search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.6k stars 5.87k forks source link

MIPS (IRIX) 32bit Big-Endian shared object cannot be parsed/opened #1527

Open lucyllewy opened 4 years ago

lucyllewy commented 4 years ago

Describe the bug Trying to open a 32bit MIPS shared object (libc.so.1) from an IRIX filesystem (Big Endian) results in failure to open with the following exception:

2020-02-10 | 23:59:27 | DEBUG | (ElfHeader$$EnhancerByCGLIB$$810c56a2) Elf symbol table section .dynsym linked to string table section .dynstr
-- | -- | -- | --
2020-02-10 | 23:59:27 | DEBUG | (ElfHeader$$EnhancerByCGLIB$$810c56a2) Elf relocation table section .rel.dyn linked to symbol table section .dynsym affecting PT_LOAD
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .sdata at 0fb515a0 from file offset 1250720
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .got at 0fb4ff50 from file offset 1245008
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .data at 0fb4c390 from file offset 1229712
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .rodata at 0fb4c000 from file offset 1228800
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .rodata.2 at 0fb188a0 from file offset 1149088
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .text at 0fa2e160 from file offset 188768
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .MIPS.stubs at 0fa2e12c from file offset 188716
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .MIPS.content.text at 0fa2e120 from file offset 188704
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .msym at 0fa26220 from file offset 156192
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .rel.dyn at 0fa24058 from file offset 147544
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .dynsym at 0fa14258 from file offset 82520
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .hash at 0fa0c2d0 from file offset 49872
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .dynstr at 0fa002a0 from file offset 672
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .dynamic at 0fa00190 from file offset 400
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .reginfo at 0fa00178 from file offset 376
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .MIPS.options at 0fa000f8 from file offset 248
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_5.4 at 0fb51598 from file offset 1250712
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_5.6 at 0fb515b0 from file offset 1250736
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_4.1 at 0fa00000 from file offset 0
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_4.6 at 0fa0c2ce from file offset 49870
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_4.12 at 0fa2e12b from file offset 188715
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_4.14 at 0fa2e144 from file offset 188740
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block segment_4.17 at 0fb2a800 from file offset 1222656
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .shstrtab at OTHER:00000000 from file offset 2243784
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .compact_rel at OTHER:00000000 from file offset 2182784
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .mdebug at OTHER:00000000 from file offset 1410532
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block .rtproc at OTHER:00000000 from file offset 1253376
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Removing discardable alignment/filler segment at 0fa0c2ce
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Removing discardable alignment/filler segment at 0fa2e12b
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Removing discardable alignment/filler segment at 0fa2e144
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Removing discardable alignment/filler segment at 0fb51598
2020-02-10 | 23:59:27 | DEBUG | (ElfProgramBuilder) Loading block _elfSectionHeaders at OTHER:00000000 from file offset 2243972
2020-02-10 | 23:59:27 | ERROR | (ImporterUtilities) Error Importing File: Error importing file: libc.so.1 java.lang.IllegalArgumentException: number of array elements must be positive, not 0
  |   |   | at ghidra.program.model.data.ArrayDataType.(ArrayDataType.java:64)
  |   |   | at ghidra.program.model.data.ArrayDataType.(ArrayDataType.java:43)
  |   |   | at ghidra.app.util.bin.format.elf.extend.MIPS_ElfExtension.processMipsOptions(MIPS_ElfExtension.java:584)
  |   |   | at ghidra.app.util.bin.format.elf.extend.MIPS_ElfExtension.processMipsHeaders(MIPS_ElfExtension.java:510)
  |   |   | at ghidra.app.util.bin.format.elf.extend.MIPS_ElfExtension.processElf(MIPS_ElfExtension.java:446)
  |   |   | at ghidra.app.util.opinion.ElfProgramBuilder.load(ElfProgramBuilder.java:159)
  |   |   | at ghidra.app.util.opinion.ElfProgramBuilder.loadElf(ElfProgramBuilder.java:100)
  |   |   | at ghidra.app.util.opinion.ElfLoader.load(ElfLoader.java:151)
  |   |   | at ghidra.app.util.opinion.AbstractLibrarySupportLoader.doLoad(AbstractLibrarySupportLoader.java:346)
  |   |   | at ghidra.app.util.opinion.AbstractLibrarySupportLoader.loadProgram(AbstractLibrarySupportLoader.java:83)
  |   |   | at ghidra.app.util.opinion.AbstractProgramLoader.load(AbstractProgramLoader.java:112)
  |   |   | at ghidra.plugin.importer.ImporterUtilities.importSingleFile(ImporterUtilities.java:401)
  |   |   | at ghidra.plugin.importer.ImporterDialog.lambda$okCallback$7(ImporterDialog.java:351)
  |   |   | at ghidra.util.task.TaskLauncher$1.run(TaskLauncher.java:90)
  |   |   | at ghidra.util.task.Task.monitoredRun(Task.java:126)
  |   |   | at ghidra.util.task.TaskRunner.lambda$startTaskThread$1(TaskRunner.java:94)
  |   |   | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
  |   |   | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
  |   |   | at java.base/java.lang.Thread.run(Thread.java:834)

To Reproduce Steps to reproduce the behavior:

  1. Get this file and uncompress: libc.so.zip
  2. Open Ghidra and start a new project
  3. Attempt to import the libc.so.1 file from the zip above in the project
  4. See error in the user log

Expected behavior Ghidra should be able to open this file and others like it: All the 32bit IRIX shared object libraries I have attempted to open fail in the same way.

Attachments libc.so.zip

Environment (please complete the following information):

mumbel commented 4 years ago

confirmed with master

Section '.MIPS.options' contains 6 entries:
 REGINFO    GPR 02080000  GP 0xffffffff
            CPR0 00000000  CPR1 001f0000  CPR2 00000000  CPR3 06300000
 EXCEPTIONS fpe_min(0) fpe_max(INEX|UFLO|OFLO|DIV0|INVAL)
 TAGS       \377\377\377\377\000\000\000\000\000\000\000\000\017\265\177@\002\010\000\000\000\000\037\000\0060\000\000\000\000\000\000\000\000\000\000\000\000\000\000
 HWPATCH    R4KEOP
 HWAND     \000\000\000\000\000\000\000\000
 HWOR      \004\010\000\000\000\000\000\001

This occurs in parsing MIPS_ElfExtension.ODK_EXCEPTIONS https://github.com/NationalSecurityAgency/ghidra/blob/a004012c9a1f8c2151c4657dade98fde24965ebb/Ghidra/Processors/MIPS/src/main/java/ghidra/app/util/bin/format/elf/extend/MIPS_ElfExtension.java#L576