Parsing ELF Executable
Posted: Fri Oct 08, 2010 9:56 pm
So I'm using GCC and am having trouble parsing an ELF file (kernel) from stage2. Here is what I have so far for the parsing part:
It's the third test I do that fails. Using the ELF specification: http://www.skyfree.org/linux/references/ELF_Format.pdf (Search for 1-3), I add up the ELF Header size + (Program Header Size * Number of Program Headers) + (Section Header Size * Number of Section Headers). Now I am aware that this isn't the full size of the file. But if all this combined is greater than ImageSize, then there is a major problem. Which is why I do jge, ebx being the combined size of all the headers. FailureSizes is just to print an error, so I know what failed.
I've relooked over my calculations plenty of times, and at first my offsets were way off, but I don't see it anymore.
Code: Select all
ParseELFImage:
; Check for signature -- SUCCEEDS
mov ebx, dword [IMAGE_PMODE_BASE]
mov eax, dword [ELFSignature]
cmp eax, ebx
jne FailureMagic
; Check for proper data encoding -- SUCCEEDS
add ebx, 5
cmp ebx, 0
je FailureData
; Check for proper file size -- FAILS
xor ebx, ebx
mov bx, word [IMAGE_PMODE_BASE + 40]
mov word [ImageSizeTest], bx
mov bx, word [IMAGE_PMODE_BASE + 42]
mov ax, word [IMAGE_PMODE_BASE + 44]
mul bx
mov bx, dx
shl ebx, 16
or bx, ax
add dword [ImageSizeTest], ebx
xor ebx, ebx
mov bx, word [IMAGE_PMODE_BASE + 46]
mov ax, word [IMAGE_PMODE_BASE + 48]
mul bx
mov bx, dx
shl ebx, 16
or bx, ax
add dword [ImageSizeTest], ebx
mov ebx, dword [ImageSizeTest]
mov eax, dword [ImageSize]
cmp ebx, eax
jge FailureSizes
I've relooked over my calculations plenty of times, and at first my offsets were way off, but I don't see it anymore.