5

I have an MIPS binary file that I want to analyze. I am having a little trouble understanding the way elfread and r2 interpret the adressing scheme from a binary.

For example, r2 finds a function named bcmVlan_setDefaultAction at the location 0x0800d318:

[0x0800fbb8]> s sym.bcmVlan_setDefaultAction  
[0x0800d318]>

While as per the .symtab table, this function is located at 0x0000d2c8

$ readelf -a bcmvlan.ko | grep bcmVlan_setDefaultAction
123: 0000d2c8   616 FUNC    GLOBAL DEFAULT    2 bcmVlan_setDefaultAction

I tried some other functions too. It seems the addresses shown by readelf and r2 are corelated, but I can't find why this difference is there.

Regards.

Improve this question
4
  • 1
    If the addresses are correlated, it might be because of different base addresses. Please compare the output of readelf -l <filename> | grep LOAD to the output of f~LOAD0 from radare2. You can also check radare's base address using e bin.baddr. To rebase, use r2 -B <0xaddr> <filename>.
    – Megabeets
    Jan 17, 2018 at 18:21
  • No instance of 'LOAD' found by r2 or readelf. It seems the base address used by r2 is 0x0800000. This explains part of the problem. BTW I found your posts about 'Gameboy' and 'Simple Crackme' to be very helpful and interesting.
    – Fulcrum
    Jan 17, 2018 at 19:03
  • Thanks! Mind to share the binary? It will help us understand better.
    – Megabeets
    Jan 17, 2018 at 19:14
  • That file is actually a linux kernel module (.ko) for MIPS architecture. I pulled it from my router. 'modinfo' shows that the file license is 'proprietary'. I'm not sure if I am allowed to share it. Any idea?
    – Fulcrum
    Jan 18, 2018 at 7:54

1 Answer 1

Reset to default
5

.symtab

The symbol table of readelf (.symtab) shows you the offset of each symbol from the base of the section the symbol is in.

As you showed us, when you listing the table you get something like that:

$ readelf --symbols <filename>
Symbol table '.symtab' contains 471 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND
     1: 00000000     0 SECTION LOCAL  DEFAULT    2
     2: 00000000     0 SECTION LOCAL  DEFAULT    4
     3: 00000000     0 SECTION LOCAL  DEFAULT    6
     4: 00000000     0 SECTION LOCAL  DEFAULT    8
     5: 00000000     0 SECTION LOCAL  DEFAULT   10
     6: 00000000     0 SECTION LOCAL  DEFAULT   12
       ...    ... Truncated for readability ...   ...
   462: 0000d2c8   616 FUNC    GLOBAL DEFAULT    2 bcmVlan_setDefaultAction

One column is interested us especially, which is the Ndx column. readelf identifies each section by an integer index. This is what Ndx stands for. The output of the .symtab shows us that our function bcmVlan_setDefaultAction belongs to Ndx number 2.

Section Table

To see which section has index number "2" you should execute:

$ readelf --sections <filename>

When you'll execute it you'd probably see something like this:

There are ?? section headers, starting at offset 0x????:
Section Headers:

  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] <section name>    <type>          00000000 0000?? 0000?? ??   A  0   0  4
  [ 2] .text             <type>          00000000 000050 00???? 00  AX  0   0 16

You function will probably be in the .text section which its base address (Off column) is 0x000050, i.e 0x50 bytes from the beginning of the file.

Then, it should all make sense since it is what you get when subtracting the address you got from readelf from the one you got from radare2:

0x0d318 - 0x0d2c8 = 0x50.
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.