-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathelfparse.s
More file actions
1264 lines (1067 loc) · 32.2 KB
/
elfparse.s
File metadata and controls
1264 lines (1067 loc) · 32.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# -----------------------------------------------------------------------------
# elfparse.s - GNU ELF64 Parser
#
# Usage: elfparse <option(s)> [file]
#
# Assemble: as --elf64 -o elfparse.o elfparse.s
# ld -o elfparse elfparse.o
#
# or just run make
#
# (C) Copyright 2024 Travis Montoya <trav@hexproof.sh>
#
# This program is free software: you can redistribute it and/or modify it under
# the terms of the GNU General Public License as published by the Free Software
# Foundation, either version 3 of the License, or (at your option) any later
# version.
#
# This program is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along with
# this program. If not, see <https://www.gnu.org/licenses/>.
# -----------------------------------------------------------------------------
.title "elfparse.s"
.version "1"
# ------------ Constants ------------
.set STDOUT, 1
.set O_RDONLY, 0
.set PROT_READ, 1
.set PROT_WRITE, 2
.set MAP_PRIVATE, 2
.set MAP_ANONYMOUS, 0x20
# syscalls
.set __NR_read, 0
.set __NR_write, 1
.set __NR_open, 2
.set __NR_close, 3
.set __NR_lseek, 8
.set __NR_mmap, 9
.set __NR_munmap, 11
.set __NR_exit, 60
# ELF constants
.set EI_MAG0, 0
.set ELFMAG0, 0x7f
.set EI_MAG1, 1
.set ELFMAG1, 'E'
.set EI_MAG2, 2
.set ELFMAG2, 'L'
.set EI_MAG3, 3
.set ELFMAG3, 'F'
.set EI_CLASS, 4 # File class byte index
.set ELFCLASSNONE, 0 # Invalid class
.set ELFCLASS32, 1 # 32-bit objects
.set ELFCLASS64, 2 # 64-bit objects
.set EI_DATA, 5 # Data encoding byte index
.set ELFDATANONE, 0 # Invalid data encoding
.set ELFDATA2LSB, 1 # 2's complement, little endian
.set ELFDATA2MSB, 2 # 2's complement, big endian
.set ELFDATANUM, 3
.set EI_VERSION, 6 # File version byte index
.set EI_OSABI, 7
.set ELFOSABI_NONE, 0
.set ELFOSABI_NETBSD, 2
.set ELFOSABI_FREEBSD, 9
.set ELFOSABI_OPENBSD, 12
.set ELFOSABI_GNU, 3
.set ELFOSABI_LINUX, 3
.set EI_ABIVERSION, 8
.set ET_NONE, 0
.set ET_REL, 1
.set ET_EXEC, 2
.set ET_DYN, 3
.set ET_CORE, 4
.set PT_LOAD, 1
.set PT_DYNAMIC, 2
.set PT_INTERP, 3
.set PT_NOTE, 4
.set PT_PHDR, 6
# ------------ ELF Structures ------------
.struct 0
elf64_ehdr:
.struct elf64_ehdr
e_ident: .space 16
e_type: .space 2
e_machine: .space 2
e_version: .space 4
e_entry: .space 8
e_phoff: .space 8
e_shoff: .space 8
e_flags: .space 4
e_ehsize: .space 2
e_phentsize: .space 2
e_phnum: .space 2
e_shentsize: .space 2
e_shnum: .space 2
e_shstrndx: .space 2
.align 8
elf64_ehdr_size:
.struct 0
elf64_phdr:
.struct elf64_phdr
p_type: .space 4
p_flags: .space 4
p_offset: .space 8
p_vaddr: .space 8
p_paddr: .space 8
p_filesz: .space 8
p_memsz: .space 8
p_align: .space 8
.align 8
elf64_phdr_size:
.struct 0
elf64_shdr:
.struct elf64_shdr
sh_name: .space 4
sh_type: .space 4
sh_flags: .space 8
sh_addr: .space 8
