contrib/file-4/src/readelf.c

   1 /*
   2  * Copyright (c) Christos Zoulas 2003.
   3  * All Rights Reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice immediately at the beginning of the file, without modification,
  10  *    this list of conditions, and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  18  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
  19  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  25  * SUCH DAMAGE.
  26  */
  27 #include "file.h"
  28
  29 #ifdef BUILTIN_ELF
  30 #include <string.h>
  31 #include <ctype.h>
  32 #include <stdlib.h>
  33 #ifdef HAVE_UNISTD_H
  34 #include <unistd.h>
  35 #endif
  36
  37 #include "readelf.h"
  38
  39 #ifndef lint
  40 FILE_RCSID("@(#)$Id: readelf.c,v 1.61 2006/11/15 15:53:23 christos Exp $")
  41 #endif
  42
  43 #ifdef  ELFCORE
  44 private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t,
  45     off_t, int *);
  46 #endif
  47 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
  48     off_t, int *);
  49 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, int *);
  50 private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
  51     int, size_t, int *);
  52
  53 #define ELF_ALIGN(a)    ((((a) + align - 1) / align) * align)
  54
  55 #define isquote(c) (strchr("'\"`", (c)) != NULL)
  56
  57 private uint16_t getu16(int, uint16_t);
  58 private uint32_t getu32(int, uint32_t);
  59 private uint64_t getu64(int, uint64_t);
  60
  61 private uint16_t
  62 getu16(int swap, uint16_t value)
  63 {
  64         union {
  65                 uint16_t ui;
  66                 char c[2];
  67         } retval, tmpval;
  68
  69         if (swap) {
  70                 tmpval.ui = value;
  71
  72                 retval.c[0] = tmpval.c[1];
  73                 retval.c[1] = tmpval.c[0];
  74
  75                 return retval.ui;
  76         } else
  77                 return value;
  78 }
  79
  80 private uint32_t
  81 getu32(int swap, uint32_t value)
  82 {
  83         union {
  84                 uint32_t ui;
  85                 char c[4];
  86         } retval, tmpval;
  87
  88         if (swap) {
  89                 tmpval.ui = value;
  90
  91                 retval.c[0] = tmpval.c[3];
  92                 retval.c[1] = tmpval.c[2];
  93                 retval.c[2] = tmpval.c[1];
  94                 retval.c[3] = tmpval.c[0];
  95
  96                 return retval.ui;
  97         } else
  98                 return value;
  99 }
 100
 101 private uint64_t
 102 getu64(int swap, uint64_t value)
 103 {
 104         union {
 105                 uint64_t ui;
 106                 char c[8];
 107         } retval, tmpval;
 108
 109         if (swap) {
 110                 tmpval.ui = value;
 111
 112                 retval.c[0] = tmpval.c[7];
 113                 retval.c[1] = tmpval.c[6];
 114                 retval.c[2] = tmpval.c[5];
 115                 retval.c[3] = tmpval.c[4];
 116                 retval.c[4] = tmpval.c[3];
 117                 retval.c[5] = tmpval.c[2];
 118                 retval.c[6] = tmpval.c[1];
 119                 retval.c[7] = tmpval.c[0];
 120
 121                 return retval.ui;
 122         } else
 123                 return value;
 124 }
 125
 126 #ifdef USE_ARRAY_FOR_64BIT_TYPES
 127 # define elf_getu64(swap, array) \
 128         ((swap ? ((uint64_t)getu32(swap, array[0])) << 32 : getu32(swap, array[0])) + \
 129          (swap ? getu32(swap, array[1]) : ((uint64_t)getu32(swap, array[1]) << 32)))
 130 #else
 131 # define elf_getu64(swap, value) getu64(swap, value)
 132 #endif
 133
 134 #define xsh_addr        (class == ELFCLASS32            \
 135                          ? (void *) &sh32               \
 136                          : (void *) &sh64)
 137 #define xsh_sizeof      (class == ELFCLASS32            \
 138                          ? sizeof sh32                  \
 139                          : sizeof sh64)
 140 #define xsh_size        (class == ELFCLASS32            \
 141                          ? getu32(swap, sh32.sh_size)   \
 142                          : getu64(swap, sh64.sh_size))
 143 #define xsh_offset      (class == ELFCLASS32            \
 144                          ? getu32(swap, sh32.sh_offset) \
 145                          : getu64(swap, sh64.sh_offset))
 146 #define xsh_type        (class == ELFCLASS32            \
 147                          ? getu32(swap, sh32.sh_type)   \
 148                          : getu32(swap, sh64.sh_type))
 149 #define xph_addr        (class == ELFCLASS32            \
 150                          ? (void *) &ph32               \
 151                          : (void *) &ph64)
 152 #define xph_sizeof      (class == ELFCLASS32            \
 153                          ? sizeof ph32                  \
 154                          : sizeof ph64)
 155 #define xph_type        (class == ELFCLASS32            \
 156                          ? getu32(swap, ph32.p_type)    \
 157                          : getu32(swap, ph64.p_type))
 158 #define xph_offset      (class == ELFCLASS32            \
 159                          ? getu32(swap, ph32.p_offset)  \
 160                          : getu64(swap, ph64.p_offset))
 161 #define xph_align       (size_t)((class == ELFCLASS32   \
 162                          ? (off_t) (ph32.p_align ?      \
 163                             getu32(swap, ph32.p_align) : 4) \
 164                          : (off_t) (ph64.p_align ?      \
 165                             getu64(swap, ph64.p_align) : 4)))
 166 #define xph_filesz      (size_t)((class == ELFCLASS32   \
 167                          ? getu32(swap, ph32.p_filesz)  \
 168                          : getu64(swap, ph64.p_filesz)))
 169 #define xnh_addr        (class == ELFCLASS32            \
 170                          ? (void *) &nh32               \
 171                          : (void *) &nh64)
 172 #define xph_memsz       (size_t)((class == ELFCLASS32   \
 173                          ? getu32(swap, ph32.p_memsz)   \
 174                          : getu64(swap, ph64.p_memsz)))
 175 #define xnh_sizeof      (class == ELFCLASS32            \
 176                          ? sizeof nh32                  \
 177                          : sizeof nh64)
 178 #define xnh_type        (class == ELFCLASS32            \
 179                          ? getu32(swap, nh32.n_type)    \
 180                          : getu32(swap, nh64.n_type))
 181 #define xnh_namesz      (class == ELFCLASS32            \
 182                          ? getu32(swap, nh32.n_namesz)  \
 183                          : getu32(swap, nh64.n_namesz))
 184 #define xnh_descsz      (class == ELFCLASS32            \
 185                          ? getu32(swap, nh32.n_descsz)  \
 186                          : getu32(swap, nh64.n_descsz))
 187 #define prpsoffsets(i)  (class == ELFCLASS32            \
 188                          ? prpsoffsets32[i]             \
 189                          : prpsoffsets64[i])
 190
 191 #ifdef ELFCORE
 192 size_t  prpsoffsets32[] = {
 193         8,              /* FreeBSD */
 194         28,             /* Linux 2.0.36 (short name) */
 195         44,             /* Linux (path name) */
 196         84,             /* SunOS 5.x */
 197 };
 198
 199 size_t  prpsoffsets64[] = {
 200         16,             /* FreeBSD, 64-bit */
 201         40,             /* Linux (tested on core from 2.4.x, short name) */
 202         56,             /* Linux (path name) */
 203         120,            /* SunOS 5.x, 64-bit */
 204 };
 205
 206 #define NOFFSETS32      (sizeof prpsoffsets32 / sizeof prpsoffsets32[0])
 207 #define NOFFSETS64      (sizeof prpsoffsets64 / sizeof prpsoffsets64[0])
 208
 209 #define NOFFSETS        (class == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64)
 210
 211 /*
 212  * Look through the program headers of an executable image, searching
 213  * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or
 214  * "FreeBSD"; if one is found, try looking in various places in its
 215  * contents for a 16-character string containing only printable
 216  * characters - if found, that string should be the name of the program
 217  * that dropped core.  Note: right after that 16-character string is,
 218  * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and
 219  * Linux, a longer string (80 characters, in 5.x, probably other
 220  * SVR4-flavored systems, and Linux) containing the start of the
 221  * command line for that program.
 222  *
 223  * The signal number probably appears in a section of type NT_PRSTATUS,
 224  * but that's also rather OS-dependent, in ways that are harder to
 225  * dissect with heuristics, so I'm not bothering with the signal number.
 226  * (I suppose the signal number could be of interest in situations where
 227  * you don't have the binary of the program that dropped core; if you
 228  * *do* have that binary, the debugger will probably tell you what
 229  * signal it was.)
