Elf64_Phdr

Elf64_Phdr

[Sasha Da Rocha Pinheiro]

Hi all,

If I have a Elf64_Phdr, why can't I straight change its elements, like, I'm getting seg fault when trying to do:
(see gdb output)

... received signal SIGSEGV, Segmentation fault.
...
957	    oldPhdr->p_vaddr = 0x1235;
(gdb) p/x oldPhdr
$11 = 0x3ffb4bf0040
(gdb) p/x *oldPhdr
$12 = {p_type = 0x6, p_flags = 0x5, p_offset = 0x40, p_vaddr = 0x400040, p_paddr = 0x400040, p_filesz = 0x1c0, p_memsz = 0x1c0, p_align = 0x8}

Regards
Sasha

Re: Elf64_Phdr

[Frank Ch. Eigler]

Hi -

> If I have a Elf64_Phdr, why can't I straight change its elements, like, I'm getting seg fault when trying to do:
> (see gdb output)
> 
> ... received signal SIGSEGV, Segmentation fault.
> ...
> 957	    oldPhdr->p_vaddr = 0x1235;
> (gdb) p/x oldPhdr
> $11 = 0x3ffb4bf0040

The elf_begin() call may have specified ELF_C_READ_MMAP, in which case
the content is mmapped PROT_READ-only.

- FChE

Re: Elf64_Phdr

[Sasha Da Rocha Pinheiro]

  Oh, of course, that might be it. 
   
 Do you know if when it's open with write permission, changes will be mapped back to the file?
  
Thanks,
 Sasha
 
  
 
 
  
 From: Frank Ch. Eigler
  
 Sent: Monday, June 24, 5:06 PM
  
 Subject: Re: Elf64_Phdr
  
 To: Sasha Da Rocha Pinheiro
  
 Cc: elfutils-devel@sourceware.org
 
 
  
 Hi -
 
  
 > If I have a Elf64_Phdr, why can't I straight change its elements, like, I'm getting seg fault when trying to do:
  
 > (see gdb output)
  
 > 
  
 > ... received signal SIGSEGV, Segmentation fault.
  
 > ...
  
 > 957       oldPhdr->p_vaddr = 0x1235;
  
 > (gdb) p/x oldPhdr
  
 > $11 = 0x3ffb4bf0040
 
  
 The elf_begin() call may have specified ELF_C_READ_MMAP, in which case
  
 the content is mmapped PROT_READ-only.
 
  
 - FChE
 
 
    

Re: Elf64_Phdr

[Mark Wielaard]

On Tue, 2019-06-25 at 05:22 +0000, Sasha Da Rocha Pinheiro wrote:
>   Oh, of course, that might be it. 
>    
>  Do you know if when it's open with write permission, changes will be
> mapped back to the file?

That depends on whether it is opened with mmap MAP_PRIVATE
(ELF_C_READ_MMAP_PRIVATE,) or not.

Cheers,

Mark

Re: Elf64_Phdr

[Sasha Da Rocha Pinheiro]

 
 What happens if I call elf64_newphdr() on the same Elf * but with different size_t __cnt? 
 What happens to the previous headers?
 
 
 Sasha
 
   
From: Mark Wielaard <mark@klomp.org>
 Sent: Tuesday, June 25, 2019 12:56:04 AM
 To: Sasha Da Rocha Pinheiro; Frank Ch. Eigler
 Cc: elfutils-devel@sourceware.org
 Subject: Re: Elf64_Phdr 
   
 
On Tue, 2019-06-25 at 05:22 +0000, Sasha Da Rocha Pinheiro wrote:
 >   Oh, of course, that might be it. 
 >    
 >  Do you know if when it's open with write permission, changes will be
 > mapped back to the file?
 
 That depends on whether it is opened with mmap MAP_PRIVATE
 (ELF_C_READ_MMAP_PRIVATE,) or not.
 
 Cheers,
 
 Mark
     

Re: Elf64_Phdr

[Sasha Da Rocha Pinheiro]

So, I need to write an elf file. I have an open Elf * handle with read only permission. I then need to update the program headers and next add a new program header entry.
For that we create an Elf * handle with write permission, and create the headers doing:
elf64_newphdr(new_elf, old_elf->e_phnum)
for loop: memcpy(newPhdr, oldPhdr, oldEhdr->e_phentsize);

This is done because prior to memcpy, I perform changes (updates) in the values in the copied program headers.

Now I need to add a new program header. How can I insert a new program header to the ones copied to newPhdr? The problem here is that I need to assess with the updated headers where to place a new header. It seems I can't call elf64_newphdr again on the new_elf handle.

Sasha




  
From: Sasha Da Rocha Pinheiro
 Sent: Tuesday, June 25, 2019 5:09 PM
 To: Mark Wielaard; Frank Ch. Eigler
 Cc: elfutils-devel@sourceware.org
 Subject: Re: Elf64_Phdr 
   
 

  What happens if I call elf64_newphdr() on the same Elf * but with different size_t __cnt? 
  What happens to the previous headers?
  
  
  Sasha
  
    
 From: Mark Wielaard <mark@klomp.org>
  Sent: Tuesday, June 25, 2019 12:56:04 AM
  To: Sasha Da Rocha Pinheiro; Frank Ch. Eigler
  Cc: elfutils-devel@sourceware.org
  Subject: Re: Elf64_Phdr 
    
  
 On Tue, 2019-06-25 at 05:22 +0000, Sasha Da Rocha Pinheiro wrote:
  >   Oh, of course, that might be it. 
  >    
  >  Do you know if when it's open with write permission, changes will be
  > mapped back to the file?
  
  That depends on whether it is opened with mmap MAP_PRIVATE
  (ELF_C_READ_MMAP_PRIVATE,) or not.
  
  Cheers,
  
  Mark
          

Re: Elf64_Phdr

[Mark Wielaard]

On Tue, 2019-06-25 at 22:09 +0000, Sasha Da Rocha Pinheiro wrote:
>  
>  What happens if I call elf64_newphdr() on the same Elf * but with
> different size_t __cnt? 

It creates a new phdr table for the Elf with cnt entries, whether or
not the phdr table existed or not. If cnt is zero any existing table is
removed.

>  What happens to the previous headers?

Using references to them become invalid.

Cheers,

Mark

Re: Elf64_Phdr

[Mark Wielaard]

On Wed, 2019-06-26 at 20:01 +0000, Sasha Da Rocha Pinheiro wrote:
> So, I need to write an elf file. I have an open Elf * handle with
> read only permission. I then need to update the program headers and
> next add a new program header entry.
> For that we create an Elf * handle with write permission, and create
> the headers doing:
> elf64_newphdr(new_elf, old_elf->e_phnum)
> for loop: memcpy(newPhdr, oldPhdr, oldEhdr->e_phentsize);
>
> This is done because prior to memcpy, I perform changes (updates) in
> the values in the copied program headers.

Best to do this with:

/* Get the number of program headers in the ELF file.  If the file uses
   more headers than can be represented in the e_phnum field of the ELF
   header the information from the sh_info field in the zeroth section
   header is used.  */
extern int elf_getphdrnum (Elf *__elf, size_t *__dst);

Also, if you want to support either 64 or 32 bit ELF files, then using
gelf_getphdr () and gelf_updatephdr () in the loop might be better than
the memcpy.

> Now I need to add a new program header. How can I insert a new
> program header to the ones copied to newPhdr? The problem here is
> that I need to assess with the updated headers where to place a new
> header. It seems I can't call elf64_newphdr again on the new_elf
> handle.

Yes, if you want to shuffle the phdrs around and/or insert headers then
you need to keep around copies of the original headers. You could use
your own array of Elf64_Phdr or GElf_Phdr for that. Note that in the
case of gelf_getphdr () you already provide your own storage, so that
might be another reason to prefer the gelf interfaces.

Cheers,

Mark