1 /* Reconstruct an ELF file by reading the segments out of remote memory.
2    Copyright (C) 2005-2011, 2014, 2015 Red Hat, Inc.
3    This file is part of elfutils.
4 
5    This file is free software; you can redistribute it and/or modify
6    it under the terms of either
7 
8      * the GNU Lesser General Public License as published by the Free
9        Software Foundation; either version 3 of the License, or (at
10        your option) any later version
11 
12    or
13 
14      * the GNU General Public License as published by the Free
15        Software Foundation; either version 2 of the License, or (at
16        your option) any later version
17 
18    or both in parallel, as here.
19 
20    elfutils is distributed in the hope that it will be useful, but
21    WITHOUT ANY WARRANTY; without even the implied warranty of
22    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
23    General Public License for more details.
24 
25    You should have received copies of the GNU General Public License and
26    the GNU Lesser General Public License along with this program.  If
27    not, see <http://www.gnu.org/licenses/>.  */
28 
29 #include <config.h>
30 #include "../libelf/libelfP.h"
31 #undef _
32 
33 #include "libdwflP.h"
34 
35 #include <gelf.h>
36 #include <sys/types.h>
37 #include <stdbool.h>
38 #include <stdlib.h>
39 #include <string.h>
40 
41 /* Reconstruct an ELF file by reading the segments out of remote memory
42    based on the ELF file header at EHDR_VMA and the ELF program headers it
43    points to.  If not null, *LOADBASEP is filled in with the difference
44    between the addresses from which the segments were read, and the
45    addresses the file headers put them at.
46 
47    The function READ_MEMORY is called to copy at least MINREAD and at most
48    MAXREAD bytes from the remote memory at target address ADDRESS into the
49    local buffer at DATA; it should return -1 for errors (with code in
50    `errno'), 0 if it failed to read at least MINREAD bytes due to EOF, or
51    the number of bytes read if >= MINREAD.  ARG is passed through.
52 
53    PAGESIZE is the minimum page size and alignment used for the PT_LOAD
54    segments.  */
55 
56 Elf *
elf_from_remote_memory(GElf_Addr ehdr_vma,GElf_Xword pagesize,GElf_Addr * loadbasep,ssize_t (* read_memory)(void * arg,void * data,GElf_Addr address,size_t minread,size_t maxread),void * arg)57 elf_from_remote_memory (GElf_Addr ehdr_vma,
58 			GElf_Xword pagesize,
59 			GElf_Addr *loadbasep,
60 			ssize_t (*read_memory) (void *arg, void *data,
61 						GElf_Addr address,
62 						size_t minread,
63 						size_t maxread),
64 			void *arg)
65 {
66   /* We might have to reserve some memory for the phdrs.  Set to NULL
67      here so we can always safely free it.  */
68   void *phdrsp = NULL;
69 
70   /* First read in the file header and check its sanity.  */
71 
72   const size_t initial_bufsize = 256;
73   unsigned char *buffer = malloc (initial_bufsize);
74   if (unlikely (buffer == NULL))
75     {
76     no_memory:
77       __libdwfl_seterrno (DWFL_E_NOMEM);
78       return NULL;
79     }
80 
81   ssize_t nread = (*read_memory) (arg, buffer, ehdr_vma,
82 				  sizeof (Elf32_Ehdr), initial_bufsize);
83   if (nread <= 0)
84     {
85     read_error:
86       free (buffer);
87       free (phdrsp);
88       __libdwfl_seterrno (nread < 0 ? DWFL_E_ERRNO : DWFL_E_TRUNCATED);
89       return NULL;
90     }
91 
92   if (memcmp (buffer, ELFMAG, SELFMAG) != 0)
93     {
94     bad_elf:
95       free (buffer);
96       free (phdrsp);
97       __libdwfl_seterrno (DWFL_E_BADELF);
98       return NULL;
99     }
100 
101   /* Extract the information we need from the file header.  */
102 
103   union
104   {
105     Elf32_Ehdr e32;
106     Elf64_Ehdr e64;
107   } ehdr;
108   Elf_Data xlatefrom =
109     {
110       .d_type = ELF_T_EHDR,
111       .d_buf = buffer,
112       .d_version = EV_CURRENT,
113     };
114   Elf_Data xlateto =
115     {
116       .d_type = ELF_T_EHDR,
117       .d_buf = &ehdr,
118       .d_size = sizeof ehdr,
119       .d_version = EV_CURRENT,
120     };
121 
122   GElf_Off phoff;
123   uint_fast16_t phnum;
124   uint_fast16_t phentsize;
125   GElf_Off shdrs_end;
126 
127   switch (buffer[EI_CLASS])
128     {
129     case ELFCLASS32:
130       xlatefrom.d_size = sizeof (Elf32_Ehdr);
131       if (elf32_xlatetom (&xlateto, &xlatefrom, buffer[EI_DATA]) == NULL)
132 	{
133 	libelf_error:
134 	  __libdwfl_seterrno (DWFL_E_LIBELF);
135 	  return NULL;
136 	}
137       phoff = ehdr.e32.e_phoff;
138       phnum = ehdr.e32.e_phnum;
139       phentsize = ehdr.e32.e_phentsize;
140       if (phentsize != sizeof (Elf32_Phdr) || phnum == 0)
141 	goto bad_elf;
142       shdrs_end = ehdr.e32.e_shoff + ehdr.e32.e_shnum * ehdr.e32.e_shentsize;
143       break;
144 
145     case ELFCLASS64:
146       xlatefrom.d_size = sizeof (Elf64_Ehdr);
147       if (elf64_xlatetom (&xlateto, &xlatefrom, buffer[EI_DATA]) == NULL)
148 	goto libelf_error;
149       phoff = ehdr.e64.e_phoff;
150       phnum = ehdr.e64.e_phnum;
151       phentsize = ehdr.e64.e_phentsize;
152       if (phentsize != sizeof (Elf64_Phdr) || phnum == 0)
153 	goto bad_elf;
154       shdrs_end = ehdr.e64.e_shoff + ehdr.e64.e_shnum * ehdr.e64.e_shentsize;
155       break;
156 
157     default:
158       goto bad_elf;
159     }
160 
161 
162   /* The file header tells where to find the program headers.
163      These are what we use to actually choose what to read.  */
164 
165   xlatefrom.d_type = xlateto.d_type = ELF_T_PHDR;
166   xlatefrom.d_size = phnum * phentsize;
167 
168   if ((size_t) nread >= phoff + phnum * phentsize)
169     /* We already have all the phdrs from the initial read.  */
170     xlatefrom.d_buf = buffer + phoff;
171   else
172     {
173       /* Read in the program headers.  */
174 
175       if (initial_bufsize < phnum * phentsize)
176 	{
177 	  unsigned char *newbuf = realloc (buffer, phnum * phentsize);
178 	  if (newbuf == NULL)
179 	    {
180 	      free (buffer);
181 	      free (phdrsp);
182 	      goto no_memory;
183 	    }
184 	  buffer = newbuf;
185 	}
186       nread = (*read_memory) (arg, buffer, ehdr_vma + phoff,
187 			      phnum * phentsize, phnum * phentsize);
188       if (nread <= 0)
189 	goto read_error;
190 
191       xlatefrom.d_buf = buffer;
192     }
193 
194   bool class32 = ehdr.e32.e_ident[EI_CLASS] == ELFCLASS32;
195   size_t phdr_size = class32 ? sizeof (Elf32_Phdr) : sizeof (Elf64_Phdr);
196   if (unlikely (phnum > SIZE_MAX / phdr_size))
197     {