 230  */
 231
 232 #define OS_STYLE_SVR4           0
 233 #define OS_STYLE_FREEBSD        1
 234 #define OS_STYLE_NETBSD         2
 235
 236 private const char *os_style_names[] = {
 237         "SVR4",
 238         "FreeBSD",
 239         "NetBSD",
 240 };
 241
 242 #define FLAGS_DID_CORE          1
 243 #define FLAGS_DID_NOTE          2
 244
 245 private int
 246 dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
 247     int num, size_t size, off_t fsize, int *flags)
 248 {
 249         Elf32_Phdr ph32;
 250         Elf64_Phdr ph64;
 251         size_t offset;
 252         unsigned char nbuf[BUFSIZ];
 253         ssize_t bufsize;
 254         off_t savedoffset;
 255         struct stat st;
 256
 257         if (fstat(fd, &st) < 0) {
 258                 file_badread(ms);
 259                 return -1;
 260         }
 261
 262         if (size != xph_sizeof) {
 263                 if (file_printf(ms, ", corrupted program header size") == -1)
 264                         return -1;
 265                 return 0;
 266         }
 267
 268         /*
 269          * Loop through all the program headers.
 270          */
 271         for ( ; num; num--) {
 272                 if ((savedoffset = lseek(fd, off, SEEK_SET)) == (off_t)-1) {
 273                         file_badseek(ms);
 274                         return -1;
 275                 }
 276                 if (read(fd, xph_addr, xph_sizeof) == -1) {
 277                         file_badread(ms);
 278                         return -1;
 279                 }
 280                 if (xph_offset > fsize) {
 281                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
 282                                 file_badseek(ms);
 283                                 return -1;
 284                         }
 285                         continue;
 286                 }
 287
 288                 off += size;
 289                 if (xph_type != PT_NOTE)
 290                         continue;
 291
 292                 /*
 293                  * This is a PT_NOTE section; loop through all the notes
 294                  * in the section.
 295                  */
 296                 if (lseek(fd, (off_t)xph_offset, SEEK_SET) == (off_t)-1) {
 297                         file_badseek(ms);
 298                         return -1;
 299                 }
 300                 bufsize = read(fd, nbuf,
 301                     ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
 302                 if (bufsize == -1) {
 303                         file_badread(ms);
 304                         return -1;
 305                 }
 306                 offset = 0;
 307                 for (;;) {
 308                         if (offset >= (size_t)bufsize)
 309                                 break;
 310                         offset = donote(ms, nbuf, offset, (size_t)bufsize,
 311                             class, swap, 4, flags);
 312                         if (offset == 0)
 313                                 break;
 314
 315                 }
 316         }
 317         return 0;
 318 }
 319 #endif
 320
 321 private size_t
 322 donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
 323     int class, int swap, size_t align, int *flags)
 324 {
 325         Elf32_Nhdr nh32;
 326         Elf64_Nhdr nh64;
 327         size_t noff, doff;
 328 #ifdef ELFCORE
 329         int os_style = -1;
 330 #endif
 331         uint32_t namesz, descsz;
 332
 333         (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
 334         offset += xnh_sizeof;
 335
 336         namesz = xnh_namesz;
 337         descsz = xnh_descsz;
 338         if ((namesz == 0) && (descsz == 0)) {
 339                 /*
 340                  * We're out of note headers.
 341                  */
 342                 return (offset >= size) ? offset : size;
 343         }
 344
 345         if (namesz & 0x80000000) {
 346             (void)file_printf(ms, ", bad note name size 0x%lx",
 347                 (unsigned long)namesz);
 348             return offset;
 349         }
 350
 351         if (descsz & 0x80000000) {
 352             (void)file_printf(ms, ", bad note description size 0x%lx",
 353                 (unsigned long)descsz);
 354             return offset;
 355         }
 356
 357
 358         noff = offset;
 359         doff = ELF_ALIGN(offset + namesz);
 360
 361         if (offset + namesz > size) {
 362                 /*
 363                  * We're past the end of the buffer.
 364                  */
 365                 return doff;
 366         }
 367
 368         offset = ELF_ALIGN(doff + descsz);
 369         if (doff + descsz > size) {
 370                 /*
 371                  * We're past the end of the buffer.
