From 8346b06165d261122e907de8ad3fc15abffa1c3c Mon Sep 17 00:00:00 2001 From: xamidev Date: Wed, 3 Sep 2025 22:11:30 +0200 Subject: [PATCH] Diff between ELF32/64 --- .helper.c.swp | Bin 12288 -> 0 bytes helpelf | Bin 19520 -> 20776 bytes helper.c | 90 --------------------------- main.c | 164 ++++++++++++++++++++++++++++++++++++++++++++++++++ makefile | 2 +- 5 files changed, 165 insertions(+), 91 deletions(-) delete mode 100644 .helper.c.swp delete mode 100644 helper.c create mode 100644 main.c diff --git a/.helper.c.swp b/.helper.c.swp deleted file mode 100644 index b7b19693b3a0a90ff7cbdd8774eb08a71e405852..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12288 zcmeI2&2Jk;7>6euDqLu(;DCV3bgPneY8=}MX^HcJm29b{#F5BH6Vk}q?9O_Ztaq2$ zbwz3wgaoKuK^)7+0S=XrfCH_>l>--ADj~r?07y9?aYEw6Z^j>uZ9)z`Rm@6{yq=l& zop+v{StUxgb8F>A`a(8GaGfAz@5Nhg@x;{7;v^xjG2iq>`yto1nV6h;JLVzd-jE4L ztBK9lQq`AORa-7MubaI0E*L6LK4T z4ZZ>&gX`c5aKI8c2Q+XT{C$j&U%?&l4fqsX12NbH>);}I20R6Rf0U5B;10MAz5qAC z2jFe+7T5qUfq5_obTAB#g1tuw`5t@@J_8?u_rVU>0Bc|coB<=?Y49ZY?IJEHP*{3)#cT>Ib(UbNKzyfaW6<5T{9NWQ^)h!r9ev;2}vQO6Z4!=uB??7FuXgu z5+>9{wsuf9+X_oHNy>Amep0Wqx>b*K{0nB)Wv0z|mQ_8Q1xbc#m-1)NB2vrH@id*D zrnz+b&30myv5ykLxUOTv_nNTQ4SL>SERZSipM)c*VF^vdeQ_dlafyO2LRO2@L) z_TtDlclYU~Eh(50BMMm>g;B#d6E-+Rj>u=J#o59Axh(Z!5j$3(c$~PI7^kzdv#7vw zO+M09gvFb@c6l?ub@*Ofjm;XHq^Dy#1)DQcwG7T}30ZB^XtC%NEns_KDJ9EdvD`|+ zf|!dmQ$*~Wy6FYFxDf#v+A2$?+k&VA50Zmr+j?uWWN7SNVWFcB?5K2x=CKbV)YX); zi4EPiKL>(FXeVuJgCHD*U}deHdcpJ^%Br!8z`%Zeusvwh2ODt`MUnj-k^3*BBlm#O z%G2}KXaeT8DcM~r;t?EL@>1&JJ{cR;%9JnfG;=4uKSzJ5iWrlMf2HgbhHP=nc z^@4##B)gGlYXq@Z3z#jRAyUiN&!$nXR?71@wb)rrG9VkjZQ9I1()N2mlusMj4|pde zeSNaz1Nvm)2lUD6MPGgbIlD<0OY7AOMrq!7xw>FfXdyR#uG`nGn#wCb(d`jYVqa8B ziw61%&rcwu7g&D7W^@Yc!}~Jp&h)g|n7g-)aUO)dO>tuT-u6J7Cx;Q7AU0cAii{4kRrgcuNXAWWDbLR7FIx{t}so6N}ki1UMA z3lbN*Yh>9%_tfeZm9^VySGR|@thK_i@fT=IU9_i`o_bok6`L%s;_9}v{+NEg_uV_0 zc_i+h{iCOU%$+mud%wTG_j~WWci+43&OYzjZbea;ELL_SBkWkULGcL2$ZAmm@UTu+ ziQ`;0hm`=gahk#R7yw+OoU;@{yP#VENw1D7jPnMo)kBuIJ_m2j!Sk&uaYke*5` zft%r5!l;CjpY!J;WfT`b=HRoUeG=yDQEtvQ8S-bB7s8!FZ%{y~M=0r?7kcM~UJg<~ z#1~NJlftKOr^u%ny1=92;z!2JdYgov8LkrY5|R%pw_ivHe-nSbLhn5nH^a>EE`!V@ zl>Tmo9_8iNEwY<$6aFUZhZd242}N32b2QS|(cT;lHbo=x%+98rogGab?e0{<-Nr+p zxX1^MsnzQ?GRq(vCYscz`V@RAt;GL&>zSr6j_fJ|8sjM4u4Q8Q=+-_qZV5uB*hgE4s=W&$+VICL5pYc4(z#Sa7W7O$L z3dj;L&G5C@$@!