located at 0x1002**** addresses, and one can see it from objdumpD.txt file that I've added to zip archive. So rabin2 -ii hello.ppc or is should show it in output, and aaa; pdf main should show, that printf functions is called from there.
(something like this)

Actual behavior

However, ii, is commands show, that printf function and other imports is located at invalid 0x4743430a addresses:

and r2 cant realize, that address called from main subroutine is actually printf function, therefore there is no Xref to string being used here.

Steps to reproduce the behavior

just run rabin2 -is to see that imports is too far.

Additional Logs, screenshots, source-code, configuration dump, ...

hello-ppc.zip
There is source file, binary file, and objdump -D output file

One more thing

I'll be happy if someone will give me any hints to track down and fix this issue, so please respond even if you're not working on this arch etc.

The text was updated successfully, but these errors were encountered:

ogre2007 · 2018-04-07T14:10:41Z

Well, as I see problem may be hiding in finding relocations:

So maybe we need to check code that parsing PT_DYNAMIC header and reloc table

ogre2007 · 2018-04-15T10:04:53Z

Still actual with master. Found out, that problem is compilation specific. Because binary from another toolchain is disassembled well

radare · 2018-06-28T02:16:35Z

Fixed in #10526

radare · 2018-06-28T02:22:06Z

i added a test too

ret2libc · 2018-06-28T07:41:54Z

@radare Shall it be closed then?

Maijin · 2018-07-01T13:59:54Z

Not it's not merged

ret2libc · 2019-01-04T15:39:51Z

Reopening this issue because while testing the provided binary (hello.ppc) I still get the wrong output.

$ ./binr/rabin2/rabin2 -iR ~/Downloads/hello.ppc
[Imports]
Num  Vaddr       Bind      Type Name
   1 0x4743430a  GLOBAL    FUNC printf
   2 0x4743431a    WEAK  NOTYPE __gmon_start__
   3 0x4743432a  GLOBAL    FUNC __libc_start_main
   0 0x00000000  (null)  (null)
[Relocations]

0 relocations

ret2libc · 2019-01-04T16:45:32Z

@radare Moreover, the fix 5080179 does not seem to really fix the mosquito binary either.

ii on that binary gives some results that may seem, at a first look, correct, but if you look at the imp.XXXX entries they are all in the wrong place (e.g. imp.unlink falls where there is the .init_array).

I noticed this because I'm refactoring the get_import_addr function in elf.c and I was surprised to find that ppc64 was the only one to require the rel_sec section to compute the import address. Where did you discover that?

radare · 2019-01-05T09:22:30Z

Discover what

…

On 4 Jan 2019, at 17:45, Riccardo Schirone ***@***.***> wrote: @radare Moreover, the fix 5080179 does not seem to really fix the mosquito binary either. ii on that binary gives some results that may seem, at a first look, correct, but if you look at the imp.XXXX entries they are all in the wrong place (e.g. imp.unlink falls where there is the .init_array). I noticed this because I'm refactoring the get_import_addr function in elf.c and I was surprised to find that ppc64 was the only one to require the rel_sec section to compute the import address. Where did you discover that? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

ret2libc · 2019-01-06T16:25:24Z

Discover what

That you need to use rel_sec->offset to compute the PPC import addresses.

ret2libc · 2020-04-22T14:08:02Z

I'm no PPC expert, but something like the following improves a bit the situation, though it is not perfect.

From 9902b2082d55ffb1e39853adf2e127d8b89c5da8 Mon Sep 17 00:00:00 2001
From: Riccardo Schirone <sirmy15@gmail.com>
Date: Wed, 22 Apr 2020 16:04:15 +0200
Subject: [PATCH] Add PPC relocs

---
 libr/bin/p/bin_elf.inc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libr/bin/p/bin_elf.inc b/libr/bin/p/bin_elf.inc
index 61d1570a6..b7595cca6 100644
--- a/libr/bin/p/bin_elf.inc
+++ b/libr/bin/p/bin_elf.inc
@@ -648,6 +648,15 @@ static RBinReloc *reloc_convert(struct Elf_(r_bin_elf_obj_t) *bin, RBinElfReloc
 		 ////eprintf("TODO(eddyb): uninmplemented ELF/ARM reloc type %i\n", rel->type);
 		}
 		break;
+	case EM_PPC: switch (rel->type) {
+		case R_PPC_NONE:	break;
+		case R_PPC_GLOB_DAT:	ADD (32, 0);
+		case R_PPC_JMP_SLOT:	ADD (32, 0);
+		default:
+			eprintf ("unimplemented ELF/PPC reloc type %d\n", rel->type);
+			break;
+		}
+		break;
 	default: break;
 	}
 
-- 
2.25.3

In particular, the following solution identifies the relocations, but there are dupped ones (I think because they are both in RELA and REL sections). Also, I can't find any PLT section, but as I said I'm no PPC expert. Maybe this can be useful as a starting point for someone else interested.

ghost · 2020-06-19T07:58:33Z

@ret2libc Indeed there is some duplication, the main problem is that the duplication come from the relocation table. This is not a bug. The binary seems to be invalid but functional. I don't know which entry we need to keep, the last one, first one, ect...
Maybe we can keep duplication so the user can understand the problem.

ret2libc · 2020-06-19T08:46:28Z

@ret2libc Indeed there is some duplication, the main problem is that the duplication come from the relocation table. This is not a bug. The binary seems to be invalid but functional. I don't know which entry we need to keep, the last one, first one, ect...
Maybe we can keep duplication so the user can understand the problem.

Yeah I think we can live with the duplication, however I am not 100% confident of the patch I wrote above as I'm no PPC expert. We may include it nonetheless, as it improves a bit the situation, but it would be better to have someone familiar with PPC looking at this.

ghost · 2020-06-19T08:47:56Z

but it would be better to have someone familiar with PPC looking at this.

We can ask on telegram?

ghost · 2020-07-01T08:28:26Z

I'm no PPC expert, but something like the following improves a bit the situation, though it is not perfect.

From 9902b2082d55ffb1e39853adf2e127d8b89c5da8 Mon Sep 17 00:00:00 2001
From: Riccardo Schirone <sirmy15@gmail.com>
Date: Wed, 22 Apr 2020 16:04:15 +0200
Subject: [PATCH] Add PPC relocs

---
 libr/bin/p/bin_elf.inc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libr/bin/p/bin_elf.inc b/libr/bin/p/bin_elf.inc
index 61d1570a6..b7595cca6 100644
--- a/libr/bin/p/bin_elf.inc
+++ b/libr/bin/p/bin_elf.inc
@@ -648,6 +648,15 @@ static RBinReloc *reloc_convert(struct Elf_(r_bin_elf_obj_t) *bin, RBinElfReloc
 		 ////eprintf("TODO(eddyb): uninmplemented ELF/ARM reloc type %i\n", rel->type);
 		}
 		break;
+	case EM_PPC: switch (rel->type) {
+		case R_PPC_NONE:	break;
+		case R_PPC_GLOB_DAT:	ADD (32, 0);
+		case R_PPC_JMP_SLOT:	ADD (32, 0);
+		default:
+			eprintf ("unimplemented ELF/PPC reloc type %d\n", rel->type);
+			break;
+		}
+		break;
 	default: break;
 	}
 
-- 
2.25.3

In particular, the following solution identifies the relocations, but there are dupped ones (I think because they are both in RELA and REL sections). Also, I can't find any PLT section, but as I said I'm no PPC expert. Maybe this can be useful as a starting point for someone else interested.

I think we can push this patch, if someone isn't happy he will create an issue.

ret2libc · 2020-07-01T08:35:22Z

I think we can push this patch, if someone isn't happy he will create an issue.