198       free (buffer);
199       goto no_memory;
200     }
201   const size_t phdrsp_bytes = phnum * phdr_size;
202   phdrsp = malloc (phdrsp_bytes);
203   if (unlikely (phdrsp == NULL))
204     {
205       free (buffer);
206       goto no_memory;
207     }
208 
209   xlateto.d_buf = phdrsp;
210   xlateto.d_size = phdrsp_bytes;
211 
212   /* Scan for PT_LOAD segments to find the total size of the file image.  */
213   size_t contents_size = 0;
214   GElf_Off segments_end = 0;
215   GElf_Off segments_end_mem = 0;
216   GElf_Addr loadbase = ehdr_vma;
217   bool found_base = false;
218   Elf32_Phdr (*p32)[phnum] = phdrsp;
219   Elf64_Phdr (*p64)[phnum] = phdrsp;
220   switch (ehdr.e32.e_ident[EI_CLASS])
221     {
222       /* Sanity checks segments and calculates segment_end,
223 	 segments_end, segments_end_mem and loadbase (if not
224 	 found_base yet).  Returns true if sanity checking failed,
225 	 false otherwise.  */
226       inline bool handle_segment (GElf_Addr vaddr, GElf_Off offset,
227 				  GElf_Xword filesz, GElf_Xword memsz)
228 	{
229 	  /* Sanity check the segment load aligns with the pagesize.  */
230 	  if (((vaddr - offset) & (pagesize - 1)) != 0)
231 	    return true;
232 
233 	  GElf_Off segment_end = ((offset + filesz + pagesize - 1)
234 				  & -pagesize);
235 
236 	  if (segment_end > (GElf_Off) contents_size)
237 	    contents_size = segment_end;
238 
239 	  if (!found_base && (offset & -pagesize) == 0)
240 	    {
241 	      loadbase = ehdr_vma - (vaddr & -pagesize);
242 	      found_base = true;
243 	    }
244 
245 	  segments_end = offset + filesz;
246 	  segments_end_mem = offset + memsz;
247 	  return false;
248 	}
249 
250     case ELFCLASS32:
251       if (elf32_xlatetom (&xlateto, &xlatefrom,
252 			  ehdr.e32.e_ident[EI_DATA]) == NULL)
253 	goto libelf_error;
254       for (uint_fast16_t i = 0; i < phnum; ++i)
255 	if ((*p32)[i].p_type == PT_LOAD)
256 	  if (handle_segment ((*p32)[i].p_vaddr, (*p32)[i].p_offset,
257 			      (*p32)[i].p_filesz, (*p32)[i].p_memsz))
258 	    goto bad_elf;
259       break;
260 
261     case ELFCLASS64:
262       if (elf64_xlatetom (&xlateto, &xlatefrom,
263 			  ehdr.e64.e_ident[EI_DATA]) == NULL)
264 	goto libelf_error;
265       for (uint_fast16_t i = 0; i < phnum; ++i)
266 	if ((*p64)[i].p_type == PT_LOAD)
267 	  if (handle_segment ((*p64)[i].p_vaddr, (*p64)[i].p_offset,
268 			      (*p64)[i].p_filesz, (*p64)[i].p_memsz))
269 	    goto bad_elf;
270       break;
271 
272     default:
273       abort ();
274       break;
275     }
276 
277   /* Trim the last segment so we don't bother with zeros in the last page
278      that are off the end of the file.  However, if the extra bit in that
279      page includes the section headers and the memory isn't extended (which
280      might indicate it will have been reused otherwise), keep them.  */
281   if ((GElf_Off) contents_size > segments_end
282       && (GElf_Off) contents_size >= shdrs_end
283       && segments_end == segments_end_mem)
284     {
285       contents_size = segments_end;
286       if ((GElf_Off) contents_size < shdrs_end)
287 	contents_size = shdrs_end;
288     }
289   else
290     contents_size = segments_end;
291 
292   free (buffer);
293 
294   /* Now we know the size of the whole image we want read in.  */