^{c zI*n24ds$x3qtjTH)1D?;L)9)cyJVuR9`{ESF3HCfX{mx{m_82vi z=hp+lsLP`pzcYj3%A<=*3unyBqa(q&(vn9n&ryq&Vg`yCC}yCTfno-V87OAp|4#;d z`#-Sz4ydm+Gv@p4;j|@t*0=vv`zyHsvy1-*tnAz~I67x~P$N7{{L%ASl({bxPE)?o zvmAecaGL6k4s-m^38$&q=rNA}kZ_ukjUMIrlZ4Y$Z1fPvzehMt!A1u;z7%-q5O7{v zf8I0n*4KPPKlSZ@?^5puZ|iXD8@_|fJ#d(v`jMNlPeX3!%m=tE#S5Mv27CwAI|(eg zoSus2z6n8UZdvxcbLJokzak*yTenEofutN&+k`Om>-nS~pD`(;b0t==8|auhe(J|Hx_YXJqu0H_H&li0`2HGYW$`@kNS-%zW|%!T^I) zeFrO_!5yP-=uKkT;eiK8vf~GMP#xs*r$_z(b`F`sKd8n8cW(ig2WLd(9eDx9*^3kt z`TPNeW5k-xrA)@Unlrs4B)A22=X2hybouJw(B5w&;e-44ep}f$4=Eq?9e~MG7(&0m zod`a2-*M(U6hsLH zG~~Sm%}XpZ*XU>R_-ww%qhtlS%#M~DRxXk5?Vt>KKiI$b1HWrL8}nUj%&9ro!wR&eHm(_$%RpqPPT28tOdW}ujXVg`yCC}yCTfr1Rs zdJ&aY(3MVbd%9~Z z1Xmb~ae9(Rcct7|d{V9_K4v}9caI)OyHd1Hhdb=))*I+8Nf4u zX}}*}%4XjK{3W0bcUOx)&SvKTJ`A`D@Hk))@NK{c02_Y+JAkytOGVjz8&h^xE7L1V z?T3`oYNFG-3%#&En*>A|U!LJj3Pb+ThuQ2P$yQZ&SJka?I(FCx*-Z^MELb#$n<4#G z_>Mp>f8C6H(VF=i@aF+!E2^r$Y3Zsg`8omuO8h4}azaKECZ@G&bApMj0 zt^xn*eE#M!`|pD8`wIT&;CF-1SGr|n1l%s*HwAoHKxxP0F>0&3 zx|X`;tOVJWbm*Wd5CLO951SDcxtPw$eKRCfh50gemrW;9j+q4#AeHltekE{tkfc zJshm_X50a}8k>r@dhtR%q^t{SSCFb*JqTd)l2p@la$%!5tdG<`M0E>VV10Bt)vYh! z0OKi$PN90$4AjoqTGs+7uj61_RJsFnrZ{o1b(H-Wz^?omA=h)HTB(3NTPH{AlPkb%4EzYB0w z*+qfg&BJ+GsU-tnE2BO=rnrftmDA&-=arXaq=MK zG5mT-?KO~UZSUh)Qa@!IC^ic`mNZPckLs(5K7Gnzl6(n=%AbKybq5aZO5I-~c;#Oq ztu$0qohd8mFun2=_|?iW;>_U4WaUdjuBv<+oGA)rMY)665wUYy42zJ&yo{=KF0CqyGXR{jkf-mq}Vk0jMX=L`!! zAJl&aDZ7XBow$NnhJhOg8r`h?CE$N(aT3x_{57OXm~r?K*v#=A_>HJ!&_UZIQ1}xy zK;_80&?=3RKotpC4}X4N=~_Y?h+{o`>AsTxK<_8*bV{-u4wuxxto;;6>*2wDC7q}|TuY;ZP#j6n@gfde zon+%VvCm^8>Qs~?SL32x5gK4y8x8-PO8P($C6yH2YRLd0C!s& zsfuPWEBUQ{9ZkDq_Z9NHr2HL?RORv%wu5$Qt>c-j7fODL3`IF|5|R|$x&{&4^uA1p zDZQn{upHiIoFmQv;XeW!bIgS`FSqtjayNxx4A#nUE#V=17mAR{ws(n0Je%=2IbFuJ z<)zP))8?AX7K-3Wb6HN4DV5AxwbXHgV~L}urV|q^i^_U1Fsx4Im}RG$tu{{r=dL-- z;keOZtwJBR6K9rUC|fWqDpk!CyQ1{eC@@nt3wE2~pxmw8R8M-PH>gV-jrBb>%j!wM zA?e&6(I+XBOFeaaIJW|p?FGInujheQ)hN~~hl4j^mYobaamKA$hPi5WzQtK3jrI8k zCrwi3R@FGHGpElaa`iOK1JGs!SR-0!