konrad-kruczynski / elfsharp

Pure managed C# library for reading ELF, UImage, Mach-O binaries.
https://elfsharp.it
Other
159 stars 57 forks source link

"ELF Number of sections >= SHN_LORESERVE (0xff00)" is not implemented in library #89

Closed mocakturk closed 1 year ago

mocakturk commented 1 year ago

Hello,

Thx for this library. I noticed an exception when reading an ELF file: System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. Parameter name: index at ELFSharp.ELF.ELF1.ReadSectionHeader(Int32 index) at ELFSharp.ELF.ELF1.ReadStringTable() at ELFSharp.ELF.ELF`1..ctor(String fileName) at ELFSharp.ELF.ELFReader.TryLoad(String fileName, IELF& elf) at ELFSharp.ELF.ELFReader.Load(String fileName)

e_shnum (number of entries in the section header table) is 0. Then, library tries to read section index = 1... That causes exception.

After some googling, I found below: _If the number of sections is greater than or equal to SHN_LORESERVE (0xff00), this member has the value zero and the actual number of section header table entries is contained in the sh_size field of the section header at index 0. (Otherwise, the shsize member of the initial entry contains 0.)

I believe, if the above description is implemented, the problem will be solved.

Thx, Murat

mocakturk commented 1 year ago

I changed the code myself. Issue solved. Here my modifications:

konrad-kruczynski commented 1 year ago

Thanks for the input, I'll try to implement your solution. Would it be possible for you to provide a test binary?

mocakturk commented 1 year ago

Hi Konrad,

Thanks for the update. However, this solution does not work. Because you inserted (sectionHeaderEntryCount == 0) case into ReadSections method. However, exception occurs inside "ReadStringTable" method. (Reading string table also reads a section)

When I put "(sectionHeaderEntryCount == 0)" case to the end of "ReadFields" method, it works. Just move lines 231-238 into the end of "ReadFields" method.

Sorry, but I cannot provide you the binary. First, it is very big (0.5GB). Second, it is a software of my company. Just let me know for testing...

Thanks for the effort...

konrad-kruczynski commented 1 year ago

Right. Please check version 2.15.2.

mocakturk commented 1 year ago

Konrad, v2.15.2 works good. Thank you.