mjhouse / deaf

A library for inspecting/modifying ELF binaries
GNU General Public License v3.0
7 stars 0 forks source link

Create a hash table data structure to represent hash table sections #26

Open mjhouse opened 1 year ago

mjhouse commented 1 year ago

Overview

NOT ACCURATE. SEE THIS COMMENT FOR MORE.

A hash table section is used to very quickly find a symbol by it's name. Given the name, the hash table can be used in an iterative way to find potential matching symbols until the symbol with the correct name is found.

The hash table is made up of:

  1. A number representing the number of "buckets" (nbucket)
  2. A number representing the number of "chains" (nchain)
  3. A "bucket" array of type Elf32_Word or Elf64_Word elements
  4. A "chain" array of indices into the symbol table (what size? same as buckets?)

To find a symbol:

Reference

See: https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html

Reference hash function (generated by GPT-4, so verify it):

fn elf_hash(name: &[u8]) -> u32 {
    let mut h: u32 = 0;
    let mut g: u32;

    for &c in name {
        h = (h << 4) + c as u32;
        g = h & 0xf000_0000;

        if g != 0 {
            h ^= g >> 24;
            h &= !g;
        }
    }

    h
}

Notes

mjhouse commented 1 year ago

The more common hash section used in modern ELF is DT_GNU_HASH, not DT_HASH as described above. DT_GNU_HASH includes a bloom filter and is significantly more complicated. Refer to the following pages for more information:

https://blogs.oracle.com/solaris/post/gnu-hash-elf-sections https://flapenguin.me/elf-dt-gnu-hash