 372                  */
 373                 return (offset >= size) ? offset : size;
 374         }
 375
 376         if (*flags & FLAGS_DID_NOTE)
 377                 goto core;
 378
 379         if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
 380             xnh_type == NT_GNU_VERSION && descsz == 16) {
 381                 uint32_t desc[4];
 382                 (void)memcpy(desc, &nbuf[doff], sizeof(desc));
 383
 384                 if (file_printf(ms, ", for GNU/") == -1)
 385                         return size;
 386                 switch (getu32(swap, desc[0])) {
 387                 case GNU_OS_LINUX:
 388                         if (file_printf(ms, "Linux") == -1)
 389                                 return size;
 390                         break;
 391                 case GNU_OS_HURD:
 392                         if (file_printf(ms, "Hurd") == -1)
 393                                 return size;
 394                         break;
 395                 case GNU_OS_SOLARIS:
 396                         if (file_printf(ms, "Solaris") == -1)
 397                                 return size;
 398                         break;
 399                 default:
 400                         if (file_printf(ms, "<unknown>") == -1)
 401                                 return size;
 402                 }
 403                 if (file_printf(ms, " %d.%d.%d", getu32(swap, desc[1]),
 404                     getu32(swap, desc[2]), getu32(swap, desc[3])) == -1)
 405                         return size;
 406                 *flags |= FLAGS_DID_NOTE;
 407                 return size;
 408         }
 409
 410         if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 &&
 411             xnh_type == NT_NETBSD_VERSION && descsz == 4) {
 412                 uint32_t desc;
 413                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
 414                 desc = getu32(swap, desc);
 415
 416                 if (file_printf(ms, ", for NetBSD") == -1)
 417                         return size;
 418                 /*
 419                  * The version number used to be stuck as 199905, and was thus
 420                  * basically content-free.  Newer versions of NetBSD have fixed
 421                  * this and now use the encoding of __NetBSD_Version__:
 422                  *
 423                  *      MMmmrrpp00
 424                  *
 425                  * M = major version
 426                  * m = minor version
 427                  * r = release ["",A-Z,Z[A-Z] but numeric]
 428                  * p = patchlevel
 429                  */
 430                 if (desc > 100000000U) {
 431                         uint32_t ver_patch = (desc / 100) % 100;
 432                         uint32_t ver_rel = (desc / 10000) % 100;
 433                         uint32_t ver_min = (desc / 1000000) % 100;
 434                         uint32_t ver_maj = desc / 100000000;
 435
 436                         if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1)
 437                                 return size;
 438                         if (ver_rel == 0 && ver_patch != 0) {
 439                                 if (file_printf(ms, ".%u", ver_patch) == -1)
 440                                         return size;
 441                         } else if (ver_rel != 0) {
 442                                 while (ver_rel > 26) {
 443                                         if (file_printf(ms, "Z") == -1)
 444                                                 return size;
 445                                         ver_rel -= 26;
 446                                 }
 447                                 if (file_printf(ms, "%c", 'A' + ver_rel - 1)
 448                                     == -1)
 449                                         return size;
 450                         }
 451                 }
 452                 *flags |= FLAGS_DID_NOTE;
 453                 return size;
 454         }
 455
 456         if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 &&
 457             xnh_type == NT_FREEBSD_VERSION && descsz == 4) {
 458                 uint32_t desc;
 459                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
 460                 desc = getu32(swap, desc);
 461                 if (file_printf(ms, ", for FreeBSD") == -1)
 462                         return size;
 463
 464                 /*
 465                  * Contents is __FreeBSD_version, whose relation to OS
 466                  * versions is defined by a huge table in the Porter's
 467                  * Handbook.  This is the general scheme:
 468                  *
 469                  * Releases:
 470                  *      Mmp000 (before 4.10)
 471                  *      Mmi0p0 (before 5.0)
 472                  *      Mmm0p0
 473                  *
 474                  * Development branches:
 475                  *      Mmpxxx (before 4.6)
 476                  *      Mmp1xx (before 4.10)
 477                  *      Mmi1xx (before 5.0)
 478                  *      M000xx (pre-M.0)
 479                  *      Mmm1xx
 480                  *
 481                  * M = major version
 482                  * m = minor version
 483                  * i = minor version increment (491000 -> 4.10)
 484                  * p = patchlevel
 485                  * x = revision
 486                  *
 487                  * The first release of FreeBSD to use ELF by default
 488                  * was version 3.0.