sh_offset: .space 8
sh_size: .space 8
sh_link: .space 4
sh_info: .space 4
sh_addralign: .space 8
sh_entsize: .space 8
.align 8
elf64_shdr_size:
.struct 0
elf64_sym:
.struct elf64_sym
st_name: .space 4
st_info: .space 1
st_other: .space 1
st_shndx: .space 2
st_value: .space 8
st_size: .space 8
elf64_sym_size:
# ------------ Initialized data ------------
.section .data
elfparse_usage:
.ascii "GNU ELF64 Parser\n"
.ascii "usage: elfparse <option(s)> [file]\n"
.ascii " -a all - prints header, program headers, sections, symbol table\n"
.ascii " -h prints the elf header\n"
.ascii " -p prints program header information\n"
.ascii " -s prints section names and addresses\n"
.ascii " -y prints the symbol table\n"
.ascii " -v print the version information of elfparse\n\n"
.ascii "When using '-a' or '-v' it cannot be combined with other arguments\n\n"
.asciz "See 'COPYING' for licensing information. elfparse (C) Copyright 2024 hexproof.sh\n"
# Program options for parsing the command line
option_a: .asciz "-a"
option_h: .asciz "-h"
option_p: .asciz "-p"
option_s: .asciz "-s"
option_d: .asciz "-d"
option_y: .asciz "-y"
option_v: .asciz "-v"
elfparse_version:
.ascii "GNU ELF64 parser (elfparse) version 1.01\n"
.ascii "(C) Copyright 2024 hexproof.sh\n"
.ascii "This program is free software; you may redistribute it under the terms of\n"
.ascii "the GNU General Public License version 3 or (at your option) any later version.\n"
.asciz "This program has absolutely no warranty.\n"
elfparse_verify_valid:
.asciz "Binary is a valid 64-BIT ELF file\n"
# EHDR messages
elfparse_str_ehdr: .asciz "\nELF Header:\n"
elfparse_str_entry: .asciz " Entry Point: 0x"
elfparse_str_type: .asciz "\n Type: "
elfparse_str_class: .asciz "\n Class: "
elfparse_str_data: .asciz "\n Data: "
elfparse_str_abi: .asciz "\n ABI: "
elfparse_str_abiver: .asciz "\n ABI Version: "
elfparse_str_filever: .asciz "\n File Version: "
elfparse_str_phdroff: .asciz "\n Program header offset: 0x"
elfparse_str_shdroff: .asciz "\n Section header offset: 0x"
elfparse_str_ehdrsiz: .asciz "\n ELF header size (bytes): "
elfparse_str_phdrsiz: .asciz "\n Program header size (bytes): "
elfparse_str_phdrcnt: .asciz "\n Program header count: "
elfparse_str_shdrsiz: .asciz "\n Section header size (bytes): "
elfparse_str_shdrcnt: .asciz "\n Section header count: "
elfparse_str_shdrstrtbl: .asciz "\n Section header string table index: "
# ABI messages
elfparse_str_abi_none: .asciz "UNIX System V ABI"
elfparse_str_abi_netbsd: .asciz "NetBSD"
elfparse_str_abi_linux: .asciz "GNU\Linux"
elfparse_str_abi_freebsd: .asciz "FreeBSD"
elfparse_str_abi_openbsd: .asciz "OpenBSD"
# EI_DATA messages
elfparse_str_data_none: .asciz "Invalid data encoding"
elfparse_str_data_2LSB: .asciz "2's complement, little endian"
elfparse_str_data_2MSB: .asciz "2's complement, big endian"
# EI_CLASS messages
elfparse_str_class_32: .asciz "ELF32"
elfparse_str_class_64: .asciz "ELF64"
elfparse_str_class_none: .asciz "Invalid type"
# e_type messages
elfparse_str_type_none: .asciz "No file type"
elfparse_str_type_rel: .asciz "Relocatable file"
elfparse_str_type_exec: .asciz "Executable file"
elfparse_str_type_dyn: .asciz "Shared object file"
elfparse_str_type_core: .asciz "Core file"
elfparse_str_type_unkn: .asciz "Unknown"
# Program header messages
elfparse_str_phdr: .asciz "\nProgram headers:"
elfparse_str_ptloadtxt: .asciz "\n .text 0x"
elfparse_str_ptloaddat: .asciz "\n .data 0x"
elfparse_str_progseg: .asciz "\n Program segment: 0x"
elfparse_str_dynseg: .asciz "\n Dynamic segment: 0x"
elfparse_str_noteseg: .asciz "\n Note segment: 0x"
elfparse_str_interp: .asciz "\n Interpreter: "
# Section header messages. We use *shdr_beg to begin the line to give the
# section name some space and then *shdr_space to print before the p_vaddr
elfparse_str_shdr: .asciz "\nSection headers:"
elfparse_str_shdr_beg: .asciz "\n "
elfparse_str_shdr_space: .asciz " 0x"
elfparse_str_sym: .asciz "\nSymbol table:"
# Errors
elfparse_invalid_file:
.asciz "Error: Unable to open file\n"
elfverify_read_error:
.asciz "Error: Unable to read ELF64 header\n"
elfparse_invalid_option:
.asciz "\nError: Invalid option detected or in wrong position: "
elfparse_see_usage:
.asciz "\nRun 'elfparse' without any arguments to see usage\n"
# ------------ Uninitialized data ------------
.lcomm shstrtab, 8
.lcomm elfobj, 8
.lcomm hexbuff, 17
.lcomm intbuff, 21
.lcomm interp_path, 256
# We don't mmap ehdr, but phdr, shdr are pointers returned from mmap
.lcomm ehdr, elf64_ehdr_size
.align 8
.lcomm phdr, 8
.lcomm phdr_size, 8
.align 8
.lcomm shdr, 8
.lcomm shdr_size, 8
# ------------ Text ------------
.globl _start
.section .text
_start:
mov (%rsp), %r12 # %rsp = argc
cmp $2, %r12
je .L_check_arg_version
cmp $3, %r12 # We should have atleast 2 command line arg
jl .L_elfparse_usage
jmp .L_elfparse_args
.L_check_arg_version:
lea 16(%rsp), %r13
mov (%r13), %rdi
lea option_v, %rsi
call str_cmp
test %eax, %eax
jz .L_print_version
jmp .L_elfparse_usage
.L_elfparse_args:
# Our usage allows us to specifiy any of the arguments in any order to print out
# various info about the ELF file. The only exception is -a can be the only option
# as it just prints out all the information.
#
# This will iterate through all the functions to parse and print the
# elf headers. See functions section for more information.
lea 16(%rsp), %r13 # Pointer to the first argument argv[1]
mov %r12, %rax
dec %rax
mov 8(%rsp, %rax, 8), %rdi # Pointer to the last argument, filename
# The options are processed on the file, so we need to be able to load the data we need first
# and then loop through all the options.
call load_elf64_file
test %rax, %rax
jl .L_elfparse_error
# Load the symbol table
call load_shstrtab
test %rax, %rax
jl .L_elfparse_error
cmp $3, %r12 # If we have more than 3 arguments jump to parsing the valid
jg .L_init_opt_parsing # ones that can have more than one argument. Option -a and -d
