readelf.c 46 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899
  1. /*
  2. * Copyright (c) Christos Zoulas 2003.
  3. * All Rights Reserved.
  4. *
  5. * Redistribution and use in source and binary forms, with or without
  6. * modification, are permitted provided that the following conditions
  7. * are met:
  8. * 1. Redistributions of source code must retain the above copyright
  9. * notice immediately at the beginning of the file, without modification,
  10. * this list of conditions, and the following disclaimer.
  11. * 2. Redistributions in binary form must reproduce the above copyright
  12. * notice, this list of conditions and the following disclaimer in the
  13. * documentation and/or other materials provided with the distribution.
  14. *
  15. * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16. * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17. * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18. * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
  19. * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20. * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21. * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22. * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23. * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24. * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25. * SUCH DAMAGE.
  26. */
  27. #include "file.h"
  28. #ifndef lint
  29. FILE_RCSID("@(#)$File: readelf.c,v 1.182 2022/07/31 16:01:01 christos Exp $")
  30. #endif
  31. #ifdef BUILTIN_ELF
  32. #include <string.h>
  33. #include <ctype.h>
  34. #include <stdlib.h>
  35. #ifdef HAVE_UNISTD_H
  36. #include <unistd.h>
  37. #endif
  38. #include "readelf.h"
  39. #include "magic.h"
  40. #ifdef ELFCORE
  41. private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t,
  42. off_t, int *, uint16_t *);
  43. #endif
  44. private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
  45. off_t, int, int *, uint16_t *);
  46. private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
  47. off_t, int, int, int *, uint16_t *);
  48. private size_t donote(struct magic_set *, void *, size_t, size_t, int,
  49. int, size_t, int *, uint16_t *, int, off_t, int, off_t);
  50. #define ELF_ALIGN(a) ((((a) + align - 1) / align) * align)
  51. #define isquote(c) (strchr("'\"`", (c)) != NULL)
  52. private uint16_t getu16(int, uint16_t);
  53. private uint32_t getu32(int, uint32_t);
  54. private uint64_t getu64(int, uint64_t);
  55. #define MAX_PHNUM 128
  56. #define MAX_SHNUM 32768
  57. #define MAX_SHSIZE (64 * 1024 * 1024)
  58. #define SIZE_UNKNOWN CAST(off_t, -1)
  59. private int
  60. toomany(struct magic_set *ms, const char *name, uint16_t num)
  61. {
  62. if (ms->flags & MAGIC_MIME)
  63. return 1;
  64. if (file_printf(ms, ", too many %s (%u)", name, num) == -1)
  65. return -1;
  66. return 1;
  67. }
  68. private uint16_t
  69. getu16(int swap, uint16_t value)
  70. {
  71. union {
  72. uint16_t ui;
  73. char c[2];
  74. } retval, tmpval;
  75. if (swap) {
  76. tmpval.ui = value;
  77. retval.c[0] = tmpval.c[1];
  78. retval.c[1] = tmpval.c[0];
  79. return retval.ui;
  80. } else
  81. return value;
  82. }
  83. private uint32_t
  84. getu32(int swap, uint32_t value)
  85. {
  86. union {
  87. uint32_t ui;
  88. char c[4];
  89. } retval, tmpval;
  90. if (swap) {
  91. tmpval.ui = value;
  92. retval.c[0] = tmpval.c[3];
  93. retval.c[1] = tmpval.c[2];
  94. retval.c[2] = tmpval.c[1];
  95. retval.c[3] = tmpval.c[0];
  96. return retval.ui;
  97. } else
  98. return value;
  99. }
  100. private uint64_t
  101. getu64(int swap, uint64_t value)
  102. {
  103. union {
  104. uint64_t ui;
  105. char c[8];
  106. } retval, tmpval;
  107. if (swap) {
  108. tmpval.ui = value;
  109. retval.c[0] = tmpval.c[7];
  110. retval.c[1] = tmpval.c[6];
  111. retval.c[2] = tmpval.c[5];
  112. retval.c[3] = tmpval.c[4];
  113. retval.c[4] = tmpval.c[3];
  114. retval.c[5] = tmpval.c[2];
  115. retval.c[6] = tmpval.c[1];
  116. retval.c[7] = tmpval.c[0];
  117. return retval.ui;
  118. } else
  119. return value;
  120. }
  121. #define elf_getu16(swap, value) getu16(swap, value)
  122. #define elf_getu32(swap, value) getu32(swap, value)
  123. #define elf_getu64(swap, value) getu64(swap, value)
  124. #define xsh_addr (clazz == ELFCLASS32 \
  125. ? CAST(void *, &sh32) \
  126. : CAST(void *, &sh64))
  127. #define xsh_sizeof (clazz == ELFCLASS32 \
  128. ? sizeof(sh32) \
  129. : sizeof(sh64))
  130. #define xsh_size CAST(size_t, (clazz == ELFCLASS32 \
  131. ? elf_getu32(swap, sh32.sh_size) \
  132. : elf_getu64(swap, sh64.sh_size)))
  133. #define xsh_offset CAST(off_t, (clazz == ELFCLASS32 \
  134. ? elf_getu32(swap, sh32.sh_offset) \
  135. : elf_getu64(swap, sh64.sh_offset)))
  136. #define xsh_type (clazz == ELFCLASS32 \
  137. ? elf_getu32(swap, sh32.sh_type) \
  138. : elf_getu32(swap, sh64.sh_type))
  139. #define xsh_name (clazz == ELFCLASS32 \
  140. ? elf_getu32(swap, sh32.sh_name) \
  141. : elf_getu32(swap, sh64.sh_name))
  142. #define xph_addr (clazz == ELFCLASS32 \
  143. ? CAST(void *, &ph32) \
  144. : CAST(void *, &ph64))
  145. #define xph_sizeof (clazz == ELFCLASS32 \
  146. ? sizeof(ph32) \
  147. : sizeof(ph64))
  148. #define xph_type (clazz == ELFCLASS32 \
  149. ? elf_getu32(swap, ph32.p_type) \
  150. : elf_getu32(swap, ph64.p_type))
  151. #define xph_offset CAST(off_t, (clazz == ELFCLASS32 \
  152. ? elf_getu32(swap, ph32.p_offset) \
  153. : elf_getu64(swap, ph64.p_offset)))
  154. #define xph_align CAST(size_t, (clazz == ELFCLASS32 \
  155. ? CAST(off_t, (ph32.p_align ? \
  156. elf_getu32(swap, ph32.p_align) : 4))\
  157. : CAST(off_t, (ph64.p_align ? \
  158. elf_getu64(swap, ph64.p_align) : 4))))
  159. #define xph_vaddr CAST(size_t, (clazz == ELFCLASS32 \
  160. ? CAST(off_t, (ph32.p_vaddr ? \
  161. elf_getu32(swap, ph32.p_vaddr) : 4))\
  162. : CAST(off_t, (ph64.p_vaddr ? \
  163. elf_getu64(swap, ph64.p_vaddr) : 4))))
  164. #define xph_filesz CAST(size_t, (clazz == ELFCLASS32 \
  165. ? elf_getu32(swap, ph32.p_filesz) \
  166. : elf_getu64(swap, ph64.p_filesz)))
  167. #define xph_memsz CAST(size_t, ((clazz == ELFCLASS32 \
  168. ? elf_getu32(swap, ph32.p_memsz) \
  169. : elf_getu64(swap, ph64.p_memsz))))
  170. #define xnh_addr (clazz == ELFCLASS32 \
  171. ? CAST(void *, &nh32) \
  172. : CAST(void *, &nh64))
  173. #define xnh_sizeof (clazz == ELFCLASS32 \
  174. ? sizeof(nh32) \
  175. : sizeof(nh64))
  176. #define xnh_type (clazz == ELFCLASS32 \
  177. ? elf_getu32(swap, nh32.n_type) \
  178. : elf_getu32(swap, nh64.n_type))
  179. #define xnh_namesz (clazz == ELFCLASS32 \
  180. ? elf_getu32(swap, nh32.n_namesz) \
  181. : elf_getu32(swap, nh64.n_namesz))
  182. #define xnh_descsz (clazz == ELFCLASS32 \
  183. ? elf_getu32(swap, nh32.n_descsz) \
  184. : elf_getu32(swap, nh64.n_descsz))
  185. #define xdh_addr (clazz == ELFCLASS32 \
  186. ? CAST(void *, &dh32) \
  187. : CAST(void *, &dh64))
  188. #define xdh_sizeof (clazz == ELFCLASS32 \
  189. ? sizeof(dh32) \
  190. : sizeof(dh64))
  191. #define xdh_tag (clazz == ELFCLASS32 \
  192. ? elf_getu32(swap, dh32.d_tag) \
  193. : elf_getu64(swap, dh64.d_tag))
  194. #define xdh_val (clazz == ELFCLASS32 \
  195. ? elf_getu32(swap, dh32.d_un.d_val) \
  196. : elf_getu64(swap, dh64.d_un.d_val))
  197. #define xcap_addr (clazz == ELFCLASS32 \
  198. ? CAST(void *, &cap32) \
  199. : CAST(void *, &cap64))
  200. #define xcap_sizeof (clazz == ELFCLASS32 \
  201. ? sizeof(cap32) \
  202. : sizeof(cap64))
  203. #define xcap_tag (clazz == ELFCLASS32 \
  204. ? elf_getu32(swap, cap32.c_tag) \
  205. : elf_getu64(swap, cap64.c_tag))
  206. #define xcap_val (clazz == ELFCLASS32 \
  207. ? elf_getu32(swap, cap32.c_un.c_val) \
  208. : elf_getu64(swap, cap64.c_un.c_val))
  209. #define xauxv_addr (clazz == ELFCLASS32 \
  210. ? CAST(void *, &auxv32) \
  211. : CAST(void *, &auxv64))
  212. #define xauxv_sizeof (clazz == ELFCLASS32 \
  213. ? sizeof(auxv32) \
  214. : sizeof(auxv64))
  215. #define xauxv_type (clazz == ELFCLASS32 \
  216. ? elf_getu32(swap, auxv32.a_type) \
  217. : elf_getu64(swap, auxv64.a_type))
  218. #define xauxv_val (clazz == ELFCLASS32 \
  219. ? elf_getu32(swap, auxv32.a_v) \
  220. : elf_getu64(swap, auxv64.a_v))
  221. #define prpsoffsets(i) (clazz == ELFCLASS32 \
  222. ? prpsoffsets32[i] \
  223. : prpsoffsets64[i])
  224. #ifdef ELFCORE
  225. /*
  226. * Try larger offsets first to avoid false matches
  227. * from earlier data that happen to look like strings.
