Upgrade to Frida 17.16.1 and elf modulemap writer fixes - #245
Merged
Conversation
Add complete ElfModule wrapper for Frida 17.15.0 ELF binary parsing: - from_file/from_memory constructors - Property accessors: pointer_size, byte_order, os_abi_version, mapped_size, base/preferred addresses, entrypoint, interpreter, source_path - enumerate_dynamic_entries for iterating ELF .dynamic section Platform-gated: only Linux/Android/FreeBSD (~200 lines) Tested: cargo build --features=auto-download
The filter closure was passed as a temporary Box with no GDestroyNotify, but Frida retains and re-invokes it on every ModuleMap::update. Now owns the closure by value with proper destroy callback: - Box::into_raw to transfer ownership to Frida - GDestroyNotify callback drops the box when map is finalized - No 'static bound needed - lifetime managed explicitly Also fixes new_from_names to capture owned copies of names instead of borrowing the caller's slice, since the filter outlives the call.
Instruction writer wrappers for void C functions were fabricating
-> bool { ...; true }, giving callers a meaningless success signal.
Changed to return () to match the C ABI:
- aarch64: put_call_address_with_arguments
- x86_64: put_leave, put_ret, put_ret_imm, put_jmp_short_label,
put_jmp_near_label, put_mov_reg_address, put_mov_reg_ptr_u32,
put_mov_reg_ptr_reg, put_mov_reg_reg_ptr, put_push_u32,
put_nop, put_pushfx, put_popfx, put_pushax, put_popax
The InstructionWriter trait methods still return bool as required by
the trait (arm/arm64 underlying C functions return gboolean).
kkuehl
changed the title
Fixes CI failure - the import was not actually used in the code.
tag field is already u32, no cast needed
kkuehl
changed the title
Contributor
Author
|
@s1341 Could we start with this one and I will bring in several much easier to digest PRs. Thanks! |
Contributor
|
merged. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add ElfModule API, fix soundness issues, and upgrade to Frida 17.15.4
This PR adds the ElfModule wrapper for Linux/Android/FreeBSD, fixes two soundness bugs in existing code, and bumps to Frida 17.15.4.
ElfModule API (Linux/Android/FreeBSD only)
Complete wrapper for Frida 17.15.0 ELF binary parsing:
from_file/from_memoryconstructorspointer_size,byte_order,os_abi_version,mapped_size,base_address,preferred_address,entrypoint,interpreter,source_pathenumerate_dynamic_entries/dynamic_entriesfor iterating ELF.dynamicsectioncfg(any(target_os = "linux", target_os = "android", target_os = "freebsd"))Use case: Parse ELF headers and dynamic sections for binary analysis on Linux-based systems.
Soundness Fixes
ModuleMap::new_with_filter use-after-free
The filter closure was passed as a temporary
Boxwith noGDestroyNotify, but Frida retains and re-invokes it on everyModuleMap::update.Fixed by:
Box::into_rawand transferring to FridaGDestroyNotifycallback to properly free the box when the map is finalized'staticbound - lifetime is now explicitly managedAlso fixes
new_from_namesto capture owned copies of names instead of borrowing the caller's slice, since the filter outlives the call.Writer return type correctness
Instruction writer wrappers for void C functions were fabricating
-> bool { ...; true }, giving callers a meaningless success signal.Changed to return
()to match the C ABI semantics:put_call_address_with_argumentsput_leave,put_ret,put_ret_imm,put_jmp_short_label,put_jmp_near_label,put_mov_reg_address,put_mov_reg_ptr_u32,put_mov_reg_ptr_reg,put_mov_reg_reg_ptr,put_push_u32,put_nop,put_pushfx,put_popfx,put_pushax,put_popaxThe
InstructionWritertrait methods still returnboolas required by the trait (arm/arm64 underlying C functions actually returngboolean).Version Bump