295   buffer = calloc (1, contents_size);
296   if (buffer == NULL)
297     {
298       free (phdrsp);
299       goto no_memory;
300     }
301 
302   switch (ehdr.e32.e_ident[EI_CLASS])
303     {
304       /* Reads the given segment.  Returns true if reading fails,
305 	 false otherwise.  */
306       inline bool handle_segment (GElf_Addr vaddr, GElf_Off offset,
307 				  GElf_Xword filesz)
308 	{
309 	  GElf_Off start = offset & -pagesize;
310 	  GElf_Off end = (offset + filesz + pagesize - 1) & -pagesize;
311 	  if (end > (GElf_Off) contents_size)
312 	    end = contents_size;
313 	  nread = (*read_memory) (arg, buffer + start,
314 				  (loadbase + vaddr) & -pagesize,
315 				  end - start, end - start);
316 	  return nread <= 0;
317 	}
318 
319     case ELFCLASS32:
320       for (uint_fast16_t i = 0; i < phnum; ++i)
321 	if ((*p32)[i].p_type == PT_LOAD)
322 	  if (handle_segment ((*p32)[i].p_vaddr, (*p32)[i].p_offset,
323 			      (*p32)[i].p_filesz))
324 	    goto read_error;
325 
326       /* If the segments visible in memory didn't include the section
327 	 headers, then clear them from the file header.  */
328       if (contents_size < shdrs_end)
329 	{
330 	  ehdr.e32.e_shoff = 0;
331 	  ehdr.e32.e_shnum = 0;
332 	  ehdr.e32.e_shstrndx = 0;
333 	}
334 
335       /* This will normally have been in the first PT_LOAD segment.  But it
336 	 conceivably could be missing, and we might have just changed it.  */
337       xlatefrom.d_type = xlateto.d_type = ELF_T_EHDR;
338       xlatefrom.d_size = xlateto.d_size = sizeof ehdr.e32;
339       xlatefrom.d_buf = &ehdr.e32;
340       xlateto.d_buf = buffer;
341       if (elf32_xlatetof (&xlateto, &xlatefrom,
342 			  ehdr.e32.e_ident[EI_DATA]) == NULL)
343 	goto libelf_error;
344       break;
345 
346     case ELFCLASS64:
347       for (uint_fast16_t i = 0; i < phnum; ++i)
348 	if ((*p64)[i].p_type == PT_LOAD)
349 	  if (handle_segment ((*p64)[i].p_vaddr, (*p64)[i].p_offset,
350 			      (*p64)[i].p_filesz))
351 	    goto read_error;
352 
353       /* If the segments visible in memory didn't include the section
354 	 headers, then clear them from the file header.  */
355       if (contents_size < shdrs_end)
356 	{
357 	  ehdr.e64.e_shoff = 0;
358 	  ehdr.e64.e_shnum = 0;
359 	  ehdr.e64.e_shstrndx = 0;
360 	}
361 
362       /* This will normally have been in the first PT_LOAD segment.  But it
363 	 conceivably could be missing, and we might have just changed it.  */
364       xlatefrom.d_type = xlateto.d_type = ELF_T_EHDR;
365       xlatefrom.d_size = xlateto.d_size = sizeof ehdr.e64;
366       xlatefrom.d_buf = &ehdr.e64;
367       xlateto.d_buf = buffer;
368       if (elf64_xlatetof (&xlateto, &xlatefrom,
369 			  ehdr.e64.e_ident[EI_DATA]) == NULL)
370 	goto libelf_error;
371       break;
372 
373     default:
374       abort ();
375       break;
376     }
377 
378   free (phdrsp);
379   phdrsp = NULL;
380 
381   /* Now we have the image.  Open libelf on it.  */
382 
383   Elf *elf = elf_memory ((char *) buffer, contents_size);
384   if (elf == NULL)
385     {
386       free (buffer);
387       goto libelf_error;
388     }
389 
390   elf->flags |= ELF_F_MALLOCED;
391   if (loadbasep != NULL)
392     *loadbasep = loadbase;
393   return elf;
394 }
395