m4b / m4b/goblin

`is_import` is wrong on MIPS ELF

Open
#419 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
202
PR merge metrics
No merged PRs in 30d

Description

Hello,
thank you very much for goblin, it is awesome. I've developed a tool called findso, in my rsbkb project, using your crate, using !is_import to identify if a given symbol is exported or not. It looks for which .so implements a given function. For example:

$ findso -p /usr/arm-linux-gnueabi/lib/ -a memcpy
/usr/arm-linux-gnueabi/lib/libc.so.6

However, on mips I have the following result:

$ findso -p /usr/mips-linux-gnu/lib/ -a memcpy
/usr/mips-linux-gnu/lib/libatomic.so.1
/usr/mips-linux-gnu/lib/libatomic.so.1.2.0
/usr/mips-linux-gnu/lib/libc.so.6
...

readelf gives the following:

$ mips-linux-gnu-readelf -D -a /usr/mips-linux-gnu/lib/libnss_compat.so.2 | grep memcpy
    47: 00007d90     0 FUNC    GLOBAL DEFAULT  UND memcpy@GLIBC_2.0 (4)
  00020188 -32600(gp) 00007d90 00007d90 FUNC    UND memcpy
$ mips-linux-gnu-readelf -D -a /usr/mips-linux-gnu/lib/libc.so.6 | grep memcpy
   862: 000a75b0   984 FUNC    GLOBAL DEFAULT   13 memcpy@@GLIBC_2.0

I think there's some MIPS weirdness (as usual), where UND symbols have a global value?

I don't know if there's a simple and reliable way of checking if a symbol is actually defined or not.

Any idea?

Some sample files can be found in the following Debian package:
https://packages.debian.org/bookworm/all/libc6-mips-cross/filelist

Code from rsbkb:

                let strtab = elf_file.dynstrtab;

                let found = elf_file
                    .dynsyms
                    .iter()
                    .any(|s| !s.is_import() && strtab.get_at(s.st_name) == Some(fun));
                if found {
                    println!("{}", f.display());
                }

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Rust s.is_import() entry point used with dynsyms, and compare its behavior against the MIPS ELF samples from the Debian package. Use mips-linux-gnu-readelf on the reported undefined and defined memcpy symbols, then verify the corrected classification through the findso command shown in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
reverse-engineering
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.