Skip to content

Commit d85aba8

Browse files
martonillesmartonilles
authored
Merge pull request #370 from IoT-Inspector/elf-handler
Add ELF handler and kernel initramfs extraction
2 parents f36674f + 95062c0 commit d85aba8

File tree

24 files changed

+464
-9
lines changed

24 files changed

+464
-9
lines changed

‎default.nix‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
, unar
1717
, file
1818
, hyperscan
19-
, pkg-config
2019
}:
2120

2221
let
@@ -36,9 +35,11 @@ let
3635
self = mkPoetryApp {
3736
projectDir = ./.;
3837

38+
preferWheels = true;
39+
3940
# Python dependencies that need special care, like non-python
4041
# build dependencies
41-
overrides = poetry2nix.overrides.withDefaults (self: super: {
42+
overrides = poetry2nix.overrides.withoutDefaults (self: super: {
4243
python-lzo = super.python-lzo.overridePythonAttrs (_: {
4344
buildInputs = [
4445
lzo
@@ -60,20 +61,16 @@ let
6061
];
6162
});
6263

63-
file-magic = super.file-magic.overridePythonAttrs (_: {
64+
file-magic = (super.file-magic.override { preferWheel = false; }).overridePythonAttrs (_: {
6465
patchPhase = ''
6566
substituteInPlace magic.py --replace "find_library('magic')" "'${file}/lib/libmagic.so'"
6667
'';
6768
});
6869

6970
hyperscan = super.hyperscan.overridePythonAttrs (_: {
7071
buildInputs = [
71-
self.poetry
7272
hyperscan
7373
];
74-
nativeBuildInputs = [
75-
pkg-config
76-
];
7774
});
7875
});
7976

‎poetry.lock‎

Lines changed: 35 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ file-magic = "^0.4.0"
2929
hyperscan = "^0.2.0"
3030
lark = "^1.1.2"
3131
lz4 = "^4.0.0"
32+
lief = "^0.12.1"
3233

3334

3435
[tool.poetry.dev-dependencies]