  228. */
  229. static const size_t prpsoffsets32[] = {
  230. #ifdef USE_NT_PSINFO
  231. 104, /* SunOS 5.x (command line) */
  232. 88, /* SunOS 5.x (short name) */
  233. #endif /* USE_NT_PSINFO */
  234. 100, /* SunOS 5.x (command line) */
  235. 84, /* SunOS 5.x (short name) */
  236. 44, /* Linux (command line) */
  237. 28, /* Linux (short name) */
  238. 48, /* Linux PowerPC (command line) */
  239. 32, /* Linux PowerPC (short name) */
  240. 8, /* FreeBSD */
  241. };
  242. static const size_t prpsoffsets64[] = {
  243. #ifdef USE_NT_PSINFO
  244. 152, /* SunOS 5.x (command line) */
  245. 136, /* SunOS 5.x (short name) */
  246. #endif /* USE_NT_PSINFO */
  247. 136, /* SunOS 5.x, 64-bit (command line) */
  248. 120, /* SunOS 5.x, 64-bit (short name) */
  249. 56, /* Linux (command line) */
  250. 40, /* Linux (tested on core from 2.4.x, short name) */
  251. 16, /* FreeBSD, 64-bit */
  252. };
  253. #define NOFFSETS32 __arraycount(prpsoffsets32)
  254. #define NOFFSETS64 __arraycount(prpsoffsets64)
  255. #define NOFFSETS (clazz == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64)
  256. /*
  257. * Look through the program headers of an executable image, searching
  258. * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or
  259. * "FreeBSD"; if one is found, try looking in various places in its
  260. * contents for a 16-character string containing only printable
  261. * characters - if found, that string should be the name of the program
  262. * that dropped core. Note: right after that 16-character string is,
  263. * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and
  264. * Linux, a longer string (80 characters, in 5.x, probably other
  265. * SVR4-flavored systems, and Linux) containing the start of the
  266. * command line for that program.
  267. *
  268. * SunOS 5.x core files contain two PT_NOTE sections, with the types
  269. * NT_PRPSINFO (old) and NT_PSINFO (new). These structs contain the
  270. * same info about the command name and command line, so it probably
  271. * isn't worthwhile to look for NT_PSINFO, but the offsets are provided
  272. * above (see USE_NT_PSINFO), in case we ever decide to do so. The
  273. * NT_PRPSINFO and NT_PSINFO sections are always in order and adjacent;
  274. * the SunOS 5.x file command relies on this (and prefers the latter).
  275. *
  276. * The signal number probably appears in a section of type NT_PRSTATUS,
  277. * but that's also rather OS-dependent, in ways that are harder to
  278. * dissect with heuristics, so I'm not bothering with the signal number.
  279. * (I suppose the signal number could be of interest in situations where
  280. * you don't have the binary of the program that dropped core; if you
  281. * *do* have that binary, the debugger will probably tell you what
  282. * signal it was.)
  283. */
  284. #define OS_STYLE_SVR4 0
  285. #define OS_STYLE_FREEBSD 1
  286. #define OS_STYLE_NETBSD 2
  287. private const char os_style_names[][8] = {
  288. "SVR4",
  289. "FreeBSD",
  290. "NetBSD",
  291. };
  292. #define FLAGS_CORE_STYLE 0x0003
  293. #define FLAGS_DID_CORE 0x0004
  294. #define FLAGS_DID_OS_NOTE 0x0008
  295. #define FLAGS_DID_BUILD_ID 0x0010
  296. #define FLAGS_DID_CORE_STYLE 0x0020
  297. #define FLAGS_DID_NETBSD_PAX 0x0040
  298. #define FLAGS_DID_NETBSD_MARCH 0x0080
  299. #define FLAGS_DID_NETBSD_CMODEL 0x0100
  300. #define FLAGS_DID_NETBSD_EMULATION 0x0200
  301. #define FLAGS_DID_NETBSD_UNKNOWN 0x0400
  302. #define FLAGS_IS_CORE 0x0800
  303. #define FLAGS_DID_AUXV 0x1000
  304. private int
  305. dophn_core(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
  306. int num, size_t size, off_t fsize, int *flags, uint16_t *notecount)
  307. {
  308. Elf32_Phdr ph32;
  309. Elf64_Phdr ph64;
  310. size_t offset, len;
  311. unsigned char nbuf[BUFSIZ];
  312. ssize_t bufsize;
  313. off_t ph_off = off, offs;
  314. int ph_num = num;
  315. if (ms->flags & MAGIC_MIME)
  316. return 0;
  317. if (num == 0) {
  318. if (file_printf(ms, ", no program header") == -1)
  319. return -1;
  320. return 0;
  321. }
  322. if (size != xph_sizeof) {
  323. if (file_printf(ms, ", corrupted program header size") == -1)
  324. return -1;
  325. return 0;
  326. }
  327. /*
  328. * Loop through all the program headers.
  329. */
  330. for ( ; num; num--) {
  331. if (pread(fd, xph_addr, xph_sizeof, off) <
  332. CAST(ssize_t, xph_sizeof)) {
  333. if (file_printf(ms,
  334. ", can't read elf program headers at %jd",
  335. (intmax_t)off) == -1)
  336. return -1;
  337. return 0;
  338. }
  339. off += size;
  340. if (fsize != SIZE_UNKNOWN && xph_offset > fsize) {
  341. /* Perhaps warn here */
  342. continue;
  343. }
  344. if (xph_type != PT_NOTE)
  345. continue;
  346. /*
  347. * This is a PT_NOTE section; loop through all the notes
  348. * in the section.
