Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
950 stars 213 forks source link

parsing result of `ELF section` is wrong. #4112

Open pr0xy-t opened 1 year ago

pr0xy-t commented 1 year ago

Version and Platform (required):

Bug Description: When binary ninja parses the following ELF files, the address of the ELF sections are not correct.

ELF file with program header size 0 (e.g. kernel module) && ELF file with other sections defined above the .text entry in the section headers

Such a file can be created by building a simple kernel module in ubuntu 20.04.

Steps To Reproduce: poc.zip Screenshot from 2023-03-16 14-13-10

  1. Compile hello.c and generate hello.ko
  2. Analyze hello.ko
  3. See sections table
plafosse commented 1 year ago

I don't believe this is actually incorrect. ko files don't have segments specified so we just create fake segments for each of the sections. I do think that this could be misleading as people could expect those .not sections to show up in memory when they will not.

One potential fix here is to check for SHT_PROGBITS instead of checking for !SHT_NOBITS as we currently do