Question: libelfmaster

[eteran]

I've noticed the examples, but don't see libelfmaster itself available. Reverse engineering is a field I work in and was curious about what the library can do.

Will it be available soon?

Thanks!

[elfmaster]

eteran, thank you for asking. An alpha version (Work in progress) will be released sometime very soon, before the end of the month. I just want to do a few tests. The examples are just getting people prepared to use it, giving some ideas of how it can be used. They are obviously very simple examples and I use them for my own personal regression tests.

[elfmaster]

This library is meant to be used for designing reverse engineering applications largely. The idea is that it can easily handle loading and parsing malformed binaries, and forensically reconstruct the section headers and symbol tables. Very similarly to how I did it with ECFS github.com/elfmaster/ecfs

[elfmaster]

Quick example:

elfmaster@limitless:~/git/libelfmaster/examples$ stripx test_stripped 
elfmaster@limitless:~/git/libelfmaster/examples$ ./symbols ./test_stripped
pause: 0-0
__gmon_start__: 0-0
__libc_start_main: 0-0
puts: 0-0
: 0-0
sub_400420: 0x400420-0x400460
sub_400470: 0x400470-0x40048a
sub_400490: 0x400490-0x4004ba
sub_400590: 0x400590-0x4005f5
sub_400600: 0x400600-0x400602
elfmaster@limitless:~/git/libelfmaster/examples$ ./plt_dump test_stripped
0x400450: pause
0x400440: __libc_start_main
0x400430: puts
0x400420: PLT-0
elfmaster@limitless:~/git/libelfmaster/examples$ ./sections test_stripped
.gnu.hash: 0x400298-0x4002b8
.dynsym: 0x4002b8-0x400330
.dynstr: 0x400330-0x400373
.got.plt: 0x601000-0x601040
.plt: 0x400420-0x400460
.rela.plt: 0x4003b8-0x400400
.init: 0x400400-0x400420
.fini: 0x400604-0x400420
.text: 0x400248-0x400604
.init_array: 0x600e10-0x600e18
.fini_array: 0x600e18-0x600e20
.dynamic: 0x600e28-0x600ff8
.eh_frame_hdr: 0x40061c-0x400650
.eh_frame: 0x400654-0x40056c
.symtab: 0-0
.strtab: 0-0
elfmaster@limitless:~/git/libelfmaster/examples$ readelf -S test_stripped

There are no sections in this file.
readelf: Error: Reading 8656 bytes extends past end of file for dynamic string table

[elfmaster]

Can you tell me a bit about your edb debugger? I was going to incorporate a userland based debugging API int libelfmaster, that should work against hostile software. Since it won't be using ptrace() and will be able to intelligently identify anti-debugging techniques. This will need alot of love. Haven't been able to put the time in yet.

[eteran]

edb is basically intended to be ollydbg, but for Linux and better! It uses ptrace internally, which of course means that there are certain anti-debugger tricks which would work. However, all of the ptrace code is abstracted out into a plugin, so in principle, it could be switched to a different mechanism with no change to the main application.

[eteran]

libelfmaster's examples look like they provide a very clean and usable API. I look forward to checking it out once it's ready for the public 👍

[elfmaster]

Awesome, maybe we can do some work together. Thank you for taking an interest. edb sounds pretty cool, I used ollydbg with strongOD (anti-anti-debugging) before to break some binary protection stuff, but beyond that I mostly have used IDA for Reversing. As an RE I'm sure you will have some great input for libelfmaster. If you like I can add you to the code base if you want to take a look.

[eteran]

I think that sounds great