portugalfuturista/rizin
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
rizin/test/db/formats/coff
Anton Kochkov 88a4121d70 bin/coff: support TI COFF v2 48-byte section header 
The COFF section table walker assumed every COFF section header is
40 bytes -- the standard COFF1 form. The TI Common Object File Format
(SPRAAO8) extends this for TI COFF v2 (file magic 0x00C2) used by the
TI tools (asm55, cl55, cl6x, cl28, etc.):

  ------------------------------------------------------------------
  offset  size  field         standard COFF1     TI COFF v2
  ------------------------------------------------------------------
  0x00    8     s_name        char[8]            char[8]
  0x08    4     s_paddr       ut32               ut32
  0x0c    4     s_vaddr       ut32               ut32
  0x10    4     s_size        ut32               ut32
  0x14    4     s_scnptr      ut32               ut32
  0x18    4     s_relptr      ut32               ut32
  0x1c    4     s_lnnoptr     ut32               ut32
  0x20    2/4   s_nreloc      ut16               ut32  <-- widened
  0x22    2/4   s_nlnno       ut16               ut32  <-- widened
  0x24    4     s_flags       ut32               ut32
  0x28    -     reserved      -                  ut16  <-- new
  0x2a    -     mempage       -                  ut16  <-- new
  ------------------------------------------------------------------
  TOTAL          40                              48

Reading TI COFF v2 with the standard 40-byte stride walks the section
table off-by-8 per section, producing nonsense values for every
section after the first. In practice, vaddr and size for the second
section spill into the next section's name field, surfacing as
attention-grabbing decimal values like 0x7461642e (ASCII '.dat'
reversed -- bytes from the upcoming '.data' name being interpreted as
a size).

Concrete reproducer with TI asm55p output:
  $ wine asm55p.exe -v5505 03_branches_calls.s
  $ rz-bin -S 03_branches_calls.obj                # before this fix
  ...
  0x00000061 0x7461642e 0x00000040 0x7461642e ...  # garbage size
  ...
  $ rz-bin -S 03_branches_calls.obj                # after this fix
  0x000000fa       0x34 0x00000030       0x34 -r-x .text
  ...

Fix: add a parallel coff_init_scn_hdr_ti() that reads the 48-byte
layout, with nreloc/nlnno as ut32 (clamped to ut16 because the rest
of the COFF code keeps them as 16-bit and counts above 64K are not
encountered in practice). bin_coff_init_scn_hdr() picks the variant
based on coff_is_ti_machine() -- the same predicate already used in
the file-header parser to consume TI's f_target_id field.

Tested with TI asm55p output for C55x, C55x+, and C5500 (machine ids
0x9c, 0xa1, and TI_1/TI_2 file magics) -- sections now parse with the
correct sizes, vaddrs, and flags, and the resulting binaries open
cleanly under 'rizin -A' for analysis.
2026-05-28 17:44:54 +08:00

264 lines
9.9 KiB
Text
Raw Blame History

NAME=tifdir imports and sections
FILE=bins/coff/tif_dir.obj
CMDS=<<EOF
ii
iS
EOF
EXPECT=<<EOF
nth vaddr bind type lib name
-------------------------------------------------------
0 0x0000b690 NONE FUNC __TIFFmalloc
1 0x0000b698 NONE FUNC __TIFFrealloc
2 0x0000b6a0 NONE FUNC __TIFFmemset
3 0x0000b6a8 NONE FUNC __TIFFmemcpy
4 0x0000b6b0 NONE FUNC __TIFFfree
5 0x0000b6b8 NONE FUNC _TIFFFindField
6 0x0000b6c0 NONE FUNC _TIFFFieldWithTag
7 0x0000b6c8 NONE FUNC _TIFFReadDirectory
8 0x0000b6d0 NONE FUNC _TIFFErrorExt
9 0x0000b6d8 NONE FUNC _TIFFWarningExt
10 0x0000b6e0 NONE FUNC _TIFFSwabShort
11 0x0000b6e8 NONE FUNC _TIFFSwabLong
12 0x0000b6f0 NONE FUNC _TIFFSwabLong8
13 0x0000b6f8 NONE FUNC __TIFFGetFields
14 0x0000b700 NONE FUNC __TIFFGetExifFields
15 0x0000b708 NONE FUNC __TIFFSetupFields
16 0x0000b710 NONE FUNC __TIFFFillStriles
17 0x0000b718 NONE FUNC __TIFFNoPostDecode
18 0x0000b720 NONE FUNC __TIFFSwab16BitData
19 0x0000b728 NONE FUNC __TIFFSwab24BitData
20 0x0000b730 NONE FUNC __TIFFSwab32BitData
21 0x0000b738 NONE FUNC __TIFFSwab64BitData
22 0x0000b740 NONE FUNC _TIFFSetCompressionScheme
23 0x0000b748 NONE FUNC __TIFFDataSize
24 0x0000b750 NONE FUNC __TIFFCheckMalloc
25 0x0000b758 NONE UNK __fltused
paddr size vaddr vsize align perm name type flags
---------------------------------------------------------------------------------------------------------------
0x000001cc 0x2f 0x00000000 0x2f 0x0 -r-- .drectve LNK_INFO,LNK_REMOVE,ALIGN_1BYTES,MEM_NO_READ
0x000001fb 0x8670 0x00000030 0x8670 0x0 -r-- .debug_S CNT_INIT_DATA,ALIGN_1BYTES,MEM_DISCARDABLE
0x0000ad73 0x70 0x000086a0 0x70 0x0 -r-- .debug_T CNT_INIT_DATA,ALIGN_1BYTES,MEM_DISCARDABLE
0x0000ade3 0x625 0x00008710 0x625 0x0 -rw- .data CNT_INIT_DATA,ALIGN_8BYTES
0x0000b408 0x54 0x00008d40 0x54 0x0 -r-- .rdata CNT_INIT_DATA,ALIGN_4BYTES
0x00000000 0x8 0x00008da0 0x8 0x0 -rw- .bss CNT_UNIN_DATA,ALIGN_4BYTES
0x0000b45c 0x2895 0x00008db0 0x2895 0x0 -r-x .text_mn CNT_CODE,ALIGN_16BYTES
0x0000e967 0x8 0x0000b650 0x8 0x0 -r-- .rdata_0xe967 CNT_INIT_DATA,LNK_COMDAT,ALIGN_8BYTES
0x0000e96f 0x4 0x0000b660 0x4 0x0 -r-- .rdata_0xe96f CNT_INIT_DATA,LNK_COMDAT,ALIGN_4BYTES
0x0000e973 0x8 0x0000b670 0x8 0x0 -r-- .rdata_0xe973 CNT_INIT_DATA,LNK_COMDAT,ALIGN_8BYTES
0x0000e97b 0x4 0x0000b680 0x4 0x0 -r-- .rdata_0xe97b CNT_INIT_DATA,LNK_COMDAT,ALIGN_4BYTES
EOF
RUN
NAME=tiny coff
FILE=bins/coff/coff.obj
CMDS=oml;is;ir
EXPECT=<<EOF
1 fd: 4 +0x00000000 0x00000058 - 0x00000067 r-- vmap.reloc-targets
2 fd: 5 +0x00000064 0x00000000 * 0x00000026 r-x vmap..text
3 fd: 3 +0x0000008b 0x00000030 - 0x0000004b r-- fmap..data
nth paddr vaddr bind type size lib name
---------------------------------------------------------------
0 ---------- 0x00000058 NONE UNK 4 imp.MessageBoxA
0 ---------- 0x00000060 NONE UNK 4 imp.ExitProcess
0 0x00000064 0x00000000 LOCAL SECT 4 .text
0 0x00000064 0x00000000 GLOBAL FUNC 4 main
0 0x0000008b 0x00000030 LOCAL SECT 4 .data
vaddr paddr target type name
