-
Notifications
You must be signed in to change notification settings - Fork 85
fix(unblob): unnecessary carving of padding in qnx elf file #1241
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
fix(unblob): unnecessary carving of padding in qnx elf file #1241
Conversation
8d6a71a
to
f9c08f4
Compare
8d6a71a
to
682942d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good, however I would like to have qnx test data to verify against, if possible.
name_end_offset = shstrtab_content.find(b"\x00", name_offset) | ||
if name_end_offset == -1: | ||
name_end_offset = len(shstrtab_content) | ||
section_name = shstrtab_content[name_offset:name_end_offset].decode( | ||
"utf-8", errors="ignore" | ||
) | ||
|
||
if section_name.startswith(QNX_SECTION_NAME_PREFIX): |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I find it hard to understand when can -1 be a find
result, and if it is handled properly.
Actually we do not need to properly parse and decode the section name at all, we need only to match against its prefix. In fact interpreting strings less would yield a more straight-forward code, that avoids find
, but it depends on the fact, that the utf-8 encoding of the prefix QNX_
is the same as its ascii encoding, so matching bytes directly would also work.
name_end_offset = shstrtab_content.find(b"\x00", name_offset) | |
if name_end_offset == -1: | |
name_end_offset = len(shstrtab_content) | |
section_name = shstrtab_content[name_offset:name_end_offset].decode( | |
"utf-8", errors="ignore" | |
) | |
if section_name.startswith(QNX_SECTION_NAME_PREFIX): | |
maybe_section_name_prefix = shstrtab_content[name_offset:name_offset + len(QNX_SECTION_NAME_PREFIX_BYTES)] | |
if maybe_section_name_prefix == QNX_SECTION_NAME_PREFIX_BYTES: |
The comment above # Get the section name from the string table
should also be updated to # Check section name prefix
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good point added your changes.
Unfortunately QNX binaries and even the Software Development Platform (SDP) are proprietary we can not just use them for testing. QNX 8 has been opened up for non commercial use, but not sure if we can use it.
682942d
to
e4f8685
Compare
e4f8685
to
239b7ef
Compare
Some QNX binaries are padded with a 4kib of null bytes. There is no reason to carve them.
So this fix will look into the elf binary sections to identify if it a QNX binary and carve the file with padding included.