Remix.run Logo
wasmperson 7 hours ago

I extracted the linux executable and was surprised to find that both readelf and objdump choke on it despite it loading and running correctly. Some investigation reveals that the name of the dynamic linker was shoved into the "unused" fields in the PT_DYNAMIC header entry to save space:

  Program Headers:
    Type           Offset             VirtAddr           PhysAddr
                   FileSiz            MemSiz              Flags  Align
    INTERP         0x0000000000000088 0x0000000000010088 0x0000000000010088
                   0x000000000000001c 0x000000000000001c         0x0
        [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
    DYNAMIC        0x00000000000000e0 0x00000000000100e0 0x6c2f343662696c2f  <-- "/lib64/ld-linux-x86-64.so.2"
                   0x2d78756e696c2d64 0x732e34362d363878         0x322e6f
  readelf: Error: the dynamic segment offset + size exceeds the size of the file
    LOAD           0x0000000000000000 0x0000000000010000 0x0000000000000000
                   0x0000000000001dc0 0x0000000000005660  RWE    0x1000

Two questions:

1. Was this done manually or is there a tool you're using which does this? I see other size-reduction tricks in here as well.

2. Does anybody know of a tool for examining executables which doesn't crap out on binaries like this?

saidnooneever 25 minutes ago | parent | next [-]

ndisasm can help read it and hex editor. no tools should mangle such format, its useless savings, worth nothing. it will cause problem with AV and other things potentially.

saw some comments about DEP on windows and this and honestly i wouldnt touch this thing with a 10ft stick. if the creator want ppl to play it they can provide a normal binary. not some obfuscated mess.

oguz-ismail2 5 hours ago | parent | prev [-]

Choke how? Both work fine here