--------------------------------------------------------------------------
0x00000009 0x0000006d 0x00000030 IMAGE_REL_AMD64_REL32 .data
0x00000010 0x00000074 0x00000030 IMAGE_REL_AMD64_REL32 .data + 0x0000000f
0x0000001c 0x00000080 0x00000058 IMAGE_REL_AMD64_REL32 MessageBoxA
0x00000023 0x00000087 0x00000060 IMAGE_REL_AMD64_REL32 ExitProcess
EOF
RUN
NAME=tiny coff2
FILE=bins/coff/coff2.obj
CMDS=<<EOF
e asm.bytes=true
oml
iS
is
s sym.__1FooBar__QAE_XZ
pd 2
EOF
EXPECT=<<EOF
1 fd: 4 +0x00000000 0x00000e60 - 0x00000e6f r-- vmap.reloc-targets
2 fd: 3 +0x0000017c 0x00000000 - 0x000000ee r-- fmap..drectve
3 fd: 3 +0x0000026b 0x000000f0 - 0x00000b9f r-- fmap..debug$S
4 fd: 3 +0x00000d1b 0x00000ba0 - 0x00000c13 r-- fmap..debug$T
5 fd: 3 +0x00000d8f 0x00000c20 * 0x00000c4c r-x fmap..text$mn
6 fd: 5 +0x00000dbc 0x00000c50 - 0x00000d23 r-- vmap..debug$S
7 fd: 3 +0x00000ec2 0x00000d30 - 0x00000d59 r-x fmap..text$mn
8 fd: 5 +0x00000eec 0x00000d60 - 0x00000e33 r-- vmap..debug$S
9 fd: 5 +0x00000ff2 0x00000e40 - 0x00000e43 r-- vmap..rtc$IMZ
10 fd: 5 +0x00001000 0x00000e50 - 0x00000e53 r-- vmap..rtc$TMZ
paddr size vaddr vsize align perm name type flags
-----------------------------------------------------------------------------------------------------------------------
0x0000017c 0xef 0x00000000 0xef 0x0 -r-- .drectve LNK_INFO,LNK_REMOVE,ALIGN_1BYTES,MEM_NO_READ
0x0000026b 0xab0 0x000000f0 0xab0 0x0 -r-- .debug_S CNT_INIT_DATA,ALIGN_1BYTES,MEM_DISCARDABLE
0x00000d1b 0x74 0x00000ba0 0x74 0x0 -r-- .debug_T CNT_INIT_DATA,ALIGN_1BYTES,MEM_DISCARDABLE
0x00000d8f 0x2d 0x00000c20 0x2d 0x0 -r-x .text_mn CNT_CODE,LNK_COMDAT,ALIGN_16BYTES
0x00000dbc 0xd4 0x00000c50 0xd4 0x0 -r-- .debug_S_0xdbc CNT_INIT_DATA,LNK_COMDAT,ALIGN_1BYTES,MEM_DISCARDABLE
0x00000ec2 0x2a 0x00000d30 0x2a 0x0 -r-x .text_mn_0xec2 CNT_CODE,LNK_COMDAT,ALIGN_16BYTES
0x00000eec 0xd4 0x00000d60 0xd4 0x0 -r-- .debug_S_0xeec CNT_INIT_DATA,LNK_COMDAT,ALIGN_1BYTES,MEM_DISCARDABLE
0x00000ff2 0x4 0x00000e40 0x4 0x0 -r-- .rtc_IMZ CNT_INIT_DATA,LNK_COMDAT,ALIGN_4BYTES
0x00001000 0x4 0x00000e50 0x4 0x0 -r-- .rtc_TMZ CNT_INIT_DATA,LNK_COMDAT,ALIGN_4BYTES
nth paddr vaddr bind type size lib name
----------------------------------------------------------------------
0 ---------- ---------- LOCAL ABS 4 @comp.id-0x01055e97
0 ---------- ---------- LOCAL ABS 4 @feat.00-0x80000191
0 0x0000017c 0x00000000 LOCAL SECT 4 .drectve
0 0x0000026b 0x000000f0 LOCAL SECT 4 .debug$S
0 0x00000d1b 0x00000ba0 LOCAL SECT 4 .debug$T
0 0x00000d8f 0x00000c20 LOCAL SECT 4 .text$mn
0 0x00000dbc 0x00000c50 LOCAL SECT 4 .debug$S
0 0x00000ec2 0x00000d30 LOCAL SECT 4 .text$mn
0 0x00000eec 0x00000d60 LOCAL SECT 4 .debug$S
0 0x00000d8f 0x00000c20 GLOBAL FUNC 4 ??0FooBar@@QAE@XZ
0 0x00000ec2 0x00000d30 GLOBAL FUNC 4 ??1FooBar@@QAE@XZ
0 ---------- 0x00000e60 NONE FUNC 4 imp.__RTC_InitBase
0 ---------- 0x00000e68 NONE FUNC 4 imp.__RTC_Shutdown
0 0x00000ff2 0x00000e40 LOCAL SECT 4 .rtc$IMZ
0 0x00000ff2 0x00000e40 LOCAL UNK 4 __RTC_InitBase.rtc$IMZ
