search

jnider / delinker

Unlinks a binary executable to get back a set of .o object files for further transformation and re-linking.
158 stars 13 forks source link

Crashes when using reconstruct-symbols switch #3

Closed AntonKukoba1 closed 4 years ago

AntonKukoba1 commented 5 years ago

Tried to unlink ps binary into .o files:

~/Desktop/delinker $ ./delinker ps --reconstruct-symbols registering backend pe32 registering backend elf32 registering backend elf64 64-bit ELF header Little endian Version: 1 OS: SystemV Type: Executable Machine: x86-64 (62) Entry point: 0x402f10 Number of program headers: 9 Number of section headers: 29 Size of section headers: 64 String table index: 28 Can't find string table section! ELF64 loading done (0 symbols, 0 relocs) reconstructing symbols from text section found entry point source.c @ 0x0 - renaming to 'main' 180 symbols recovered Building relocations Done building relocations Segmentation fault

jnider commented 5 years ago

Any chance you can share the binary with me so I can debug it?

jnider commented 5 years ago

Did you mean /bin/ps ?

AntonKukoba1 commented 5 years ago

yep I meant /bin/ps. I've used the one from linux mint 18 x64.

jnider commented 5 years ago

I fixed the crash (trying to dereference a NULL pointer) but the program will still not work as expected since it does not yet support 64-bit ELF as an input file. There are a few more changes that need to be made - but at least it doesn't crash now. I will have to first enable disassembly in 64-bit mode, then update the list of instructions that need to be delinked.

jnider commented 4 years ago

There is now some support for x86_64 ELF. It can recreate the symbols, create the relocations and outputs a single object file "source.o". However, this .o file cannot yet be successfully relinked because some of the relocations (of the the dynamic symbols) seem to be of the wrong type. I tested this on "/bin/ps" from Ubuntu 20.04 because that's what I have.

AntonKukoba1 commented 4 years ago

Yes it works now https://pastebin.com/CzmAC5yF thank you.