Skip to content

Name ppc64 ELFv1 text call stubs after their plt slot ##bin - #26468

Merged
trufae merged 2 commits into
masterfrom
step4
Aug 15, 2026
Merged

Name ppc64 ELFv1 text call stubs after their plt slot ##bin#26468
trufae merged 2 commits into
masterfrom
step4

Conversation

@trufae

@trufae trufae commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

Calls now read bl sym.plt.strlen instead of an anonymous address, and the anal name join recovers forwarded arguments through the stubs. Lazy stubs are identified by their branch into a known glink stub, eager ones through the toc, always validated against the real slot set. Also fold the qdsp6, riscv, loongarch and vax import math into one shared helper.

step 4 is this @phix33

@phix33

phix33 commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator

Built it and ran the tests it ships — all pass here (45 + 28 + 19).

Two independent gaps.

1. --plt-static-chain stubs are rejected. The matcher expects ld r2, d+8(base) immediately after the mtctr, but bfd also loads the descriptor's environment word — before the toc restore for executables, after it for -shared. Accepting an optional ld rX, d+16(base) on both sides covers it. Measured on powerpc64-e5500/glibc-2.31 builds: --plt-static-chain and --plt-static-chain --plt-thread-safe go 0 → 5 named stubs, the -shared pair 0 → 2, with libz and more unchanged.

2. The scan only walks .text (plt_section_by_name (eo, ".text")), which costs two things. It misses the __gmon_start__ stub that bfd puts in .init — that is the one stub short on every binary I tried (libz 49 of 50, more 112 of 113, a small test lib 4 of 5), and it is otherwise identical in shape to the ones that match. And the early return when .text is absent means a section-less ELFv1 gets nothing at all: zeroing e_shoff/e_shnum on libz takes it from 49 to 0.

Walking every executable section fixes both of those, and adding a PT_LOAD+PF_X fallback when there are no sections covers the section-less case. The static-chain gap is separate and needs the tail matcher change.

@trufae

trufae commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator Author

the problem is that this can cause huge loading times if we parse all the binary just for few patterns. maybe we can use binoptions for that and have and e bin.XXX option to enable that and show a R_LOG_INFO about this if we need that.. but imagnie loading a static elf without sections of 100MB.. ill try to come up with some corpus and study a better fix but the optional large scan seems reasonable to me

@phix33

phix33 commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator

Looks good. Thanks for these PRs too.

@trufae

trufae commented Aug 15, 2026

Copy link
Copy Markdown
Collaborator Author

@copilot resolve the merge conflicts in this pull request

Copilot AI commented Aug 15, 2026

Copy link
Copy Markdown
Contributor

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in 8806532. The only conflict was in test/db/anal/plt-local where the ppc64 ELFv1 tests and the new x86_64 retpoline tests from master both needed to be kept.

radare added 2 commits August 15, 2026 15:50
Calls now read bl sym.plt.strlen instead of an anonymous address, and
the anal name join recovers forwarded arguments through the stubs. Lazy
stubs are identified by their branch into a known glink stub, eager ones
through the toc, always validated against the real slot set. Also fold
the qdsp6, riscv, loongarch and vax import math into one shared helper.
…n loads ##bin

The stub scan only walked .text, so it missed the __gmon_start__ stub bfd
puts in .init and found nothing at all on section-less files. Walk every
executable section, falling back to the PT_LOAD PF_X segments when there
are none, with each range clamped to the file and a shared 32MB budget so
corrupt section headers cannot inflate load time. The matcher now takes
the optional ld rX, d+16(base) env load that --plt-static-chain emits,
before or after the toc restore, and stubs at the tail of a range match
through zero padding. Adds section-less, static-chain and bogus-shdr
libz fixtures.
@trufae
trufae merged commit cb8192b into master Aug 15, 2026
47 of 48 checks passed
@trufae
trufae deleted the step4 branch August 15, 2026 15:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants