Repository navigation
Validate ELF headers, fail on heap setup errors, add tracked launches - #9
Closed
ItsJokerZz wants to merge 0 commit into
Closed
ItsJokerZz wants to merge 0 commit into
ItsJokerZz wants to merge 0 commit into
Conversation
Contributor
|
Please separate this into two: one with bug fixes which I will likely merge, and a second one for the new feature. I don’t think I will merge the feature as it is designed right now, better to use http get request for this where you can pass parameters. |
Author
|
Sounds good- will do. |
Author
|
Bug fixes here on commit 8530ff5 |
Contributor
|
What does the max_size constant do? Limit elf file size? |
Author
|
It was an upper bound to stop the header's offsets and sizes from overflowing when added together. Checking for overflow directly does the same job without limiting file size, so I'll just remove it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
elfldr.c
elfldr_readrejects headers that are not 64-bit ELF, have a bad sectionheader size or count, or point past a 64 MB cap, and checks each section's
offset and size before using them. These values come straight off the
network and were used as allocation and receive sizes unchecked.
sizeof(Elf64_Ehdr)wheresizeof(Elf64_Shdr)was meant (samesize, no behaviour change).
of
elfldr_set_heap_sizewas ignored before, so the payload would runwith a default-sized heap.
socksrv.c
TRACKED, a 32-bit big-endian inputlength, up to 191 bytes of input, then the payload as usual.
(
/dev/null, or a socket pair carrying the input), and the client getsback
TPIDplus the pid, or -1 on failure.print
PAYLOAD_READYand kills it otherwise.pipeURI option, since its output nevergoes to the client.
Why
A client that launches payloads has no way to learn which process it
started, so it cannot stop or monitor it later. The tracked request gives
it the pid without mixing payload output into the reply. The rest is
hardening found along the way.
This brings the PS5 loader in line with the same changes proposed for the
PS4 loader, so one client can speak the same request to both.