0

There is this piece of C code that is used extract info from binaries:

bincode_t *initialize_bincode(const char *file)
{
    bfd *abfd;
    bincode_t *bin;
    //char *target = "x86_64-unknown-linux-gnu";
    char *target = "i686-pc-linux-gnu";

    bfd_init();

    if (!bfd_set_default_target(target)) {
        bs_dbgmsg("  (!) bfd_set_default_target()\n");
        return NULL;
    }

    if ((abfd = bfd_openr(file, target)) == NULL) {
        bs_dbgmsg("  (!) bfd_openr(): %s\n", file);
        return NULL;
    }

    if (!bfd_check_format(abfd, bfd_object)) {
        //isolated the error to be here (through simple print debugging)
        bs_dbgmsg("  (!) bfd_check_format()\n");
        printf("Error: %s", bfd_errmsg(bfd_get_error()));
        bfd_close(abfd);
        return NULL;
    }

    if((bin = malloc(sizeof(bincode_t))) == NULL) {
        bs_errmsg("  (!) malloc(): bin\n");
        exit(EXIT_FAILURE);
    }

I ran this code on Linux against 2 Windows binary samples. However, one of sample results in an error of

Error: File format not recognized ... Section flag STYP_DSECT (0x1) ignored

The file command on both samples results in the following output:

fc671a044d48bffe519a89b06d289d83f52958cb: PE32 executable (GUI) Intel 80386, for MS Windows

and

fe0c189a5067a2dfe46bad1c2cedaa5b7bbc6a20: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

The second binary (DLL) results into the error. My question is, why did this happen? What can I do to resolve this? I would like the code to also "see" the DLL binary.

I plugged the DLL binary into gdb and indeed gdb didn't recognize the file. GDB output:

...not in executable format: File format not recognised

Edit 1: Added code and completed error message output. Kindly note that I am a C beginner.

Edit 2: As suggested in the comments, I have used bfd_errmsg(bfd_get_error()) and included the output above.

jowabels
  • 122
  • 1
  • 9
  • Show us your code so we can answer your question. From what you've described, it sounds like you're not accessing the file correctly. – David Sep 30 '16 at 04:05
  • Is it documented that bfd_check_format sets errno? – user253751 Sep 30 '16 at 04:06
  • on error, bfd_check_format returns false with following error codes: `bfd_error_invalid_operation`, `file_not_recognised`, etc – jowabels Sep 30 '16 at 04:23
  • I am not sure if `strerror(errno)` was correct or not in showing the error message in the preceding code – jowabels Sep 30 '16 at 04:24
  • You should print `bfd_errmsg (bfd_get_error ())` instead. – Tom Tromey Sep 30 '16 at 21:54
  • @TomTromey Thanks for the suggestion that indeed was helpful. The file format was not recognized. Any thoughts on why is this the case and/or how to get around this? – jowabels Oct 03 '16 at 03:48
  • The thing I'd look at is what targets were configured in BFD. You could try rebuilding it, configuring with `--enable-targets=all`. – Tom Tromey Oct 03 '16 at 17:19

0 Answers0