ORC (Object Re-Construction)

orc is a CLI utility which parses stripped ELF files and attempts to recreate an approximation of the missing section headers

Background

Since dynamic linking/loading and execution of an ELF binary only requires program headers, the section headers are techincally optional and can be removed.

$ /bin/busybox id
uid=0(root) gid=0(root)
$ readelf -h /bin/busybox | grep -i section
Start of section headers: 0 (bytes into file)
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
$ readelf -S /bin/busybox There are no sections in this file.

However, many tools (e.g. objdump and gdb), depend on the presence of section headers in order to parse and analyze the target ELF file.

$ objdump -d /bin/busybox /bin/busybox: file format elf32-tradbigmips

$ gdb -q /bin/busybox id
0x77f631b0 in ?? ()
(gdb) info functions
All defined functions:
(gdb)

Description

orc parses the program headers and segments of a stripped ELF file and attempts to rebuild the section headers.

$ ./build/orc /bin/busybox 2>/dev/null
$ readelf -h /bin/busybox | grep -i section
Start of section headers: 329384 (bytes into file)
Size of section headers: 40 (bytes)
Number of section headers: 21
Section header string table index: 20
$ readelf -S /bin/busybox There are 21 section headers, starting at offset 0x506a8:
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 00400134 000134 00001a 00 A 0 0 1
[ 2] .MIPS.abiflags MIPS_ABIFLAGS 00400150 000150 000018 00 A 0 0 8
[ 3] .dynamic DYNAMIC 00400168 000168 000118 08 A 6 0 4
[ 4] .hash HASH 00400280 000280 00095c 04 A 5 0 4
[ 5] .dynsym DYNSYM 00400bdc 000bdc 0014e0 10 A 6 1 0
[ 6] .dynstr STRTAB 004020bc 0020bc 000a79 00 A 0 0 1
[ 7] .gnu.version VERSYM 00402b36 002b36 00029c 02 A 5 0 2
[ 8] .gnu.version_r VERNEED 00402dd4 002dd4 000050 00 A 6 1 4
[ 9] .rel.dyn REL 00402e24 002e24 000048 08 A 5 0 0
[10] .rel.plt REL 00402e6c 002e6c 0009d0 08 AI 5 14 0
[11] .init PROGBITS 0040383c 00383c 000044 00 AX 0 0 4
[12] .text PROGBITS 00403880 003880 03d7b8 00 AX 0 0 16
[13] .fini PROGBITS 00441038 041038 00dcc8 00 AX 0 0 4
[14] .plt PROGBITS 0044ed00 04ed00 0013c0 00 AX 0 0 32
[15] .got.plt PROGBITS 004600d0 0500d0 0004f0 04 WA 0 0 0
[16] .data PROGBITS 004605c0 0505c0 00001c 00 WA 0 0 16
[17] .rld_map PROGBITS 004605dc 0505dc 000004 00 WA 0 0 4
[18] .got PROGBITS 004605e0 0505e0 000008 04 WAp 0 0 16
[19] .bss NOBITS 004605f0 0505e8 0006d0 00 WA 0 0 16
[20] .shstrtab STRTAB 00000000 050600 0000a8 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)

Now objdump is able to parse and disassemble the file:

$ objdump -j .plt -d /bin/busybox | grep -A7 '<getuid@\w*>:'
00450080 <getuid@mips16plt>:
450080:	b203 lw	v0,45008c <getuid@mips16plt+0xc>
450082:	9a60 lw	v1,0(v0)
450084:	651a move	t8,v0
450086:	eb00 jr	v1
450088:	653b move	t9,v1
45008a:	6500 nop
45008c:	0046 05b0 .word	0x4605b0

and gdb can properly resolve the symbols

$ gdb -q /bin/busybox id
0x77f631b0 in ?? ()
(gdb) info functions getuid@mips
All functions matching regular expression "getuid@mips":
Non-debugging symbols:
0x00450081 getuid@mips16plt
(gdb) break getuid@mips16plt
Breakpoint 1 at 0x450081
(gdb) cont
Continuing.
Breakpoint 1, 0x00450081 in getuid@mips16plt ()
(gdb) x/6i $pc
=> 0x450081 <getuid@mips16plt>:	lw	v0,0x45008c <getuid@mips16plt+11>
0x450083 <getuid@mips16plt+2>:	lw	v1,0(v0)
0x450085 <getuid@mips16plt+4>:	move	t8,v0
0x450087 <getuid@mips16plt+6>:	jr	v1
0x450089 <getuid@mips16plt+8>:	move	t9,v1
0x45008b <getuid@mips16plt+10>:	nop

Building

git clone https://github.com/mathewmarcus/orc.git
mkdir build
cd build/
cmake ..
cmake --build .

Usage

./orc [ -S section_headers_csv ] [ -s symbols_csv ] elf-file

Positional Arguments

elf-file

The ELF file to analyze and to which the section headers will be added. Note that this file is modified in-place

Options

-S section_headers_csv

The are some sections which orc may not be able to determine automatically. If information (e.g Name, Type, Offset, etc) about these sections is determined by manual reverse-engineering, it can be manually added to a CSV file, which orc can then parse. The CSV must not include a header file, and each line must match this format - note that fields correspond to the fields of a section header:

Name,Type,Addr (hex),Offset (hex),Size,EntSize,Flags,Link,Info,Alignment

-s symbols_csv

orc can optionally generate .symtab and .strtab sections - which may have be striped away - if information about these specified is specified via a CSV file. The CSV must match this format:

"Name","Location","Function Size""FUN_00506c44","00506c44","24"

Ghidra can be used to create such a CSV file, as described here

Ghidra integration

orc includes a Ghidra script which can be used to generate a CSV containing any/all functions which Ghidra discovers during its analysis of the target ELF.

1. Copy or link the Ghidra script into one of the Ghidra scripts directories

   $ ln -s `realpath ./scripts/ExportMIPS16Symbols.py`~/ghidra_scripts/

2. Open the Ghidra Script Manager window:
3. Click Refresh Script List
4. In the left navbar, find and run the MIPS/ExportMIPS16Symbols.py script, which will allow you to specify an output CSV into which the Ghidra-parsed function symbols will be saved.

This CSV file can now be used in the orc invocation as described here

TODO:

• add support for other architectures/platforms besides MIPS
• support for parsing additional section headers
• code cleanup
• unit tests