m4b / m4b/goblin

Failing to parse QEMU memory dump note .shstrtab

Open
#370 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

Hi,
if you generate an ELF core file containing the memory dump of VM in QEMU (```qemu-system-x86_64``` than in console ```dump-guest-memory FILENAME```) and you parse it with a simple Rust program as
```
use goblin::Object;
use std::io::Read;
use std::fs::File;

fn main() {

let mut file = File::open("/tmp/elf").map_err(|_| "open file error").expect("Error");

let mut head = vec![0; 1024*1024*2];
file.read(&mut head).ok();
println!("{:?}\n", Object::parse(&head));
}
```

you get ```Err(Malformed("Section 1 size (151127112) + offset (11) is out of bounds. Overflowed: false"))``` but the ELF core is correctly formatted. I suppose the error is a offset-by-one error.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the failure with a QEMU-generated ELF core from the `dump-guest-memory FILENAME` command, then start at Rust's `goblin::Object::parse` handling of the ELF `.shstrtab` section. Compare the reported section size and offset with the valid dump; done means the correctly formatted core parses without the malformed-section error.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.