magic(3): Fix program name extraction from core dumps.
[dragonfly.git] / contrib / file-4 / src / readelf.c
1 /*
2  * Copyright (c) Christos Zoulas 2003.
3  * All Rights Reserved.
4  * 
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice immediately at the beginning of the file, without modification,
10  *    this list of conditions, and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *  
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
19  * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 #include "file.h"
28
29 #ifdef BUILTIN_ELF
30 #include <string.h>
31 #include <ctype.h>
32 #include <stdlib.h>
33 #ifdef HAVE_UNISTD_H
34 #include <unistd.h>
35 #endif
36
37 #include "readelf.h"
38
39 #ifndef lint
40 FILE_RCSID("@(#)$File: readelf.c,v 1.68 2007/12/27 16:13:26 christos Exp $")
41 #endif
42
43 #ifdef  ELFCORE
44 private int dophn_core(struct magic_set *, int, int, int, off_t, int, size_t,
45     off_t, int *);
46 #endif
47 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
48     off_t, int *);
49 private int doshn(struct magic_set *, int, int, int, off_t, int, size_t, int *);
50 private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
51     int, size_t, int *);
52
53 #define ELF_ALIGN(a)    ((((a) + align - 1) / align) * align)
54
55 #define isquote(c) (strchr("'\"`", (c)) != NULL)
56
57 private uint16_t getu16(int, uint16_t);
58 private uint32_t getu32(int, uint32_t);
59 private uint64_t getu64(int, uint64_t);
60
61 private uint16_t
62 getu16(int swap, uint16_t value)
63 {
64         union {
65                 uint16_t ui;
66                 char c[2];
67         } retval, tmpval;
68
69         if (swap) {
70                 tmpval.ui = value;
71
72                 retval.c[0] = tmpval.c[1];
73                 retval.c[1] = tmpval.c[0];
74                 
75                 return retval.ui;
76         } else
77                 return value;
78 }
79
80 private uint32_t
81 getu32(int swap, uint32_t value)
82 {
83         union {
84                 uint32_t ui;
85                 char c[4];
86         } retval, tmpval;
87
88         if (swap) {
89                 tmpval.ui = value;
90
91                 retval.c[0] = tmpval.c[3];
92                 retval.c[1] = tmpval.c[2];
93                 retval.c[2] = tmpval.c[1];
94                 retval.c[3] = tmpval.c[0];
95                 
96                 return retval.ui;
97         } else
98                 return value;
99 }
100
101 private uint64_t
102 getu64(int swap, uint64_t value)
103 {
104         union {
105                 uint64_t ui;
106                 char c[8];
107         } retval, tmpval;
108
109         if (swap) {
110                 tmpval.ui = value;
111
112                 retval.c[0] = tmpval.c[7];
113                 retval.c[1] = tmpval.c[6];
114                 retval.c[2] = tmpval.c[5];
115                 retval.c[3] = tmpval.c[4];
116                 retval.c[4] = tmpval.c[3];
117                 retval.c[5] = tmpval.c[2];
118                 retval.c[6] = tmpval.c[1];
119                 retval.c[7] = tmpval.c[0];
120                 
121                 return retval.ui;
122         } else
123                 return value;
124 }
125
126 #ifdef USE_ARRAY_FOR_64BIT_TYPES
127 # define elf_getu64(swap, array) \
128         ((swap ? ((uint64_t)getu32(swap, array[0])) << 32 : getu32(swap, array[0])) + \
129          (swap ? getu32(swap, array[1]) : ((uint64_t)getu32(swap, array[1]) << 32)))
130 #else
131 # define elf_getu64(swap, value) getu64(swap, value)
132 #endif
133
134 #define xsh_addr        (class == ELFCLASS32            \
135                          ? (void *) &sh32               \
136                          : (void *) &sh64)
137 #define xsh_sizeof      (class == ELFCLASS32            \
138                          ? sizeof sh32                  \
139                          : sizeof sh64)
140 #define xsh_size        (class == ELFCLASS32            \
141                          ? getu32(swap, sh32.sh_size)   \
142                          : getu64(swap, sh64.sh_size))
143 #define xsh_offset      (class == ELFCLASS32            \
144                          ? getu32(swap, sh32.sh_offset) \
145                          : getu64(swap, sh64.sh_offset))
146 #define xsh_type        (class == ELFCLASS32            \
147                          ? getu32(swap, sh32.sh_type)   \
148                          : getu32(swap, sh64.sh_type))
149 #define xph_addr        (class == ELFCLASS32            \
150                          ? (void *) &ph32               \
151                          : (void *) &ph64)
152 #define xph_sizeof      (class == ELFCLASS32            \
153                          ? sizeof ph32                  \
154                          : sizeof ph64)
155 #define xph_type        (class == ELFCLASS32            \
156                          ? getu32(swap, ph32.p_type)    \
157                          : getu32(swap, ph64.p_type))
158 #define xph_offset      (off_t)(class == ELFCLASS32     \
159                          ? getu32(swap, ph32.p_offset)  \
160                          : getu64(swap, ph64.p_offset))
161 #define xph_align       (size_t)((class == ELFCLASS32   \
162                          ? (off_t) (ph32.p_align ?      \
163                             getu32(swap, ph32.p_align) : 4) \
164                          : (off_t) (ph64.p_align ?      \
165                             getu64(swap, ph64.p_align) : 4)))
166 #define xph_filesz      (size_t)((class == ELFCLASS32   \
167                          ? getu32(swap, ph32.p_filesz)  \
168                          : getu64(swap, ph64.p_filesz)))
169 #define xnh_addr        (class == ELFCLASS32            \
170                          ? (void *) &nh32               \
171                          : (void *) &nh64)
172 #define xph_memsz       (size_t)((class == ELFCLASS32   \
173                          ? getu32(swap, ph32.p_memsz)   \
174                          : getu64(swap, ph64.p_memsz)))
175 #define xnh_sizeof      (class == ELFCLASS32            \
176                          ? sizeof nh32                  \
177                          : sizeof nh64)
178 #define xnh_type        (class == ELFCLASS32            \
179                          ? getu32(swap, nh32.n_type)    \
180                          : getu32(swap, nh64.n_type))
181 #define xnh_namesz      (class == ELFCLASS32            \
182                          ? getu32(swap, nh32.n_namesz)  \
183                          : getu32(swap, nh64.n_namesz))
184 #define xnh_descsz      (class == ELFCLASS32            \
185                          ? getu32(swap, nh32.n_descsz)  \
186                          : getu32(swap, nh64.n_descsz))
187 #define prpsoffsets(i)  (class == ELFCLASS32            \
188                          ? prpsoffsets32[i]             \
189                          : prpsoffsets64[i])
190
191 #ifdef ELFCORE
192 size_t  prpsoffsets32[] = {
193         8,              /* FreeBSD */
194         44,             /* Linux (path name) */
195         28,             /* Linux 2.0.36 (short name) */
196         84,             /* SunOS 5.x */
197 };
198
199 size_t  prpsoffsets64[] = {
200         16,             /* FreeBSD, 64-bit */
201         56,             /* Linux (path name) */
202         40,             /* Linux (tested on core from 2.4.x, short name) */
203         120,            /* SunOS 5.x, 64-bit */
204 };
205
206 #define NOFFSETS32      (sizeof prpsoffsets32 / sizeof prpsoffsets32[0])
207 #define NOFFSETS64      (sizeof prpsoffsets64 / sizeof prpsoffsets64[0])
208
209 #define NOFFSETS        (class == ELFCLASS32 ? NOFFSETS32 : NOFFSETS64)
210
211 /*
212  * Look through the program headers of an executable image, searching
213  * for a PT_NOTE section of type NT_PRPSINFO, with a name "CORE" or
214  * "FreeBSD"; if one is found, try looking in various places in its
215  * contents for a 16-character string containing only printable
216  * characters - if found, that string should be the name of the program
217  * that dropped core.  Note: right after that 16-character string is,
218  * at least in SunOS 5.x (and possibly other SVR4-flavored systems) and
219  * Linux, a longer string (80 characters, in 5.x, probably other
220  * SVR4-flavored systems, and Linux) containing the start of the
221  * command line for that program.
222  *
223  * The signal number probably appears in a section of type NT_PRSTATUS,
224  * but that's also rather OS-dependent, in ways that are harder to
225  * dissect with heuristics, so I'm not bothering with the signal number.
226  * (I suppose the signal number could be of interest in situations where
227  * you don't have the binary of the program that dropped core; if you
228  * *do* have that binary, the debugger will probably tell you what
229  * signal it was.)
