Save and dump original section header values in readelf
readelf now saves and dumps original section header values for better debugging of corrupt ELF files.
The readelf utility now saves and dumps the original section header values before they are cleared during validation. This change helps in diagnosing issues with corrupt ELF files by making the ‘garbage’ values visible. New test files and an updated test script are included to verify this functionality.
In Details
This commit enhances readelf to preserve the original section header values before validate_section_info clears them. This is achieved by adding orig_section_headers to the filedata structure and introducing save_original_section_header_values. The original values can now be displayed, aiding in the analysis of malformed ELF files. A larger refactoring to use sane_section_headers instead of section_headers in more places was deferred.
- readelf
- A utility in GNU Binutils that displays information about ELF (Executable and Linkable Format) files. It can show section headers, symbol tables, and other details about the object file.
- ELF
- Executable and Linkable Format. A standard file format for executables, object code, shared libraries, and core dumps on many Unix-like operating systems.
- section header
- A structure within an ELF file that describes a section, such as code, data, or symbol tables. Section headers contain information like the section's name, type, size, and memory address.
- validate_section_info
- A function within
readelfthat checks the integrity of section header information. It may clear or modify certain fields to prevent errors during further processing. - filedata
- A data structure used within
readelfto hold information about the ELF file being processed, including section headers, symbol tables, and other metadata.