Herschel
Herschel copied to clipboard
adimetrius
Elf: no symbol hash table
This is https://github.com/adimetrius/Herschel/commit/cc4bead0534a6824bca446a8d906e7952b0d8ffd.
Symbol hash table is not present in Albert sample. It is required to know length of symbol table.
See my ElfDecoder report for details: https://github.com/adimetrius/Herschel/files/5621861/Albert.zip.
Correct, symbol hash table is not implemented yet. It will be.
Your ElfDecoder report is awesome! Is the decoder available? Woudl it work in regular BB? I wish I had known about it - otherwise I had to use obsolete command-line-style readelf.
Your ElfDecoder report is awesome!
I ported 64 bit disassembler (HrDecoder) into my ElfDecoder today. New report: Albert.zip. I adjusted test program a bit and made quick and dirty fix for #3. I will publish ElfDecoder later.
ElfDecoder is published at https://github.com/X547/OberonUtils/tree/master/PE%20Decoder (module WorkElfDecoder, usage: WorkElfDecoder.Decode "<path>").
Mind you that HrDecoder is FAR FAR from being a complete 64-bit disassembler. It is based on the DevDecoder shipped with BB, which is 32-bit, and I've only changed (some of) the instructions that I generate in HrL. However, I introduced in it an attempt to detect procedure and variable references.
Mind you that HrDecoder is FAR FAR from being a complete 64-bit disassembler.
It is still better than nothing. I got a lot of *** decode error *** when decoding C++ applications, errors are mostly SSE related. Also I added support for multi-byte NOP (0F 1F), that are often present in executables. I don't know any better x86_64 disassemblers that can be easily ported to Component Pascal.
I introduced in it an attempt to detect procedure and variable references.
I recommend to handle disassembly and address to symbol name lookup in separate modules. In my decoders there are multiple disassembly modules with common interface that are dynamically loaded by module decoder. Address resolution is handled by module decoder. Disassembler call WorkDecoders.Handler.PutAdr to display address. This approach is used in DevDecoder, but it can't resolve addresses.