avast / avast/retdec

fileinfo symbol table does not match objdump output

Open
#296 0 comments 0 reactions 0 assignees View on GitHub
C-fileformat C-fileinfo T-format-elf
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

`fileinfo` symbol table is different to one that is produced by `objdump` ( or `readelf`). There are many empty import lines in `fileinfo` that don't have counterpart in `objdump`. This applies to ELF samples.

## Input
```sh
$ retdec-fileinfo -v D5BFF653A49CF803940D81AAC07645820DE2E0BAB35874C149176564841FE726
```
## Output
```
Import table
------------
Number of imports: 150

i address
-----------------
0 0x24db8
1 0x24dc0
2 0x24fb8
3 0x24fc0
4 0x24fc8
5 0x24fd0
6 0x24fd8
...
```
There are 150 empty records.

## Expected output
```
$ objdump -T D5BFF653A49CF803940D81AAC07645820DE2E0BAB35874C149176564841FE726.dat

D5BFF653A49CF803940D81AAC07645820DE2E0BAB35874C149176564841FE726.dat: file format elf64-little

DYNAMIC SYMBOL TABLE:
0000000000000688 l d .init 0000000000000000 .init
0000000000024dc8 l d .jcr 0000000000000000 .jcr
0000000000000000 l D *UND* 0000000000000000
0000000000000000 l D *UND* 0000000000000000 GLIBC_2.17
0000000000000000 l D *UND* 0000000000000000 GLIBC_PRIVATE
0000000000000000 l D *UND* 0000000000000000 GLIBC_PRIVATE
0000000000000000 l D *UND* 0000000000000000
0000000000000000 l D *UND* 0000000000000000 GLIBC_2.17
0000000000000000 l D *UND* 0000000000000000
0000000000000000 l D *UND* 0000000000000000 GLIBC_2.17
0000000000000000 l D *UND* 0000000000000000
0000000000000000 l D *UND* 0000000000000000 GLIBC_2.17
0000000000000900 g DF .text 0000000000001b38 Base gconv
0000000000000860 g DF .text 0000000000000098 Base gconv_init

```
Please investigate what is the cause of 150 empty imports.

#### Configuration
Commit: 7138895e3a11b81622f90514ec63d43b976d361a
Build type: Release
64b Arch Linux, GCC 7.3.1

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the discrepancy with retdec-fileinfo using the supplied sample, then compare its import and symbol-table output with objdump -T or readelf. Trace the ELF symbol and import handling behind the retdec-fileinfo entry point and determine why empty records are emitted. Done means the spurious empty imports are removed and the reported table matches the reference output.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
reverse-engineering, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.