search

Gallopsled / pwntools

CTF framework and exploit development library
http://pwntools.com
Other
11.99k stars 1.7k forks source link

Improved DynELF address resolutions and symbol lookups #2335

Closed Bl4ck-C4t closed 8 months ago

Bl4ck-C4t commented 9 months ago

Most changes are centered around not using the leaker function when we can directly read from the ELF object instead (where possible). This especially improves resolving section addresses, even when having an inconsistent leaker function.

Added the Elf64_Rel and Elf32_Rel datatypes (the entries of DT_JMPREL)

Added another way to lookup symbols by using DT_JMPREL when the default way through GNU_HASH fails (as it often does with FULL RELRO binaries).

Also the older _find_linkmap_assisted(self, path) was removed as it is no longer needed. _find_dt(self, tag) will use the elf object to resolve tags, if it can, automatically.

This should overall make DynELF more stable, faster and more informative.

peace-maker commented 8 months ago

Nice, I'm not too familiar with this code, so proper review will take some time. It's a shame we don't have tests for this yet at all :/

Bl4ck-C4t commented 8 months ago

Yea I could try adding some, but I only tested it on different 64 bit Elfs for now

Bl4ck-C4t commented 8 months ago

Is there anything else needed for this before it is merged?