  349. */
  350. len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
  351. offs = xph_offset;
  352. if ((bufsize = pread(fd, nbuf, len, offs)) == -1) {
  353. if (file_printf(ms, " can't read note section at %jd",
  354. (intmax_t)offs) == -1)
  355. return -1;
  356. return 0;
  357. }
  358. offset = 0;
  359. for (;;) {
  360. if (offset >= CAST(size_t, bufsize))
  361. break;
  362. offset = donote(ms, nbuf, offset, CAST(size_t, bufsize),
  363. clazz, swap, 4, flags, notecount, fd, ph_off,
  364. ph_num, fsize);
  365. if (offset == 0)
  366. break;
  367. }
  368. }
  369. return 0;
  370. }
  371. #endif
  372. static int
  373. do_note_netbsd_version(struct magic_set *ms, int swap, void *v)
  374. {
  375. uint32_t desc;
  376. memcpy(&desc, v, sizeof(desc));
  377. desc = elf_getu32(swap, desc);
  378. if (file_printf(ms, ", for NetBSD") == -1)
  379. return -1;
  380. /*
  381. * The version number used to be stuck as 199905, and was thus
  382. * basically content-free. Newer versions of NetBSD have fixed
  383. * this and now use the encoding of __NetBSD_Version__:
  384. *
  385. * MMmmrrpp00
  386. *
  387. * M = major version
  388. * m = minor version
  389. * r = release ["",A-Z,Z[A-Z] but numeric]
  390. * p = patchlevel
  391. */
  392. if (desc > 100000000U) {
  393. uint32_t ver_patch = (desc / 100) % 100;
  394. uint32_t ver_rel = (desc / 10000) % 100;
  395. uint32_t ver_min = (desc / 1000000) % 100;
  396. uint32_t ver_maj = desc / 100000000;
  397. if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1)
  398. return -1;
  399. if (ver_rel == 0 && ver_patch != 0) {
  400. if (file_printf(ms, ".%u", ver_patch) == -1)
  401. return -1;
  402. } else if (ver_rel != 0) {
  403. while (ver_rel > 26) {
  404. if (file_printf(ms, "Z") == -1)
  405. return -1;
  406. ver_rel -= 26;
  407. }
  408. if (file_printf(ms, "%c", 'A' + ver_rel - 1)
  409. == -1)
  410. return -1;
  411. }
  412. }
  413. return 0;
  414. }
  415. static int
  416. do_note_freebsd_version(struct magic_set *ms, int swap, void *v)
  417. {
  418. uint32_t desc;
  419. memcpy(&desc, v, sizeof(desc));
  420. desc = elf_getu32(swap, desc);
  421. if (file_printf(ms, ", for FreeBSD") == -1)
  422. return -1;
  423. /*
  424. * Contents is __FreeBSD_version, whose relation to OS
  425. * versions is defined by a huge table in the Porter's
  426. * Handbook. This is the general scheme:
  427. *
  428. * Releases:
  429. * Mmp000 (before 4.10)
  430. * Mmi0p0 (before 5.0)
  431. * Mmm0p0
  432. *
  433. * Development branches:
  434. * Mmpxxx (before 4.6)
  435. * Mmp1xx (before 4.10)
  436. * Mmi1xx (before 5.0)
  437. * M000xx (pre-M.0)
  438. * Mmm1xx
  439. *
  440. * M = major version
  441. * m = minor version
  442. * i = minor version increment (491000 -> 4.10)
  443. * p = patchlevel
  444. * x = revision
  445. *
  446. * The first release of FreeBSD to use ELF by default
  447. * was version 3.0.
  448. */
  449. if (desc == 460002) {
  450. if (file_printf(ms, " 4.6.2") == -1)
  451. return -1;
  452. } else if (desc < 460100) {
  453. if (file_printf(ms, " %d.%d", desc / 100000,
  454. desc / 10000 % 10) == -1)
  455. return -1;
  456. if (desc / 1000 % 10 > 0)
  457. if (file_printf(ms, ".%d", desc / 1000 % 10) == -1)
  458. return -1;
  459. if ((desc % 1000 > 0) || (desc % 100000 == 0))
  460. if (file_printf(ms, " (%d)", desc) == -1)
  461. return -1;
  462. } else if (desc < 500000) {
  463. if (file_printf(ms, " %d.%d", desc / 100000,
  464. desc / 10000 % 10 + desc / 1000 % 10) == -1)
  465. return -1;
  466. if (desc / 100 % 10 > 0) {
  467. if (file_printf(ms, " (%d)", desc) == -1)
  468. return -1;
  469. } else if (desc / 10 % 10 > 0) {
  470. if (file_printf(ms, ".%d", desc / 10 % 10) == -1)
  471. return -1;
  472. }
  473. } else {
  474. if (file_printf(ms, " %d.%d", desc / 100000,
  475. desc / 1000 % 100) == -1)
  476. return -1;
  477. if ((desc / 100 % 10 > 0) ||
  478. (desc % 100000 / 100 == 0)) {
  479. if (file_printf(ms, " (%d)", desc) == -1)
  480. return -1;
  481. } else if (desc / 10 % 10 > 0) {
  482. if (file_printf(ms, ".%d", desc / 10 % 10) == -1)
  483. return -1;
  484. }
  485. }
  486. return 0;
  487. }
  488. private int
  489. /*ARGSUSED*/
  490. do_bid_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
  491. int swap __attribute__((__unused__)), uint32_t namesz, uint32_t descsz,
  492. size_t noff, size_t doff, int *flags)
  493. {
  494. if (namesz == 4 && strcmp(RCAST(char *, &nbuf[noff]), "GNU") == 0 &&
  495. type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
  496. uint8_t desc[20];
  497. const char *btype;
  498. uint32_t i;
  499. *flags |= FLAGS_DID_BUILD_ID;
  500. switch (descsz) {
  501. case 8:
  502. btype = "xxHash";
  503. break;
  504. case 16:
  505. btype = "md5/uuid";
  506. break;
  507. case 20:
  508. btype = "sha1";
  509. break;
  510. default:
  511. btype = "unknown";
  512. break;
  513. }
  514. if (file_printf(ms, ", BuildID[%s]=", btype) == -1)
  515. return -1;
  516. memcpy(desc, &nbuf[doff], descsz);
  517. for (i = 0; i < descsz; i++)
  518. if (file_printf(ms, "%02x", desc[i]) == -1)
  519. return -1;
  520. return 1;
  521. }
  522. if (namesz == 4 && strcmp(RCAST(char *, &nbuf[noff]), "Go") == 0 &&
  523. type == NT_GO_BUILD_ID && descsz < 128) {
  524. char buf[256];
  525. if (file_printf(ms, ", Go BuildID=%s",
  526. file_copystr(buf, sizeof(buf), descsz,
  527. RCAST(const char *, &nbuf[doff]))) == -1)
  528. return -1;
  529. return 1;
  530. }
  531. return 0;
  532. }
  533. private int
  534. do_os_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
  535. int swap, uint32_t namesz, uint32_t descsz,
  536. size_t noff, size_t doff, int *flags)
  537. {
  538. const char *name = RCAST(const char *, &nbuf[noff]);
  539. if (namesz == 5 && strcmp(name, "SuSE") == 0 &&
  540. type == NT_GNU_VERSION && descsz == 2) {
  541. *flags |= FLAGS_DID_OS_NOTE;
  542. if (file_printf(ms, ", for SuSE %d.%d", nbuf[doff],
  543. nbuf[doff + 1]) == -1)
  544. return -1;
  545. return 1;
  546. }
  547. if (namesz == 4 && strcmp(name, "GNU") == 0 &&
  548. type == NT_GNU_VERSION && descsz == 16) {
  549. uint32_t desc[4];
  550. memcpy(desc, &nbuf[doff], sizeof(desc));
  551. *flags |= FLAGS_DID_OS_NOTE;
  552. if (file_printf(ms, ", for GNU/") == -1)
  553. return -1;
  554. switch (elf_getu32(swap, desc[0])) {
  555. case GNU_OS_LINUX:
  556. if (file_printf(ms, "Linux") == -1)
  557. return -1;
  558. break;
  559. case GNU_OS_HURD:
  560. if (file_printf(ms, "Hurd") == -1)
  561. return -1;
  562. break;
  563. case GNU_OS_SOLARIS:
  564. if (file_printf(ms, "Solaris") == -1)
  565. return -1;
  566. break;
  567. case GNU_OS_KFREEBSD:
  568. if (file_printf(ms, "kFreeBSD") == -1)
  569. return -1;
  570. break;
  571. case GNU_OS_KNETBSD:
  572. if (file_printf(ms, "kNetBSD") == -1)
  573. return -1;
  574. break;
  575. default:
  576. if (file_printf(ms, "<unknown>") == -1)
  577. return -1;
  578. }
  579. if (file_printf(ms, " %d.%d.%d", elf_getu32(swap, desc[1]),
  580. elf_getu32(swap, desc[2]), elf_getu32(swap, desc[3])) == -1)
  581. return -1;
  582. return 1;
  583. }
  584. if (namesz == 7 && strcmp(name, "NetBSD") == 0) {
  585. if (type == NT_NETBSD_VERSION && descsz == 4) {
  586. *flags |= FLAGS_DID_OS_NOTE;
  587. if (do_note_netbsd_version(ms, swap, &nbuf[doff]) == -1)
  588. return -1;
  589. return 1;
  590. }
  591. }
  592. if (namesz == 8 && strcmp(name, "FreeBSD") == 0) {
  593. if (type == NT_FREEBSD_VERSION && descsz == 4) {
  594. *flags |= FLAGS_DID_OS_NOTE;
  595. if (do_note_freebsd_version(ms, swap, &nbuf[doff])
  596. == -1)
  597. return -1;
  598. return 1;
  599. }
  600. }
  601. if (namesz == 8 && strcmp(name, "OpenBSD") == 0 &&
  602. type == NT_OPENBSD_VERSION && descsz == 4) {
  603. *flags |= FLAGS_DID_OS_NOTE;
  604. if (file_printf(ms, ", for OpenBSD") == -1)
  605. return -1;
  606. /* Content of note is always 0 */
  607. return 1;
  608. }
  609. if (namesz == 10 && strcmp(name, "DragonFly") == 0 &&
  610. type == NT_DRAGONFLY_VERSION && descsz == 4) {
  611. uint32_t desc;
  612. *flags |= FLAGS_DID_OS_NOTE;
  613. if (file_printf(ms, ", for DragonFly") == -1)
  614. return -1;
  615. memcpy(&desc, &nbuf[doff], sizeof(desc));
  616. desc = elf_getu32(swap, desc);
  617. if (file_printf(ms, " %d.%d.%d", desc / 100000,
  618. desc / 10000 % 10, desc % 10000) == -1)
  619. return -1;
  620. return 1;
  621. }
  622. return 0;
  623. }
  624. private int
  625. do_pax_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
  626. int swap, uint32_t namesz, uint32_t descsz,
  627. size_t noff, size_t doff, int *flags)
  628. {
  629. const char *name = RCAST(const char *, &nbuf[noff]);
  630. if (namesz == 4 && strcmp(name, "PaX") == 0 &&
  631. type == NT_NETBSD_PAX && descsz == 4) {
  632. static const char *pax[] = {
  633. "+mprotect",
  634. "-mprotect",
  635. "+segvguard",
  636. "-segvguard",
  637. "+ASLR",
  638. "-ASLR",
  639. };
  640. uint32_t desc;
  641. size_t i;
  642. int did = 0;
  643. *flags |= FLAGS_DID_NETBSD_PAX;
  644. memcpy(&desc, &nbuf[doff], sizeof(desc));
  645. desc = elf_getu32(swap, desc);
  646. if (desc && file_printf(ms, ", PaX: ") == -1)
  647. return -1;
  648. for (i = 0; i < __arraycount(pax); i++) {
  649. if (((1 << CAST(int, i)) & desc) == 0)
  650. continue;
  651. if (file_printf(ms, "%s%s", did++ ? "," : "",
  652. pax[i]) == -1)
  653. return -1;
  654. }
  655. return 1;
  656. }
  657. return 0;
  658. }
  659. private int
  660. do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
  661. int swap, uint32_t namesz, uint32_t descsz,
  662. size_t noff, size_t doff, int *flags, size_t size, int clazz)
  663. {
  664. #ifdef ELFCORE
  665. char buf[256];
  666. const char *name = RCAST(const char *, &nbuf[noff]);
  667. int os_style = -1;
  668. /*
  669. * Sigh. The 2.0.36 kernel in Debian 2.1, at
  670. * least, doesn't correctly implement name
  671. * sections, in core dumps, as specified by
  672. * the "Program Linking" section of "UNIX(R) System
  673. * V Release 4 Programmer's Guide: ANSI C and
  674. * Programming Support Tools", because my copy
  675. * clearly says "The first 'namesz' bytes in 'name'
  676. * contain a *null-terminated* [emphasis mine]
  677. * character representation of the entry's owner
  678. * or originator", but the 2.0.36 kernel code
  679. * doesn't include the terminating null in the
  680. * name....
  681. */
  682. if ((namesz == 4 && strncmp(name, "CORE", 4) == 0) ||
  683. (namesz == 5 && strcmp(name, "CORE") == 0)) {
  684. os_style = OS_STYLE_SVR4;
  685. }
  686. if ((namesz == 8 && strcmp(name, "FreeBSD") == 0)) {
  687. os_style = OS_STYLE_FREEBSD;
  688. }
  689. if ((namesz >= 11 && strncmp(name, "NetBSD-CORE", 11)
  690. == 0)) {
  691. os_style = OS_STYLE_NETBSD;
  692. }
  693. if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) {
  694. if (file_printf(ms, ", %s-style", os_style_names[os_style])
  695. == -1)
  696. return -1;
  697. *flags |= FLAGS_DID_CORE_STYLE;
  698. *flags |= os_style;
  699. }
  700. switch (os_style) {
  701. case OS_STYLE_NETBSD:
  702. if (type == NT_NETBSD_CORE_PROCINFO) {
  703. char sbuf[512];
  704. struct NetBSD_elfcore_procinfo pi;
  705. memset(&pi, 0, sizeof(pi));
  706. memcpy(&pi, nbuf + doff, MIN(descsz, sizeof(pi)));
  707. if (file_printf(ms, ", from '%.31s', pid=%u, uid=%u, "
  708. "gid=%u, nlwps=%u, lwp=%u (signal %u/code %u)",
  709. file_printable(ms, sbuf, sizeof(sbuf),
  710. RCAST(char *, pi.cpi_name), sizeof(pi.cpi_name)),
  711. elf_getu32(swap, CAST(uint32_t, pi.cpi_pid)),
  712. elf_getu32(swap, pi.cpi_euid),
  713. elf_getu32(swap, pi.cpi_egid),
  714. elf_getu32(swap, pi.cpi_nlwps),
  715. elf_getu32(swap, CAST(uint32_t, pi.cpi_siglwp)),
  716. elf_getu32(swap, pi.cpi_signo),
  717. elf_getu32(swap, pi.cpi_sigcode)) == -1)
  718. return -1;
  719. *flags |= FLAGS_DID_CORE;
  720. return 1;
  721. }
  722. break;
  723. case OS_STYLE_FREEBSD:
  724. if (type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) {
  725. size_t argoff, pidoff;
  726. if (clazz == ELFCLASS32)
  727. argoff = 4 + 4 + 17;
  728. else
  729. argoff = 4 + 4 + 8 + 17;
  730. if (file_printf(ms, ", from '%.80s'", nbuf + doff +
  731. argoff) == -1)
  732. return -1;
  733. pidoff = argoff + 81 + 2;
  734. if (doff + pidoff + 4 <= size) {
  735. if (file_printf(ms, ", pid=%u",
  736. elf_getu32(swap, *RCAST(uint32_t *, (nbuf +
  737. doff + pidoff)))) == -1)
  738. return -1;
  739. }
  740. *flags |= FLAGS_DID_CORE;
  741. }
  742. break;
  743. default:
  744. if (type == NT_PRPSINFO && *flags & FLAGS_IS_CORE) {
  745. size_t i, j;
  746. unsigned char c;
  747. /*
  748. * Extract the program name. We assume
  749. * it to be 16 characters (that's what it
  750. * is in SunOS 5.x and Linux).
  751. *
  752. * Unfortunately, it's at a different offset
  753. * in various OSes, so try multiple offsets.
  754. * If the characters aren't all printable,
  755. * reject it.
  756. */
  757. for (i = 0; i < NOFFSETS; i++) {
  758. unsigned char *cname, *cp;
  759. size_t reloffset = prpsoffsets(i);
  760. size_t noffset = doff + reloffset;
  761. size_t k;
  762. for (j = 0; j < 16; j++, noffset++,
  763. reloffset++) {
  764. /*
  765. * Make sure we're not past
  766. * the end of the buffer; if
  767. * we are, just give up.
  768. */
  769. if (noffset >= size)
  770. goto tryanother;
  771. /*
  772. * Make sure we're not past
  773. * the end of the contents;
  774. * if we are, this obviously
  775. * isn't the right offset.
  776. */
  777. if (reloffset >= descsz)
  778. goto tryanother;
  779. c = nbuf[noffset];
  780. if (c == '\0') {
  781. /*
  782. * A '\0' at the
  783. * beginning is
  784. * obviously wrong.
  785. * Any other '\0'
  786. * means we're done.
  787. */
  788. if (j == 0)
  789. goto tryanother;
  790. else
  791. break;
  792. } else {
  793. /*
  794. * A nonprintable
  795. * character is also
  796. * wrong.
  797. */
  798. if (!isprint(c) || isquote(c))
  799. goto tryanother;
  800. }
  801. }
  802. /*
  803. * Well, that worked.
  804. */
  805. /*
  806. * Try next offsets, in case this match is
  807. * in the middle of a string.
  808. */
  809. for (k = i + 1 ; k < NOFFSETS; k++) {
  810. size_t no;
  811. int adjust = 1;
  812. if (prpsoffsets(k) >= prpsoffsets(i))
  813. continue;
  814. /*
  815. * pr_fname == pr_psargs - 16 &&
  816. * non-nul-terminated fname (qemu)
  817. */
  818. if (prpsoffsets(k) ==
  819. prpsoffsets(i) - 16 && j == 16)
  820. continue;
  821. for (no = doff + prpsoffsets(k);
  822. no < doff + prpsoffsets(i); no++)
  823. adjust = adjust
  824. && isprint(nbuf[no]);
  825. if (adjust)
  826. i = k;
  827. }
  828. cname = CAST(unsigned char *,
  829. &nbuf[doff + prpsoffsets(i)]);
  830. for (cp = cname; cp < nbuf + size && *cp
  831. && isprint(*cp); cp++)
  832. continue;
  833. /*
  834. * Linux apparently appends a space at the end
  835. * of the command line: remove it.
