ELF: Stop unloaded sections from claiming a relocatable object's addresses - #739
ELF: Stop unloaded sections from claiming a relocatable object's addresses#739zardus wants to merge 1 commit into
Conversation
A relocatable object carries no addresses of its own, so __register_sections lays its allocated sections out itself. A section whose type is in _NON_ALLOCATED_SECTION_NAMES took an address from that layout without reserving any space, and no backer is ever added for it, so it landed on top of the section that follows. On a Linux kernel module the allocated .note.Linux therefore covers the first 0x30 bytes of .text, and on MIPS .reginfo shares an address with .MIPS.abiflags. Regions documents that its members do not overlap and finds one by bisecting on their end addresses, so a single overlapping section leaves that list unsorted by the search key and the lookup misses regions that are really there. find_section_containing() then returns None for most of the object's mapped range, or a stale section, depending on what was looked up before it, because Backend caches the previous hit. CFGFast reads it twice: a block whose section is not executable is discarded, and JumpTableResolver requires the table to be inside a mapped section when the object has no segments, so an ARM module loses both the code the note covers and every jump table. These sections now report that they occupy no memory, which is what the constant already claims about them. Every section address, every loaded byte, every relocation and every symbol stays as it was; the sections only leave the address map, the way a section without SHF_ALLOC already does.
|
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS Validation record for head
Loader comparison over 1710 corpus objects spanning 55 architectures and 10 container formats, and separately over 39 relocatable ELF objects that carry an allocated note or
CFGFast ( Over the 39 affected objects:
Six objects change; every difference:
Net across the 39: 18 function entries removed, 9 added, 0 bytes of recovered code lost, 44 gained. The CFGFast comparison and the loader comparison were run in opposite revision orders and agree exactly on all 39 objects in both revisions, so none of these differences is nondeterminism. Caveats: the corpus objects are named only by architecture, container and sha256 because the dataset is not public; |
|
Corpus decompilation diffs can be found at angr/dec-snapshots@master...angr/cle_739 |
2 participants
THIS MESSAGE WAS GENERATED BY AN AUTOMATED PROCESS
A relocatable object carries no addresses of its own, so cle lays its allocated sections out itself. A section whose type is in
_NON_ALLOCATED_SECTION_NAMEStakes an address from that layout without reserving space, and no backer is ever added for it, so it sits on top of the section that follows: on a Linux kernel module the allocated.note.Linuxcovers the first 0x30 bytes of.text.Regionsdocuments that its members do not overlap and bisects on their end addresses, so one such section makesfind_section_containing()return None for most of the object, or a stale section depending on what was looked up before. CFGFast discards a block whose section is not executable, andJumpTableResolverneeds the table inside a mapped section when there are no segments, so an ARM module loses both the code under the note and its jump tables.These sections now report that they occupy no memory, which is what the constant already claims about them. Nothing else moves: every address, loaded byte, relocation and symbol stays as it was.
The regression loads
tests/x86_64/switch_default_abort.o, already on angr/binaries master, where.note.gnu.propertycovers.eh_frame; there is no companion binaries PR.Validation: #739 (comment)