Carving ELF Files

Re:Carving ELF Files by eqvinox on Sunday July 21, 2024 @04:50PM (#41027980)

The approach taken there is unfortunately not correct. The existence of sections (and section headers) is completely optional for ELF files; you can have valid executables and libraries without them. `sstrip` [https://github.com/aunali1/super-strip] can be used to generate such files.

The correct approach is to process the program headers and find the tail end of anything referenced in PT_LOAD as well as from DT_DYN items.

You can combine that with a section based approach; if the file has debug information it won't be covered by program headers and you'd end up cutting it off if going purely by program headers. However, this is technically optional while the program header based approach is really required.

[ Parent | on HN ]

Re:Carving ELF Files by BobbyTables2 on Sunday July 21, 2024 @06:52PM (#41029040)

I fully agree, and the approach of relying on the original ELF file headers of any kind seems very strange to me.

When a memory dump is taken, the program could have dynamically allocated memory, which will always be in segments of memory outside those described by the ELF file. (Even before main() executes)

The approach also ignores dynamic libraries loaded, and also won’t handle a relocatable ELF.

One really has to look at /proc/PID/maps to see the actual memory ranges used by the process.

[ Parent | on HN ]

Re:Carving ELF Files by joren485 on Monday July 22, 2024 @02:06AM (#41031315)

Thank you for your feedback!

I improved my post (and my carver) by including parsing the program headers as well.

Also, thanks for the suggestion of super-strip. An interesting tool that I will play around with.

[ Parent | on HN ]