  836. */
  837. while (cp > cname && isspace(cp[-1]))
  838. cp--;
  839. if (file_printf(ms, ", from '%s'",
  840. file_copystr(buf, sizeof(buf),
  841. CAST(size_t, cp - cname),
  842. RCAST(char *, cname))) == -1)
  843. return -1;
  844. *flags |= FLAGS_DID_CORE;
  845. return 1;
  846. tryanother:
  847. ;
  848. }
  849. }
  850. break;
  851. }
  852. #endif
  853. return 0;
  854. }
  855. private off_t
  856. get_offset_from_virtaddr(struct magic_set *ms, int swap, int clazz, int fd,
  857. off_t off, int num, off_t fsize, uint64_t virtaddr)
  858. {
  859. Elf32_Phdr ph32;
  860. Elf64_Phdr ph64;
  861. /*
  862. * Loop through all the program headers and find the header with
  863. * virtual address in which the "virtaddr" belongs to.
  864. */
  865. for ( ; num; num--) {
  866. if (pread(fd, xph_addr, xph_sizeof, off) <
  867. CAST(ssize_t, xph_sizeof)) {
  868. if (file_printf(ms,
  869. ", can't read elf program header at %jd",
  870. (intmax_t)off) == -1)
  871. return -1;
  872. return 0;
  873. }
  874. off += xph_sizeof;
  875. if (fsize != SIZE_UNKNOWN && xph_offset > fsize) {
  876. /* Perhaps warn here */
  877. continue;
  878. }
  879. if (virtaddr >= xph_vaddr && virtaddr < xph_vaddr + xph_filesz)
  880. return xph_offset + (virtaddr - xph_vaddr);
  881. }
  882. return 0;
  883. }
  884. private size_t
  885. get_string_on_virtaddr(struct magic_set *ms,
  886. int swap, int clazz, int fd, off_t ph_off, int ph_num,
  887. off_t fsize, uint64_t virtaddr, char *buf, ssize_t buflen)
  888. {
  889. char *bptr;
  890. off_t offset;
  891. if (buflen == 0)
  892. return 0;
  893. offset = get_offset_from_virtaddr(ms, swap, clazz, fd, ph_off, ph_num,
  894. fsize, virtaddr);
  895. if (offset < 0 ||
  896. (buflen = pread(fd, buf, CAST(size_t, buflen), offset)) <= 0) {
  897. (void)file_printf(ms, ", can't read elf string at %jd",
  898. (intmax_t)offset);
  899. return 0;
  900. }
  901. buf[buflen - 1] = '\0';
  902. /* We expect only printable characters, so return if buffer contains
  903. * non-printable character before the '\0' or just '\0'. */
  904. for (bptr = buf; *bptr && isprint(CAST(unsigned char, *bptr)); bptr++)
  905. continue;
  906. if (*bptr != '\0')
  907. return 0;
  908. return bptr - buf;
  909. }
  910. /*ARGSUSED*/
  911. private int
  912. do_auxv_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
  913. int swap, uint32_t namesz __attribute__((__unused__)),
  914. uint32_t descsz __attribute__((__unused__)),
  915. size_t noff __attribute__((__unused__)), size_t doff,
  916. int *flags, size_t size __attribute__((__unused__)), int clazz,
  917. int fd, off_t ph_off, int ph_num, off_t fsize)
  918. {
  919. #ifdef ELFCORE
  920. Aux32Info auxv32;
  921. Aux64Info auxv64;
  922. size_t elsize = xauxv_sizeof;
  923. const char *tag;
  924. int is_string;
  925. size_t nval, off;
  926. if ((*flags & (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE)) !=
  927. (FLAGS_IS_CORE|FLAGS_DID_CORE_STYLE))
  928. return 0;
  929. switch (*flags & FLAGS_CORE_STYLE) {
  930. case OS_STYLE_SVR4:
  931. if (type != NT_AUXV)
  932. return 0;
  933. break;
  934. #ifdef notyet
  935. case OS_STYLE_NETBSD:
  936. if (type != NT_NETBSD_CORE_AUXV)
  937. return 0;
  938. break;
  939. case OS_STYLE_FREEBSD:
  940. if (type != NT_FREEBSD_PROCSTAT_AUXV)
  941. return 0;
  942. break;
  943. #endif
  944. default:
  945. return 0;
  946. }
  947. *flags |= FLAGS_DID_AUXV;
  948. nval = 0;
  949. for (off = 0; off + elsize <= descsz; off += elsize) {
  950. memcpy(xauxv_addr, &nbuf[doff + off], xauxv_sizeof);
  951. /* Limit processing to 50 vector entries to prevent DoS */
  952. if (nval++ >= 50) {
  953. file_error(ms, 0, "Too many ELF Auxv elements");
  954. return 1;
  955. }
  956. switch(xauxv_type) {
  957. case AT_LINUX_EXECFN:
  958. is_string = 1;
  959. tag = "execfn";
  960. break;
  961. case AT_LINUX_PLATFORM:
  962. is_string = 1;
  963. tag = "platform";
  964. break;
  965. case AT_LINUX_UID:
  966. is_string = 0;
  967. tag = "real uid";
  968. break;
  969. case AT_LINUX_GID:
  970. is_string = 0;
  971. tag = "real gid";
  972. break;
  973. case AT_LINUX_EUID:
  974. is_string = 0;
  975. tag = "effective uid";
  976. break;
  977. case AT_LINUX_EGID:
  978. is_string = 0;
  979. tag = "effective gid";
  980. break;
  981. default:
  982. is_string = 0;
  983. tag = NULL;
  984. break;
  985. }
  986. if (tag == NULL)
  987. continue;
  988. if (is_string) {
  989. char buf[256];
  990. ssize_t buflen;
  991. buflen = get_string_on_virtaddr(ms, swap, clazz, fd,
  992. ph_off, ph_num, fsize, xauxv_val, buf, sizeof(buf));
  993. if (buflen == 0)
  994. continue;
  995. if (file_printf(ms, ", %s: '%s'", tag, buf) == -1)
  996. return -1;
  997. } else {
  998. if (file_printf(ms, ", %s: %d", tag,
  999. CAST(int, xauxv_val)) == -1)
  1000. return -1;
  1001. }
  1002. }
  1003. return 1;
  1004. #else
  1005. return 0;
  1006. #endif
  1007. }
  1008. private size_t
  1009. dodynamic(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
  1010. int clazz, int swap, int *pie, size_t *need)
  1011. {
  1012. Elf32_Dyn dh32;
  1013. Elf64_Dyn dh64;
  1014. unsigned char *dbuf = CAST(unsigned char *, vbuf);
  1015. if (xdh_sizeof + offset > size) {
  1016. /*
  1017. * We're out of note headers.
  1018. */
  1019. return xdh_sizeof + offset;
  1020. }
  1021. memcpy(xdh_addr, &dbuf[offset], xdh_sizeof);
  1022. offset += xdh_sizeof;
  1023. switch (xdh_tag) {
  1024. case DT_FLAGS_1:
  1025. *pie = 1;
  1026. if (xdh_val & DF_1_PIE)
  1027. ms->mode |= 0111;
  1028. else
  1029. ms->mode &= ~0111;
  1030. break;
  1031. case DT_NEEDED:
  1032. (*need)++;
  1033. break;
  1034. default:
  1035. break;
  1036. }
  1037. return offset;
  1038. }
  1039. private size_t
  1040. donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
  1041. int clazz, int swap, size_t align, int *flags, uint16_t *notecount,
  1042. int fd, off_t ph_off, int ph_num, off_t fsize)
  1043. {
  1044. Elf32_Nhdr nh32;
  1045. Elf64_Nhdr nh64;
  1046. size_t noff, doff;
  1047. uint32_t namesz, descsz;
  1048. char buf[256];
  1049. unsigned char *nbuf = CAST(unsigned char *, vbuf);
  1050. if (*notecount == 0)
  1051. return 0;
  1052. --*notecount;
  1053. if (xnh_sizeof + offset > size) {
  1054. /*
  1055. * We're out of note headers.
  1056. */
  1057. return xnh_sizeof + offset;
  1058. }
  1059. /*XXX: GCC */
  1060. memset(&nh32, 0, sizeof(nh32));
  1061. memset(&nh64, 0, sizeof(nh64));
  1062. memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
  1063. offset += xnh_sizeof;
  1064. namesz = xnh_namesz;
  1065. descsz = xnh_descsz;
  1066. if ((namesz == 0) && (descsz == 0)) {
  1067. /*
  1068. * We're out of note headers.
