Samuel,
Source file attached. It needs libelf-dev package and:
cc -o check_0x5070FF check_0x5070FF.c -lelf
It shows up as an obviously rushed prototype that could be rationalised
and optimised. I thought about that but concluded it was pointless to
risk breaking a "throw away" tool. It has been tested on 64 bit but
might need some adaptation for 32 bit.
Cheers,
Mike.
On 23/07/2026 22:55, Samuel Thibault wrote:
Re,
Michael Kelly, le sam. 18 juil. 2026 21:35:50 +0100, a ecrit:
I wrote a small program to inspect all Elf executable 'progbits'
sections in each library for similar patterns.
Could you share it? We still have some corrupted packages in the archive
which makes some package build go mayhem without an easy way to know
which library pose problem.
Samuel
#include <errno.h>
#include <error.h>
#include <fcntl.h>
#include <libelf.h>
#include <gelf.h>
#include <stdio.h>
#include <mach/mach.h>
#include <sys/mman.h>
#include <sys/stat.h>
static int
check_chunk(const char* addr,
const vm_offset_t start,
const vm_offset_t end,
const vm_offset_t offset)
{
if (offset < start || offset >= (end - 0x10))
return 0;
const unsigned char* content = (const unsigned char*)addr;
content += offset;
for (unsigned int i = 0; i < 0x10; i++)
{
if (content[i] != 0)
return 0;
}
/* fprintf(stderr, "zero chunk: %llx\n", offset); */
return 1;
}
static unsigned int
check_chunks(const void* addr,
const vm_offset_t start,
const vm_offset_t sz)
{
vm_offset_t end = (start + sz);
vm_offset_t offset = start;
unsigned int errors = 0;
while (offset < end)
{
const vm_offset_t page_offset = (offset & ~0xFFFULL);
unsigned int chunks =
(check_chunk(addr, offset, end, page_offset + 0x50) +
check_chunk(addr, offset, end, page_offset + 0x70) +
check_chunk(addr, offset, end, page_offset + 0xff0));
if (chunks >= 2)
{
/* fprintf(stderr, "%d zero chunks at offset: %x\n", chunks, offset); */
errors++;
}
if (offset & 0xFFF)
{
offset += 0x1000;
offset &= (~0xFFFULL);
}
else
offset += 0x1000;
}
return errors;
}
int
main(int argc, const char *argv[])
{
if (argc < 2)
error(1, 0, "Usage: <shared-lib-path>");
const char* libname = argv[1];
int fd = open(libname, O_RDONLY);
if (fd == -1)
error(1, errno, "Cannot open: %s", libname);
struct stat statbuf;
if (fstat(fd, &statbuf) == -1)
error(1, errno, "fstat");
vm_offset_t max_offset = statbuf.st_size;
vm_offset_t offset = 0;
unsigned int errors = 0;
void *addr = mmap(NULL, max_offset, PROT_READ, MAP_PRIVATE, fd, 0);
if (addr == MAP_FAILED)
error(1, errno, "mmap failed");
if (elf_version (EV_CURRENT) == EV_NONE)
error(1, 0, "elf initialisation failure: %s\n", elf_errmsg(-1));
Elf *elf_file = elf_begin (fd, ELF_C_READ, NULL);
if (elf_file)
{
Elf_Kind k = elf_kind (elf_file);
if (k == ELF_K_ELF)
{
Elf_Scn *scn = NULL;
while ((scn = elf_nextscn (elf_file, scn)) != NULL)
{
GElf_Shdr elf_shdr;
if (gelf_getshdr (scn, &elf_shdr) != &elf_shdr)
error (1, 0, "Cannot retrieve elf section header: %s\n",
elf_errmsg(-1));
if (elf_shdr.sh_type == SHT_PROGBITS &&
elf_shdr.sh_flags & SHF_EXECINSTR)
{
const vm_offset_t scn_offset = elf_shdr.sh_offset;
const vm_offset_t scn_size = elf_shdr.sh_size;
Elf_Data* data = NULL;
while ((data = elf_getdata (scn, data)) != NULL)
{
vm_offset_t data_offset = scn_offset + data->d_off;
vm_offset_t data_size = data->d_size;
if ((data_offset + data_size) <= max_offset)
{
/* fprintf(stdout, "Checking range: %llx-%llx\n", */
/* data_offset, */
/* data_offset + data_size); */
errors += check_chunks(addr, data_offset, data_size);
}
}
}
}
}
elf_end (elf_file);
}
else
{
fprintf(stderr, "elf_begin failed: %s\n", elf_errmsg(-1));
}
if (errors)
fprintf(stderr, "Possibly corrupt library: %s\n", libname);
if (munmap(addr, statbuf.st_size))
error(1, errno, "munmap failed");
return (errors ? 0 : 1);
}