Zero the data in imports and exports section to prevent analysis marking strings.

This commit is contained in:
James Benton 2019-10-03 11:44:55 +01:00
parent 3275fe9c7f
commit 55e72815e3

View File

@ -135,38 +135,60 @@ public class Cafe_ElfExtension extends ElfExtension {
processRplCrcs(elfLoadHelper, sectionHeader); processRplCrcs(elfLoadHelper, sectionHeader);
} else if (headertype == SHT_RPL_FILEINFO.value) { } else if (headertype == SHT_RPL_FILEINFO.value) {
processRplFileInfo(elfLoadHelper, sectionHeader); processRplFileInfo(elfLoadHelper, sectionHeader);
} else if (headertype == SHT_RPL_IMPORTS.value) {
processRplImports(elfLoadHelper, sectionHeader);
} else if (headertype == SHT_RPL_EXPORTS.value) { } else if (headertype == SHT_RPL_EXPORTS.value) {
processRplExports(elfLoadHelper, sectionHeader); processRplExports(elfLoadHelper, sectionHeader);
} }
} }
} }
private void processRplImports(ElfLoadHelper elfLoadHelper, ElfSectionHeader sectionHeader) {
// Clear the section data otherwise analysis will identify strings in it.
Address sectionAddress = elfLoadHelper.findLoadAddress(sectionHeader, 0);
int sectionSize = (int) sectionHeader.getSize();
elfLoadHelper.createUndefinedData(sectionAddress, sectionSize);
byte[] zeroes = new byte[sectionSize];
try {
elfLoadHelper.getProgram().getMemory().setBytes(sectionAddress, zeroes);
} catch (MemoryAccessException e) {
}
}
private void processRplExports(ElfLoadHelper elfLoadHelper, ElfSectionHeader sectionHeader) { private void processRplExports(ElfLoadHelper elfLoadHelper, ElfSectionHeader sectionHeader) {
String sectionName = sectionHeader.getNameAsString(); String sectionName = sectionHeader.getNameAsString();
boolean isDataExports = sectionName.contentEquals(".dexports"); if (sectionName.contentEquals(".dexports")) {
if (!isDataExports) { // Create symbols for data exports
// Function exports are already in symbol table BinaryReader reader = elfLoadHelper.getElfHeader().getReader();
return; reader.setPointerIndex(sectionHeader.getOffset());
try {
int count = reader.readNextInt();
/* int signature = */ reader.readNextInt();
for (int i = 0; i < count; ++i) {
int value = reader.readNextInt();
int nameOffset = reader.readNextInt();
/* boolean isTlsExport = (nameOffset & 0x80000000) != 0; */
String name = reader.readAsciiString(sectionHeader.getOffset() + (nameOffset & 0x7FFFFFFF));
elfLoadHelper.createSymbol(elfLoadHelper.getDefaultAddress(value), name, true, false, null);
}
} catch (IOException e) {
e.printStackTrace();
} catch (InvalidInputException e) {
e.printStackTrace();
}
} }
// Create symbols for data exports // Clear the section data otherwise analysis will identify strings in it.
BinaryReader reader = elfLoadHelper.getElfHeader().getReader(); Address sectionAddress = elfLoadHelper.findLoadAddress(sectionHeader, 0);
reader.setPointerIndex(sectionHeader.getOffset()); int sectionSize = (int) sectionHeader.getSize();
elfLoadHelper.createUndefinedData(sectionAddress, sectionSize);
byte[] zeroes = new byte[sectionSize];
try { try {
int count = reader.readNextInt(); elfLoadHelper.getProgram().getMemory().setBytes(sectionAddress, zeroes);
/* int signature = */ reader.readNextInt(); } catch (MemoryAccessException e) {
for (int i = 0; i < count; ++i) {
int value = reader.readNextInt();
int nameOffset = reader.readNextInt();
/* boolean isTlsExport = (nameOffset & 0x80000000) != 0; */
String name = reader.readAsciiString(sectionHeader.getOffset() + (nameOffset & 0x7FFFFFFF));
elfLoadHelper.createSymbol(elfLoadHelper.getDefaultAddress(value), name, true, false, null);
}
} catch (IOException e) {
e.printStackTrace();
} catch (InvalidInputException e) {
e.printStackTrace();
} }
} }