Skip to content

fix(filter): run PLTFilter last to evict PLT stubs re-added by EhFrameFilter #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
maxgio92 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix(filter): run PLTFilter last to evict PLT stubs re-added by EhFrameFilter #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions detector.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,17 +187,20 @@ func DetectFunctions(code []byte, baseAddr uint64, arch Arch) ([]FunctionCandida
// DetectFunctionsFromELF parses an ELF binary from the given reader, extracts
// the .text section, and returns detected function candidates using combined
// prologue detection, call site analysis, and alignment-based boundary
// detection, followed by FP filters (PLT section ranges, intra-function jump
// targets). When .eh_frame is present, FDE entries are used as a whitelist to
// discard disassembly candidates that are not confirmed by the compiler, and
// any function entries visible only in .eh_frame are added to the result.
// detection, followed by FP filters (intra-function jump targets, PLT stubs).
// When .eh_frame is present, FDE entries are used as a whitelist to discard
// disassembly candidates that are not confirmed by the compiler, and any
// function entries visible only in .eh_frame are added to the result.
// The architecture is inferred from the ELF header.
//
// By default the full filter pipeline (PLTFilter, CETFilter, EhFrameFilter)
// is applied. opts may include WithFilters to replace the default pipeline.
// By default the full filter pipeline (CETFilter, EhFrameFilter, PLTFilter)
// is applied. PLTFilter runs last so that any PLT-section addresses
// reintroduced by EhFrameFilter (via FDE records for linker-generated stubs)
// are always evicted regardless of detection method.
// opts may include WithFilters to replace the default pipeline.
func DetectFunctionsFromELF(r io.ReaderAt, opts ...Option) ([]FunctionCandidate, error) {
o := &options{
filters: []CandidateFilter{PLTFilter, CETFilter, EhFrameFilter},
filters: []CandidateFilter{CETFilter, EhFrameFilter, PLTFilter},
}
for _, opt := range opts {
opt(o)
Expand Down