230  */
231
232 #define OS_STYLE_SVR4           0
233 #define OS_STYLE_FREEBSD        1
234 #define OS_STYLE_NETBSD         2
235
236 private const char *os_style_names[] = {
237         "SVR4",
238         "FreeBSD",
239         "NetBSD",
240 };
241
242 #define FLAGS_DID_CORE          1
243 #define FLAGS_DID_NOTE          2
244 #define FLAGS_DID_CORE_STYLE    4
245
246 private int
247 dophn_core(struct magic_set *ms, int class, int swap, int fd, off_t off,
248     int num, size_t size, off_t fsize, int *flags)
249 {
250         Elf32_Phdr ph32;
251         Elf64_Phdr ph64;
252         size_t offset;
253         unsigned char nbuf[BUFSIZ];
254         ssize_t bufsize;
255         off_t savedoffset;
256         struct stat st;
257
258         if (fstat(fd, &st) < 0) {
259                 file_badread(ms);
260                 return -1;
261         }
262
263         if (size != xph_sizeof) {
264                 if (file_printf(ms, ", corrupted program header size") == -1)
265                         return -1;
266                 return 0;
267         }
268
269         /*
270          * Loop through all the program headers.
271          */
272         for ( ; num; num--) {
273                 if ((savedoffset = lseek(fd, off, SEEK_SET)) == (off_t)-1) {
274                         file_badseek(ms);
275                         return -1;
276                 }
277                 if (read(fd, xph_addr, xph_sizeof) == -1) {
278                         file_badread(ms);
279                         return -1;
280                 }
281                 if (xph_offset > fsize) {
282                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
283                                 file_badseek(ms);
284                                 return -1;
285                         }
286                         continue;
287                 }
288
289                 off += size;
290                 if (xph_type != PT_NOTE)
291                         continue;
292
293                 /*
294                  * This is a PT_NOTE section; loop through all the notes
295                  * in the section.
296                  */
297                 if (lseek(fd, xph_offset, SEEK_SET) == (off_t)-1) {
298                         file_badseek(ms);
299                         return -1;
300                 }
301                 bufsize = read(fd, nbuf,
302                     ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
303                 if (bufsize == -1) {
304                         file_badread(ms);
305                         return -1;
306                 }
307                 offset = 0;
308                 for (;;) {
309                         if (offset >= (size_t)bufsize)
310                                 break;
311                         offset = donote(ms, nbuf, offset, (size_t)bufsize,
312                             class, swap, 4, flags);
313                         if (offset == 0)
314                                 break;
315
316                 }
317         }
318         return 0;
319 }
320 #endif
321
322 private size_t
323 donote(struct magic_set *ms, unsigned char *nbuf, size_t offset, size_t size,
324     int class, int swap, size_t align, int *flags)
325 {
326         Elf32_Nhdr nh32;
327         Elf64_Nhdr nh64;
328         size_t noff, doff;
329 #ifdef ELFCORE
330         int os_style = -1;
331 #endif
332         uint32_t namesz, descsz;
333
334         (void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
335         offset += xnh_sizeof;
336
337         namesz = xnh_namesz;
338         descsz = xnh_descsz;
339         if ((namesz == 0) && (descsz == 0)) {
340                 /*
341                  * We're out of note headers.
342                  */
343                 return (offset >= size) ? offset : size;
344         }
345
346         if (namesz & 0x80000000) {
347             (void)file_printf(ms, ", bad note name size 0x%lx",
348                 (unsigned long)namesz);
349             return offset;
350         }
351
352         if (descsz & 0x80000000) {
353             (void)file_printf(ms, ", bad note description size 0x%lx",
354                 (unsigned long)descsz);
355             return offset;
356         }
357
358
359         noff = offset;
360         doff = ELF_ALIGN(offset + namesz);
361
362         if (offset + namesz > size) {
363                 /*
364                  * We're past the end of the buffer.
365                  */
366                 return doff;
367         }
368
369         offset = ELF_ALIGN(doff + descsz);
370         if (doff + descsz > size) {
371                 /*
372                  * We're past the end of the buffer.
373                  */
374                 return (offset >= size) ? offset : size;
375         }
376
377         if (*flags & FLAGS_DID_NOTE)
378                 goto core;
379
380         if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
381             xnh_type == NT_GNU_VERSION && descsz == 16) {
382                 uint32_t desc[4];
383                 (void)memcpy(desc, &nbuf[doff], sizeof(desc));
384
385                 if (file_printf(ms, ", for GNU/") == -1)
386                         return size;
387                 switch (getu32(swap, desc[0])) {
388                 case GNU_OS_LINUX:
389                         if (file_printf(ms, "Linux") == -1)
390                                 return size;
391                         break;
392                 case GNU_OS_HURD:
393                         if (file_printf(ms, "Hurd") == -1)
394                                 return size;
395                         break;
396                 case GNU_OS_SOLARIS:
397                         if (file_printf(ms, "Solaris") == -1)
398                                 return size;
399                         break;
400                 default:
401                         if (file_printf(ms, "<unknown>") == -1)
402                                 return size; 
403                 }
404                 if (file_printf(ms, " %d.%d.%d", getu32(swap, desc[1]),
405                     getu32(swap, desc[2]), getu32(swap, desc[3])) == -1)
406                         return size;
407                 *flags |= FLAGS_DID_NOTE;
408                 return size;
409         }
410
411         if (namesz == 7 && strcmp((char *)&nbuf[noff], "NetBSD") == 0 &&
412             xnh_type == NT_NETBSD_VERSION && descsz == 4) {
413                 uint32_t desc;
414                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
415                 desc = getu32(swap, desc);
416
417                 if (file_printf(ms, ", for NetBSD") == -1)
418                         return size;
419                 /*
420                  * The version number used to be stuck as 199905, and was thus
421                  * basically content-free.  Newer versions of NetBSD have fixed
422                  * this and now use the encoding of __NetBSD_Version__:
423                  *
424                  *      MMmmrrpp00
425                  *
426                  * M = major version
427                  * m = minor version
428                  * r = release ["",A-Z,Z[A-Z] but numeric]
429                  * p = patchlevel
430                  */
431                 if (desc > 100000000U) {
432                         uint32_t ver_patch = (desc / 100) % 100;
433                         uint32_t ver_rel = (desc / 10000) % 100;
434                         uint32_t ver_min = (desc / 1000000) % 100;
435                         uint32_t ver_maj = desc / 100000000;
436
437                         if (file_printf(ms, " %u.%u", ver_maj, ver_min) == -1)
438                                 return size;
439                         if (ver_rel == 0 && ver_patch != 0) {
440                                 if (file_printf(ms, ".%u", ver_patch) == -1)
441                                         return size;
442                         } else if (ver_rel != 0) {
443                                 while (ver_rel > 26) {
444                                         if (file_printf(ms, "Z") == -1)
445                                                 return size;
446                                         ver_rel -= 26;
447                                 }
448                                 if (file_printf(ms, "%c", 'A' + ver_rel - 1)
449                                     == -1)
450                                         return size;
451                         }
452                 }
453                 *flags |= FLAGS_DID_NOTE;
454                 return size;
455         }
456
457         if (namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0 &&
458             xnh_type == NT_FREEBSD_VERSION && descsz == 4) {
459                 uint32_t desc;
460                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
461                 desc = getu32(swap, desc);
462                 if (file_printf(ms, ", for FreeBSD") == -1)
463                         return size;
464
465                 /*
466                  * Contents is __FreeBSD_version, whose relation to OS
467                  * versions is defined by a huge table in the Porter's
468                  * Handbook.  This is the general scheme:
469                  * 
470                  * Releases:
471                  *      Mmp000 (before 4.10)
472                  *      Mmi0p0 (before 5.0)
473                  *      Mmm0p0
474                  * 
475                  * Development branches:
476                  *      Mmpxxx (before 4.6)
477                  *      Mmp1xx (before 4.10)
478                  *      Mmi1xx (before 5.0)
479                  *      M000xx (pre-M.0)
480                  *      Mmm1xx
481                  * 
482                  * M = major version
483                  * m = minor version
484                  * i = minor version increment (491000 -> 4.10)
485                  * p = patchlevel
486                  * x = revision
487                  * 
488                  * The first release of FreeBSD to use ELF by default
489                  * was version 3.0.
490                  */
491                 if (desc == 460002) {
492                         if (file_printf(ms, " 4.6.2") == -1)
493                                 return size;
494                 } else if (desc < 460100) {
495                         if (file_printf(ms, " %d.%d", desc / 100000,
496                             desc / 10000 % 10) == -1)
497                                 return size;
498                         if (desc / 1000 % 10 > 0)
499                                 if (file_printf(ms, ".%d", desc / 1000 % 10)
500                                     == -1)
501                                         return size;
502                         if ((desc % 1000 > 0) || (desc % 100000 == 0))
503                                 if (file_printf(ms, " (%d)", desc) == -1)
504                                         return size;
505                 } else if (desc < 500000) {
506                         if (file_printf(ms, " %d.%d", desc / 100000,
507                             desc / 10000 % 10 + desc / 1000 % 10) == -1)
508                                 return size;
509                         if (desc / 100 % 10 > 0) {
510                                 if (file_printf(ms, " (%d)", desc) == -1)
511                                         return size;
512                         } else if (desc / 10 % 10 > 0) {
513                                 if (file_printf(ms, ".%d", desc / 10 % 10)
514                                     == -1)
515                                         return size;
516                         }
517                 } else {
518                         if (file_printf(ms, " %d.%d", desc / 100000,
519                             desc / 1000 % 100) == -1)
520                                 return size;
521                         if ((desc / 100 % 10 > 0) ||
522                             (desc % 100000 / 100 == 0)) {
523                                 if (file_printf(ms, " (%d)", desc) == -1)
524                                         return size;
525                         } else if (desc / 10 % 10 > 0) {
526                                 if (file_printf(ms, ".%d", desc / 10 % 10)
527                                     == -1)
528                                         return size;
529                         }
530                 }
531                 *flags |= FLAGS_DID_NOTE;
532                 return size;
533         }
534
535         if (namesz == 8 && strcmp((char *)&nbuf[noff], "OpenBSD") == 0 &&
536             xnh_type == NT_OPENBSD_VERSION && descsz == 4) {
537                 if (file_printf(ms, ", for OpenBSD") == -1)
538                         return size;
539                 /* Content of note is always 0 */
540                 *flags |= FLAGS_DID_NOTE;
541                 return size;
542         }
543
544         if (namesz == 10 && strcmp((char *)&nbuf[noff], "DragonFly") == 0 &&
545             xnh_type == NT_DRAGONFLY_VERSION && descsz == 4) {
546                 uint32_t desc;
547                 if (file_printf(ms, ", for DragonFly") == -1)
548                         return size;
549                 (void)memcpy(&desc, &nbuf[doff], sizeof(desc));
550                 desc = getu32(swap, desc);
551                 if (file_printf(ms, " %d.%d.%d", desc / 100000,
552                     desc / 10000 % 10, desc % 10000) == -1)
553                         return size;
554                 *flags |= FLAGS_DID_NOTE;
555                 return size;
556         }
557
558 core:
559         /*
560          * Sigh.  The 2.0.36 kernel in Debian 2.1, at
561          * least, doesn't correctly implement name
562          * sections, in core dumps, as specified by
563          * the "Program Linking" section of "UNIX(R) System
564          * V Release 4 Programmer's Guide: ANSI C and
565          * Programming Support Tools", because my copy
566          * clearly says "The first 'namesz' bytes in 'name'
567          * contain a *null-terminated* [emphasis mine]
568          * character representation of the entry's owner
569          * or originator", but the 2.0.36 kernel code
570          * doesn't include the terminating null in the
571          * name....
572          */
573         if ((namesz == 4 && strncmp((char *)&nbuf[noff], "CORE", 4) == 0) ||
574             (namesz == 5 && strcmp((char *)&nbuf[noff], "CORE") == 0)) {
575                 os_style = OS_STYLE_SVR4;
576         } 
577
578         if ((namesz == 8 && strcmp((char *)&nbuf[noff], "FreeBSD") == 0)) {
579                 os_style = OS_STYLE_FREEBSD;
580         }
581
582         if ((namesz >= 11 && strncmp((char *)&nbuf[noff], "NetBSD-CORE", 11)
583             == 0)) {
584                 os_style = OS_STYLE_NETBSD;
585         }
586
587 #ifdef ELFCORE
588         if ((*flags & FLAGS_DID_CORE) != 0)
589                 return size;
590
591         if (os_style != -1 && (*flags & FLAGS_DID_CORE_STYLE) == 0) {
592                 if (file_printf(ms, ", %s-style", os_style_names[os_style])
593                     == -1)
594                         return size;
595                 *flags |= FLAGS_DID_CORE_STYLE;
596         }
597
598         switch (os_style) {
599         case OS_STYLE_NETBSD:
600                 if (xnh_type == NT_NETBSD_CORE_PROCINFO) {
601                         uint32_t signo;
602                         /*
603                          * Extract the program name.  It is at
604                          * offset 0x7c, and is up to 32-bytes,
605                          * including the terminating NUL.
606                          */
607                         if (file_printf(ms, ", from '%.31s'",
608                             &nbuf[doff + 0x7c]) == -1)
609                                 return size;
610                         
611                         /*
612                          * Extract the signal number.  It is at
613                          * offset 0x08.
614                          */
615                         (void)memcpy(&signo, &nbuf[doff + 0x08],
616                             sizeof(signo));
617                         if (file_printf(ms, " (signal %u)",
618                             getu32(swap, signo)) == -1)
619                                 return size;
620                         *flags |= FLAGS_DID_CORE;
621                         return size;
622                 }
623                 break;
624
625         default:
626                 if (xnh_type == NT_PRPSINFO) {
627                         size_t i, j;
628                         unsigned char c;
629                         /*
630                          * Extract the program name.  We assume
631                          * it to be 16 characters (that's what it
632                          * is in SunOS 5.x and Linux).
633                          *
634                          * Unfortunately, it's at a different offset
635                          * in various OSes, so try multiple offsets.
636                          * If the characters aren't all printable,
637                          * reject it.
638                          */
639                         for (i = 0; i < NOFFSETS; i++) {
640                                 unsigned char *cname, *cp;
641                                 size_t reloffset = prpsoffsets(i);
642                                 size_t noffset = doff + reloffset;
643                                 for (j = 0; j < 16; j++, noffset++,
644                                     reloffset++) {
645                                         /*
646                                          * Make sure we're not past
647                                          * the end of the buffer; if
648                                          * we are, just give up.
649                                          */
650                                         if (noffset >= size)
651                                                 goto tryanother;
652
653                                         /*
654                                          * Make sure we're not past
655                                          * the end of the contents;
656                                          * if we are, this obviously
657                                          * isn't the right offset.
658                                          */
659                                         if (reloffset >= descsz)
660                                                 goto tryanother;
661
662                                         c = nbuf[noffset];
663                                         if (c == '\0') {
664                                                 /*
665                                                  * A '\0' at the
666                                                  * beginning is
667                                                  * obviously wrong.
668                                                  * Any other '\0'
669                                                  * means we're done.
670                                                  */
671                                                 if (j == 0)
672                                                         goto tryanother;
673                                                 else
674                                                         break;
675                                         } else {
676                                                 /*
677                                                  * A nonprintable
678                                                  * character is also
679                                                  * wrong.
680                                                  */
681                                                 if (!isprint(c) || isquote(c))
682                                                         goto tryanother;
683                                         }
684                                 }
685                                 /*
686                                  * Well, that worked.
687                                  */
688                                 cname = (unsigned char *)
689                                     &nbuf[doff + prpsoffsets(i)];
690                                 for (cp = cname; *cp && isprint(*cp); cp++)
691                                         continue;
692                                 /*
693                                  * Linux apparently appends a space at the end
694                                  * of the command line: remove it.
695                                  */
696                                 while (cp > cname && isspace(cp[-1]))
697                                         cp--;
698                                 if (file_printf(ms, ", from '%.*s'",
699                                     (int)(cp - cname), cname) == -1)
700                                         return size;
701                                 *flags |= FLAGS_DID_CORE;
702                                 return size;
703
704                         tryanother:
705                                 ;
706                         }
707                 }
708                 break;
709         }
710 #endif
711         return offset;
712 }
713
714 private int
715 doshn(struct magic_set *ms, int class, int swap, int fd, off_t off, int num,
716     size_t size, int *flags)
717 {
718         Elf32_Shdr sh32;
719         Elf64_Shdr sh64;
720         int stripped = 1;
721         void *nbuf;
722         off_t noff;
723
724         if (size != xsh_sizeof) {
725                 if (file_printf(ms, ", corrupted section header size") == -1)
726                         return -1;
727                 return 0;
728         }
729
730         if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
731                 file_badseek(ms);
732                 return -1;
733         }
734
735         for ( ; num; num--) {
736                 if (read(fd, xsh_addr, xsh_sizeof) == -1) {
737                         file_badread(ms);
738                         return -1;
739                 }
740                 switch (xsh_type) {
741                 case SHT_SYMTAB:
742 #if 0
743                 case SHT_DYNSYM:
744 #endif
745                         stripped = 0;
746                         break;
747                 case SHT_NOTE:
748                         if ((off = lseek(fd, (off_t)0, SEEK_CUR)) ==
749                             (off_t)-1) {
750                                 file_badread(ms);
751                                 return -1;
752                         }
753                         if ((nbuf = malloc((size_t)xsh_size)) == NULL) {
754                                 file_error(ms, errno, "Cannot allocate memory"
755                                     " for note");
756                                 return -1;
757                         }
758                         if ((noff = lseek(fd, (off_t)xsh_offset, SEEK_SET)) ==
759                             (off_t)-1) {
760                                 file_badread(ms);
761                                 free(nbuf);
762                                 return -1;
763                         }
764                         if (read(fd, nbuf, (size_t)xsh_size) !=
765                             (ssize_t)xsh_size) {
766                                 free(nbuf);
767                                 file_badread(ms);
768                                 return -1;
769                         }
770
771                         noff = 0;
772                         for (;;) {
773                                 if (noff >= (size_t)xsh_size)
774                                         break;
775                                 noff = donote(ms, nbuf, (size_t)noff,
776                                     (size_t)xsh_size, class, swap, 4,
777                                     flags);
778                                 if (noff == 0)
779                                         break;
780                         }
781                         if ((lseek(fd, off, SEEK_SET)) == (off_t)-1) {
782                                 free(nbuf);
783                                 file_badread(ms);
784                                 return -1;
785                         }
786                         free(nbuf);
787                         break;
788                 }
789         }
790         if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
791                 return -1;
792         return 0;
793 }
794
795 /*
796  * Look through the program headers of an executable image, searching
797  * for a PT_INTERP section; if one is found, it's dynamically linked,
798  * otherwise it's statically linked.
799  */
800 private int
801 dophn_exec(struct magic_set *ms, int class, int swap, int fd, off_t off,
802     int num, size_t size, off_t fsize, int *flags)
803 {
804         Elf32_Phdr ph32;
805         Elf64_Phdr ph64;
806         const char *linking_style = "statically";
807         const char *shared_libraries = "";
808         unsigned char nbuf[BUFSIZ];
809         int bufsize;
810         size_t offset, align;
811         off_t savedoffset = (off_t)-1;
812         struct stat st;
813
814         if (fstat(fd, &st) < 0) {
815                 file_badread(ms);
816                 return -1;
817         }
818         
819         if (size != xph_sizeof) {
820                 if (file_printf(ms, ", corrupted program header size") == -1)
821                     return -1;
822                 return 0;
823         }
824
825         if (lseek(fd, off, SEEK_SET) == (off_t)-1) {
826                 file_badseek(ms);
827                 return -1;
828         }
829
830         for ( ; num; num--) {
831                 if (read(fd, xph_addr, xph_sizeof) == -1) {
832                         file_badread(ms);
833                         return -1;
834                 }
835                 if (xph_offset > st.st_size && savedoffset != (off_t)-1) {
836                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
837                                 file_badseek(ms);
838                                 return -1;
839                         }
840                         continue;
841                 }
842
843                 if ((savedoffset = lseek(fd, (off_t)0, SEEK_CUR)) == (off_t)-1) {
844                         file_badseek(ms);
845                         return -1;
846                 }
847
848                 if (xph_offset > fsize) {
849                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
850                                 file_badseek(ms);
851                                 return -1;
852                         }
853                         continue;
854                 }
855
856                 switch (xph_type) {
857                 case PT_DYNAMIC:
858                         linking_style = "dynamically";
859                         break;
860                 case PT_INTERP:
861                         shared_libraries = " (uses shared libs)";
862                         break;
863                 case PT_NOTE:
864                         if ((align = xph_align) & 0x80000000) {
865                                 if (file_printf(ms, 
866                                     ", invalid note alignment 0x%lx",
867                                     (unsigned long)align) == -1)
868                                         return -1;
869                                 align = 4;
870                         }
871                         /*
872                          * This is a PT_NOTE section; loop through all the notes
873                          * in the section.
874                          */
875                         if (lseek(fd, xph_offset, SEEK_SET)
876                             == (off_t)-1) {
877                                 file_badseek(ms);
878                                 return -1;
879                         }
880                         bufsize = read(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
881                             xph_filesz : sizeof(nbuf)));
882                         if (bufsize == -1) {
883                                 file_badread(ms);
884                                 return -1;
885                         }
886                         offset = 0;
887                         for (;;) {
888                                 if (offset >= (size_t)bufsize)
889                                         break;
890                                 offset = donote(ms, nbuf, offset,
891                                     (size_t)bufsize, class, swap, align,
892                                     flags);
893                                 if (offset == 0)
894                                         break;
895                         }
896                         if (lseek(fd, savedoffset, SEEK_SET) == (off_t)-1) {
897                                 file_badseek(ms);
898                                 return -1;
899                         }
900                         break;
901                 default:
902                         break;
903                 }
904         }
905         if (file_printf(ms, ", %s linked%s", linking_style, shared_libraries)
906             == -1)
907             return -1;
908         return 0;
909 }
910
911
912 protected int
913 file_tryelf(struct magic_set *ms, int fd, const unsigned char *buf,
914     size_t nbytes)
915 {
916         union {
917                 int32_t l;
918                 char c[sizeof (int32_t)];
919         } u;
920         int class;
921         int swap;
922         struct stat st;
923         off_t fsize;
924         int flags = 0;
925
926         /*
927          * If we cannot seek, it must be a pipe, socket or fifo.
