1

My question is: Why does readelf -x .data bin.so give me empty data when ghidra does not? (0x00 repeated for section length until last element 0xFFFFFFFF).

ghidra/JEB contradict me by showing that it has populated data (only first 8 bytes are null). I have tried python tools lief, elfcat, among others.

Obtaining repro file:

  1. wget https://repo1.maven.org/maven2/com/facebook/fresco/imagepipeline/2.0.0/imagepipeline-2.0.0.aar
  2. unzip imagepipeline-2.0.0.aar "jni/arm64-v8a/libimagepipeline.so
  3. readelf -x .data jni/arm64-v8a/libimagepipeline.so
  4. Load the elf into ghidra and confirm that the .data section (can be found by double clicking on .data in "Program Tree" on left(default) hand side) is populated with excellent data.
Improve this question
2
  • I believe that the data section is somehow filled in the load time.
    – macro_controller
    Jan 30, 2020 at 8:11
  • Ghidra is implementing a component of dynamic behavior during static analysis? ouch, I had a brief look at ghidra code and aside from relocation remapping (which I didn't think affects .data), it looked kinda normal? ghidra elf parser
    – user30945
    Jan 30, 2020 at 8:37

1 Answer 1

Reset to default
1

The .data is filled with relocation information at load time.

from IDA:

LOAD:0000000000000598 08 20 01 00+                Elf64_Rela <0x12008, 0x403, 0x11EF> ; R_AARCH64_RELATIVE
LOAD:00000000000005B0 10 20 01 00+                Elf64_Rela <0x12010, 0x403, 0x1200> ; R_AARCH64_RELATIVE
LOAD:00000000000005C8 18 20 01 00+                Elf64_Rela <0x12018, 0x403, 0xC48> ; R_AARCH64_RELATIVE
LOAD:00000000000005E0 20 20 01 00+                Elf64_Rela <0x12020, 0x403, 0x127B> ; R_AARCH64_RELATIVE
LOAD:00000000000005F8 28 20 01 00+                Elf64_Rela <0x12028, 0x403, 0x128B> ; R_AARCH64_RELATIVE
LOAD:0000000000000610 30 20 01 00+                Elf64_Rela <0x12030, 0x403, 0xEE8> ; R_AARCH64_RELATIVE
LOAD:0000000000000628 38 20 01 00+                Elf64_Rela <0x12038, 0x403, 0x12F1> ; R_AARCH64_RELATIVE
LOAD:0000000000000640 40 20 01 00+                Elf64_Rela <0x12040, 0x403, 0x1300> ; R_AARCH64_RELATIVE
LOAD:0000000000000658 48 20 01 00+                Elf64_Rela <0x12048, 0x403, 0x1000> ; R_AARCH64_RELATIVE
LOAD:0000000000000670 50 20 01 00+                Elf64_Rela <0x12050, 0x403, 0x1305> ; R_AARCH64_RELATIVE
LOAD:0000000000000688 58 20 01 00+                Elf64_Rela <0x12058, 0x403, 0x1310> ; R_AARCH64_RELATIVE
LOAD:00000000000006A0 60 20 01 00+                Elf64_Rela <0x12060, 0x403, 0x104C> ; R_AARCH64_RELATIVE
LOAD:00000000000006B8 68 20 01 00+                Elf64_Rela <0x12068, 0x403, 0x1315> ; R_AARCH64_RELATIVE
LOAD:00000000000006D0 70 20 01 00+                Elf64_Rela <0x12070, 0x403, 0x132B> ; R_AARCH64_RELATIVE
LOAD:00000000000006E8 78 20 01 00+                Elf64_Rela <0x12078, 0x403, 0x1054> ; R_AARCH64_RELATIVE
LOAD:0000000000000700 80 20 01 00+                Elf64_Rela <0x12080, 0x403, 0x1334> ; R_AARCH64_RELATIVE
LOAD:0000000000000718 88 20 01 00+                Elf64_Rela <0x12088, 0x403, 0x132B> ; R_AARCH64_RELATIVE
LOAD:0000000000000730 90 20 01 00+                Elf64_Rela <0x12090, 0x403, 0x1074> ; R_AARCH64_RELATIVE
LOAD:0000000000000748 98 20 01 00+                Elf64_Rela <0x12098, 0x403, 0x134C> ; R_AARCH64_RELATIVE
LOAD:0000000000000760 A0 20 01 00+                Elf64_Rela <0x120A0, 0x403, 0x1359> ; R_AARCH64_RELATIVE
LOAD:0000000000000778 A8 20 01 00+                Elf64_Rela <0x120A8, 0x403, 0x1094> ; R_AARCH64_RELATIVE
LOAD:0000000000000790 B0 20 01 00+                Elf64_Rela <0x120B0, 0x403, 0x1360> ; R_AARCH64_RELATIVE
LOAD:00000000000007A8 B8 20 01 00+                Elf64_Rela <0x120B8, 0x403, 0x136F> ; R_AARCH64_RELATIVE
LOAD:00000000000007C0 C0 20 01 00+                Elf64_Rela <0x120C0, 0x403, 0x10A8> ; R_AARCH64_RELATIVE

You can see that every entry is corresponding to the data you see in the .data section.

Improve this answer
1
  • This is the correct info, I wish ghidra had displayed that the .data came from relocation section, might have saved me a few hours.
    – user30945
    Jan 30, 2020 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.