Closed probonopd closed 7 years ago
Running unknown binary recovered by PhotoRec is a bad idea. Let's append garbage at the end of an ELF
cat /bin/ls /bin/pwd > ls
chmod a+x ./ls
./ls
The resulting ls binary works, it's not "too large" to run. What problem do you have with such files ? Some binaries used tricky header to prevent analysis by ida, hopper to works but I want that photorec to be able to recover them anyway... (see http://www.blog.elfparser.com/ )
Thanks for the explanation. I don't have an issue with it, just noticed that the extracted ELFs can be larger than the original ones.
It looks like
photorec
makes no attempt at calculating the correct length of ELF files, instead it just assumes an ELF to extend until the next start position of the next file it recognizes.This seems wrong, as the extracted ELF files can be too large, can have garbage at the end.