928          */
929         if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
930                 fd = file_pipe2file(ms, fd, buf, nbytes);
931
932         if (fstat(fd, &st) == -1) {
933                 file_badread(ms);
934                 return -1;
935         }
936         fsize = st.st_size;
937
938         /*
939          * ELF executables have multiple section headers in arbitrary
940          * file locations and thus file(1) cannot determine it from easily.
941          * Instead we traverse thru all section headers until a symbol table
942          * one is found or else the binary is stripped.
943          */
944         if (buf[EI_MAG0] != ELFMAG0
945             || (buf[EI_MAG1] != ELFMAG1 && buf[EI_MAG1] != OLFMAG1)
946             || buf[EI_MAG2] != ELFMAG2 || buf[EI_MAG3] != ELFMAG3)
947             return 0;
948
949
950         class = buf[EI_CLASS];
951
952         if (class == ELFCLASS32) {
953                 Elf32_Ehdr elfhdr;
954                 uint16_t type;
955
956                 if (nbytes <= sizeof (Elf32_Ehdr))
957                         return 0;
958
959
960                 u.l = 1;
961                 (void) memcpy(&elfhdr, buf, sizeof elfhdr);
962                 swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA];
963
964                 type = getu16(swap, elfhdr.e_type);
965                 switch (type) {
966 #ifdef ELFCORE
967                 case ET_CORE:
968                         if (dophn_core(ms, class, swap, fd,
969                             (off_t)getu32(swap, elfhdr.e_phoff),
970                             getu16(swap, elfhdr.e_phnum), 
971                             (size_t)getu16(swap, elfhdr.e_phentsize),
972                             fsize, &flags) == -1)
973                                 return -1;
974                         break;
975 #endif
976                 case ET_EXEC:
977                 case ET_DYN:
978                         if (dophn_exec(ms, class, swap,
979                             fd, (off_t)getu32(swap, elfhdr.e_phoff),
980                             getu16(swap, elfhdr.e_phnum), 
981                             (size_t)getu16(swap, elfhdr.e_phentsize),
982                             fsize, &flags) == -1)
983                                 return -1;
984                         if (doshn(ms, class, swap, fd,
985                             (off_t)getu32(swap, elfhdr.e_shoff),
986                             getu16(swap, elfhdr.e_shnum),
987                             (size_t)getu16(swap, elfhdr.e_shentsize),
988                             &flags) == -1)
989                                 return -1;
990                         break;
991
992                 default:
993                         break;
994                 }
995                 return 1;
996         }
997
998         if (class == ELFCLASS64) {
999                 Elf64_Ehdr elfhdr;
1000                 if (nbytes <= sizeof (Elf64_Ehdr))
1001                         return 0;
1002
1003
1004                 u.l = 1;
1005                 (void) memcpy(&elfhdr, buf, sizeof elfhdr);
1006                 swap = (u.c[sizeof(int32_t) - 1] + 1) != elfhdr.e_ident[EI_DATA];
1007
1008                 if (getu16(swap, elfhdr.e_type) == ET_CORE) {
1009 #ifdef ELFCORE
1010                         if (dophn_core(ms, class, swap, fd,
1011                             (off_t)elf_getu64(swap, elfhdr.e_phoff),
1012                             getu16(swap, elfhdr.e_phnum), 
1013                             (size_t)getu16(swap, elfhdr.e_phentsize),
1014                             fsize, &flags) == -1)
1015                                 return -1;
1016 #else
1017                         ;
1018 #endif
1019                 } else {
1020                         if (getu16(swap, elfhdr.e_type) == ET_EXEC) {
1021                                 if (dophn_exec(ms, class, swap, fd,
1022                                     (off_t)elf_getu64(swap, elfhdr.e_phoff),
1023                                     getu16(swap, elfhdr.e_phnum), 
1024                                     (size_t)getu16(swap, elfhdr.e_phentsize),
1025                                     fsize, &flags) == -1)
1026                                         return -1;
1027                         }
1028                         if (doshn(ms, class, swap, fd,
1029                             (off_t)elf_getu64(swap, elfhdr.e_shoff),
1030                             getu16(swap, elfhdr.e_shnum),
1031                             (size_t)getu16(swap, elfhdr.e_shentsize), &flags)
1032                             == -1)
1033                                 return -1;
1034                 }
1035                 return 1;
1036         }
1037         return 0;
1038 }
1039 #endif