‎tests/handlers/executable/test_elf.py‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
import pytest
2+
from helpers import unhex
3+
4+
from unblob.file_utils import File
5+
from unblob.handlers.executable.elf import ELF64Handler
6+
from unblob.models import ValidChunk
7+
8+
ELF_CONTENT = unhex(
9+
"""\
10+
00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|
11+
00000010 03 00 3e 00 01 00 00 00 60 10 00 00 00 00 00 00 |..>.....`.......|
12+
00000020 40 00 00 00 00 00 00 00 30 10 00 00 00 00 00 00 |@.......0.......|
13+
00000030 00 00 00 00 40 00 38 00 0c 00 40 00 03 00 02 00 |[email protected]...@.....|
14+
00000040 06 00 00 00 04 00 00 00 40 00 00 00 00 00 00 00 |........@.......|
15+
00000050 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 |@.......@.......|
16+
00000060 a0 02 00 00 00 00 00 00 a0 02 00 00 00 00 00 00 |................|
17+
00000070 08 00 00 00 00 00 00 00 03 00 00 00 04 00 00 00 |................|
18+
00000080 00 00 00 00 00 00 00 00 18 03 00 00 00 00 00 00 |................|
19+
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
20+
000000a0 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 |................|
21+
000000b0 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 |................|
22+
000000c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
23+
000000d0 e0 02 00 00 00 00 00 00 e0 02 00 00 00 00 00 00 |................|
24+
000000e0 00 10 00 00 00 00 00 00 01 00 00 00 05 00 00 00 |................|
25+
000000f0 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................|
26+
00000100 00 10 00 00 00 00 00 00 1b 00 00 00 00 00 00 00 |................|
27+
00000110 1b 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................|
28+
00000120 01 00 00 00 04 00 00 00 e0 02 00 00 00 00 00 00 |................|
29+
00000130 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |. ..............|
30+
00000140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
31+
00000150 00 10 00 00 00 00 00 00 01 00 00 00 06 00 00 00 |................|
32+
00000160 e0 02 00 00 00 00 00 00 b8 3d 00 00 00 00 00 00 |.........=......|
33+
00000170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
34+
00000180 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................|
35+
00000190 02 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 |................|
36+
000001a0 c8 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |.=..............|
37+
000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
38+
000001c0 08 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 |................|
39+
000001d0 00 00 00 00 00 00 00 00 38 03 00 00 00 00 00 00 |........8.......|
40+
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
41+
000001f0 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 |................|
42+
00000200 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 |................|
43+
00000210 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |h...............|
44+
00000220 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
45+
00000230 08 00 00 00 00 00 00 00 53 e5 74 64 04 00 00 00 |........S.td....|
46+
00000240 00 00 00 00 00 00 00 00 38 03 00 00 00 00 00 00 |........8.......|
47+
00000250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
48+
00000260 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 |................|
49+
00000270 50 e5 74 64 04 00 00 00 00 00 00 00 00 00 00 00 |P.td............|
50+
00000280 0c 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |. ..............|
51+
00000290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
52+
000002a0 08 00 00 00 00 00 00 00 51 e5 74 64 06 00 00 00 |........Q.td....|
53+
000002b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
54+
*
55+
000002d0 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 |................|
56+
000002e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
57+
*
58+
00001000 f3 0f 1e fa 48 83 ec 08 48 8b 05 d9 2f 00 00 48 |....H...H.../..H|
59+
00001010 85 c0 74 02 ff d0 48 83 c4 08 c3 00 2e 73 68 73 |..t...H......shs|
60+
00001020 74 72 74 61 62 00 2e 69 6e 69 74 00 00 00 00 00 |trtab..init.....|
61+
00001030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
62+
*
63+
00001070 0b 00 00 00 01 00 00 00 06 00 00 00 00 00 00 00 |................|
64+
00001080 00 10 00 00 00 00 00 00 00 10 00 00 00 00 00 00 |................|
65+
00001090 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
66+
000010a0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
67+
000010b0 01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 |................|
68+
000010c0 00 00 00 00 00 00 00 00 1b 10 00 00 00 00 00 00 |................|
69+
000010d0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
70+
000010e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
71+
000010f0
72+
"""
73+
)
74+
75+
76+
def test_chunk_is_calculated():
77+
file = File.from_bytes(ELF_CONTENT)
78+
chunk = ELF64Handler().calculate_chunk(file, 0)
79+
80+
assert isinstance(chunk, ValidChunk)
81+
assert chunk.start_offset == 0
82+
assert chunk.end_offset == len(ELF_CONTENT)
83+
84+
85+
@pytest.mark.parametrize(
86+
"offset, byte",
87+
[
88+
pytest.param(0x10, 0xFE, id="invalid e_type"),
89+
pytest.param(0x12, 0xFE, id="invalid e_machine"),
90+
pytest.param(0x14, 0xFE, id="invalid e_version"),
91+
],
92+
)
93+
def test_invalid_header(offset, byte):
94+
file = File.from_bytes(ELF_CONTENT)
95+
file[offset] = byte
96+
chunk = ELF64Handler().calculate_chunk(file, 0)
97+
98+
assert chunk is None

‎tests/integration/executable/elf/elf32/__input__/sample_32_be.elf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:2e48e9356134d947f71cf7027043234fe9721776926b49b640e2af019654e976
3+
size 5877

‎tests/integration/executable/elf/elf32/__input__/sample_32_le.elf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:17f17175f6b65306d43695804a1199e3acfc13c907df8b44e38eb1315abd0c2d
3+
size 15601

‎tests/integration/executable/elf/elf32/__output__/sample_32_be.elf_extract/0-13.unknown‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:3fa247b1e7697ed1e1ea26bb5905b2624a7d169cc2825398cc87fb3aa979e763
3+
size 13

‎tests/integration/executable/elf/elf32/__output__/sample_32_be.elf_extract/13-5877.elf32‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:445d44e2a476c24f551d6e586d95b7690b8d2677897000b0ae60bbfa57a26c14
3+
size 5864

‎tests/integration/executable/elf/elf32/__output__/sample_32_be.elf_extract/13-5877.elf32_extract/.gitkeep‎

Whitespace-only changes.

‎tests/integration/executable/elf/elf32/__output__/sample_32_le.elf_extract/0-13.unknown‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:3fa247b1e7697ed1e1ea26bb5905b2624a7d169cc2825398cc87fb3aa979e763
3+
size 13

0 commit comments

Comments
 (0)