Segfault when reading .dynstr (strtab) in an ELF file - c

Question

I'm trying to read the names of shared libraries used in binaries, using the C language. So far, I have the following program in test.c:
#include <string.h>
#include <sys/mman.h>
#include <elf.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <fcntl.h>
int main(int argc, char **argv) {
const char *ls = NULL;
int fd = -1;
struct stat stat = {0};
if (argc != 2) {
printf("Missing arg\n");
return 0;
}
// open the file in readonly mode
fd = open(argv[1], O_RDONLY);
if (fd < 0) {
perror("open");
goto cleanup;
}
// get the file size
if (fstat(fd, &stat) != 0) {
perror("stat");
goto cleanup;
}
// put the file in memory
ls = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
if (ls == MAP_FAILED) {
perror("mmap");
goto cleanup;
}
Elf64_Ehdr *eh = (Elf64_Ehdr *)ls;
// looking for the PT_DYNAMIC segment
for (int i = 0; i < eh->e_phnum; i++) {
Elf64_Phdr *ph = (Elf64_Phdr *)((char *)ls + (eh->e_phoff + eh->e_phentsize * i));
const char *strtab = NULL;
if (ph->p_type == PT_DYNAMIC) {
const Elf64_Dyn *dtag_table = (const Elf64_Dyn *)(ls + ph->p_offset);
// looking for the string table
for (int j = 0; 1; j++) {
// the end of the dtag table is marked by DT_NULL
if (dtag_table[j].d_tag == DT_NULL) {
break;
}
if (dtag_table[j].d_tag == DT_STRTAB) {
strtab = (const char *)dtag_table[j].d_un.d_ptr;
printf("string table addr: %p\n", strtab);
}
}
// no string table ? we're stuck, bail out
if (strtab == NULL) {
printf("no strtab, abort\n");
break;
}
// now, i print shared libraries
for (int j = 0; 1; j++) {
// the end of the dtag table is marked by DT_NULL
if (dtag_table[j].d_tag == DT_NULL) {
break;
}
if (dtag_table[j].d_tag == DT_NEEDED) {
printf("too long: %d\n", &strtab[dtag_table[j].d_un.d_val] >= ls + stat.st_size);
printf("string offset in strtab: %lu\n", dtag_table[j].d_un.d_val);
printf("string from strtab: %s\n", &strtab[dtag_table[j].d_un.d_val]);
}
}
// only go through the PT_DYNAMIC segment we found,
// other segments dont matter
break;
}
}
// cleanup memory
cleanup:
if (fd != -1) {
close(fd);
}
if (ls != MAP_FAILED) {
munmap((void *)ls, stat.st_size);
}
return 0;
}
I compile it with:
gcc -g -Wall -Wextra test.c
When I run ./a.out a.out (so reading the shared libraries of itself), it seems to work fine, I get the following output:
string table addr: 0x4003d8
too long: 0
string offset in strtab: 1
string from strtab: libc.so.6
However, when I run it against system binaries, like /bin/ls, with ./a.out /bin/ls, then I get a segfault at line 78.
string table addr: 0x401030
too long: 0
string offset in strtab: 1
Segmentation fault (core dumped)
I don't know why. Reading the /bin/ls with readelf, the adresses I use seem right and the string offset seems right too:
$ readelf -a /bin/ls | grep dynstr
...
[ 6] .dynstr STRTAB 0000000000401030 00001030
...
$ readelf -p .dynstr /bin/ls
String dump of section '.dynstr':
[ 1] libselinux.so.1
...
What am I doing wrong?

Answer 1

What am I doing wrong?
For a non-PIE binary, this:
strtab = (const char *)dtag_table[j].d_un.d_ptr;
points to where the .dynstr would have been if that binary was actually running in current process.
If the binary is not running, you need to relocate this value by $where_mmaped - $load_addr. The $where_mmaped is your ls variable. The $load_addr is the address where the binary was statically linked to load (usually it's the p_vaddr of the first PT_LOAD segment; for x86_64 binary the typical value is 0x400000).
You'll note that this neatly explains why ./a.out a.out works: you read .dynstr from your own address space, while using a.out to figure out correct offsets.