$LaD~?qlj$3UI={7MYz!Q@}c5-(fVwXhwaG zh?I`CuEC*@8^)$1X?B@#%GnIFf{YR#x-leG%q{6EiH(?_RaFuIk>(z#%v5QX;lj5E z-zdJnhp$DMX>rQAD)1-qRh}WnU*NzeApC-2;j@5qpxIP~m09G_u`W~8(oa;?{(@S5 zr&_jMRW`SdLpY&Yex#PzPeAZ-wTW45${MvS152nu!E!=XF5DzRHKcF0Z-#Uk=r^~j z>ieoStd`r~Q0?DW)f1|9yIOuhtwG&>m?QQlR41?tTh|3F!Evn;!TDAkRTd*NY5j(LoEfET7Y3!d`uhD)kZ6KXwS|ChY zxM)F$SgCL#nWmpB2?1(-{*=zZ+BHBxkEfHn7VX3 zX;@{__!5&2gYisEZUW2ckvKMtVSOyYXt@lQp=PXWEovK!P{#%|9%_MA85?o6KqjdL z646Wy`_K?`AQ999+hIKs4N`kkI_g>m4i~kFw#WR*ZCF0ju&E9E%~I4%G;JV^#_^!Z z%#LIv4H^=J{fDlu*6YPQ-PIIJXX5(uem$-yBLSfPWFWlU*aYcn>UTAT{Ha~>KscF* zCo-v~Oq@2+HKl1ETZ-}Qx(bp;&QkvEx{+uNIoyU|V*Wrl635QBP}JX_LPBC_77IpF z15y7j$`z7?oP|Y_BSFN@F|z>5%OV_!E}sVpGQXH8tbzGF28H6ILX$5APhI5m9Ztky558pQkjXyX>nKIl*CkxIBJ;^n_Ur~Jzai$~DQF^8_kxb2k$L4Qri%m1yA!^jEw@%nd`up`I6FvFU- zJZ6bBP*LQaQ=6chXYO7>H{Vp;&gq7Y{G$#!<-zRtUeI0nf}(x^^x5Ok{}}YimI_Kn zVYxk!Ot-odIKTV*B3jzt&p=3}GocX9ykk4hwRB7i(BAVDB!da9Kbq*nv?iENBvYC{ zvy%l9v4Ng@$>P zzDMr6$6ovKW>gdJzR#O=;6g}$2avNxd-(aaxqzbS#^s#SApQlQfN%V{JGCo@$q-;VX+WA^ z@EWeLdUAldK>nckI0>dQp%{~VE^Agx&0gBfT)YI!hZl4F zeo*n?A=iGn{v~0jNEpRPRjE%8A*e*~r6x=NcxGS}0gnq*0(1WF1%uYAq`q9AlCVK2 z%J`+6g!h3@YhMzV>t7PK2z_(>g3S2Z2@t6-*WV-@7J|~hx&6NnKK1EJAvY`pC44$h zpK@l_|2}Ax6KOwp-4xePJR2$~=J9g`+kehJ-R+X-47_ z9y967d5(m&rhuhiY416czFhB>Fz;CsS23C6?|xGIbN%PyVvGs+Q-Mk#?+M=>f=U&02VZxUk(VbE+>>Ph+e6X-u76j#ZP6AEVi#S`fN`}Kyx z<0b_Y%DN`dzki9Lzs96sLfLwuZ*J$`E;aO@lpSM=U)s5I0{z&HhQhxIJqe^n2E)H1k|Mv`(k5y6SfF4_nr@yD$kfQtR J{9;1c{{kGQXKw%i delta 4144 zcmZ8k4RBP|6~5>F?7rPi_CML(5XlCK2C$o?2J%P9u5sxmq)D_=!6KU=35mrdnN90WkBD*%C%*%&l9ZrlUSR{~`OdMTgUt^xF~pSCWpt zlDHQl_U%TN?Z6u$V(T)zeS9l?S-3r{b7#tO-OS4Qz0wK)T-$GRoZ;j0-(KJSmt)I* zbJwZc(gD6%F3zzdjneD=Zxumy{)~Jnc=>yB0M_u=l>lF%1i?a>_n~&V@Z3rs$P)T4 z(v`Uw&C^jIFm6?2yjks9!6eKs8$Z(MrXD30Lurf!8_MgpG4w1mY)_`|#)2evEn>P( z*6LEz1?%G;OCVJ0(P3%yLT@RLS?WVpgG=Icoet z*u12^$y1*C)ZTA0nWL0+;`nl8CPvP+jc$1~F* zvfxklQRF9>>SKB!ofp*-qw(p)$d+j~6v6=;Ey?u^jS~C?y$ly4#!jR{{G(na9?}>KzGl&FuteZu8#J#9sLnT zFD+~C9Spbk2zzJu`i@A15rtG-xU=M%QmjYCd;h1I%x0ATMfo7gtf@?<3FQ|kkD;9R zStj!?N;+?pjp2s8_Be6nO+ zjk#p7XacF1qEOe8UY!3!|k-B$xC|n``E>4r7VgDSdNWyxpgDj8Mv@f7TJD{LW4a7Dg@xfCL<)+%W-KVK0Fz1XuxI6Ya{} zm1t`NS`*4r|7rwXklI2hA?ogfJBimIz#vSJr_qr{u?e0a@O>{0-7wTq?q=8Z2)4m| z^0a6-plt+Fl;A4Y0D{}#PvlvdeIJT37$@+fz!voEfpSW)D)e)D{)6y$Lf4Ce9)YvO zTWzDcJPZ$$Cuxr$I12Yr?lw`}I6O|CH5v`)i%k6pU8*(oEb@FOh_=9KJ%d2H2K^G5 zHJUIg%SKBFjZLUqpTqu{w29O*V$y62=6+NJ)5j#5UJDs;ee_}|uDe#s@C=&#YA1O^ z{vV@7eG3~)p8r z0>SK;s0*O6fRF$|ScN9Y%OX!c6cCstKp5y*Az#qu!hMwBB9W~arYXT}0p`QIL@N;B zGU!ba3JVm0b;K(apcGyu&l~~1%d{4B{SK=ZgW_U2x1iS=&7$Rg0?o>ki1mghi`ma% z{}MQ9*ghfuTjZyP(NTh}1rZ7gj=w^ql*{bRC?1ep6n_bB3Q8j?3L(8YM8VF_v0XsD zK4xqqVpl^9`ww7{gSuGYB!ZmYpK?4+FpoTPdMuUoI964z(Q7HCyRzO!)DzRFMk(Ev zR2f;+TqZlK9W{2t^hvkJ)U4&eI4q8+$xri_wtzxG}tit~M2GA`Cja4d3+?BX%LEj1U5 zV*#vAGar!34dMe_U|@enn#wdr+Y12v$C*t6=Za3CDbxy78-h7_(?PHY?|bl;@NICB z!?+$q36EhTUPbvBYVvV{Z(yUmLyZc|CYduS7lA7MQ?+ToS7BwDs(z@-U8-H1P_;v< z`hqIotlB?NeG3t2y9Lq?sQyE0mbMHnD+T!jRojT*m#W-EWND*n`w;t(6#im$kF_H? z(A6_^6TiBqg72%D=7$!y@L9FR_Kx+PN&RHOuc|H0?(D}?2J1+6u5VvAz#pn@vLusz z?Q0kE>?QHMo7%g3ShArdxv{@{up_yqeV~JNb*%5}=;s@jyyoo3lS-tE4GgaB?u~Te z_cf1q)wMQ^n+IroXu869OU%WlX4o$`?BFh7!+7+|}qZ<->det()kKiLxvjCpHfC7Ic&xF) zK5ig98*Xb{{AZkfk6Y^=^wPm zT)``w-Tb!ZN~q*7G}l3rLrb0g&Qd+iM+$FjS!BC;p$-##w57uS{30ElX8aX&-d&+X t3%9ja*!EZJ=zZSMT45iqF{m=Xy>*dog|Ygp_yjuBG2MA1{-00G{vSnA45I)5 diff --git a/helper.c b/helper.c deleted file mode 100644 index f26f951..0000000 --- a/helper.c +++ /dev/null @@ -1,90 +0,0 @@ -// goal: -// replace "file" + "checksec" - -#include -#include -#include -#include -#include - -#define MAX_FILENAME 256 -#define EI_NIDENT 16 -#define MAX_HEADER_LEN 2048 - -#define Elf32_Half uint16_t -#define Elf32_Word uint32_t -#define Elf32_Addr uint32_t -#define Elf32_Off uint32_t - -struct Elf32_Ehdr -{ - unsigned char e_ident[EI_NIDENT]; - Elf32_Half e_type; - Elf32_Half e_machine; - Elf32_Word e_version; - Elf32_Addr e_entry; - Elf32_Off e_phoff; - Elf32_Off e_shoff; - Elf32_Word e_flags; - Elf32_Half e_ehsize; - Elf32_Half e_phentsize; - Elf32_Half e_phnum; - Elf32_Half e_shentsize; - Elf32_Half e_shnum; - Elf32_Half e_shstrndx; -}; - -int parse_elf_header32(struct Elf32_Ehdr* header, FILE* fp) -{ - fread(header, sizeof(struct Elf32_Ehdr), 1, fp); - return EXIT_SUCCESS; -} - -int main(int argc, char* argv[]) -{ - // Accessing file arg - if (argc < 2) - { - printf("Usage: %s \n", argv[0]); - return -EINVAL; - } - - char* filename = argv[1]; - - // 0. is ELF32 or ELF64 ??? - // 1. create ELF header struct - // 2. populate ELF header struct - // 3. display ELF header struct - - if (!filename) - { - printf("Error parsing filename.