0 0x00001000 0x00000e50 LOCAL SECT 4 .rtc$TMZ
0 0x00001000 0x00000e50 LOCAL UNK 4 __RTC_Shutdown.rtc$TMZ
;-- section..text_mn_0xec2:
;-- ??1FooBar@@QAE@XZ:
;-- .text$mn:
0x00000d30 55 push ebp ; RELOC TARGET 10 ??1FooBar@@QAE@XZ @ 0x00000d30 ; [05] -r-x section size 42 named .text_mn_0xec2
0x00000d31 8bec mov ebp, esp
EOF
RUN
NAME=patched reloc x86
FILE=bins/coff/tif_dir.obj
CMDS=<<EOF
e asm.bytes=true
af @ sym._TIFFGetField
pd 1 @ 0x8dbd
axt @ sym._TIFFVGetField
pd 1 @ sym._TIFFVGetField+0xe
pd 1 @ sym.imp._TIFFFindField
EOF
EXPECT=<<EOF
| 0x00008dbd e80e000000 call sym._TIFFVGetField ; RELOC 32 _TIFFVGetField @ 0x00008dd0
sym._TIFFGetField 0x8dbd [CALL] call sym._TIFFVGetField
| 0x00008dde e8d5280000 call sym.imp._TIFFFindField; RELOC 32 _TIFFFindField
; CALL XREF from sym._TIFFVGetField @ 0x8dde
;-- _TIFFFindField:
0x0000b6b8 .dword 0x00000000 ; RELOC TARGET 32 _TIFFFindField
EOF
RUN
NAME=patching REL32 amd64
FILE=bins/coff/coff.obj
CMDS=<<EOF
e asm.bytes=true
pd 2 @ sym.main+6
EOF
EXPECT=<<EOF
0x00000006 4c8d05230000. lea r8, qword [0x00000030] ; sym..data ; "Win64 assembly"; RELOC 32 .data @ 0x00000030
0x0000000d 488d152b0000. lea rdx, qword [0x0000003f] ; str.Coffee_time ; "Coffee time!"; RELOC 32 .data @ 0x00000030 + 0xf
EOF
RUN
NAME=TI COFF v2: c28x target_id 0x009d -> cpu c28x
FILE=bins/tms320/emulateme_nostd.ccsv5.c28x.ticoff2.dbg.coff
CMDS=<<EOF
iI~^arch
iI~^cpu
iI~^bintype
EOF
EXPECT=<<EOF
arch tms320
cpu c28x
bintype coff
EOF
RUN
NAME=TI COFF v2: c54x target_id 0x0098 -> cpu c54x
FILE=bins/tms320/emulateme_nostd.ccsv5.c54x.ticoff2.dbg.coff
CMDS=<<EOF
iI~^cpu
EOF
EXPECT=<<EOF
cpu c54x
EOF
RUN
NAME=TI COFF v2: c55x target_id 0x009c -> cpu c55x
FILE=bins/tms320/emulateme_nostd.ccsv5.c55x.ticoff2.dbg.coff
CMDS=<<EOF
iI~^cpu
EOF
EXPECT=<<EOF
cpu c55x
EOF
RUN
NAME=TI COFF v2: c62x target_id 0x0099 -> cpu c64x
FILE=bins/tms320/emulateme_nostd.ccsv5.c62x.ticoff2.dbg.coff
CMDS=<<EOF
iI~^cpu
EOF
EXPECT=<<EOF
cpu c64x
EOF
RUN
NAME=TI COFF v2: c64x target_id 0x0099 -> cpu c64x
FILE=bins/tms320/emulateme_nostd.ccsv5.c64x.ticoff2.dbg.coff
CMDS=<<EOF
iI~^cpu
EOF
EXPECT=<<EOF
cpu c64x
EOF
RUN
NAME=TI COFF v2: c64xp target_id 0x0099 -> cpu c64x
FILE=bins/tms320/emulateme_nostd.ccsv5.c64xp.ticoff2.dbg.coff
CMDS=<<EOF
iI~^cpu
EOF
EXPECT=<<EOF
cpu c64x
EOF
RUN
NAME=TI COFF v2: c55xp file (target_id 0x009c) parses cleanly
FILE=bins/tms320/emulateme_nostd.ccsv5.c55xp.ticoff2.dbg.coff
CMDS=<<EOF
iI~^arch
iI~^bits
EOF
EXPECT=<<EOF
arch tms320
bits 32
EOF
RUN
NAME=TI COFF v2: stripped variant parses
FILE=bins/tms320/emulateme_nostd.ccsv5.c55x.ticoff2.dbg.stripped.coff
CMDS=<<EOF
iI~^arch
iS~.text
EOF
EXPECT=<<EOF
arch tms320
0x00000236 0x2da 0x00000030 0x2da 0x0 -r-x .text CNT_CODE,MEM_PURGEABLE,MEM_NO_READ
EOF
RUN
NAME=TI COFF v2: relocatable variant parses sections
FILE=bins/tms320/emulateme_nostd.ccsv5.c55x.ticoff2.rel.coff
CMDS=<<EOF
iI~^arch
iI~^cpu
EOF
EXPECT=<<EOF
arch tms320
cpu c55x
EOF
RUN
Reference in a new issue View git blame Copy permalink