Skip to content

qiling cannot load elf which have a zero memory size segment #1353

@DiamondHunters

Description

@DiamondHunters

*Describe the bug
when I try to runing ql = Qiling(["./moveAside"], rootfs="rootfs/x86_linux")
an error thrown.

  File "qiling\core.py", line 184, in __init__
    self.loader.run()
  File "qiling\loader\elf.py", line 107, in run
    self.load_with_ld(elffile, stack_address + stack_size, load_address, self.argv, self.env)
  File "qiling\loader\elf.py", line 217, in load_with_ld
    mem_start, mem_end = load_elf_segments(elffile, load_address, self.path)
  File "qiling\loader\elf.py", line 205, in load_elf_segments
    self.ql.mem.map(lbound, ubound - lbound, perms, os.path.basename(info))
  File "qiling\os\memory.py", line 609, in map
    if not self.is_available(addr, size):
  File "qiling\os\memory.py", line 488, in is_available
    assert size > 0, 'expected a positive size value'
AssertionError: expected a positive size value
Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x08048034 0x08048034 0x00100 0x00100 R   0x4
  INTERP         0x000134 0x08048134 0x08048134 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x08048000 0x08048000 0x00330 0x00330 R   0x1000
  LOAD           0x001000 0x08049000 0x08049000 0x0ce46 0x0ce46 R E 0x1000
  LOAD           0x00e000 0x08056000 0x08056000 0x00000 0x00000 R   0x1000
  LOAD           0x00ef50 0x08056f50 0x08056f50 0x5a942c 0x7a9440 RW  0x1000
  DYNAMIC        0x00ef50 0x08056f50 0x08056f50 0x000b0 0x000b0 RW  0x4
  GNU_RELRO      0x00ef50 0x08056f50 0x08056f50 0x000b0 0x000b0 R   0x1

I found that this is caused by the presence of a segment with a memory size of 0
At "qiling\loader\elf.py", line 205, in load_elf_segments
self.ql.mem.map(lbound, ubound - lbound, perms, os.path.basename(info))
ubound has the same value with lbound,then map size is 0,qiling does not accept this.
But the executable program runs well in a real environment with glibc.
Perhaps there is a lack of special treatment for such boundary conditions?

Sample Code

ql = Qiling(["./moveAside"], rootfs="rootfs/x86_linux")

Expected behavior

Screenshots

Additional context

moveAside.zip

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions