Skip to content

use both .debug_frame and .eh_frame in dwarf parsing #8421

Description

@psifertex

Right now, when parsing an elf with dwarf, either .debug_frame or .eh_frame are parsed, but some files have both and have distinct data in one vs the other. We should be able to pull the best sources from both:

if file.section_by_name(".eh_frame").is_some() {
let mut eh_frame = gimli::EhFrame::load(section_reader)
.map_err(|e| format!("Failed to load EH frame: {}", e))?;
if file.architecture() == object::Architecture::Aarch64 {
eh_frame.set_vendor(gimli::Vendor::AArch64);
}
let address_size = file
.architecture()
.address_size()
.map(|s| s.bytes())
.unwrap_or(if file.is_64() { 8 } else { 4 });
eh_frame.set_address_size(address_size);
parse_unwind_section(&file, eh_frame).map_err(|e| format!("Error parsing .eh_frame: {}", e))
} else if file.section_by_name(".debug_frame").is_some() {
let mut debug_frame = gimli::DebugFrame::load(section_reader)
.map_err(|e| format!("Failed to load debug frame: {}", e))?;
if file.architecture() == object::Architecture::Aarch64 {
debug_frame.set_vendor(gimli::Vendor::AArch64);
}
let address_size = file
.architecture()
.address_size()
.map(|s| s.bytes())
.unwrap_or(if file.is_64() { 8 } else { 4 });
debug_frame.set_address_size(address_size);
parse_unwind_section(&file, debug_frame)
.map_err(|e| format!("Error parsing .debug_frame: {}", e))
} else {
Ok(Default::default())
}

As an example, see super shade stands ideally in the funcion at 0x155d44

Very very quick prototype test available at: https://github.com/Vector35/binaryninja-api/tree/dwarf_combine_headers

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions