volatility3/volatility3/framework/symbols/linux/extensions/elf.py

# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0
# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0
#

from typing import Dict, Tuple
import logging

from volatility3.framework import constants
from volatility3.framework.constants.linux import (
    ELF_IDENT,
    ELF_CLASS,
)
from volatility3.framework import objects, interfaces, exceptions

vollog = logging.getLogger(__name__)


class elf(objects.StructType):
    """
    Class used to create elf objects. It overrides the typename to `Elf32_` or `Elf64_`,
    depending on the corresponding value on e_ident
    """

    def __init__(
        self,
        context: interfaces.context.ContextInterface,
        type_name: str,
        object_info: interfaces.objects.ObjectInformation,
        size: int,
        members: Dict[str, Tuple[int, interfaces.objects.Template]],
    ) -> None:
        super().__init__(
            context=context,
            type_name=type_name,
            object_info=object_info,
            size=size,
            members=members,
        )

        layer_name = self.vol.layer_name
        symbol_table_name = self.get_symbol_table_name()
        # We read the MAGIC: (0x0 to 0x4) 0x7f 0x45 0x4c 0x46
        try:
            magic = self._context.object(
                symbol_table_name + constants.BANG + "unsigned long",
                layer_name=layer_name,
                offset=object_info.offset,
            )
        except (
            exceptions.PagedInvalidAddressException,
            exceptions.InvalidAddressException,
        ) as excp:
            vollog.debug(
                f"Unable to check magic bytes for ELF file at offset {hex(object_info.offset)} in layer {layer_name}: {excp}"
            )
            return None

        # Check validity
        if magic != 0x464C457F:  # e.g. ELF
            return None

        # We need to read the EI_CLASS (0x4 offset)
        ei_class = self._context.object(
            symbol_table_name + constants.BANG + "unsigned char",
            layer_name=layer_name,
            offset=object_info.offset + ELF_IDENT.EI_CLASS,
        )

        if ei_class == ELF_CLASS.ELFCLASS32:
            self._type_prefix = "Elf32_"
            self._ei_class_size = 32
        elif ei_class == ELF_CLASS.ELFCLASS64:
            self._type_prefix = "Elf64_"
            self._ei_class_size = 64
        else:
            raise ValueError(f"Unsupported ei_class value {ei_class}")

        # Construct the full header
        self._hdr = self._context.object(
            symbol_table_name + constants.BANG + self._type_prefix + "Ehdr",
            layer_name=layer_name,
            offset=object_info.offset,
        )
        self._offset = object_info.offset

        self._cached_symtab = None
        self._cached_strtab = None

    def is_valid(self):
        """
        Determine whether it is a valid object
        """
        if hasattr(self, "_type_prefix") and hasattr(self, "_hdr"):
            return self._type_prefix is not None and self._hdr is not None
        else:
            return False

    def __getattr__(self, name):
        # Just redirect to the corresponding header
        if name[0:2] == "e_" and name in dir(self._hdr):
            return self._hdr.__getattr__(name)
        else:
            return self.__getattribute__(name)

    def __dir__(self):
        return self._hdr.__dir__() + [
            "get_program_headers",
            "is_valid",
            "get_section_headers",
            "get_symbols",
            "__dir__",
        ]

    def get_program_headers(self):
        program_headers = self._context.object(
            self.get_symbol_table_name() + constants.BANG + "array",
            layer_name=self.vol.layer_name,
            offset=self._offset + self.e_phoff,
            subtype=self._context.symbol_space.get_type(
                self.get_symbol_table_name()
                + constants.BANG
                + self._type_prefix
                + "Phdr"
            ),
            count=self.e_phnum,
        )

        for prog_header in program_headers:
            prog_header.parent_e_type = self.e_type
            prog_header.parent_offset = self._offset
            prog_header.type_prefix = self._type_prefix
            yield prog_header

    def get_section_headers(self):
        section_headers = self._context.object(
            self.get_symbol_table_name() + constants.BANG + "array",
            layer_name=self.vol.layer_name,
            offset=self._offset + self.e_shoff,
            subtype=self._context.symbol_space.get_type(
                self.get_symbol_table_name()
                + constants.BANG
                + self._type_prefix
                + "Shdr"
            ),
            count=self.e_shnum,
        )
        return section_headers

    def get_link_maps(self, kernel_symbol_table_name):
        """Get the ELF link map objects for the given VMA address

        Args:
            kernel_symbol_table_name (str): Kernel symbol table name

        Yields:
            The ELF link map objects
        """
        got_entry_size = self._ei_class_size // 8

        elf_symbol_table = self.get_symbol_table_name()

        link_maps_seen = set()
        for phdr in self.get_program_headers():
            try:
                if phdr.p_type.description != "PT_DYNAMIC":
                    continue
            except ValueError:
                vollog.log(
                    constants.LOGLEVEL_VVVV,
                    f"Skipping unknown ELF program header type: {phdr.p_type}",
                )
                continue

            for dsec in phdr.dynamic_sections():
                try:
                    if dsec.d_tag.description != "DT_PLTGOT":
                        continue
                except ValueError:
                    vollog.log(
                        constants.LOGLEVEL_VVVV,
                        f"Skipping unknown ELF dynamic section type: {dsec.d_tag}",
                    )
                    continue

                got_start = dsec.d_ptr

                # link_map is stored at the second GOT entry
                link_map_addr = got_start + got_entry_size

                # It needs the kernel symbol table to create a pointer
                link_map_ptr = self._context.object(
                    kernel_symbol_table_name + constants.BANG + "pointer",
                    offset=link_map_addr,
                    layer_name=self.vol.layer_name,
                )
                if not link_map_ptr:
                    vollog.log(
                        constants.LOGLEVEL_VVVV,
                        f"Invalid ELF link map pointer at 0x{link_map_addr:x}",
                    )
                    continue

                linkmap_symname = (
                    elf_symbol_table + constants.BANG + self._type_prefix + "LinkMap"
                )
                try:
                    link_map = self._context.object(
                        object_type=linkmap_symname,
                        offset=link_map_ptr,
                        layer_name=self.vol.layer_name,
                    )
                except exceptions.InvalidAddressException:
                    vollog.log(
                        constants.LOGLEVEL_VVVV,
                        f"Invalid ELF link map address at 0x{link_map_ptr:x}",
                    )
                    continue

                while link_map and link_map.vol.offset != 0:
                    if link_map.vol.offset in link_maps_seen:
                        break
                    link_maps_seen.add(link_map.vol.offset)

                    yield link_map

                    try:
                        link_map = self._context.object(
                            object_type=linkmap_symname,
                            offset=link_map.l_next,
                            layer_name=self.vol.layer_name,
                        )
                    except exceptions.InvalidAddressException:
                        vollog.log(
                            constants.LOGLEVEL_VVVV,
                            f"ELF link map linked list is corrupt at 0x{self.vol.offset:x}",
                        )
                        break

    def _find_symbols(self):
        dt_strtab = None
        dt_symtab = None
        dt_strent = None

        for phdr in self.get_program_headers():
            # Find PT_DYNAMIC segment
            try:
                if phdr.p_type.description != "PT_DYNAMIC":
                    continue
            except ValueError:
                vollog.log(
                    constants.LOGLEVEL_VVVV,
                    f"Skipping unknown ELF program header type: {phdr.p_type}",
                )
                continue

            # This section contains pointers to the strtab, symtab, and strent sections
            for dsec in phdr.dynamic_sections():
                try:
                    dtag = dsec.d_tag.description
                except ValueError:
                    vollog.log(
                        constants.LOGLEVEL_VVVV,
                        f"Skipping unknown ELF dynamic section type: {dsec.d_tag}",
                    )
                    continue

                if dtag == "DT_STRTAB":
                    dt_strtab = dsec.d_ptr

                elif dtag == "DT_SYMTAB":
                    dt_symtab = dsec.d_ptr

                elif dtag == "DT_SYMENT":
                    # Size of the symtab symbol entry
                    dt_strent = dsec.d_ptr

            break

        if not (dt_strtab and dt_symtab and dt_strent):
            return None

        self._cached_symtab = dt_symtab
        self._cached_strtab = dt_strtab

        # Calculate number of symbol entries assuming that strtab follows symtab
        if dt_symtab < dt_strtab:
            self._cached_numsyms = (dt_strtab - dt_symtab) // dt_strent
        else:
            self._cached_numsyms = 1024

    def get_symbols(self):
        if self._cached_symtab is None:
            self._find_symbols()

        if self._cached_symtab is None:
            return None

        symtab_arr = self._context.object(
            self.get_symbol_table_name() + constants.BANG + "array",
            layer_name=self.vol.layer_name,
            offset=self._cached_symtab,
            subtype=self._context.symbol_space.get_type(
                self.get_symbol_table_name()
                + constants.BANG
                + self._type_prefix
                + "Sym"
            ),
            count=self._cached_numsyms,
        )

        for sym in symtab_arr:
            sym.cached_strtab = self._cached_strtab
            yield sym


class elf_sym(objects.StructType):
    """An elf symbol entry"""