# cannot be combined with other arguments.
mov (%r13), %rdi
lea option_a, %rsi
call str_cmp
test %eax, %eax
jz .L_print_all_data
.L_init_opt_parsing:
dec %r12 # We don't need to parse the filename
mov $1, %r15 # %r15 will hold the option counter and we use $1 to bypass program name
.L_parse_options:
cmp %r12, %r15
je .L_elfparse_exit
mov (%r13), %rdi
call .L_process_options
.L_next_option:
add $8, %r13 # Increment to the next address for the next argument
inc %r15
jmp .L_parse_options
.L_process_options:
mov %rdi, %r10 # Save the original argument pointer in %r10
lea option_h, %rsi
call str_cmp
test %eax, %eax
jz .L_print_ehdr_data
mov %r10, %rdi
lea option_p, %rsi
call str_cmp
test %eax, %eax
jz .L_print_phdr_data
mov %r10, %rdi
push %rdi
lea option_s, %rsi
call str_cmp
test %eax, %eax
jz .L_print_shdr_data
mov %r10, %rdi
push %rdi
lea option_y, %rsi
call str_cmp
test %eax, %eax
jz .L_print_symbols
jmp .L_elfparse_option_error
.L_print_ehdr_data:
call parse_elf64_ehdr
jmp .L_next_option
.L_print_phdr_data:
call parse_elf64_phdr
jmp .L_next_option
.L_print_shdr_data:
call parse_elf64_sections
jmp .L_next_option
.L_print_all_data:
# Print ehdr
call parse_elf64_ehdr
cmp $0, %rax
jl .L_elfparse_exit
# Print all phdr[x] names/addresses. This also calls the function to
# print out sectio headers information.
call parse_elf64_phdr
cmp $0, %rax
jl .L_elfparse_exit
# Print section information
call parse_elf64_sections
jmp .L_elfparse_exit
.L_print_symbols:
call parse_elf64_sym
jmp .L_next_option
.L_print_version:
lea elfparse_version, %rdi
call print_str
.L_elfparse_exit:
mov phdr, %r10
test %r10, %r10
jz .L_exit_next
mov phdr, %rdi
mov phdr_size, %rsi
mov $__NR_munmap, %rax
syscall
.L_exit_next:
mov shdr, %r10
test %r10, %r10
jz .L_exit_final
mov shdr, %rdi
mov shdr_size, %rsi
mov $__NR_munmap, %rax
syscall
.L_exit_final:
mov elfobj, %rdi
mov $__NR_close, %rax
syscall
# Call the exit syscall
# exit(0)
xor %rdi, %rdi
mov $__NR_exit, %rax
syscall
# ------------ Print statements to STDOUT ------------
# This should be an area to improve. Error handling.
.L_elfparse_error:
lea elfparse_invalid_file, %rdi
call print_str
jmp .L_elfparse_exit
.L_elfparse_verify_error:
lea elfverify_read_error, %rdi
call print_str
jmp .L_elfparse_exit
.L_elfparse_usage:
lea elfparse_usage, %rdi
call print_str
jmp .L_elfparse_exit
.L_elfparse_option_error:
lea elfparse_invalid_option, %rdi
call print_str
mov %r10, %rdi
call print_str
lea elfparse_see_usage, %rdi
call print_str
jmp .L_elfparse_exit
# ------------ Elf Parser Functions ------------
# Read in the ehdr, phdr and shdr of the binary
# %rdi contains the address of the file name
#
# If this function succeeds the elfobj variable
# will be a valid file handle and this returns
# success (0) else we return failrue (-1) and
# elfobj is invalid.
#
# This could have been written better, especially since I overcomplicated it by
# mmap/reading each section separately. We should have just fstat the file and
# mapped the entire file to memory.
load_elf64_file:
push %rbp
mov %rsp, %rbp
push %rsi
mov $O_RDONLY, %rsi
xor %rdx, %rdx
mov $__NR_open, %rax
syscall
cmp $0, %rax
jl .L_load_error
mov %rax, elfobj # save file handle to elfobj
# Read in ehdr. The reason we are not using MMAP for the ehdr is because we know
# there is only a single header so we don't need to allocate memory for X amount
# of headers. So we directly read it to the space we have allocated in .bss for it
mov %rax, %rdi
lea ehdr, %rsi
mov $elf64_ehdr_size, %rdx
mov $__NR_read, %rax
syscall
cmp $elf64_ehdr_size, %rax
jne .L_load_error
# Since we have loaded theehdr, before doing any more operations we go ahead and verify
# that this is a valid ELF64 binary. See function header for verify_elf64_file for what
# verification it does
call verify_elf64_file
cmp $0, %rax
jne .L_load_error
# mmap for program headers
movzwq ehdr + e_phnum, %rsi
imul $elf64_phdr_size, %rsi # e_phnum * sizeof(Elf64_Phdr)
mov %rsi, phdr_size
xor %rdi, %rdi
mov $(PROT_READ | PROT_WRITE), %rdx
mov $(MAP_PRIVATE | MAP_ANONYMOUS), %r10
mov $-1, %r8
xor %r9, %r9
mov $__NR_mmap, %rax
syscall
cmp $-1, %rax
je .L_load_error
mov %rax, phdr
# Read program headers
mov elfobj, %rdi
mov phdr, %rsi
mov phdr_size, %rdx
mov $__NR_read, %rax
syscall
cmp phdr_size, %rax
jne .L_load_error
# Save current file position
mov elfobj, %rdi
xor %rsi, %rsi
mov $1, %rdx # SEEK_CUR
mov $__NR_lseek, %rax
syscall
push %rax # Save current position
# Seek to section header offset
mov elfobj, %rdi
mov ehdr + e_shoff, %rsi
xor %rdx, %rdx # SEEK_SET
mov $__NR_lseek, %rax
syscall
# mmap for section headers
movzwq ehdr + e_shnum, %rsi
imul $elf64_shdr_size, %rsi
mov %rsi, shdr_size
xor %rdi, %rdi
mov $(PROT_READ | PROT_WRITE), %rdx
mov $(MAP_PRIVATE | MAP_ANONYMOUS), %r10
mov $-1, %r8
xor %r9, %r9
mov $__NR_mmap, %rax
syscall
cmp $-1, %rax
je .L_load_error
mov %rax, shdr
# Read section headers
mov elfobj, %rdi
mov shdr, %rsi
mov shdr_size, %rdx
mov $__NR_read, %rax
syscall
cmp shdr_size, %rax
jne .L_load_error
mov elfobj, %rdi
pop %rsi
xor %rdx, %rdx
mov $__NR_lseek, %rax
syscall
xor %rax, %rax
jmp .L_load_cleanup
.L_load_error:
mov $-1, %rax
.L_load_cleanup:
pop %rdi
mov %rbp, %rsp
pop %rbp
ret
# We preload the string table. We need this for printing
# the section information.
# No input. This just must be called AFTER load_elf64_file
load_shstrtab:
push %rbp
mov %rsp, %rbp
push %r13
push %r12
movzw ehdr + e_shstrndx, %rax
imul $elf64_shdr_size, %rax
mov shdr, %rdx
add %rax, %rdx
mov sh_offset(%rdx), %r13
mov sh_size(%rdx), %r12
xor %rdi, %rdi
mov %r12, %rsi
mov $(PROT_READ | PROT_WRITE), %rdx
mov $(MAP_PRIVATE | MAP_ANONYMOUS), %r10
mov $-1, %r8
xor %r9, %r9
mov $__NR_mmap, %rax
syscall
cmp $-1, %rax
je .L_mmap_error
mov %rax, shstrtab
# Seek to the string table offset
mov elfobj, %rdi
mov %r13, %rsi # Use sh_offset for seeking
xor %rdx, %rdx
mov $__NR_lseek, %rax
syscall
# Read the string table
mov elfobj, %rdi
mov shstrtab, %rsi
mov %r12, %rdx # Use sh_size for reading
mov $__NR_read, %rax
syscall
cmp %r12, %rax
jne .L_read_error
mov shstrtab, %rax
jmp .L_cleanup
.L_mmap_error:
.L_read_error:
mov $-1, %rax
.L_cleanup:
pop %r12
pop %r13
mov %rbp, %rsp
pop %rbp
ret
# We will read in the ehdr and verify portions of e_ident
# ehdr is already loaded by load_elf64_file
# Verify magic bytes "\177ELF" and EI_CLASS being ELFCLASS64. We do this because
# we are only dealing with elf64_* headers.
#
# This is called from inside load_elf64_file
verify_elf64_file:
lea ehdr, %rcx
cmpb $ELFMAG0, elf64_ehdr + e_ident + EI_MAG0(%rcx)
jne .L_verify_error
cmpb $ELFMAG1, elf64_ehdr + e_ident + EI_MAG1(%rcx)
jne .L_verify_error
cmpb $ELFMAG2, elf64_ehdr + e_ident + EI_MAG2(%rcx)
jne .L_verify_error
cmpb $ELFMAG3, elf64_ehdr + e_ident + EI_MAG3(%rcx)
jne .L_verify_error
cmpb $ELFCLASS64, elf64_ehdr + e_ident + EI_CLASS(%rcx)
jne .L_verify_error
lea elfparse_verify_valid, %rdi
call print_str
xor %rax, %rax
ret
.L_verify_error:
mov $-1, %rax
ret
# Parse the elf64_ehdr structure. This structure gives us further information
# for processing the rest of the file.
#
# This is called from the main .L_elfparse_args section. elf64_load_file must
# already have been called.
parse_elf64_ehdr:
# Print the different fields of the Elf64_Ehdr structure
# ehdr has already been read in by verify_elf64_file
lea elfparse_str_ehdr, %rdi
call print_str
lea elfparse_str_entry, %rdi
call print_str
# Convert the address to a printable hex string
# %rsi contains our e_entry offset
# %rdi is our buffer
mov ehdr + e_entry, %rsi
lea hexbuff, %rdi
call uint64_to_hex
lea hexbuff, %rdi
call print_str
# Print the e_ident[EI_CLASS] entry
# Really don't need this as we verify it IS a 64 BIT ELF
# in verify_elf64_file
lea elfparse_str_class, %rdi
call print_str
xor %rsi, %rsi
mov ehdr + e_ident + EI_CLASS, %rsi
cmp $ELFCLASSNONE, %sil
je .L_class_none
cmp $ELFCLASS32, %sil
je .L_class_32
cmp $ELFCLASS64, %sil
je .L_class_64
jmp .L_print_type
.L_class_none:
lea elfparse_str_class_none, %rdi
jmp .L_print_class
.L_class_32:
lea elfparse_str_class_32, %rdi
jmp .L_print_class
.L_class_64:
lea elfparse_str_class_64, %rdi
.L_print_class:
call print_str
.L_print_type:
# Print the e_type entry
lea elfparse_str_type, %rdi
call print_str
xor %rsi, %rsi
mov ehdr + e_type, %rsi
cmp $ET_NONE, %sil
je .L_type_none
cmp $ET_REL, %sil
je .L_type_rel
cmp $ET_EXEC, %sil
je .L_type_exec
cmp $ET_DYN, %sil
je .L_type_dyn
cmp $ET_CORE, %sil
je .L_type_core
jmp .L_print_data
.L_type_none:
lea elfparse_str_type_none, %rdi
jmp .L_print_parsed_type
.L_type_rel:
lea elfparse_str_type_rel, %rdi
jmp .L_print_parsed_type
.L_type_exec:
lea elfparse_str_type_exec, %rdi
jmp .L_print_parsed_type
.L_type_dyn:
lea elfparse_str_type_dyn, %rdi
jmp .L_print_parsed_type
.L_type_core:
lea elfparse_str_type_core, %rdi
.L_print_parsed_type:
call print_str
.L_print_data:
# Print the e_ident[EI_DATA] entry
lea elfparse_str_data, %rdi
call print_str
xor %rsi, %rsi
mov ehdr + e_ident + EI_DATA, %rsi
cmp $ELFDATANONE, %sil
je .L_data_none
cmp $ELFDATA2LSB, %sil
je .L_data_2LSB
cmp $ELFDATA2MSB, %sil
je .L_data_2MSB
jmp .L_print_abi
.L_data_none:
lea elfparse_str_data_none, %rdi
jmp .L_print_parsed_data
.L_data_2LSB:
lea elfparse_str_data_2LSB, %rdi
jmp .L_print_parsed_data
.L_data_2MSB:
lea elfparse_str_data_2MSB, %rdi
.L_print_parsed_data:
call print_str
.L_print_abi:
# Print the e_ident[EI_OSABI] entry
lea elfparse_str_abi, %rdi
call print_str
xor %rsi, %rsi
mov ehdr + e_ident + EI_OSABI, %rsi
cmp $ELFOSABI_NONE, %sil
je .L_abi_none
cmp $ELFOSABI_NETBSD, %sil
je .L_abi_netbsd
cmp $ELFOSABI_LINUX, %sil
je .L_abi_linux
cmp $ELFOSABI_FREEBSD, %sil
je .L_abi_freebsd
cmp $ELFOSABI_OPENBSD, %sil
je .L_abi_openbsd
jmp .L_print_abi_version
.L_abi_none:
lea elfparse_str_abi_none, %rdi
jmp .L_print_parsed_abi
.L_abi_netbsd:
lea elfparse_str_abi_netbsd, %rdi
jmp .L_print_parsed_abi
.L_abi_linux:
lea elfparse_str_abi_linux, %rdi
jmp .L_print_parsed_abi
.L_abi_freebsd:
lea elfparse_str_abi_freebsd, %rdi
jmp .L_print_parsed_abi
.L_abi_openbsd:
lea elfparse_str_abi_openbsd, %rdi
.L_print_parsed_abi:
call print_str
.L_print_abi_version:
# Print ABI Version
lea elfparse_str_abiver, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_ident + EI_ABIVERSION, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_file_version:
# Print the EI_VERSION of e_ident (File version)
lea elfparse_str_filever, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_ident + EI_VERSION, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_phdr_offset:
lea elfparse_str_phdroff, %rdi
call print_str
mov ehdr + e_phoff, %rsi
lea hexbuff, %rdi
call uint64_to_hex
lea hexbuff, %rdi
call print_str
.L_print_shdr_offset:
lea elfparse_str_shdroff, %rdi
call print_str
mov ehdr + e_shoff, %rsi
lea hexbuff, %rdi
call uint64_to_hex
lea hexbuff, %rdi
call print_str
.L_print_ehdr_size:
lea elfparse_str_ehdrsiz, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_ehsize, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_phdr_size:
lea elfparse_str_phdrsiz, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_phentsize, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_phdr_count:
lea elfparse_str_phdrcnt, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_phnum, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_shdr_size:
lea elfparse_str_shdrsiz, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_shentsize, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_shdr_count:
lea elfparse_str_shdrcnt, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_shnum, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
.L_print_strtbl_index:
lea elfparse_str_shdrstrtbl, %rdi
call print_str
xor %rax, %rax
movzbq ehdr + e_shstrndx, %rax
lea intbuff, %rsi
call uint64_to_ascii
lea intbuff, %rdi
call print_str
xor %rax, %rax
ret
# Parse the Program header information. Iterate each phdr
# and print out sections and offset. PT_INTERP we print
# the interpreter
parse_elf64_phdr:
lea elfparse_str_phdr, %rdi
call print_str
xor %rcx, %rcx # our index into phdr
movzw ehdr + e_phnum, %rbx # holds e_phnum value
.L_loop_section:
cmp %rcx, %rbx
je .L_exit_parse_phdr
mov %rcx, %rax # below we are essentially doing phdr[X].p_type where X = %rcx
imul $elf64_phdr_size, %rax
mov phdr, %rdx
add %rax, %rdx
mov p_type(%rdx), %eax
cmp $PT_LOAD, %eax
je .L_print_ptload
cmp $PT_PHDR, %eax
je .L_print_ptphdr
cmp $PT_DYNAMIC, %eax
je .L_print_ptdyn
cmp $PT_NOTE, %eax
je .L_print_ptnote
cmp $PT_INTERP, %eax
je .L_print_ptinterp
# Any other section we just loop
inc %rcx
jmp .L_loop_section
.L_print_phdr_addr:
# This prints out the phdr[i].p_vaddr
mov p_vaddr(%rdx), %rsi
lea hexbuff, %rdi
call uint64_to_hex
lea hexbuff, %rdi
call print_str
inc %rcx
jmp .L_loop_section