konrad-kruczynski / elfsharp

Pure managed C# library for reading ELF, UImage, Mach-O binaries.
https://elfsharp.it
Other
159 stars 57 forks source link

dynamicStringTable = (StringTable<T>)section throws #49

Closed sdmaclea closed 4 years ago

sdmaclea commented 4 years ago

The cast in the below line sometimes throws. https://github.com/konrad-kruczynski/elfsharp/blob/48f5204ad696b25bbbdc6ea11bebc2566a32fc9e/ELFSharp/ELF/ELF.cs#L291

I worked around the issue by putting it in a try catch block.

I found the issue when trying to load libcoreclr.so.dbg from .NET Core SDK 3.1.100-preview2.

If you want the binary follow the install instructions from https://dotnet.microsoft.com/download/dotnet-core/3.1. Installing https://dotnet.microsoft.com/download/dotnet-core/thank-you/sdk-3.1.100-preview2-linux-x64-binaries

run

$ #install the dotnet symbol tool
$ dotnet tool install dotnet-symbol --global
$ #find the 3.1.100-preview2 runtime
$ dotnet --info | grep Microsoft.NETCore.App
  Microsoft.NETCore.App 2.1.13 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.7 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.0-preview2.19525.6 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
$ # Download libcoreclr.so.dbg with symbols
$ dotnet-symbol /usr/share/dotnet/shared/Microsoft.NETCore.App/3.1.0-preview2.19525.6/libcoreclr.so -o .
Downloading from http://msdl.microsoft.com/download/symbols/
Writing files to .
Writing: ./libcoreclr.so
Writing: ./libcoreclr.so.dbg
Writing: ./libmscordaccore.so
Writing: ./libmscordbi.so
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/libsos.so/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/libsos.so'
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/sos.netcore.dll/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/sos.netcore.dll'
konrad-kruczynski commented 4 years ago

Hi! I'll try to look at the issue this or next weekend. Would it be possible for you to send me the binary to save some time installing .NET core preview?

sdmaclea commented 4 years ago

I dropped a copy of libcoreclr.so.dbg in http://linux.microsoft.com/~steve.maclean/

konrad-kruczynski commented 4 years ago

I have just tried to download it, but it results in 403.

sdmaclea commented 4 years ago

I looked and that server won't allow serving that file. Probably binary files are being denied. I looked for other options, but nothing is easy. Apparently, I don't have a better option than fetching from the symbol server.

These are the simplest instruction I can offer.

# The install using the install script documented here 
# https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script
curl -sSL https://dot.net/v1/dotnet-install.sh | bash /dev/stdin -i $HOME/dotnet.3.1.100-preview2 -v 3.1.100-preview2-014569

# install the dotnet-symbol tool to $HOME/dotnet-symbol/dotnet-symbol
$HOME/dotnet.3.1.100-preview2/dotnet tool install --tool-path $HOME/dotnet-symbol dotnet-symbol

# Use the dotnet-symbol tool get the debug info for libcoreclr.so
$HOME/dotnet-symbol/dotnet-symbol --symbols $HOME/dotnet.3.1.100-preview2/shared/Microsoft.NETCore.App/3.1.0-preview2.19525.6/libcoreclr.so

In case it helps here is the debug info I have off hand.

When I had it open in the VS Code C# debugger it said something about "NoBits" when looking at the section.

Here is the relevant info I could get from objdump.

$ objdump -j ".dynstr" -D -x -s -t libcoreclr.so.dbg

libcoreclr.so.dbg:     file format elf64-x86-64
libcoreclr.so.dbg
architecture: i386:x86-64, flags 0x00000150:
HAS_SYMS, DYNAMIC, D_PAGED
start address 0x0000000000000000

Program Header:
    PHDR off    0x0000000000000040 vaddr 0x0000000000000040 paddr 0x0000000000000040 align 2**3
         filesz 0x00000000000001f8 memsz 0x00000000000001f8 flags r--
    LOAD off    0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**12
         filesz 0x000000000000025c memsz 0x00000000006f8a30 flags r-x
    LOAD off    0x00000000000009b0 vaddr 0x00000000006fa9b0 paddr 0x00000000006fa9b0 align 2**12
         filesz 0x0000000000000000 memsz 0x0000000000095a98 flags rw-
 DYNAMIC off    0x00000000000009b0 vaddr 0x0000000000747808 paddr 0x0000000000747808 align 2**3
         filesz 0x0000000000000000 memsz 0x0000000000000290 flags rw-
    NOTE off    0x0000000000000238 vaddr 0x0000000000000238 paddr 0x0000000000000238 align 2**2
         filesz 0x0000000000000024 memsz 0x0000000000000024 flags r--
EH_FRAME off    0x000000000000025c vaddr 0x00000000006d9084 paddr 0x00000000006d9084 align 2**2
         filesz 0x0000000000000000 memsz 0x000000000001f9ac flags r--
   STACK off    0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
         filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
     TLS off    0x00000000000009b0 vaddr 0x00000000006fa9b0 paddr 0x00000000006fa9b0 align 2**4
         filesz 0x0000000000000000 memsz 0x0000000000000079 flags r--
   RELRO off    0x00000000000009b0 vaddr 0x00000000006fa9b0 paddr 0x00000000006fa9b0 align 2**4
         filesz 0x000000000004d650 memsz 0x000000000004d650 flags rw-

Dynamic Section:

Sections:
Idx Name          Size      VMA               LMA               File off  Algn
  2 .dynstr       00000fbd  00000000000021b0  00000000000021b0  0000025c  2**0
                  ALLOC, READONLY
SYMBOL TABLE:
00000000000021b0 l    d  .dynstr    0000000000000000 .dynstr

Disassembly of section .dynstr:

00000000000021b0 <.dynstr>:
    ...

$ objdump -T libcoreclr.so.dbg 

libcoreclr.so.dbg:     file format elf64-x86-64

objdump: libcoreclr.so.dbg: Invalid operation

I am thinking it might be throwing because the section exists but it is empty?

The ".strtab" section does not exist.

konrad-kruczynski commented 4 years ago

Ok, I was able to get the file using your instruction, thanks. It seems that dynamic string table is effectively absent in this file, having type NoBits instead of StrTab. So as you said, it formally exists, but it's empty. I'm not sure this is actually legal according to the ELF spec, but the library has to be prepared for this. I have a fix and will soon commit it (it's tiny, actually).

I have an additional question though. Can I include libcoreclr.so.dbg in my test suite (I mean legal reasons)? I guess I can, but would like to ask to be sure.

sdmaclea commented 4 years ago

Can I include libcoreclr.so.dbg in my test suite (I mean legal reasons)?

It is a file built by LLVM from MIT licensed code. I see no reason you couldn't use it.

Thanks.