I agree. Are you willing to do it? Otherwise I can do it.

ghost · 2020-07-01T08:37:02Z

I can do this.

ghost · 2020-07-01T09:21:38Z

Done, i had one regression test

ogre2007 changed the title ~~ELF Parser incorrectly locating imports (PPC)~~ ELF Parser locating imports incorrectly (PPC) Apr 7, 2018

radare added this to the 2.6.0 milestone Apr 8, 2018

radare mentioned this issue May 12, 2018

Fix reloc symbols not loaded correctly #10079

Closed

XVilka added ELF RBin labels May 14, 2018

radare assigned ret2libc May 20, 2018

radare modified the milestones: 2.6.0, 2.7.0 May 21, 2018

radare modified the milestones: 2.7.0, 2.8.0 Jun 28, 2018

XVilka added the PowerPC label Jun 29, 2018

Maijin closed this as completed Jul 1, 2018

Maijin reopened this Jul 1, 2018

XVilka modified the milestones: 2.8.0, 2.9.0 - pre-r2con Aug 5, 2018

radare self-assigned this Aug 31, 2018

radare modified the milestones: 2.9.0, 3.0 Sep 2, 2018

ret2libc removed this from the 3.0 milestone Oct 11, 2018

radare closed this as completed in 5080179 Nov 19, 2018

ret2libc reopened this Jan 4, 2019

ret2libc mentioned this issue Jan 4, 2019

Refactoring of get_import_addr in format/elf #12649

Merged

XVilka added PPC PowerPC architecture support issues and removed PowerPC labels Feb 17, 2020

ret2libc removed their assignment Apr 22, 2020

ghost mentioned this issue Jul 1, 2020

Add reloc convert ppc #17191

Merged

4 tasks

ret2libc closed this as completed in #17191 Jul 1, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ELF Parser locating imports incorrectly (PPC) #9825

ELF Parser locating imports incorrectly (PPC) #9825

ogre2007 commented Apr 7, 2018 •

edited

Loading

ogre2007 commented Apr 7, 2018 •

edited

Loading

ogre2007 commented Apr 15, 2018

radare commented Jun 28, 2018

radare commented Jun 28, 2018

ret2libc commented Jun 28, 2018

Maijin commented Jul 1, 2018

ret2libc commented Jan 4, 2019

ret2libc commented Jan 4, 2019

radare commented Jan 5, 2019 via email

ret2libc commented Jan 6, 2019

ret2libc commented Apr 22, 2020

ghost commented Jun 19, 2020

ret2libc commented Jun 19, 2020

ghost commented Jun 19, 2020

ghost commented Jul 1, 2020

ret2libc commented Jul 1, 2020

ghost commented Jul 1, 2020

ghost commented Jul 1, 2020

ELF Parser locating imports incorrectly (PPC) #9825

ELF Parser locating imports incorrectly (PPC) #9825

Comments

ogre2007 commented Apr 7, 2018 • edited Loading

Work environment

Expected behavior

Actual behavior

Steps to reproduce the behavior

Additional Logs, screenshots, source-code, configuration dump, ...

One more thing

ogre2007 commented Apr 7, 2018 • edited Loading

ogre2007 commented Apr 15, 2018

radare commented Jun 28, 2018

radare commented Jun 28, 2018

ret2libc commented Jun 28, 2018

Maijin commented Jul 1, 2018

ret2libc commented Jan 4, 2019

ret2libc commented Jan 4, 2019

radare commented Jan 5, 2019 via email

ret2libc commented Jan 6, 2019

ret2libc commented Apr 22, 2020

ghost commented Jun 19, 2020

ret2libc commented Jun 19, 2020

ghost commented Jun 19, 2020

ghost commented Jul 1, 2020

ret2libc commented Jul 1, 2020

ghost commented Jul 1, 2020

ghost commented Jul 1, 2020

ogre2007 commented Apr 7, 2018 •

edited

Loading

ogre2007 commented Apr 7, 2018 •

edited

Loading