Skip to content

fix(unblob): unnecessary carving of padding in qnx elf file #1241

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

elektrischermoench
Copy link

Some QNX binaries are padded with a 4kib of null bytes. There is no reason to carve them.
So this fix will look into the elf binary sections to identify if it a QNX binary and carve the file with padding included.

@qkaiser qkaiser force-pushed the 4248-unnecessary-carving-of-elf-file-in-qnx-firmware branch 2 times, most recently from 8d6a71a to f9c08f4 Compare August 13, 2025 09:37
@qkaiser qkaiser added enhancement New feature or request format:executable python Pull requests that update Python code labels Aug 13, 2025
@qkaiser qkaiser force-pushed the 4248-unnecessary-carving-of-elf-file-in-qnx-firmware branch 2 times, most recently from 8d6a71a to 682942d Compare August 13, 2025 10:14
Copy link
Contributor

@e3krisztian e3krisztian left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looks good, however I would like to have qnx test data to verify against, if possible.

Comment on lines 419 to 426
name_end_offset = shstrtab_content.find(b"\x00", name_offset)
if name_end_offset == -1:
name_end_offset = len(shstrtab_content)
section_name = shstrtab_content[name_offset:name_end_offset].decode(
"utf-8", errors="ignore"
)

if section_name.startswith(QNX_SECTION_NAME_PREFIX):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I find it hard to understand when can -1 be a find result, and if it is handled properly.

Actually we do not need to properly parse and decode the section name at all, we need only to match against its prefix. In fact interpreting strings less would yield a more straight-forward code, that avoids find, but it depends on the fact, that the utf-8 encoding of the prefix QNX_ is the same as its ascii encoding, so matching bytes directly would also work.

Suggested change
name_end_offset = shstrtab_content.find(b"\x00", name_offset)
if name_end_offset == -1:
name_end_offset = len(shstrtab_content)
section_name = shstrtab_content[name_offset:name_end_offset].decode(
"utf-8", errors="ignore"
)
if section_name.startswith(QNX_SECTION_NAME_PREFIX):
maybe_section_name_prefix = shstrtab_content[name_offset:name_offset + len(QNX_SECTION_NAME_PREFIX_BYTES)]
if maybe_section_name_prefix == QNX_SECTION_NAME_PREFIX_BYTES:

The comment above # Get the section name from the string table should also be updated to # Check section name prefix

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point added your changes.

Unfortunately QNX binaries and even the Software Development Platform (SDP) are proprietary we can not just use them for testing. QNX 8 has been opened up for non commercial use, but not sure if we can use it.

@elektrischermoench elektrischermoench force-pushed the 4248-unnecessary-carving-of-elf-file-in-qnx-firmware branch from 682942d to e4f8685 Compare August 17, 2025 19:49
@elektrischermoench elektrischermoench force-pushed the 4248-unnecessary-carving-of-elf-file-in-qnx-firmware branch from e4f8685 to 239b7ef Compare August 17, 2025 20:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request format:executable python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants