Files
rea/src/flutter/DartElf.test.ts
T
560674e2de feat(native): report binary hardening for ELF, PE and Mach-O (#8524)
* feat(native): report binary hardening for ELF, PE and Mach-O

Documents inspect_binary_hardening and its CLI equivalent, including
per-property states, supporting evidence, read budgets, and one report
per Mach-O slice. Explains that missing protection imports remain
unknown, signature presence does not establish validity, and hardened
runtime requires inspect_signature. Adds hardening links throughout the
documentation. The supplied diff also removes the advanced CodeQL
workflow and configuration, along with snapshot-binding mismatch
guidance.

* fix(native): validate declared payloads and dynamic tables before hardening rows

Run the shared range checks for ELF, read imports from the dynamic tables
rather than section metadata, and keep an unresolved symbol count apart from
an absent table. Check every Mach-O command before building rows and retain
only the offsets the rows need.

Make the verifier's readelf output wide, check the emitted format before
parsing Mach-O, and place the sources before the libraries in the link.

* fix(native): share Mach-O segment admission with hardening reads

A segment with a section count its cmdsize cannot hold passed the hardening
reader and could enable restrict_segment. Move the size, section count and
file range checks to a shared admission that readMachoImage and the hardening
reader both use, and pin the ELF load-size case with a regression test.

* fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters

Segment admission never checked each section's payload range, so a
file-backed section past the slice still produced rows. Decode sections with
the section header owner and mark the slice malformed when a payload leaves
it; zero-fill and empty sections own no file bytes and are exempt.

admitInterp accepted a NUL first byte in a longer extent, which counted an
empty interpreter as PIE evidence. It now requires a nonempty path.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH

* fix(native): read CFG instrumentation from decoded GuardFlags

Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already
decodes instead of masking the raw GuardFlags word a second time.

* fix(native): reject ELF table spans a second PT_LOAD remaps

The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through
the one PT_LOAD containing the table's first address. A second PT_LOAD
starting inside the table could map the rest of it from other file bytes
and the reader still reported parsed import evidence.

Cap each mapping at the next PT_LOAD that starts inside it, reject a
requested range that crosses that boundary, and stop hash reads at the
same limit, matching the conflicting-mapping refusal in readElfSymbols.

* fix(native): dedupe ELF note tables only on shared boundaries

The hardening reader dropped any note table whose bytes another table
already covered. A covering SHT_NOTE can hold a non-GNU note whose
descriptor is itself a complete GNU property note, while PT_NOTE names
that inner note directly. Walking only the outer stream missed the GNU
marker and reported CET disabled.

Drop an alias only when it starts and ends on boundaries of admitted
tables, which are note boundaries of the walked streams. Any other
covered alias leaves the feature rows unknown, as a partial overlap
already does.

* fix(native): admit every Mach-O symbol record after a canary match

The Mach-O stack protector scan returned as soon as it found an
undefined ___stack_chk_fail, so a later undefined symbol whose n_strx
lay outside the string table was never checked. The same damaged table
parsed or failed as malformed depending only on record order.

Keep the match and finish the bounded record walk. Records after the
match are only checked against the string table bounds, so their names
are not read or charged to the scan budget. The ELF reader already
admits its whole symbol table before matching names.

* fix(native): accept ELF load aliases with the same file translation

The hardening reader treated every PT_LOAD that starts inside a table,
or that also contains the table's address, as a conflicting mapping.
A load with the same address-to-file translation names the same file
bytes, so tables it overlaps still have one interpretation, and the
canonical ElfLoadMap already merges such spans.

Treat equivalent loads as one interpretation. A load with a different
translation, or the zero-filled tail of an equivalent load, still ends
the usable range, so a remapped table is still rejected.

* fix(native): keep same-span ELF note tables with different alignments unknown

A section and a program header that share endpoints were treated as one
note stream even when their effective note alignments differed. Walking the
same bytes at 4 and 8 can frame different notes, so dropping the second table
could hide a GNU property word and report CET or BTI as disabled.

Require matching effective alignment at both endpoints, and no alignment
change inside the covered span, before treating a table as an alias.
Otherwise mark the feature rows unknown. The fixture's .note.gnu.property
section now declares the class's note alignment, as toolchains emit it.

* refactor(native): read LC_SYMTAB through the shared fixed-word decoder

Move the Mach-O fixed uint32 command layouts out of MachoCommandNames
into domain/apple/machoLoadCommands so there is one owner of those
offsets. MachoCommandNames and the hardening reader now both decode
through it; the hardening reader keeps its own bounds and import policy.

* fix(native): skip Mach-O common definitions in canary imports

A common definition sets N_UNDF|N_EXT like an import but stores its
allocation size in n_value. An object holding only
`int __stack_chk_fail;` therefore reported stack_protector: enabled.

Require a zero n_value before an undefined external counts as an
import, for both nlist widths.

* refactor(native): read linkedit data commands through the shared fixed-word decoder

readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that
FIXED_WORD_FIELDS already owns. Take the command and decode through
decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the
truncation and endianness behavior.

* fix(native): skip empty SHT_NOTE sections in ELF hardening

A zero-sized SHT_NOTE owns no bytes, so the section directory marks it
not file-backed and the hardening reader rejected the whole image as
malformed, while readElfImage accepted the same bytes. Skip empty note
sections before the file-backing check; they have nothing to walk.

