Elf: match imported functions to libraries?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
It seems that the Elf parser has the functionality to get the libraries which the binary will get at runtime, via the elf.libraries Vec. After playing around with the library, it seems that the elf.dynstrtab field has the functions from the various imported libraries. But how do you figure out which library is imported for each function?
In Go, there's a function which returns an array of structs which have the function name and the library name, debug/elf/file.go:ImportedSymbols(). How could similar functionality be implemented using Goblin?
From trying to learn more about the Elf format, it seems that the elf.versym field might have the linking between the two, but I'm clearly missing something.
I also don't know if this is what was being discussed in https://github.com/m4b/goblin/issues/282, since that issue doesn't mention anything about function names, but maybe there is some structure which connects versions, functions, and libraries. Again, I'm still learning about the nitty-gritty of ELFs, and yesterday was the first time I tried anything with Goblin.
Ultimately, I'd like to have a way to do import hashing for malware analysis with Rust in my MalwareDB project, which I had done previously in Go.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing Goblin's elf.libraries, elf.dynstrtab, and elf.versym fields with Go's debug/elf/file.go:ImportedSymbols() and the discussion in issue #282. Determine how imported function names can be associated with library names in ELF files, then define an API that exposes those pairs and verify it against the import-hashing use case described.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100