2.3 Some ELF Parser Bugs
@eZine
Published in
tmp0ut
· 3 Nov 2022
... field is officially for "big-endian only". https://github.com/bminor/binutils-gdb/blob/master/include/elf/common.h#L115 #define EM_MIPS 8 /* MIPS R3000 (officially, big-endian only) */ :: 1.1 Ghidra, Ida, GDB, binutils Anti-Debug ::::::::::::::::::::::::::::::::::::::::::::: To demonstrate how widespread this sort of issue is, let's take a look at some other tools commonly used to debug and analyze ELF files. When ei_data is changed to 1 in le.Eros.mips, Ghidra will recognize it as an ELF, but it won't know what language (cpu arch) it is. This was tested on ghidra_10.1.1_PUBLIC. The unmodified MI ...
