ELF (LLVM Side)

Object File Editing

llvm-objcopy [options] input [output]:

  • --add-section <section=file>, add a section named <section> with the content of <file> to the output.
  • --dump-section <section>=<file>, dump the content of section <section> into the file <file>
  • --discard-all, -x, remove most local symbols from the output.

ELF Section Flags

// include/llvm/BinaryFormat/ELF.h

// Section flags.
enum : unsigned {
  // Section data should be writable during execution.
  SHF_WRITE = 0x1,

  // Section occupies memory during program execution.
  SHF_ALLOC = 0x2,

  // Section contains executable machine instructions.
  SHF_EXECINSTR = 0x4,

  // The data in this section may be merged.
  SHF_MERGE = 0x10,

  // The data in this section is null-terminated strings.
  SHF_STRINGS = 0x20,

  // A field in this section holds a section header table index.
  SHF_INFO_LINK = 0x40U,

  // Adds special ordering requirements for link editors.
  SHF_LINK_ORDER = 0x80U,

  // This section requires special OS-specific processing to avoid incorrect
  // behavior.
  SHF_OS_NONCONFORMING = 0x100U,

  // This section is a member of a section group.
  SHF_GROUP = 0x200U,

  // This section holds Thread-Local Storage.
  SHF_TLS = 0x400U,

  // Identifies a section containing compressed data.
  SHF_COMPRESSED = 0x800U,

  // This section is excluded from the final executable or shared library.
  SHF_EXCLUDE = 0x80000000U,

  // Start of target-specific flags.

  SHF_MASKOS = 0x0ff00000,

  // Bits indicating processor-specific flags.
  SHF_MASKPROC = 0xf0000000,

  /// All sections with the "d" flag are grouped together by the linker to form
  /// the data section and the dp register is set to the start of the section by
  /// the boot code.
  XCORE_SHF_DP_SECTION = 0x10000000,

  /// All sections with the "c" flag are grouped together by the linker to form
  /// the constant pool and the cp register is set to the start of the constant
  /// pool by the boot code.
  XCORE_SHF_CP_SECTION = 0x20000000,

  // If an object file section does not have this flag set, then it may not hold
  // more than 2GB and can be freely referred to in objects using smaller code
  // models. Otherwise, only objects using larger code models can refer to them.
  // For example, a medium code model object can refer to data in a section that
  // sets this flag besides being able to refer to data in a section that does
  // not set it; likewise, a small code model object can refer only to code in a
  // section that does not set this flag.
  SHF_X86_64_LARGE = 0x10000000,

  // All sections with the GPREL flag are grouped into a global data area
  // for faster accesses
  SHF_HEX_GPREL = 0x10000000,

  // Section contains text/data which may be replicated in other sections.
  // Linker must retain only one copy.
  SHF_MIPS_NODUPES = 0x01000000,

  // Linker must generate implicit hidden weak names.
  SHF_MIPS_NAMES = 0x02000000,

  // Section data local to process.
  SHF_MIPS_LOCAL = 0x04000000,

  // Do not strip this section.
  SHF_MIPS_NOSTRIP = 0x08000000,

  // Section must be part of global data area.
  SHF_MIPS_GPREL = 0x10000000,

  // This section should be merged.
  SHF_MIPS_MERGE = 0x20000000,

  // Address size to be inferred from section entry size.
  SHF_MIPS_ADDR = 0x40000000,

  // Section data is string data by default.
  SHF_MIPS_STRING = 0x80000000,

  // Make code section unreadable when in execute-only mode
  SHF_ARM_PURECODE = 0x20000000
};

Interesting flags:

Reference: [code], elf-doc: Sections

SHF_LINK_ORDER = 0x80U: Adds special ordering requirements for link editors.

SHF_OS_NONCONFORMING = 0x100U: This section requires special OS-specific processing to avoid incorrect behavior.

Relocation

Relocation wiki:

Relocation table is a list of pointers created by the translator (a compiler or assembler) and stored in the object or executable file. Each entry in the table, or “fixup”, is a pointer to an absolute address in the object code that must be changed when the loader relocates the program so that it will refer to the correct location.

Fixups are designed to support relocation of the program as a complete unit. In some cases, each fixup in the table is itself relative to a base address of zero, so the fixups themselves must be changed as the loader moves through the table.

In some archtectures a fixup that crosses certain boundaries (such as a segment boundary) or that is not aligned on a word boundary is illegal and flagged as an error by the linker.

DOS and 16-bit Windows: far pointers (segment:offset), segments will be corrected when the executable was loaded into memory.

32-bit Windows: relocation table optional for exe; but if ASLR is enabled, relocation table is mandatory.

64-bit Windows: ASLR is mandatory, thus relocation is mandatory.

Unix-like systems: ELF and shared library format allows serveral types of relocaton.

  • Linux relocation:
    • relocation entries in ELF header has section header type (sh_type) of SHT_RELA or SHT_REL
    • struct Elf32_Rela, Elf64_Rela, Elf32_Rel, Elf64_Rel.
    • section name
  • FreeBSD relocation:
    • section header type (sh_type) of relocation entries (SHT_RELA, SHT_REL);
    • section name .relName and .relaName

llvm: ELFRelocs/Mips.def

.def file defines a list of case statement by the macro ELF_RELOC

.def file is included as header file in ELF.cpp; used by getELFRelocationTypeName(Machine, Type)

each processor has its own set of relocation types.

// lib/Object/ELF.cpp

#define STRINGIFY_ENUM_CASE(ns, name)          \
  case ns::name:                               \
    return #name;

#define ELF_RELOC(name, value) STRINGIFY_ENUM_CASE(ELF, name)

StringRef llvm::object::getELFRelocationTypeName(uint32_t Machine,
                                                 uint32_t Type) {
  switch (Machine) {
   ...
   case ELF::EM_MIPS:
    switch (Type) {
#include "llvm/BinaryFormat/ELFRelocs/Mips.def"
    default:
      break;
    }
    break;
   ...
Created Apr 29, 2020 // Last Updated Jul 18, 2020

If you could revise
the fundmental principles of
computer system design
to improve security...

... what would you change?