Vector35 / Vector35/binaryninja-api
parsing result of `ELF section` is wrong.
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.3k
- Forks
- 298
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 19
Description
Version and Platform (required):
- Binary Ninja Version: 3.4.4149-dev (c431b49b)
- OS: Ubuntu Linux
- OS Version: 22.04
- CPU Architecture: x64
Bug Description:
When binary ninja parses the following ELF files, the address of the ELF sections are not correct.
ELF file with program header size 0 (e.g. kernel module) && ELF file with other sections defined above the .text entry in the section headers
Such a file can be created by building a simple kernel module in ubuntu 20.04.
Steps To Reproduce:
poc.zip
- Compile hello.c and generate hello.ko
- Analyze hello.ko
- See sections table
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the poc.zip attachment and reproduce the issue by compiling hello.c into hello.ko on Ubuntu, then inspect the sections table in Binary Ninja. Trace the ELF section parsing path to determine why section addresses are wrong for a zero program-header size and for sections above .text. Done means the reproduced ELF sections show correct addresses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100