Name local plt stubs generically from their got relocs in aa ##analysis

radare2 now names PLT stubs for local functions in -fPIC binaries. Instead of
per-arch entry-size math in elf.c, the PLT is decoded once during aa: each
stub's indirect jump reveals its GOT slot, whose reloc names the local target,
and the stub is flagged sym.plt.<target>. r_anal_extract_rarg then matches
sym.plt.X to sym.X so args and prototypes propagate to forwarding callers,
like sym.imp does for imports. Gated by anal.plt (default true); ppc32 thunks
and ppc64 ELFv1 glink stubs are left untouched.

Author: radare

libr/anal/var.c

@@ -1602,6 +1602,19 @@ R_API void r_anal_extract_rarg(RAnal *anal, RAnalOp *op, RAnalFunction *fcn, int
 		int callee_rargs = 0;
 		char *callee = NULL;
 		ut64 offset = op->jump == UT64_MAX ? op->ptr : op->jump;
+		// a plt stub has no args of its own: a sym.plt.X flag names the local
+		// function it forwards to, so resolve the args at sym.X instead
+		if (anal->flb.f && offset != UT64_MAX) {
+			RFlagItem *sf = r_flag_get_by_spaces (anal->flb.f, false, offset, R_FLAGS_FS_SYMBOLS, NULL);
+			if (sf && sf->name && r_str_startswith (sf->name, "sym.plt.")) {
+				char *tn = r_str_newf ("sym.%s", sf->name + strlen ("sym.plt."));
+				RFlagItem *tf = r_flag_get (anal->flb.f, tn);
+				if (tf && tf->addr != offset) {
+					offset = tf->addr;
+				}
+				free (tn);
+			}
+		}
 		RAnalFunction *f = r_anal_get_function_at (anal, offset);
 		if (!f) {
 			RCore *core = (RCore *)anal->coreb.core;

libr/core/canal.c

@@ -5791,6 +5791,142 @@ R_API void r_core_anal_propagate_noreturn(RCore *core, ut64 addr) {
 	r_bitset_free (done);
 }
 
+// a -fPIC object calls its own globals through the plt; flag those stubs so
+// calls read sym.plt.<target> instead of an anonymous fcn address
+static void plt_stub_flag(RCore *core, ut64 entry, ut64 size, ut64 slot) {
+	const int ptrsz = R_MAX (4, core->anal->config->bits / 8);
+	// the reloc tree keeps file vaddrs while the decoded slot is a runtime address
+	RBinObject *bo = r_bin_cur_object (core->bin);
+	const st64 shift = bo? bo->baddr_shift: 0;
+	RBinReloc *rel = r_core_getreloc (core, slot - shift, ptrsz);
+	if (!rel || rel->import || !rel->symbol) {
+		return;
+	}
+	RBinSymbol *target = rel->symbol;
+	if (!target->vaddr || target->vaddr == UT64_MAX || target->vaddr == entry) {
+		return;
+	}
+	// STT_GNU_IFUNC is the only type r2 maps to LOOS
+	if (!target->type || (strcmp (target->type, R_BIN_TYPE_FUNC_STR)
+			&& strcmp (target->type, R_BIN_TYPE_LOOS_STR))) {
+		return;
+	}
+	const char *tname = r_bin_name_tostring2 (target->name, 'o');
+	if (R_STR_ISEMPTY (tname)) {
+		return;
+	}
+	char *fname = r_str_newf ("sym.plt.%s", tname);
+	r_name_filter (fname, -1);
+	if (!r_flag_get (core->flags, fname)) {
+		r_flag_set (core->flags, fname, entry, size);
+	}
+	free (fname);
+}
+
+// walk the section decoding entries: remember the last lea and load, and when an
+// entry ends in an indirect jump derive the got slot it goes through
+static void plt_stub_scan_section(RCore *core, RBinSection *sec) {
+	if (sec->vsize < 8 || sec->vsize > 0x100000) {
+		return;
+	}
+	const ut64 sec_vaddr = r_bin_get_vaddr (core->bin, sec->paddr, sec->vaddr);
+	const int len = (int)sec->vsize;
+	ut8 *buf = malloc (len);
+	if (!buf || !r_io_read_at (core->io, sec_vaddr, buf, len)) {
+		free (buf);
+		return;
+	}
+	const int minop = R_MAX (1, r_arch_info (core->anal->arch, R_ARCH_INFO_MINOP_SIZE));
+	ut64 entry = sec_vaddr;
+	ut64 lea_ptr = UT64_MAX;
+	ut64 load_disp = UT64_MAX;
+	int i = 0;
+	while (i < len) {
+		const ut64 at = sec_vaddr + i;
+		RAnalOp op;
+		const int oplen = r_anal_op (core->anal, &op, at, buf + i, len - i, R_ARCH_OP_MASK_BASIC);
+		const int type = op.type & R_ANAL_OP_TYPE_MASK & ~R_ANAL_OP_TYPE_COND;
+		const bool indirect = type == R_ANAL_OP_TYPE_UJMP
+			|| (type == R_ANAL_OP_TYPE_JMP && (op.type & R_ANAL_OP_TYPE_MEM));
+		bool ends = true;
+		if (oplen < 1) {
+			r_anal_op_fini (&op);
+			i += minop;
+			entry = sec_vaddr + i;
+			lea_ptr = UT64_MAX;
+			load_disp = UT64_MAX;
+			continue;
+		}
+		if (indirect) {
+			// x86 encodes the slot in one op; arm64-alikes split it lea/load/branch
+			ut64 slot = (op.ptr > 0 && op.ptr != -1)? (ut64)op.ptr: UT64_MAX;
+			if (slot == UT64_MAX && lea_ptr != UT64_MAX && load_disp != UT64_MAX) {
+				slot = lea_ptr + load_disp;
+			}
+			if (slot != UT64_MAX) {
+				plt_stub_flag (core, entry, at + oplen - entry, slot);
+			}
+		} else {
+			switch (type) {
+			case R_ANAL_OP_TYPE_LEA:
+			case R_ANAL_OP_TYPE_MOV:
+				if (op.ptr > 0 && op.ptr != -1) {
+					lea_ptr = (ut64)op.ptr;
+				}
+				ends = false;
+				break;
+			case R_ANAL_OP_TYPE_LOAD:
+				if (op.ptr > 0 && op.ptr != -1) {
+					// riscv-style loads resolve the slot in the op itself
+					lea_ptr = (ut64)op.ptr;
+					load_disp = 0;
+				} else {
+					load_disp = op.disp;
+				}
+				ends = false;
+				break;
+			case R_ANAL_OP_TYPE_JMP:
+			case R_ANAL_OP_TYPE_CALL:
+			case R_ANAL_OP_TYPE_UCALL:
+			case R_ANAL_OP_TYPE_RET:
+			case R_ANAL_OP_TYPE_TRAP:
+			case R_ANAL_OP_TYPE_SWI:
+			case R_ANAL_OP_TYPE_ILL:
+			case R_ANAL_OP_TYPE_UNK:
+			case R_ANAL_OP_TYPE_NOP: // trailing padding belongs to no entry
+				break;
+			default:
+				ends = false;
+				break;
+			}
+		}
+		r_anal_op_fini (&op);
+		i += oplen;
+		if (ends) {
+			entry = sec_vaddr + i;
+			lea_ptr = UT64_MAX;
+			load_disp = UT64_MAX;
+		}
+	}
+	free (buf);
+}
+
+R_API void r_core_anal_plt_stubs(RCore *core) {
+	R_RETURN_IF_FAIL (core);
+	RVecRBinSection *sections = r_bin_get_sections_vec (core->bin);
+	if (!sections) {
+		return;
+	}
+	r_flag_space_push (core->flags, R_FLAGS_FS_SYMBOLS);
+	RBinSection *sec;
+	R_VEC_FOREACH (sections, sec) {
+		if (sec->name && strstr (sec->name, "plt") && (sec->perm & R_PERM_X)) {
+			plt_stub_scan_section (core, sec);
+		}
+	}
+	r_flag_space_pop (core->flags);
+}
+
 R_API char *r_core_anal_get_comments(RCore *core, ut64 addr) {
 	if (core) {
 		const char *type = r_meta_get_string (core->anal, R_META_TYPE_VARTYPE, addr);

libr/core/cconfig.c

@@ -4103,6 +4103,7 @@ R_API int r_core_config_init(RCore *core) {
 	SETCB ("anal.ignbithints", "false", &cb_anal_ignbithints, "ignore the ahb hints (only obey asm.bits)");
 	SETI ("anal.symsort", 0, "sort symbols before 'aaa'nalysis (-1: backward, 0: no sort, 1: forward");
 	SETB ("anal.imports", "true", "run af@@@i in aa for better noreturn propagation");
+	SETB ("anal.plt", "true", "name plt stubs of locally defined functions as sym.plt.* during aa");
 	SETB ("anal.calls", "false", "make basic af analysis walk into calls");
 	SETB ("anal.autoname", "false", "speculatively set a name for the functions, may result in some false positives");
 	SETB ("anal.hasnext", "false", "continue analysis after each function");

libr/core/cmd_anal.inc.c

@@ -15137,6 +15137,11 @@ static bool cmd_aa(RCore *core, bool aaa) {
 	r_cons_break_push (core->cons, NULL, NULL);
 	r_cons_break_timeout (core->cons, r_config_get_i (core->config, "anal.timeout"));
 
+	if (r_config_get_b (core->config, "anal.plt")) {
+		logline (core, 8, "Name local plt stubs from their got relocs (anal.plt)");
+		r_core_anal_plt_stubs (core);
+	}
+
 	// required for noreturn
 	if (r_config_get_b (core->config, "anal.imports")) {
 		logline (core, 10, "Analyze imports (af@@@i)");

libr/include/r_core.h

@@ -734,6 +734,7 @@ R_API int r_core_get_stacksz(RCore *core, ut64 from, ut64 to);
 R_API RAnalOp* r_core_anal_op(RCore *core, ut64 addr, int mask);
 R_IPI int core_type_by_addr(RCore *core, ut64 addr);
 R_API void r_core_anal_esil(RCore *core, const char *str, const char *addr);
+R_API void r_core_anal_plt_stubs(RCore *core);
 R_API void r_core_anal_fcn_merge(RCore *core, ut64 addr, ut64 addr2);
 R_API const char *r_core_anal_optype_colorfor(RCore *core, ut64 addr, ut8 ch, bool verbose);
 R_API ut64 r_core_anal_address(RCore *core, ut64 addr);

test/db/anal/autoname

@@ -27,7 +27,7 @@ EXPECT=<<EOF
       |                         |                      '--------.
       |                         |                               |
 .--------------------.    .---------------------------.   .----------------------------.
-|  sub.add2_1050     |    |  sub.__cxa_finalize_1040  |   |  sym.deregister_tm_clones  |
+|  sym.plt.add2      |    |  sub.__cxa_finalize_1040  |   |  sym.deregister_tm_clones  |
 `--------------------'    `---------------------------'   `----------------------------'
 EOF
 RUN

test/db/anal/plt-local

@@ -0,0 +1,183 @@
+NAME=x86_64 shared lib: aa names the plt stub of a locally defined function
+FILE=bins/elf/pltrel/add.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.
+EOF
+EXPECT=<<EOF
+0x00001050 10 sym.plt.add2
+EOF
+RUN
+
+NAME=x86_64 shared lib: call through a local plt stub names its target
+FILE=bins/elf/pltrel/add.so
+CMDS=<<EOF
+aa
+pd 1 @ 0x1135
+EOF
+EXPECT=<<EOF
+|           0x00001135      e816ffffff     call sym.plt.add2
+EOF
+RUN
+
+NAME=x86_64 shared lib: the stub function takes the flag name
+FILE=bins/elf/pltrel/add.so
+CMDS=<<EOF
+aa
+s 0x1050
+afn
+EOF
+EXPECT=<<EOF
+sym.plt.add2
+EOF
+RUN
+
+NAME=x86_64 shared lib: a locally defined stub target is not an import
+FILE=bins/elf/pltrel/add.so
+CMDS=<<EOF
+aa
+ii~add2
+EOF
+EXPECT=<<EOF
+EOF
+RUN
+
+NAME=glibc ld.so: interposable locals get their plt stubs named
+FILE=bins/elf/ld-2.31.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.
+EOF
+EXPECT=<<EOF
+0x00002080 11 sym.plt.free
+0x00002090 11 sym.plt._dl_catch_exception
+0x000020a0 11 sym.plt.malloc
+0x000020b0 11 sym.plt._dl_signal_exception
+0x000020c0 11 sym.plt.calloc
+0x000020d0 11 sym.plt.realloc
+0x000020e0 11 sym.plt._dl_signal_error
+0x000020f0 11 sym.plt._dl_catch_error
+EOF
+RUN
+
+NAME=aarch64: adrp+ldr stubs of local functions get named
+FILE=bins/elf/librsjni_androix.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.
+EOF
+EXPECT=<<EOF
+0x0000b7f0 16 sym.plt._Z11loadSymbolsPvR13dispatchTablei
+0x0000b830 16 sym.plt._Z14loadIOSuppSymsPvR8ioSuppDT
+EOF
+RUN
+
+NAME=x86_64 caller forwarding its args through a local plt stub inherits them
+FILE=bins/elf/pltrel/add.so
+ARGS=-e io.cache=true
+CMDS=<<EOF
+wx e832ffffffc3 @ 0x1119
+aa
+afs @ 0x1119
+EOF
+EXPECT=<<EOF
+void sym.add (int64_t arg1, int64_t arg2);
+EOF
+RUN
+
+NAME=plt stub args survive a non default base address
+FILE=bins/elf/pltrel/add.so
+ARGS=-B 0x400000 -e io.cache=true
+CMDS=<<EOF
+wx e832ffffffc3 @ 0x401119
+aa
+fs symbols
+f~plt.
+afs @ 0x401119
+EOF
+EXPECT=<<EOF
+0x00401050 10 sym.plt.add2
+void sym.add (int64_t arg1, int64_t arg2);
+EOF
+RUN
+
+NAME=a typedef prototype propagates through a local plt stub by name
+FILE=bins/elf/pltrel/add.so
+ARGS=-e io.cache=true
+CMDS=<<EOF
+"td int add2(int a, int b);"
+wx e832ffffffc3 @ 0x1119
+aa
+afs @ 0x1119
+EOF
+EXPECT=<<EOF
+void sym.add (int a, int b);
+EOF
+RUN
+
+NAME=x86_64 caller that sets up its own arg registers is unaffected by stubs
+FILE=bins/elf/pltrel/add.so
+CMDS=<<EOF
+aa
+afs @ sym.add
+EOF
+EXPECT=<<EOF
+void sym.add (int64_t arg1, int64_t arg2);
+EOF
+RUN
+
+NAME=anal.plt=false disables local plt stub naming
+FILE=bins/elf/pltrel/add.so
+ARGS=-e anal.plt=false
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.~?
+EOF
+EXPECT=<<EOF
+0
+EOF
+RUN
+
+NAME=imports-only executable grows no local plt stubs
+FILE=bins/elf/crackme0x05
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.~?
+EOF
+EXPECT=<<EOF
+0
+EOF
+RUN
+
+NAME=ppc64 ELFv1 glink stubs are not resolved by decoding (known limitation)
+FILE=bins/elf/ppc64v1-libz.so
+CMDS=<<EOF
+aa
+fs symbols
+f~plt.~?
+EOF
+EXPECT=<<EOF
+0
+EOF
+RUN
+
+NAME=glibc libc.so: local jump-slot and plt.got stubs both get named
+FILE=bins/elf/libc-2.31.so
+CMDS=<<EOF2
+aa
+fs symbols
+f~plt.
+EOF2
+EXPECT=<<EOF2
+0x00025310 11 sym.plt.malloc
+0x00025330 11 sym.plt.free
+0x00025370 11 sym.plt.realloc
+0x00025400 11 sym.plt.memalign
+0x00025550 11 sym.plt.calloc
+EOF2
+RUN

test/db/cmd/r2pipe2

@@ -54,6 +54,11 @@ EXPECT=<<EOF
       "origin": "logline",
       "message": "Analyze imports (af@@@i)"
     },
+    {
+      "type": "INFO",
+      "origin": "logline",
+      "message": "Name local plt stubs from their got relocs (anal.plt)"
+    },
     {
       "type": "INFO",
       "origin": "logline",