Failing to parse QEMU memory dump note .shstrtab
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 202
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
if you generate an ELF core file containing the memory dump of VM in QEMU (```qemu-system-x86_64``` than in console ```dump-guest-memory FILENAME```) and you parse it with a simple Rust program as
```
use goblin::Object;
use std::io::Read;
use std::fs::File;
fn main() {
let mut file = File::open("/tmp/elf").map_err(|_| "open file error").expect("Error");
let mut head = vec![0; 1024*1024*2];
file.read(&mut head).ok();
println!("{:?}\n", Object::parse(&head));
}
```
you get ```Err(Malformed("Section 1 size (151127112) + offset (11) is out of bounds. Overflowed: false"))``` but the ELF core is correctly formatted. I suppose the error is a offset-by-one error.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure with a QEMU-generated ELF core from the `dump-guest-memory FILENAME` command, then start at Rust's `goblin::Object::parse` handling of the ELF `.shstrtab` section. Compare the reported section size and offset with the valid dump; done means the correctly formatted core parses without the malformed-section error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100