\n"); - return -EINVAL; - } - - FILE* elf_file = fopen(filename, "rb"); - - if (!elf_file) - { - printf("Couldn't open file '%s'\n", filename); - return -ENOENT; - } - - struct Elf32_Ehdr elf_header = {0}; - int res = parse_elf_header32(&elf_header, elf_file); - if (res) - { - printf("Error parsing ELF header.\n"); - return -EINVAL; - } - - if (!(memcmp(elf_header.e_ident, "\177ELF", 4) == 0)) - { - printf("Not an ELF file..\n"); - return -EINVAL; - } - - printf("ELF file\n"); - - return EXIT_SUCCESS; -} diff --git a/main.c b/main.c new file mode 100644 index 0000000..d2adc18 --- /dev/null +++ b/main.c @@ -0,0 +1,164 @@ +// goal: +// replace "file" + "checksec" + +#include +#include +#include +#include +#include + +#define MAX_FILENAME 256 +#define EI_NIDENT 16 +#define MAX_HEADER_LEN 2048 + +#define Elf32_Half uint16_t +#define Elf32_Word uint32_t +#define Elf32_Addr uint32_t +#define Elf32_Off uint32_t + +#define Elf64_Half uint32_t +#define Elf64_Word uint64_t +#define Elf64_Addr uint64_t +#define Elf64_Off uint64_t + +struct Elf32_Ehdr +{ + unsigned char e_ident[EI_NIDENT]; + Elf32_Half e_type; + Elf32_Half e_machine; + Elf32_Word e_version; + Elf32_Addr e_entry; + Elf32_Off e_phoff; + Elf32_Off e_shoff; + Elf32_Word e_flags; + Elf32_Half e_ehsize; + Elf32_Half e_phentsize; + Elf32_Half e_phnum; + Elf32_Half e_shentsize; + Elf32_Half e_shnum; + Elf32_Half e_shstrndx; +}; + +struct Elf64_Ehdr +{ + unsigned char e_ident[EI_NIDENT]; + Elf64_Half e_type; + Elf64_Half e_machine; + Elf64_Word e_version; + Elf64_Addr e_entry; + Elf64_Off e_phoff; + Elf64_Off e_shoff; + Elf64_Word e_flags; + Elf64_Half e_ehsize; + Elf64_Half e_phentsize; + Elf64_Half e_phnum; + Elf64_Half e_shentsize; + Elf64_Half e_shnum; + Elf64_Half e_shstrndx; +}; + +int parse_elf_header32(struct Elf32_Ehdr* header, FILE* fp) +{ + if (!fread(header, sizeof(struct