lief-project / LIEF

LIEF - Library to Instrument Executable Formats

Home Page:https://lief.re

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

handling QNX ELF note, type 3 (stack info)

lclevy opened this issue · comments

Describe the bug
ELF note of type 3 is not supported for QNX ELFs.

I have this error:
Note type: 0x3 is not supported for owner: 'QNX

To Reproduce
when parsing this ELF note, as parsed by Ghidra:

// _elfNote.2 
// Auxiliary information location  [0x24f - 0x266] - displace
// _elfNote.2::0010024f-_elfNote.2::00100266
//   ElfNote_4_8__elfNote.2__0010024f     XREF[1]:     00100168(*)  
     2::0010024f 04 00 00 00 08 00         ElfNote_
                        00 00 03 00 00 00 
                        51 4e 58 00 00 0
     2::0010024f 04 00 00 00     ddw       4h                      namesz        ELF Note "QNX", 3h  XREF[1]:     00100168(*)  
     2::00100253 08 00 00 00     ddw       8h                      descsz        Length of descript
     2::00100257 03 00 00 00     ddw       3h                      type          Vendor specific type
     2::0010025b 51 4e 58 00     ds        "QNX"                   name          Vendor name
     2::0010025f 00 00 00 00 00  db[8]                             description
                        10 00 00
     2::0010025f [0]             0h,  0h,  0h,  0h,
     2::00100263 [4]             0h, 10h,  0h,  0h

sorry, I can not share this ELF, as it contains copyrighted code.

Expected behavior
avoid an error and display this note properly.

Environment (please complete the following information):
Windows 10, Python 3.11.7
latest LIEF, cloned from github

Additional context
elf note types for QNX are listed here:
https://github.com/bminor/binutils-gdb/blob/master/include/elf/common.h#L810

and type 3 is described here:
https://www.qnx.com/developers/docs/8.0/com.qnx.doc.security.system/topic/manual/stack_protection.html

I tried to parse it using LIEF and Python, but the SHT bug is blocking.

NOTICE

If the issue does not contain enough information to be reproduced,
it will be flagged as incomplete
and closed.

/NOTICE