1 /* Reconstruct an ELF file by reading the segments out of remote memory.
2 Copyright (C) 2005-2011, 2014, 2015 Red Hat, Inc.
3 This file is part of elfutils.
4
5 This file is free software; you can redistribute it and/or modify
6 it under the terms of either
7
8 * the GNU Lesser General Public License as published by the Free
9 Software Foundation; either version 3 of the License, or (at
10 your option) any later version
11
12 or
13
14 * the GNU General Public License as published by the Free
15 Software Foundation; either version 2 of the License, or (at
16 your option) any later version
17
18 or both in parallel, as here.
19
20 elfutils is distributed in the hope that it will be useful, but
21 WITHOUT ANY WARRANTY; without even the implied warranty of
22 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23 General Public License for more details.
24
25 You should have received copies of the GNU General Public License and
26 the GNU Lesser General Public License along with this program. If
27 not, see <http://www.gnu.org/licenses/>. */
28
29 #include <config.h>
30 #include "../libelf/libelfP.h"
31 #undef _
32
33 #include "libdwflP.h"
34
35 #include <gelf.h>
36 #include <sys/types.h>
37 #include <stdbool.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 /* Reconstruct an ELF file by reading the segments out of remote memory
42 based on the ELF file header at EHDR_VMA and the ELF program headers it
43 points to. If not null, *LOADBASEP is filled in with the difference
44 between the addresses from which the segments were read, and the
45 addresses the file headers put them at.
46
47 The function READ_MEMORY is called to copy at least MINREAD and at most
48 MAXREAD bytes from the remote memory at target address ADDRESS into the
49 local buffer at DATA; it should return -1 for errors (with code in
50 `errno'), 0 if it failed to read at least MINREAD bytes due to EOF, or
51 the number of bytes read if >= MINREAD. ARG is passed through.
52
53 PAGESIZE is the minimum page size and alignment used for the PT_LOAD
54 segments. */
55
56 Elf *
elf_from_remote_memory(GElf_Addr ehdr_vma,GElf_Xword pagesize,GElf_Addr * loadbasep,ssize_t (* read_memory)(void * arg,void * data,GElf_Addr address,size_t minread,size_t maxread),void * arg)57 elf_from_remote_memory (GElf_Addr ehdr_vma,
58 GElf_Xword pagesize,
59 GElf_Addr *loadbasep,
60 ssize_t (*read_memory) (void *arg, void *data,
61 GElf_Addr address,
62 size_t minread,
63 size_t maxread),
64 void *arg)
65 {
66 /* We might have to reserve some memory for the phdrs. Set to NULL
67 here so we can always safely free it. */
68 void *phdrsp = NULL;
69
70 /* First read in the file header and check its sanity. */
71
72 const size_t initial_bufsize = 256;
73 unsigned char *buffer = malloc (initial_bufsize);
74 if (unlikely (buffer == NULL))
75 {
76 no_memory:
77 __libdwfl_seterrno (DWFL_E_NOMEM);
78 return NULL;
79 }
80
81 ssize_t nread = (*read_memory) (arg, buffer, ehdr_vma,
82 sizeof (Elf32_Ehdr), initial_bufsize);
83 if (nread <= 0)
84 {
85 read_error:
86 free (buffer);
87 free (phdrsp);
88 __libdwfl_seterrno (nread < 0 ? DWFL_E_ERRNO : DWFL_E_TRUNCATED);
89 return NULL;
90 }
91
92 if (memcmp (buffer, ELFMAG, SELFMAG) != 0)
93 {
94 bad_elf:
95 free (buffer);
96 free (phdrsp);
97 __libdwfl_seterrno (DWFL_E_BADELF);
98 return NULL;
99 }
100
101 /* Extract the information we need from the file header. */
102
103 union
104 {
105 Elf32_Ehdr e32;
106 Elf64_Ehdr e64;
107 } ehdr;
108 Elf_Data xlatefrom =
109 {
110 .d_type = ELF_T_EHDR,
111 .d_buf = buffer,
112 .d_version = EV_CURRENT,
113 };
114 Elf_Data xlateto =
115 {
116 .d_type = ELF_T_EHDR,
117 .d_buf = &ehdr,
118 .d_size = sizeof ehdr,
119 .d_version = EV_CURRENT,
120 };
121
122 GElf_Off phoff;
123 uint_fast16_t phnum;
124 uint_fast16_t phentsize;
125 GElf_Off shdrs_end;
126
127 switch (buffer[EI_CLASS])
128 {
129 case ELFCLASS32:
130 xlatefrom.d_size = sizeof (Elf32_Ehdr);
131 if (elf32_xlatetom (&xlateto, &xlatefrom, buffer[EI_DATA]) == NULL)
132 {
133 libelf_error:
134 __libdwfl_seterrno (DWFL_E_LIBELF);
135 return NULL;
136 }
137 phoff = ehdr.e32.e_phoff;
138 phnum = ehdr.e32.e_phnum;
139 phentsize = ehdr.e32.e_phentsize;
140 if (phentsize != sizeof (Elf32_Phdr) || phnum == 0)
141 goto bad_elf;
142 shdrs_end = ehdr.e32.e_shoff + ehdr.e32.e_shnum * ehdr.e32.e_shentsize;
143 break;
144
145 case ELFCLASS64:
146 xlatefrom.d_size = sizeof (Elf64_Ehdr);
147 if (elf64_xlatetom (&xlateto, &xlatefrom, buffer[EI_DATA]) == NULL)
148 goto libelf_error;
149 phoff = ehdr.e64.e_phoff;
150 phnum = ehdr.e64.e_phnum;
151 phentsize = ehdr.e64.e_phentsize;
152 if (phentsize != sizeof (Elf64_Phdr) || phnum == 0)
153 goto bad_elf;
154 shdrs_end = ehdr.e64.e_shoff + ehdr.e64.e_shnum * ehdr.e64.e_shentsize;
155 break;
156
157 default:
158 goto bad_elf;
159 }
160
161
162 /* The file header tells where to find the program headers.
163 These are what we use to actually choose what to read. */
164
165 xlatefrom.d_type = xlateto.d_type = ELF_T_PHDR;
166 xlatefrom.d_size = phnum * phentsize;
167
168 if ((size_t) nread >= phoff + phnum * phentsize)
169 /* We already have all the phdrs from the initial read. */
170 xlatefrom.d_buf = buffer + phoff;
171 else
172 {
173 /* Read in the program headers. */
174
175 if (initial_bufsize < phnum * phentsize)
176 {
177 unsigned char *newbuf = realloc (buffer, phnum * phentsize);
178 if (newbuf == NULL)
179 {
180 free (buffer);
181 free (phdrsp);
182 goto no_memory;
183 }
184 buffer = newbuf;
185 }
186 nread = (*read_memory) (arg, buffer, ehdr_vma + phoff,
187 phnum * phentsize, phnum * phentsize);
188 if (nread <= 0)
189 goto read_error;
190
191 xlatefrom.d_buf = buffer;
192 }
193
194 bool class32 = ehdr.e32.e_ident[EI_CLASS] == ELFCLASS32;
195 size_t phdr_size = class32 ? sizeof (Elf32_Phdr) : sizeof (Elf64_Phdr);
196 if (unlikely (phnum > SIZE_MAX / phdr_size))
197 {
198 free (buffer);
199 goto no_memory;
200 }
201 const size_t phdrsp_bytes = phnum * phdr_size;
202 phdrsp = malloc (phdrsp_bytes);
203 if (unlikely (phdrsp == NULL))
204 {
205 free (buffer);
206 goto no_memory;
207 }
208
209 xlateto.d_buf = phdrsp;
210 xlateto.d_size = phdrsp_bytes;
211
212 /* Scan for PT_LOAD segments to find the total size of the file image. */
213 size_t contents_size = 0;
214 GElf_Off segments_end = 0;
215 GElf_Off segments_end_mem = 0;
216 GElf_Addr loadbase = ehdr_vma;
217 bool found_base = false;
218 Elf32_Phdr (*p32)[phnum] = phdrsp;
219 Elf64_Phdr (*p64)[phnum] = phdrsp;
220 switch (ehdr.e32.e_ident[EI_CLASS])
221 {
222 /* Sanity checks segments and calculates segment_end,
223 segments_end, segments_end_mem and loadbase (if not
224 found_base yet). Returns true if sanity checking failed,
225 false otherwise. */
226 inline bool handle_segment (GElf_Addr vaddr, GElf_Off offset,
227 GElf_Xword filesz, GElf_Xword memsz)
228 {
229 /* Sanity check the segment load aligns with the pagesize. */
230 if (((vaddr - offset) & (pagesize - 1)) != 0)
231 return true;
232
233 GElf_Off segment_end = ((offset + filesz + pagesize - 1)
234 & -pagesize);
235
236 if (segment_end > (GElf_Off) contents_size)
237 contents_size = segment_end;
238
239 if (!found_base && (offset & -pagesize) == 0)
240 {
241 loadbase = ehdr_vma - (vaddr & -pagesize);
242 found_base = true;
243 }
244
245 segments_end = offset + filesz;
246 segments_end_mem = offset + memsz;
247 return false;
248 }
249
250 case ELFCLASS32:
251 if (elf32_xlatetom (&xlateto, &xlatefrom,
252 ehdr.e32.e_ident[EI_DATA]) == NULL)
253 goto libelf_error;
254 for (uint_fast16_t i = 0; i < phnum; ++i)
255 if ((*p32)[i].p_type == PT_LOAD)
256 if (handle_segment ((*p32)[i].p_vaddr, (*p32)[i].p_offset,
257 (*p32)[i].p_filesz, (*p32)[i].p_memsz))
258 goto bad_elf;
259 break;
260
261 case ELFCLASS64:
262 if (elf64_xlatetom (&xlateto, &xlatefrom,
263 ehdr.e64.e_ident[EI_DATA]) == NULL)
264 goto libelf_error;
265 for (uint_fast16_t i = 0; i < phnum; ++i)
266 if ((*p64)[i].p_type == PT_LOAD)
267 if (handle_segment ((*p64)[i].p_vaddr, (*p64)[i].p_offset,
268 (*p64)[i].p_filesz, (*p64)[i].p_memsz))
269 goto bad_elf;
270 break;
271
272 default:
273 abort ();
274 break;
275 }
276
277 /* Trim the last segment so we don't bother with zeros in the last page
278 that are off the end of the file. However, if the extra bit in that
279 page includes the section headers and the memory isn't extended (which
280 might indicate it will have been reused otherwise), keep them. */
281 if ((GElf_Off) contents_size > segments_end
282 && (GElf_Off) contents_size >= shdrs_end
283 && segments_end == segments_end_mem)
284 {
285 contents_size = segments_end;
286 if ((GElf_Off) contents_size < shdrs_end)
287 contents_size = shdrs_end;
288 }
289 else
290 contents_size = segments_end;
291
292 free (buffer);
293
294 /* Now we know the size of the whole image we want read in. */
295 buffer = calloc (1, contents_size);
296 if (buffer == NULL)
297 {
298 free (phdrsp);
299 goto no_memory;
300 }
301
302 switch (ehdr.e32.e_ident[EI_CLASS])
303 {
304 /* Reads the given segment. Returns true if reading fails,
305 false otherwise. */
306 inline bool handle_segment (GElf_Addr vaddr, GElf_Off offset,
307 GElf_Xword filesz)
308 {
309 GElf_Off start = offset & -pagesize;
310 GElf_Off end = (offset + filesz + pagesize - 1) & -pagesize;
311 if (end > (GElf_Off) contents_size)
312 end = contents_size;
313 nread = (*read_memory) (arg, buffer + start,
314 (loadbase + vaddr) & -pagesize,
315 end - start, end - start);
316 return nread <= 0;
317 }
318
319 case ELFCLASS32:
320 for (uint_fast16_t i = 0; i < phnum; ++i)
321 if ((*p32)[i].p_type == PT_LOAD)
322 if (handle_segment ((*p32)[i].p_vaddr, (*p32)[i].p_offset,
323 (*p32)[i].p_filesz))
324 goto read_error;
325
326 /* If the segments visible in memory didn't include the section
327 headers, then clear them from the file header. */
328 if (contents_size < shdrs_end)
329 {
330 ehdr.e32.e_shoff = 0;
331 ehdr.e32.e_shnum = 0;
332 ehdr.e32.e_shstrndx = 0;
333 }
334
335 /* This will normally have been in the first PT_LOAD segment. But it
336 conceivably could be missing, and we might have just changed it. */
337 xlatefrom.d_type = xlateto.d_type = ELF_T_EHDR;
338 xlatefrom.d_size = xlateto.d_size = sizeof ehdr.e32;
339 xlatefrom.d_buf = &ehdr.e32;
340 xlateto.d_buf = buffer;
341 if (elf32_xlatetof (&xlateto, &xlatefrom,
342 ehdr.e32.e_ident[EI_DATA]) == NULL)
343 goto libelf_error;
344 break;
345
346 case ELFCLASS64:
347 for (uint_fast16_t i = 0; i < phnum; ++i)
348 if ((*p64)[i].p_type == PT_LOAD)
349 if (handle_segment ((*p64)[i].p_vaddr, (*p64)[i].p_offset,
350 (*p64)[i].p_filesz))
351 goto read_error;
352
353 /* If the segments visible in memory didn't include the section
354 headers, then clear them from the file header. */
355 if (contents_size < shdrs_end)
356 {
357 ehdr.e64.e_shoff = 0;
358 ehdr.e64.e_shnum = 0;
359 ehdr.e64.e_shstrndx = 0;
360 }
361
362 /* This will normally have been in the first PT_LOAD segment. But it
363 conceivably could be missing, and we might have just changed it. */
364 xlatefrom.d_type = xlateto.d_type = ELF_T_EHDR;
365 xlatefrom.d_size = xlateto.d_size = sizeof ehdr.e64;
366 xlatefrom.d_buf = &ehdr.e64;
367 xlateto.d_buf = buffer;
368 if (elf64_xlatetof (&xlateto, &xlatefrom,
369 ehdr.e64.e_ident[EI_DATA]) == NULL)
370 goto libelf_error;
371 break;
372
373 default:
374 abort ();
375 break;
376 }
377
378 free (phdrsp);
379 phdrsp = NULL;
380
381 /* Now we have the image. Open libelf on it. */
382
383 Elf *elf = elf_memory ((char *) buffer, contents_size);
384 if (elf == NULL)
385 {
386 free (buffer);
387 goto libelf_error;
388 }
389
390 elf->flags |= ELF_F_MALLOCED;
391 if (loadbasep != NULL)
392 *loadbasep = loadbase;
393 return elf;
394 }
395