Elf32_Ehdr), 1, fp)) + { + return -EINVAL; + } + return 0; +} + +int parse_elf_header64(struct Elf64_Ehdr* header, FILE* fp) +{ + if (!fread(header, sizeof(struct Elf64_Ehdr), 1, fp)) + { + return -EINVAL; + } + return 0; +} + +int read_elf_magic(FILE* fp) +{ + char buf[5] = {0}; + fread(buf, 1, 4, fp); + if (memcmp(buf, "\177ELF", 4) == 0) return 1; + return 0; +} + +void display_elf32(struct Elf32_Ehdr* header) +{ + printf("32-bit ELF\n"); +} + +void display_elf64(struct Elf64_Ehdr* header) +{ + printf("64-bit ELF\n"); +} + +unsigned char read_elf_obj_size(FILE* fp) +{ + unsigned char local_elf_obj_size = 0; + fseek(fp, 4, SEEK_SET); + fread(&local_elf_obj_size, 1, 1, fp); + rewind(fp); + return local_elf_obj_size; +} + +int main(int argc, char* argv[]) +{ + // Argument processing + if (argc < 2) + { + printf("Usage: %s \n", argv[0]); + return -EINVAL; + } + + char* filename = argv[1]; + if (!filename) + { + printf("Error parsing filename.\n"); + return -EINVAL; + } + + FILE* elf_file = fopen(filename, "rb"); + if (!elf_file) + { + printf("Couldn't open file '%s'\n", filename); + return -ENOENT; + } + + int is_elf = read_elf_magic(elf_file); + if (!is_elf) + { + printf("Not a valid ELF file.\n"); + return -EINVAL; + } + + // ELF32 or ELF64? + unsigned char elf_obj_size = read_elf_obj_size(elf_file); + + switch(elf_obj_size) + { + case 0x01: + struct Elf32_Ehdr elf32_header = {0}; + if (parse_elf_header32(&elf32_header, elf_file)) + { + printf("Failed to parse 32-bit ELF header\n"); + return -EINVAL; + } + display_elf32(&elf32_header); + break; + case 0x02: + struct Elf64_Ehdr elf64_header = {0}; + if (parse_elf_header64(&elf64_header, elf_file)) + { + printf("Failed to parse 64-bit ELF header\n"); + return -EINVAL; + } + display_elf64(&elf64_header); + break; + default: + printf("Invalid ELF object size\n"); + return -EINVAL; + } + + return EXIT_SUCCESS; +} diff --git a/makefile b/makefile index 700483f..33629db 100644 --- a/makefile +++ b/makefile @@ -1,5 +1,5 @@ all: - gcc -Wall -Wextra helper.c -g -o helpelf + gcc -Wall -Wextra main.c -g -o helpelf install: sudo cp helpelf /usr/bin/helpelf