 489                  */
 490                 if (desc == 460002) {
 491                         if (file_printf(ms, " 4.6.2") == -1)
 492                                 return size;
 493                 } else if (desc < 460100) {
 494                         if (file_printf(ms, " %d.%d", desc / 100000,
 495                             desc / 10000 % 10) == -1)
 496                                 return size;
 497                         if (desc / 1000 % 10 > 0)
 498                                 if (file_printf(ms, ".%d", desc / 1000 % 10)
 499                                     == -1)
 500                                         return size;
 501                         if ((desc % 1000 > 0) || (desc % 100000 == 0))
 502                                 if (file_printf(ms, " (%d)", desc) == -1)
 503                                         return size;
 504                 } else if (desc < 500000) {
 505                         if (file_printf(ms, " %d.%d", desc / 100000,
 506                             desc / 10000 % 10 + desc / 1000 % 10) == -1)
 507                                 return size;
 508                         if (desc / 100 % 10 > 0) {
 509                                 if (file_printf(ms, " (%d)", desc) == -1)
 510                                         return size;
 511                         } else if (desc / 10 % 10 > 0) {
 512                                 if (file_printf(ms, ".%d", desc / 10 % 10)
 513                                     == -1)
 514                                         return size;
 515                         }
 516                 } else {
 517                         if (file_printf(ms, " %d.%d", desc / 100000,
 518                             desc / 1000 % 100) == -1)
 519                                 return size;
 520                         if ((desc / 100 % 10 > 0) ||
 521                             (desc % 100000 / 100 == 0)) {
 522                                 if (file_printf(ms, " (%d)", desc) == -1)
 523                                         return size;
 524                         } else if (desc / 10 % 10 > 0) {
 525                                 if (file_printf(ms, ".%d", desc / 10 % 10)
 526                                     == -1)
 527                                         return size;
 528                         }
 529                 }
 530                 *flags |= FLAGS_DID_NOTE;
 531                 return size;
 532         }
 533
 534         if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 &&
 535             xnh_type == NT_OPENBSD_VERSION && descsz == 4) {
 536                 if (file_printf(ms, ", for OpenBSD") == -1)
 537                         return size;
 538                 /* Content of note is always 0 */
 539                 *flags |= FLAGS_DID_NOTE;
 540                 return size;
 541         }
 542
 543         if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 &&
 544             xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
 545                 uint32_t desc;
 546                 if (file_printf(ms, ", for DragonFly") == -1)
 547                         return size;
 548                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
 549                 desc = getu32(swap, desc);
 550                 if (file_printf(ms, " %d.%d.%d", desc / 100000,
 551                     desc / 10000 % 10, desc % 10000) == -1)
 552                         return size;
 553                 *flags |= FLAGS_DID_NOTE;
 554                 return size;
 555         }
 556
 557 core:
 558         /*
 559          * Sigh.  The 2.0.36 kernel in Debian 2.1, at
 560          * least, doesn't correctly implement name
 561          * sections, in core dumps, as specified by
 562          * the "Program Linking" section of "UNIX(R) System
 563          * V Release 4 Programmer's Guide: ANSI C and
 564          * Programming Support Tools", because my copy
 565          * clearly says "The first 'namesz' bytes in 'name'
 566          * contain a *null-terminated* [emphasis mine]
 567          * character representation of the entry's owner
 568          * or originator", but the 2.0.36 kernel code
 569          * doesn't include the terminating null in the
 570          * name....
 571          */
 572         if ((namesz == 4 && strncmp((char *)&nbuf[noff], "CORE", 4) == 0) ||
 573             (namesz == 5 && strcmp((char *)&nbuf[noff], "CORE") == 0)) {
 574                 os_style = OS_STYLE_SVR4;
 575         }
 576
 577         if ((namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0)) {
 578                 os_style = OS_STYLE_FREEBSD;
 579         }
 580
 581         if ((namesz >= 11 && strncmp((char *)&nbuf[noff], "NetBSD-CORE", 11)
 582             == 0)) {
 583                 os_style = OS_STYLE_NETBSD;
 584         }
 585
 586 #ifdef ELFCORE
 587         if ((*flags & FLAGS_DID_CORE) != 0)
 588                 return size;
 589
 590         if (os_style != -1) {
 591                 if (file_printf(ms, ", %s-style", os_style_names[os_style])
 592                     == -1)
 593                         return size;
 594         }
 595
 596         switch (os_style) {
 597         case OS_STYLE_NETBSD:
 598                 if (xnh_type == NT_NETBSD_CORE_PROCINFO) {
 599                         uint32_t signo;
 600                         /*
 601                          * Extract the program name.  It is at
 602                          * offset 0x7c, and is up to 32-bytes,
 603                          * including the terminating NUL.
 604                          */
 605                         if (file_printf(ms, ", from '%.31s'",
 606                             &nbuf[doff + 0x7c]) == -1)
 607                                 return size;
 608
 609                         /*
 610                          * Extract the signal number.  It is at
 611                          * offset 0x08.
 612                          */
 613                         (void)memcpy(&signo, &nbuf[doff + 0x08],
 614                             sizeof(signo));
 615                         if (file_printf(ms, " (signal %u)",
 616                             getu32(swap, signo)) == -1)
 617                                 return size;
 618                         return size;
 619                 }
 620                 break;
 621
 622         default:
 623                 if (xnh_type == NT_PRPSINFO) {
 624                         size_t i, j;
 625                         unsigned char c;
 626                         /*
 627                          * Extract the program name.  We assume
 628                          * it to be 16 characters (that's what it
 629                          * is in SunOS 5.x and Linux).
 630                          *
 631                          * Unfortunately, it's at a different offset
 632                          * in varous OSes, so try multiple offsets.
 633                          * If the characters aren't all printable,
 634                          * reject it.
 635                          */
 636                         for (i = 0; i < NOFFSETS; i++) {
 637                                 size_t reloffset = prpsoffsets(i);
 638                                 size_t noffset = doff + reloffset;
 639                                 for (j = 0; j < 16; j++, noffset++,
 640                                     reloffset++) {
 641                                         /*
 642                                          * Make sure we're not past
 643                                          * the end of the buffer; if
 644                                          * we are, just give up.
 645                                          */
 646                                         if (noffset >= size)
 647                                                 goto tryanother;
 648
 649                                         /*
 650                                          * Make sure we're not past
 651                                          * the end of the contents;
 652                                          * if we are, this obviously
 653                                          * isn't the right offset.
 654                                          */
 655                                         if (reloffset >= descsz)
 656                                                 goto tryanother;
 657
 658                                         c = nbuf[noffset];
 659                                         if (c == '\0') {
 660                                                 /*
 661                                                  * A '\0' at the
 662                                                  * beginning is
 663                                                  * obviously wrong.
 664                                                  * Any other '\0'
 665                                                  * means we're done.
 666                                                  */
 667                                                 if (j == 0)
 668                                                         goto tryanother;
 669                                                 else
 670                                                         break;
 671                                         } else {
 672                                                 /*
 673                                                  * A nonprintable
 674                                                  * character is also
 675                                                  * wrong.
 676                                                  */
 677                                                 if (!isprint(c) || isquote(c))
 678                                                         goto tryanother;
 679                                         }
 680                                 }
 681                                 /*
 682                                  * Well, that worked.
 683                                  */
 684                                 if (file_printf(ms, ", from '%.16s'",
 685                                     &nbuf[doff + prpsoffsets(i)]) == -1)
 686                                         return size;
 687                                 return size;
 688
 689                         tryanother:
 690                                 ;
 691                         }
 692                 }
 693                 break;
 694         }
 695 #endif
 696         *flags |= FLAGS_DID_CORE;
 697         return offset;
 698 }
 699
 700 private int
 701 doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num,
 702     size_t size, int *flags)
 703 {
 704         Elf32_Shdr sh32;
 705         Elf64_Shdr sh64;
 706         int stripped = 1;
 707         void *nbuf;
 708         off_t noff;
 709
 710         if (size != xsh_sizeof) {
 711                 if (file_printf(ms, ", corrupted section header size") == -1)
 712                         return -1;
 713                 return 0;
 714         }
 715
 716         if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
 717                 file_badseek(ms);
 718                 return -1;
 719         }
 720
 721         for ( ; num; num--) {
 722                 if (read(fd, xsh_addr, xsh_sizeof) == -1) {
 723                         file_badread(ms);
 724                         return -1;
 725                 }
 726                 switch (xsh_type) {
 727                 case SHT_SYMTAB:
 728 #if 0
 729                 case SHT_DYNSYM:
 730 #endif
 731                         stripped = 0;
 732                         break;
 733                 case SHT_NOTE:
 734                         if ((off = lseek(fd, (off_t)0, SEEK_CUR)) ==
 735                             (off_t)-1) {
 736                                 file_badread(ms);
 737                                 return -1;
 738                         }
 739                         if ((nbuf = malloc((size_t)xsh_size)) == NULL) {
 740                                 file_error(ms, errno, "Cannot allocate memory"
 741                                     " for note");
 742                                 return -1;
 743                         }
 744                         if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) ==
 745                             (off_t)-1) {
 746                                 file_badread(ms);
 747                                 free(nbuf);
 748                                 return -1;
 749                         }
 750                         if (read(fd, nbuf, (size_t)xsh_size) !=
 751                             (ssize_t)xsh_size) {
 752                                 free(nbuf);
 753                                 file_badread(ms);
 754                                 return -1;
 755                         }
 756
 757                         noff = 0;
 758                         for (;;) {
 759                                 if (noff >= (size_t)xsh_size)
 760                                         break;
 761                                 noff = donote(ms, nbuf, (size_t)noff,
 762                                     (size_t)xsh_size, class, swap, 4,
 763                                     flags);
 764                                 if (noff == 0)
 765                                         break;
 766                         }
 767                         if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) {
 768                                 free(nbuf);
 769                                 file_badread(ms);
 770                                 return -1;
 771                         }
 772                         free(nbuf);
 773                         break;
 774                 }
 775         }
 776         if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
 777                 return -1;
 778         return 0;
 779 }
 780
 781 /*
 782  * Look through the program headers of an executable image, searching
 783  * for a PT_INTERP section; if one is found, it's dynamically linked,
 784  * otherwise it's statically linked.
 785  */
 786 private int
 787 dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
 788     int num, size_t size, off_t fsize, int *flags)
 789 {
 790         Elf32_Phdr ph32;
 791         Elf64_Phdr ph64;
 792         const char *linking_style = "statically";
 793         const char *shared_libraries = "";
 794         unsigned char nbuf[BUFSIZ];
 795         int bufsize;
 796         size_t offset, align;
 797         off_t savedoffset = (off_t)-1;
 798         struct stat st;
 799
 800         if (fstat(fd, &st) < 0) {
 801                 file_badread(ms);
 802                 return -1;
 803         }
 804
 805         if (size != xph_sizeof) {
 806                 if (file_printf(ms, ", corrupted program header size") == -1)
 807                     return -1;
 808                 return 0;
 809         }
 810
 811         if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
 812                 file_badseek(ms);
 813                 return -1;
 814         }
 815
 816         for ( ; num; num--) {
 817                 if (read(fd, xph_addr, xph_sizeof) == -1) {
 818                         file_badread(ms);
 819                         return -1;
 820                 }
 821                 if (xph_offset > st.st_size && savedoffset != (off_t)-1) {
 822                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
 823                                 file_badseek(ms);
 824                                 return -1;
 825                         }
 826                         continue;
 827                 }
 828
 829                 if ((savedoffset = lseek(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) {
 830                         file_badseek(ms);
 831                         return -1;
 832                 }
 833
 834                 if (xph_offset > fsize) {
 835                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
 836                                 file_badseek(ms);
 837                                 return -1;
 838                         }
 839                         continue;
 840                 }
 841
 842                 switch (xph_type) {
 843                 case PT_DYNAMIC:
 844                         linking_style = "dynamically";
 845                         break;
 846                 case PT_INTERP:
 847                         shared_libraries = " (uses shared libs)";
 848                         break;
 849                 case PT_NOTE:
 850                         if ((align = xph_align) & 0x80000000) {
 851                                 if (file_printf(ms,
 852                                     ", invalid note alignment 0x%lx",
 853                                     (unsigned long)align) == -1)
 854                                         return -1;
 855                                 align = 4;
 856                         }
 857                         /*
 858                          * This is a PT_NOTE section; loop through all the notes
 859                          * in the section.
 860                          */
 861                         if (lseek(fd, (off_t)xph_offset, SEEK_SET)
 862                             == (off_t)-1) {
 863                                 file_badseek(ms);
 864                                 return -1;
 865                         }
 866                         bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
 867                             xph_filesz : sizeof(nbuf)));
 868                         if (bufsize == -1) {
 869                                 file_badread(ms);
 870                                 return -1;
 871                         }
 872                         offset = 0;
 873                         for (;;) {
 874                                 if (offset >= (size_t)bufsize)
 875                                         break;
 876                                 offset = donote(ms, nbuf, offset,
 877                                     (size_t)bufsize, class, swap, align,
 878                                     flags);
 879                                 if (offset == 0)
 880                                         break;
 881                         }
 882                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
 883                                 file_badseek(ms);
 884                                 return -1;
 885                         }
 886                         break;
 887                 }
 888         }
 889         if (file_printf(ms, ", %s linked%s", linking_style, shared_libraries)
 890             == -1)
 891             return -1;
 892         return 0;
 893 }
 894
 895
 896 protected int
 897 file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
 898     size_t nbytes)
 899 {
 900         union {
 901                 int32_t l;
 902                 char c[sizeof (int32_t)];
 903         } u;
 904         int class;
 905         int swap;
 906         struct stat st;
 907         off_t fsize;
 908         int flags = 0;
 909
 910         /*
 911          * If we cannot seek, it must be a pipe, socket or fifo.
 912          */
 913         if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
 914                 fd = file_pipe2file(ms, fd, buf, nbytes);
 915
 916         if (fstat(fd, &st) == -1) {
 917                 file_badread(ms);
 918                 return -1;
 919         }
 920         fsize = st.st_size;
 921
 922         /*
 923          * ELF executables have multiple section headers in arbitrary
 924          * file locations and thus file(1) cannot determine it from easily.
 925          * Instead we traverse thru all section headers until a symbol table
 926          * one is found or else the binary is stripped.
 927          */
 928         if (buf[EI_MAG0] != ELFMAG0
 929             || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
 930             || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
 931             return 0;
 932
 933
 934         class = buf[EI_CLASS];
 935
 936         if (class == ELFCLASS32) {
 937                 Elf32_Ehdr elfhdr;
 938                 if (nbytes <= sizeof (Elf32_Ehdr))
 939                         return 0;
 940
 941
 942                 u.l = 1;
 943                 (void) memcpy(&elfhdr, buf, sizeof elfhdr);
 944                 swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA];
 945
 946                 if (getu16(swap, elfhdr.e_type) == ET_CORE) {
 947 #ifdef ELFCORE
 948                         if (dophn_core(ms, class, swap, fd,
 949                             (off_t)getu32(swap, elfhdr.e_phoff),
 950                             getu16(swap, elfhdr.e_phnum),
 951                             (size_t)getu16(swap, elfhdr.e_phentsize),
 952                             fsize, &flags) == -1)
 953                                 return -1;
 954 #else
 955                         ;
 956 #endif
 957                 } else {
 958                         if (getu16(swap, elfhdr.e_type) == ET_EXEC) {
 959                                 if (dophn_exec(ms, class, swap,
 960                                     fd, (off_t)getu32(swap, elfhdr.e_phoff),
 961                                     getu16(swap, elfhdr.e_phnum),
 962                                     (size_t)getu16(swap, elfhdr.e_phentsize),
 963                                     fsize, &flags)
 964                                     == -1)
 965                                         return -1;
 966                         }
 967                         if (doshn(ms, class, swap, fd,
 968                             (off_t)getu32(swap, elfhdr.e_shoff),
 969                             getu16(swap, elfhdr.e_shnum),
 970                             (size_t)getu16(swap, elfhdr.e_shentsize),
 971                             &flags) == -1)
 972                                 return -1;
 973                 }
 974                 return 1;
 975         }
 976
 977         if (class == ELFCLASS64) {
 978                 Elf64_Ehdr elfhdr;
 979                 if (nbytes <= sizeof (Elf64_Ehdr))
 980                         return 0;
 981
 982
 983                 u.l = 1;
 984                 (void) memcpy(&elfhdr, buf, sizeof elfhdr);
 985                 swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA];
 986
 987                 if (getu16(swap, elfhdr.e_type) == ET_CORE) {
 988 #ifdef ELFCORE
 989                         if (dophn_core(ms, class, swap, fd,
 990                             (off_t)elf_getu64(swap, elfhdr.e_phoff),
 991                             getu16(swap, elfhdr.e_phnum),
 992                             (size_t)getu16(swap, elfhdr.e_phentsize),
 993                             fsize, &flags) == -1)
 994                                 return -1;
 995 #else
 996                         ;
 997 #endif
 998                 } else {
 999                         if (getu16(swap, elfhdr.e_type) == ET_EXEC) {
1000                                 if (dophn_exec(ms, class, swap, fd,
1001                                     (off_t)elf_getu64(swap, elfhdr.e_phoff),
1002                                     getu16(swap, elfhdr.e_phnum),
1003                                     (size_t)getu16(swap, elfhdr.e_phentsize),
1004                                     fsize, &flags) == -1)
1005                                         return -1;
1006                         }
1007                         if (doshn(ms, class, swap, fd,
1008                             (off_t)elf_getu64(swap, elfhdr.e_shoff),
1009                             getu16(swap, elfhdr.e_shnum),
1010                             (size_t)getu16(swap, elfhdr.e_shentsize), &flags)
1011                             == -1)
1012                                 return -1;
1013                 }
1014                 return 1;
1015         }
1016         return 0;
1017 }
1018 #endif