  1069. */
  1070. return (offset >= size) ? offset : size;
  1071. }
  1072. if (namesz & 0x80000000) {
  1073. (void)file_printf(ms, ", bad note name size %#lx",
  1074. CAST(unsigned long, namesz));
  1075. return 0;
  1076. }
  1077. if (descsz & 0x80000000) {
  1078. (void)file_printf(ms, ", bad note description size %#lx",
  1079. CAST(unsigned long, descsz));
  1080. return 0;
  1081. }
  1082. noff = offset;
  1083. doff = ELF_ALIGN(offset + namesz);
  1084. if (offset + namesz > size) {
  1085. /*
  1086. * We're past the end of the buffer.
  1087. */
  1088. return doff;
  1089. }
  1090. offset = ELF_ALIGN(doff + descsz);
  1091. if (doff + descsz > size) {
  1092. /*
  1093. * We're past the end of the buffer.
  1094. */
  1095. return (offset >= size) ? offset : size;
  1096. }
  1097. if ((*flags & FLAGS_DID_OS_NOTE) == 0) {
  1098. if (do_os_note(ms, nbuf, xnh_type, swap,
  1099. namesz, descsz, noff, doff, flags))
  1100. return offset;
  1101. }
  1102. if ((*flags & FLAGS_DID_BUILD_ID) == 0) {
  1103. if (do_bid_note(ms, nbuf, xnh_type, swap,
  1104. namesz, descsz, noff, doff, flags))
  1105. return offset;
  1106. }
  1107. if ((*flags & FLAGS_DID_NETBSD_PAX) == 0) {
  1108. if (do_pax_note(ms, nbuf, xnh_type, swap,
  1109. namesz, descsz, noff, doff, flags))
  1110. return offset;
  1111. }
  1112. if ((*flags & FLAGS_DID_CORE) == 0) {
  1113. if (do_core_note(ms, nbuf, xnh_type, swap,
  1114. namesz, descsz, noff, doff, flags, size, clazz))
  1115. return offset;
  1116. }
  1117. if ((*flags & FLAGS_DID_AUXV) == 0) {
  1118. if (do_auxv_note(ms, nbuf, xnh_type, swap,
  1119. namesz, descsz, noff, doff, flags, size, clazz,
  1120. fd, ph_off, ph_num, fsize))
  1121. return offset;
  1122. }
  1123. if (namesz == 7 && strcmp(RCAST(char *, &nbuf[noff]), "NetBSD") == 0) {
  1124. int descw, flag;
  1125. const char *str, *tag;
  1126. if (descsz > 100)
  1127. descsz = 100;
  1128. switch (xnh_type) {
  1129. case NT_NETBSD_VERSION:
  1130. return offset;
  1131. case NT_NETBSD_MARCH:
  1132. flag = FLAGS_DID_NETBSD_MARCH;
  1133. tag = "compiled for";
  1134. break;
  1135. case NT_NETBSD_CMODEL:
  1136. flag = FLAGS_DID_NETBSD_CMODEL;
  1137. tag = "compiler model";
  1138. break;
  1139. case NT_NETBSD_EMULATION:
  1140. flag = FLAGS_DID_NETBSD_EMULATION;
  1141. tag = "emulation:";
  1142. break;
  1143. default:
  1144. if (*flags & FLAGS_DID_NETBSD_UNKNOWN)
  1145. return offset;
  1146. *flags |= FLAGS_DID_NETBSD_UNKNOWN;
  1147. if (file_printf(ms, ", note=%u", xnh_type) == -1)
  1148. return offset;
  1149. return offset;
  1150. }
  1151. if (*flags & flag)
  1152. return offset;
  1153. str = RCAST(const char *, &nbuf[doff]);
  1154. descw = CAST(int, descsz);
  1155. *flags |= flag;
  1156. file_printf(ms, ", %s: %s", tag,
  1157. file_copystr(buf, sizeof(buf), descw, str));
  1158. return offset;
  1159. }
  1160. return offset;
  1161. }
  1162. /* SunOS 5.x hardware capability descriptions */
  1163. typedef struct cap_desc {
  1164. uint64_t cd_mask;
  1165. const char *cd_name;
  1166. } cap_desc_t;
  1167. static const cap_desc_t cap_desc_sparc[] = {
  1168. { AV_SPARC_MUL32, "MUL32" },
  1169. { AV_SPARC_DIV32, "DIV32" },
  1170. { AV_SPARC_FSMULD, "FSMULD" },
  1171. { AV_SPARC_V8PLUS, "V8PLUS" },
  1172. { AV_SPARC_POPC, "POPC" },
  1173. { AV_SPARC_VIS, "VIS" },
  1174. { AV_SPARC_VIS2, "VIS2" },
  1175. { AV_SPARC_ASI_BLK_INIT, "ASI_BLK_INIT" },
  1176. { AV_SPARC_FMAF, "FMAF" },
  1177. { AV_SPARC_FJFMAU, "FJFMAU" },
  1178. { AV_SPARC_IMA, "IMA" },
  1179. { 0, NULL }
  1180. };
  1181. static const cap_desc_t cap_desc_386[] = {
  1182. { AV_386_FPU, "FPU" },
  1183. { AV_386_TSC, "TSC" },
  1184. { AV_386_CX8, "CX8" },
  1185. { AV_386_SEP, "SEP" },
  1186. { AV_386_AMD_SYSC, "AMD_SYSC" },
  1187. { AV_386_CMOV, "CMOV" },
  1188. { AV_386_MMX, "MMX" },
  1189. { AV_386_AMD_MMX, "AMD_MMX" },
  1190. { AV_386_AMD_3DNow, "AMD_3DNow" },
  1191. { AV_386_AMD_3DNowx, "AMD_3DNowx" },
  1192. { AV_386_FXSR, "FXSR" },
  1193. { AV_386_SSE, "SSE" },
  1194. { AV_386_SSE2, "SSE2" },
  1195. { AV_386_PAUSE, "PAUSE" },
  1196. { AV_386_SSE3, "SSE3" },
  1197. { AV_386_MON, "MON" },
  1198. { AV_386_CX16, "CX16" },
  1199. { AV_386_AHF, "AHF" },
  1200. { AV_386_TSCP, "TSCP" },
  1201. { AV_386_AMD_SSE4A, "AMD_SSE4A" },
  1202. { AV_386_POPCNT, "POPCNT" },
  1203. { AV_386_AMD_LZCNT, "AMD_LZCNT" },
  1204. { AV_386_SSSE3, "SSSE3" },
  1205. { AV_386_SSE4_1, "SSE4.1" },
  1206. { AV_386_SSE4_2, "SSE4.2" },
  1207. { 0, NULL }
  1208. };
  1209. private int
  1210. doshn(struct magic_set *ms, int clazz, int swap, int fd, off_t off, int num,
  1211. size_t size, off_t fsize, int mach, int strtab, int *flags,
  1212. uint16_t *notecount)
  1213. {
  1214. Elf32_Shdr sh32;
  1215. Elf64_Shdr sh64;
  1216. int stripped = 1, has_debug_info = 0;
  1217. size_t nbadcap = 0;
  1218. void *nbuf;
  1219. off_t noff, coff, name_off, offs;
  1220. uint64_t cap_hw1 = 0; /* SunOS 5.x hardware capabilities */
  1221. uint64_t cap_sf1 = 0; /* SunOS 5.x software capabilities */
  1222. char name[50];
  1223. ssize_t namesize;
  1224. if (ms->flags & MAGIC_MIME)
  1225. return 0;
  1226. if (num == 0) {
  1227. if (file_printf(ms, ", no section header") == -1)
  1228. return -1;
  1229. return 0;
  1230. }
  1231. if (size != xsh_sizeof) {
  1232. if (file_printf(ms, ", corrupted section header size") == -1)
  1233. return -1;
  1234. return 0;
  1235. }
  1236. /* Read offset of name section to be able to read section names later */
  1237. offs = CAST(off_t, (off + size * strtab));
  1238. if (pread(fd, xsh_addr, xsh_sizeof, offs) < CAST(ssize_t, xsh_sizeof)) {
  1239. if (file_printf(ms, ", missing section headers at %jd",
  1240. (intmax_t)offs) == -1)
  1241. return -1;
  1242. return 0;
  1243. }
  1244. name_off = xsh_offset;
  1245. if (fsize != SIZE_UNKNOWN && fsize < name_off) {
  1246. if (file_printf(ms, ", too large section header offset %jd",
  1247. (intmax_t)name_off) == -1)
  1248. return -1;
  1249. return 0;
  1250. }
  1251. for ( ; num; num--) {
  1252. /* Read the name of this section. */
  1253. offs = name_off + xsh_name;
  1254. if ((namesize = pread(fd, name, sizeof(name) - 1, offs))
  1255. == -1) {
  1256. if (file_printf(ms,
  1257. ", can't read name of elf section at %jd",
  1258. (intmax_t)offs) == -1)
  1259. return -1;
  1260. return 0;
  1261. }
