1

On VirusTotal, there are lots of ELF samples are missing section headers when using file command to see the info.

Also, when using the Python elftools library to parse them, exceptions will be thrown.

Can these kinds of ELF files still be executed or dangerous? If so, what's the best way to parse them?

Example: https://www.virustotal.com/gui/file/7096d1deb8a097b25a74cb2b72009dc37430180b53725e1bec4d18be5856f139/detection (This is not a good example as it's a ".so" file.)


Add the real output:

readelf -h:

ELF Header:
  Magic:   7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           IBM S/390
  Version:                           0x1
  Entry point address:               0x403650
  Start of program headers:          52 (bytes into file)
  Start of section headers:          1090000 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         27
  Section header string table index: 26
readelf: Error: Reading 0x438 bytes extends past end of file for section headers

readelf -l:

readelf: Error: Reading 0x438 bytes extends past end of file for section headers

Elf file type is EXEC (Executable file)
Entry point 0x403650
There are 8 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00400034 0x00400034 0x00100 0x00100 R E 0x4
  INTERP         0x000134 0x00400134 0x00400134 0x0000d 0x0000d R   0x1
  [Requesting program interpreter: /lib/ld.so.1]
  LOAD           0x000000 0x00400000 0x00400000 0xd7c70 0xd7c70 R E 0x1000
  LOAD           0x0d7c70 0x004d8c70 0x004d8c70 0x2da34 0x3167c RW  0x1000
  DYNAMIC        0x1052a8 0x005062a8 0x005062a8 0x000e0 0x000e0 RW  0x4
  NOTE           0x000144 0x00400144 0x00400144 0x00020 0x00020 R   0x4
  GNU_EH_FRAME   0x0d7b7c 0x004d7b7c 0x004d7b7c 0x0002c 0x0002c R   0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4

1 Answer 1

2
  • Section information is not used at all when the kernel loads a program into memory to create its process image. In other words, execution in no way depends on section information.
  • Stripping section information from a binary is not in and of itself necessarily an indicator of dangerous/criminal functionality, although it can serve to make analysis more difficult.
  • According to VirusTotal, the example binary you linked to contains 29 sections, so I am not sure what that is supposed to be an example of. Perhaps one of the fields in the ELF header having to do with sections has been edited/corrupted to slow down automatic analysis, since section information cannot be displayed.
    • if the section header table is still present in the binary, the ELF header can be repaired so that this information is properly parsed. See here for an example
    • run readelf -h against the binary to see if the ELF header has been corrupted
  • A number of tools can parse such a binary, including radare2, Cutter, IDA, and Ghidra
4
  • How about those ones with file command output including: "error reading (Invalid argument)"
    – I Wonder
    Feb 18, 2020 at 22:59
  • 1
    @IWonder No idea. Use readelf with the -h option to look at the header, and then the -l option to look at section-to-segment mappings. If your are serious about getting help, share the output of the above commands in your post
    – julian
    Feb 18, 2020 at 23:04
  • Added in the comment
    – I Wonder
    Feb 19, 2020 at 1:11
  • @IWonder looks like section information hasn’t been removed from the binary but readelf cannot parse the section header table. My guess is that the sh_off value is not correct. If this is the case you will need to manually inspect the binary to determine the correct section header table offset
    – julian
    Feb 19, 2020 at 21:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.