On VirusTotal, there are lots of ELF samples are missing section headers
when using file
command to see the info.
Also, when using the Python elftools
library to parse them, exceptions will be thrown.
Can these kinds of ELF files still be executed or dangerous? If so, what's the best way to parse them?
Example: https://www.virustotal.com/gui/file/7096d1deb8a097b25a74cb2b72009dc37430180b53725e1bec4d18be5856f139/detection (This is not a good example as it's a ".so" file.)
Add the real output:
readelf -h:
ELF Header:
Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, big endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: IBM S/390
Version: 0x1
Entry point address: 0x403650
Start of program headers: 52 (bytes into file)
Start of section headers: 1090000 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 27
Section header string table index: 26
readelf: Error: Reading 0x438 bytes extends past end of file for section headers
readelf -l:
readelf: Error: Reading 0x438 bytes extends past end of file for section headers
Elf file type is EXEC (Executable file)
Entry point 0x403650
There are 8 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x00400134 0x00400134 0x0000d 0x0000d R 0x1
[Requesting program interpreter: /lib/ld.so.1]
LOAD 0x000000 0x00400000 0x00400000 0xd7c70 0xd7c70 R E 0x1000
LOAD 0x0d7c70 0x004d8c70 0x004d8c70 0x2da34 0x3167c RW 0x1000
DYNAMIC 0x1052a8 0x005062a8 0x005062a8 0x000e0 0x000e0 RW 0x4
NOTE 0x000144 0x00400144 0x00400144 0x00020 0x00020 R 0x4
GNU_EH_FRAME 0x0d7b7c 0x004d7b7c 0x004d7b7c 0x0002c 0x0002c R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4