  1262. name[namesize] = '\0';
  1263. if (strcmp(name, ".debug_info") == 0) {
  1264. has_debug_info = 1;
  1265. stripped = 0;
  1266. }
  1267. if (pread(fd, xsh_addr, xsh_sizeof, off) <
  1268. CAST(ssize_t, xsh_sizeof)) {
  1269. if (file_printf(ms, ", can't read elf section at %jd",
  1270. (intmax_t)off) == -1)
  1271. return -1;
  1272. return 0;
  1273. }
  1274. off += size;
  1275. /* Things we can determine before we seek */
  1276. switch (xsh_type) {
  1277. case SHT_SYMTAB:
  1278. #if 0
  1279. case SHT_DYNSYM:
  1280. #endif
  1281. stripped = 0;
  1282. break;
  1283. default:
  1284. if (fsize != SIZE_UNKNOWN && xsh_offset > fsize) {
  1285. /* Perhaps warn here */
  1286. continue;
  1287. }
  1288. break;
  1289. }
  1290. /* Things we can determine when we seek */
  1291. switch (xsh_type) {
  1292. case SHT_NOTE:
  1293. if (CAST(uintmax_t, (xsh_size + xsh_offset)) >
  1294. CAST(uintmax_t, fsize)) {
  1295. if (file_printf(ms,
  1296. ", note offset/size %#" INTMAX_T_FORMAT
  1297. "x+%#" INTMAX_T_FORMAT "x exceeds"
  1298. " file size %#" INTMAX_T_FORMAT "x",
  1299. CAST(uintmax_t, xsh_offset),
  1300. CAST(uintmax_t, xsh_size),
  1301. CAST(uintmax_t, fsize)) == -1)
  1302. return -1;
  1303. return 0;
  1304. }
  1305. if (xsh_size > MAX_SHSIZE) {
  1306. file_error(ms, errno, "Note section size too "
  1307. "big (%ju > %u)", (uintmax_t)xsh_size,
  1308. MAX_SHSIZE);
  1309. return -1;
  1310. }
  1311. if ((nbuf = malloc(xsh_size)) == NULL) {
  1312. file_error(ms, errno, "Cannot allocate memory"
  1313. " for note");
  1314. return -1;
  1315. }
  1316. offs = xsh_offset;
  1317. if (pread(fd, nbuf, xsh_size, offs) <
  1318. CAST(ssize_t, xsh_size)) {
  1319. free(nbuf);
  1320. if (file_printf(ms,
  1321. ", can't read elf note at %jd",
  1322. (intmax_t)offs) == -1)
  1323. return -1;
  1324. return 0;
  1325. }
  1326. noff = 0;
  1327. for (;;) {
  1328. if (noff >= CAST(off_t, xsh_size))
  1329. break;
  1330. noff = donote(ms, nbuf, CAST(size_t, noff),
  1331. xsh_size, clazz, swap, 4, flags, notecount,
  1332. fd, 0, 0, 0);
  1333. if (noff == 0)
  1334. break;
  1335. }
  1336. free(nbuf);
  1337. break;
  1338. case SHT_SUNW_cap:
  1339. switch (mach) {
  1340. case EM_SPARC:
  1341. case EM_SPARCV9:
  1342. case EM_IA_64:
  1343. case EM_386:
  1344. case EM_AMD64:
  1345. break;
  1346. default:
  1347. goto skip;
  1348. }
  1349. if (nbadcap > 5)
  1350. break;
  1351. if (lseek(fd, xsh_offset, SEEK_SET)
  1352. == CAST(off_t, -1)) {
  1353. file_badseek(ms);
  1354. return -1;
  1355. }
  1356. coff = 0;
  1357. for (;;) {
  1358. Elf32_Cap cap32;
  1359. Elf64_Cap cap64;
  1360. char cbuf[/*CONSTCOND*/
  1361. MAX(sizeof(cap32), sizeof(cap64))];
  1362. if ((coff += xcap_sizeof) >
  1363. CAST(off_t, xsh_size))
  1364. break;
  1365. if (read(fd, cbuf, CAST(size_t, xcap_sizeof)) !=
  1366. CAST(ssize_t, xcap_sizeof)) {
  1367. file_badread(ms);
  1368. return -1;
  1369. }
  1370. if (cbuf[0] == 'A') {
  1371. #ifdef notyet
  1372. char *p = cbuf + 1;
  1373. uint32_t len, tag;
  1374. memcpy(&len, p, sizeof(len));
  1375. p += 4;
  1376. len = getu32(swap, len);
  1377. if (memcmp("gnu", p, 3) != 0) {
  1378. if (file_printf(ms,
  1379. ", unknown capability %.3s", p)
  1380. == -1)
  1381. return -1;
  1382. break;
  1383. }
  1384. p += strlen(p) + 1;
  1385. tag = *p++;
  1386. memcpy(&len, p, sizeof(len));
  1387. p += 4;
  1388. len = getu32(swap, len);
  1389. if (tag != 1) {
  1390. if (file_printf(ms, ", unknown gnu"
  1391. " capability tag %d", tag)
  1392. == -1)
  1393. return -1;
  1394. break;
  1395. }
  1396. // gnu attributes
  1397. #endif
  1398. break;
  1399. }
  1400. memcpy(xcap_addr, cbuf, xcap_sizeof);
  1401. switch (xcap_tag) {
  1402. case CA_SUNW_NULL:
  1403. break;
  1404. case CA_SUNW_HW_1:
  1405. cap_hw1 |= xcap_val;
  1406. break;
  1407. case CA_SUNW_SF_1:
  1408. cap_sf1 |= xcap_val;
  1409. break;
  1410. default:
  1411. if (file_printf(ms,
  1412. ", with unknown capability "
  1413. "%#" INT64_T_FORMAT "x = %#"
  1414. INT64_T_FORMAT "x",
  1415. CAST(unsigned long long, xcap_tag),
  1416. CAST(unsigned long long, xcap_val))
  1417. == -1)
  1418. return -1;
  1419. if (nbadcap++ > 2)
  1420. coff = xsh_size;
  1421. break;
  1422. }
  1423. }
  1424. /*FALLTHROUGH*/
  1425. skip:
  1426. default:
  1427. break;
  1428. }
  1429. }
  1430. if (has_debug_info) {
  1431. if (file_printf(ms, ", with debug_info") == -1)
  1432. return -1;
  1433. }
  1434. if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
  1435. return -1;
  1436. if (cap_hw1) {
  1437. const cap_desc_t *cdp;
  1438. switch (mach) {
  1439. case EM_SPARC:
  1440. case EM_SPARC32PLUS:
  1441. case EM_SPARCV9:
  1442. cdp = cap_desc_sparc;
  1443. break;
  1444. case EM_386:
  1445. case EM_IA_64:
  1446. case EM_AMD64:
  1447. cdp = cap_desc_386;
  1448. break;
  1449. default:
  1450. cdp = NULL;
  1451. break;
  1452. }
  1453. if (file_printf(ms, ", uses") == -1)
  1454. return -1;
  1455. if (cdp) {
  1456. while (cdp->cd_name) {
  1457. if (cap_hw1 & cdp->cd_mask) {
  1458. if (file_printf(ms,
  1459. " %s", cdp->cd_name) == -1)
  1460. return -1;
  1461. cap_hw1 &= ~cdp->cd_mask;
  1462. }
  1463. ++cdp;
  1464. }
  1465. if (cap_hw1)
  1466. if (file_printf(ms,
  1467. " unknown hardware capability %#"
  1468. INT64_T_FORMAT "x",
  1469. CAST(unsigned long long, cap_hw1)) == -1)
  1470. return -1;
  1471. } else {
  1472. if (file_printf(ms,
  1473. " hardware capability %#" INT64_T_FORMAT "x",
  1474. CAST(unsigned long long, cap_hw1)) == -1)
  1475. return -1;
  1476. }
  1477. }
  1478. if (cap_sf1) {
  1479. if (cap_sf1 & SF1_SUNW_FPUSED) {
  1480. if (file_printf(ms,
  1481. (cap_sf1 & SF1_SUNW_FPKNWN)
  1482. ? ", uses frame pointer"
  1483. : ", not known to use frame pointer") == -1)
  1484. return -1;
  1485. }
  1486. cap_sf1 &= ~SF1_SUNW_MASK;
  1487. if (cap_sf1)
  1488. if (file_printf(ms,
  1489. ", with unknown software capability %#"
  1490. INT64_T_FORMAT "x",
  1491. CAST(unsigned long long, cap_sf1)) == -1)
  1492. return -1;
  1493. }
  1494. return 0;
  1495. }
  1496. /*
  1497. * Look through the program headers of an executable image, to determine
  1498. * if it is statically or dynamically linked. If it has a dynamic section,
  1499. * it is pie, and does not have an interpreter or needed libraries, we
  1500. * call it static pie.
  1501. */
  1502. private int
  1503. dophn_exec(struct magic_set *ms, int clazz, int swap, int fd, off_t off,
  1504. int num, size_t size, off_t fsize, int sh_num, int *flags,
  1505. uint16_t *notecount)
  1506. {
  1507. Elf32_Phdr ph32;
  1508. Elf64_Phdr ph64;
  1509. const char *linking_style;
  1510. unsigned char nbuf[BUFSIZ];
  1511. char ibuf[BUFSIZ];
  1512. char interp[BUFSIZ];
  1513. ssize_t bufsize;
  1514. size_t offset, align, need = 0;
  1515. int pie = 0, dynamic = 0;
  1516. if (num == 0) {
  1517. if (file_printf(ms, ", no program header") == -1)
  1518. return -1;
  1519. return 0;
  1520. }
  1521. if (size != xph_sizeof) {
  1522. if (file_printf(ms, ", corrupted program header size") == -1)
  1523. return -1;
  1524. return 0;
  1525. }
  1526. interp[0] = '\0';
  1527. for ( ; num; num--) {
  1528. int doread;
  1529. if (pread(fd, xph_addr, xph_sizeof, off) <
  1530. CAST(ssize_t, xph_sizeof)) {
  1531. if (file_printf(ms,
  1532. ", can't read elf program headers at %jd",
  1533. (intmax_t)off) == -1)
  1534. return -1;
  1535. return 0;
  1536. }
  1537. off += size;
  1538. bufsize = 0;
  1539. align = 4;
  1540. /* Things we can determine before we seek */
  1541. switch (xph_type) {
  1542. case PT_DYNAMIC:
  1543. doread = 1;
  1544. break;
  1545. case PT_NOTE:
  1546. if (sh_num) /* Did this through section headers */
  1547. continue;
  1548. if (((align = xph_align) & 0x80000000UL) != 0 ||
  1549. align < 4) {
  1550. if (file_printf(ms,
  1551. ", invalid note alignment %#lx",
  1552. CAST(unsigned long, align)) == -1)
  1553. return -1;
  1554. align = 4;
  1555. }
  1556. /*FALLTHROUGH*/
  1557. case PT_INTERP:
  1558. doread = 1;
  1559. break;
  1560. default:
  1561. doread = 0;
  1562. if (fsize != SIZE_UNKNOWN && xph_offset > fsize) {
  1563. /* Maybe warn here? */
  1564. continue;
  1565. }
  1566. break;
  1567. }
  1568. if (doread) {
  1569. size_t len = xph_filesz < sizeof(nbuf) ? xph_filesz
  1570. : sizeof(nbuf);
  1571. off_t offs = xph_offset;
  1572. bufsize = pread(fd, nbuf, len, offs);
  1573. if (bufsize == -1) {
  1574. if (file_printf(ms,
  1575. ", can't read section at %jd",
  1576. (intmax_t)offs) == -1)
  1577. return -1;
  1578. return 0;
  1579. }
  1580. }
  1581. /* Things we can determine when we seek */
  1582. switch (xph_type) {
  1583. case PT_DYNAMIC:
  1584. dynamic = 1;
  1585. offset = 0;
  1586. // Let DF_1 determine if we are PIE or not.
  1587. ms->mode &= ~0111;
  1588. for (;;) {
  1589. if (offset >= CAST(size_t, bufsize))
  1590. break;
  1591. offset = dodynamic(ms, nbuf, offset,
  1592. CAST(size_t, bufsize), clazz, swap,
  1593. &pie, &need);
  1594. if (offset == 0)
  1595. break;
  1596. }
  1597. if (ms->flags & MAGIC_MIME)
  1598. continue;
  1599. break;
  1600. case PT_INTERP:
  1601. need++;
  1602. if (ms->flags & MAGIC_MIME)
  1603. continue;
  1604. if (bufsize && nbuf[0]) {
  1605. nbuf[bufsize - 1] = '\0';
  1606. memcpy(interp, nbuf, CAST(size_t, bufsize));
  1607. } else
  1608. strlcpy(interp, "*empty*", sizeof(interp));
  1609. break;
  1610. case PT_NOTE:
  1611. if (ms->flags & MAGIC_MIME)
  1612. return 0;
  1613. /*
  1614. * This is a PT_NOTE section; loop through all the notes
  1615. * in the section.
  1616. */
  1617. offset = 0;
  1618. for (;;) {
  1619. if (offset >= CAST(size_t, bufsize))
  1620. break;
  1621. offset = donote(ms, nbuf, offset,
  1622. CAST(size_t, bufsize), clazz, swap, align,
  1623. flags, notecount, fd, 0, 0, 0);
  1624. if (offset == 0)
  1625. break;
  1626. }
  1627. break;
  1628. default:
  1629. if (ms->flags & MAGIC_MIME)
  1630. continue;
  1631. break;
  1632. }
  1633. }
  1634. if (ms->flags & MAGIC_MIME)
  1635. return 0;
  1636. if (dynamic) {
  1637. if (pie && need == 0)
  1638. linking_style = "static-pie";
  1639. else
  1640. linking_style = "dynamically";
  1641. } else {
  1642. linking_style = "statically";
  1643. }
  1644. if (file_printf(ms, ", %s linked", linking_style) == -1)
  1645. return -1;
  1646. if (interp[0])
  1647. if (file_printf(ms, ", interpreter %s", file_printable(ms,
  1648. ibuf, sizeof(ibuf), interp, sizeof(interp))) == -1)
  1649. return -1;
  1650. return 0;
  1651. }
  1652. protected int
  1653. file_tryelf(struct magic_set *ms, const struct buffer *b)
  1654. {
  1655. int fd = b->fd;
  1656. const unsigned char *buf = CAST(const unsigned char *, b->fbuf);
  1657. size_t nbytes = b->flen;
  1658. union {
  1659. int32_t l;
  1660. char c[sizeof(int32_t)];
  1661. } u;
  1662. int clazz;
  1663. int swap;
  1664. struct stat st;
  1665. const struct stat *stp;
  1666. off_t fsize;
  1667. int flags = 0;
  1668. Elf32_Ehdr elf32hdr;
  1669. Elf64_Ehdr elf64hdr;
  1670. uint16_t type, phnum, shnum, notecount;
  1671. if (ms->flags & (MAGIC_APPLE|MAGIC_EXTENSION))
  1672. return 0;
  1673. /*
  1674. * ELF executables have multiple section headers in arbitrary
  1675. * file locations and thus file(1) cannot determine it from easily.
  1676. * Instead we traverse thru all section headers until a symbol table
  1677. * one is found or else the binary is stripped.
  1678. * Return immediately if it's not ELF (so we avoid pipe2file unless
  1679. * needed).
  1680. */
  1681. if (buf[EI_MAG0] != ELFMAG0
  1682. || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
  1683. || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
  1684. return 0;
  1685. /*
  1686. * If we cannot seek, it must be a pipe, socket or fifo.
  1687. */
  1688. if((lseek(fd, CAST(off_t, 0), SEEK_SET) == CAST(off_t, -1))
  1689. && (errno == ESPIPE))
  1690. fd = file_pipe2file(ms, fd, buf, nbytes);
  1691. if (fd == -1) {
  1692. file_badread(ms);
  1693. return -1;
  1694. }
  1695. stp = &b->st;
  1696. /*
  1697. * b->st.st_size != 0 if previous fstat() succeeded,
  1698. * which is likely, we can avoid extra stat() call.
  1699. */
  1700. if (b->st.st_size == 0) {
  1701. stp = &st;
  1702. if (fstat(fd, &st) == -1) {
  1703. file_badread(ms);
  1704. return -1;
  1705. }
  1706. }
  1707. if (S_ISREG(stp->st_mode) || stp->st_size != 0)
  1708. fsize = stp->st_size;
  1709. else
  1710. fsize = SIZE_UNKNOWN;
  1711. clazz = buf[EI_CLASS];
  1712. switch (clazz) {
  1713. case ELFCLASS32:
  1714. #undef elf_getu
  1715. #define elf_getu(a, b) elf_getu32(a, b)
  1716. #undef elfhdr
  1717. #define elfhdr elf32hdr
  1718. #include "elfclass.h"
  1719. case ELFCLASS64:
  1720. #undef elf_getu
  1721. #define elf_getu(a, b) elf_getu64(a, b)
  1722. #undef elfhdr
  1723. #define elfhdr elf64hdr
  1724. #include "elfclass.h"
  1725. default:
  1726. if (file_printf(ms, ", unknown class %d", clazz) == -1)
  1727. return -1;
  1728. break;
  1729. }
  1730. return 0;
  1731. }
  1732. #endif