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self._cached_strtab = None

    @property
    def cached_strtab(self):
        return self._cached_strtab

    @cached_strtab.setter
    def cached_strtab(self, cached_strtab):
        self._cached_strtab = cached_strtab

    def get_name(self):
        addr = self._cached_strtab + self.st_name

        # Just get the first 255 characters, it should be enough for a symbol name
        name_bytes = self._context.layers[self.vol.layer_name].read(addr, 255, pad=True)

        if name_bytes:
            idx = name_bytes.find(b"\x00")
            if idx != -1:
                name_bytes = name_bytes[:idx]
            return name_bytes.decode("utf-8", errors="ignore")
        else:
            # If we cannot read the name from the address space,
            # we return None.
            return None


class elf_phdr(objects.StructType):
    """An elf program header"""

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self._parent_e_type = None
        self._parent_offset = None
        self._type_prefix = None

    @property
    def parent_e_type(self):
        return self._parent_e_type

    @parent_e_type.setter
    def parent_e_type(self, e_type):
        self._parent_e_type = e_type

    @property
    def parent_offset(self):
        return self._parent_offset

    @parent_offset.setter
    def parent_offset(self, offset):
        self._parent_offset = offset

    @property
    def type_prefix(self):
        return self._type_prefix

    @type_prefix.setter
    def type_prefix(self, prefix):
        self._type_prefix = prefix

    def get_vaddr(self):
        offset = self.__getattr__("p_vaddr")

        try:
            if self._parent_e_type.description == "ET_DYN":
                offset = self._parent_offset + offset
        except ValueError:
            # Unknown ELF object file type. Anyway, if the ELF object file type is not a
            # shared object (ET_DYN), the virtual address is 'p_vaddr'.
            vollog.log(
                constants.LOGLEVEL_VVVV,
                f"Skipping unknown ELF object type: {self._parent_e_type}",
            )

        return offset

    def dynamic_sections(self):
        # sanity check
        try:
            if self.p_type.description != "PT_DYNAMIC":
                return None
        except ValueError:
            # If the value is outside the ones declared in the enumeration, an
            # exception is raised
            vollog.log(
                constants.LOGLEVEL_VVVV,
                f"Skipping unknown ELF program header type: {self.p_type}",
            )
            return None

        # the buffer of array starts at elf_base + our virtual address ( offset )
        arr_start = self.get_vaddr()

        symbol_table_name = self.get_symbol_table_name()

        rtsize = self._context.symbol_space.get_type(
            symbol_table_name + constants.BANG + self._type_prefix + "Dyn"
        ).size

        for i in range(256):
            # use the real size
            idx = i * rtsize

            dyn = self._context.object(
                symbol_table_name + constants.BANG + self._type_prefix + "Dyn",
                layer_name=self.vol.layer_name,
                offset=arr_start + idx,
            )

            yield dyn

            if dyn.d_tag == 0:
                break


class elf_linkmap(objects.StructType):
    def get_name(self):
        try:
            buf = self._context.layers.read(self.vol.layer_name, self.l_name, 256)
        except exceptions.PagedInvalidAddressException:
            # Protection against memory smear
            vollog.log(
                constants.LOGLEVEL_VVVV,
                f"Invalid l_name address for ELF link map at 0x{self.vol.offset:x}",
            )
            return None

        idx = buf.find(b"\x00")
        if idx != -1:
            buf = buf[:idx]
        return buf.decode()


class_types = {
    "Elf": elf,
    "Elf64_Phdr": elf_phdr,
    "Elf32_Phdr": elf_phdr,
    "Elf32_Sym": elf_sym,
    "Elf64_Sym": elf_sym,
    "Elf32_LinkMap": elf_linkmap,
    "Elf64_LinkMap": elf_linkmap,
}