Module: OneGadget::Fetchers::DynamicSymbols

Included in:

Base

Defined in:

lib/one_gadget/fetchers/dynamic_symbols.rb

Overview

Reading a shared object that ships without section headers, as an embedded libc commonly does: OpenWrt strips them from musl to save flash, and a vendor firmware may do the same to glibc.

Nothing is actually missing from such a file -- the loader still has to find the symbols, so they are reachable through PT_DYNAMIC -- but the usual route to them is not. objdump disassembles sections and so produces nothing at all, and the engine recognises a terminal call by the symbol objdump prints beside it. Both are answered here: the symbols are read out of the dynamic segment, and the raw disassembly is rewritten to name them, so everything downstream reads what it always reads.

Constant Summary

CONTROL_TARGET =

Where a line that transfers control says it goes. Raw disassembly writes every destination as 0x<addr>, and the rest of the line is whatever the architecture puts around it: the destination may be separated by a comma, and followed by the note objdump appends to name the mnemonic's alias.

Examples:

'call   0x94180'
'beqz   a5,0x43060'
'b.ls   0x47dcc  // b.plast'

%r{\A(.*[\s,])0x([0-9a-f]+)(?:\s+//.*)?\z}

TRAILING_ADDRESS =

An address any other line names, which it states last and alone -- so a value the line merely operates on is left as it is written.

Examples:

An architecture may resolve a pc-relative operand from this.

'lea    rcx,[rip+0x19dabe]        # 0x1eb960'

/\A(.*\s)0x([0-9a-f]+)\z/