* fix(scripts): run hardening verifier commands through the shared owner

The binary hardening verifier started its probes and compiler drivers with
raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md
requires. Every launch now goes through createVerifierCommands, and the
temporary root is removed only after the owner closes cleanly.

* fix(scripts): clean up hardening verifier commands on Ctrl-C

SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached
compiler trees and the temporary root could outlive the verifier. The
verifier now turns those signals into an abort that every owned command
receives, so cleanup closes the owner and removes the root before exit.

* fix(scripts): fail the hardening verifier when a signal lands outside a command

Only the owned commands read the interruption signal, so a SIGINT or
SIGTERM during the final cleanup or between commands was recorded and
then dropped, and the verifier exited 0. After cleanup settles, the
verifier now throws the interruption reason. A failure the operation or
its cleanup already raised still leaves first and is not replaced.

* fix(native): fail Mach-O slices with a malformed encryption command

The hardening reader turned every malformed status from the shared
encryption reader into an unknown `encrypted` row, so a short
LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the
slice parsed with a full report.

Only two conflicting encryption commands stay an unknown row now. Any other
encryption defect fails the slice like other structural command failures.

* fix(native): ignore STB_LOCAL undefined ELF symbols as imports

A local undefined __stack_chk_fail or __memcpy_chk is never resolved
against another object, so it does not establish an external import.
Skip STB_LOCAL bindings when reading protector signs, and give the
fixture's positive symbols STB_GLOBAL binding.

---------

Co-authored-by: Matt Van Horn <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
2026-11-06 01:07:00 +08:00

635 lines
24 KiB
TypeScript

import { describe, expect, it } from "vitest";
import { readElfSymbols, readSnapshotHeader } from "./DartElf.js";
import {
REFERENCE_HASH,
buildElf32Image,
buildElf64Image,
buildStrippedElf64Image,
snapshotSection,
appendElfRanges,
} from "./FlutterBuild.fixture.js";
const readElfSymbol = async (bytes: Buffer, name: string) => {
const result = await readElfSymbols(bytes, [name]);
return result.symbols[0] === undefined
? { failure: result.failures[0]! }
: { symbol: result.symbols[0] };
};
/**
* Build a synthetic ELF64 little-endian image with one PT_LOAD segment
* and a dynamic symbol table naming the Dart snapshot sections. This keeps
* the golden tests self-contained instead of reading the author's disk.
*/
const GALLERY_HASH = REFERENCE_HASH;
const imageWithSections = (): Buffer => {
const elf = buildElf64Image([
{ name: "_kDartVmSnapshotData", value: 0x400, size: 52 },
{ name: "_kDartIsolateSnapshotData", value: 0x800, size: 52 },
]);
const section = snapshotSection(GALLERY_HASH);
return Buffer.concat([
elf,
Buffer.alloc(0x400 - elf.length),
section,
Buffer.alloc(0x800 - 0x400 - section.length),
section,
]);
};
/** The same layout without section headers: symbols live in PT_DYNAMIC. */
const strippedImageWithSections = (
extraDynamicEntries: ReadonlyArray<readonly [number, bigint]> = [],
): Buffer => {
const elf = buildStrippedElf64Image(
[
{ name: "_kDartVmSnapshotData", value: 0x400, size: 52 },
{ name: "_kDartIsolateSnapshotData", value: 0x800, size: 52 },
],
extraDynamicEntries,
);
const section = snapshotSection(GALLERY_HASH);
return Buffer.concat([
elf,
Buffer.alloc(0x400 - elf.length),
section,
Buffer.alloc(0x800 - 0x400 - section.length),
section,
]);
};
describe("readElfSymbol", () => {
it("locates snapshot symbols in a synthetic ELF64 image", async () => {
const image = imageWithSections();
const isolateData = await readElfSymbol(image, "_kDartIsolateSnapshotData");
if ("failure" in isolateData) throw new Error(isolateData.failure.reason);
expect(isolateData.symbol.offset).toBe(0x800);
expect(isolateData.symbol.size).toBe(52);
const header = readSnapshotHeader(image, isolateData.symbol.offset);
expect(header.magicValid).toBe(true);
expect(header.kind).toBe(3);
});
it("refuses a non-ELF image instead of guessing", async () => {
const result = await readElfSymbol(Buffer.from("not an elf at all"), "x");
expect("failure" in result && result.failure.reason).toBe(
"not an ELF image",
);
});
it("refuses an unknown symbol", async () => {
const result = await readElfSymbol(buildElf64Image([]), "_kDartAbsent");
expect("failure" in result).toBe(true);
});
it("locates snapshot symbols in a section-stripped ET_DYN image", async () => {
const image = strippedImageWithSections();
const isolateData = await readElfSymbol(image, "_kDartIsolateSnapshotData");
if ("failure" in isolateData) throw new Error(isolateData.failure.reason);
expect(isolateData.symbol.offset).toBe(0x800);
expect(isolateData.symbol.size).toBe(52);
const header = readSnapshotHeader(image, isolateData.symbol.offset);
expect(header.magicValid).toBe(true);
expect(header.kind).toBe(3);
});
it.each([
[16, "DT_SYMBOLIC"],
[22, "DT_TEXTREL"],
[24, "DT_BIND_NOW"],
] as const)(
"ignores the payload of %s (%s) without losing symbols",
async (tag, _name) => {
const names = ["_kDartVmSnapshotData", "_kDartIsolateSnapshotData"];
const control = await readElfSymbols(
strippedImageWithSections([[tag, 0n]]),
names,
);
expect(control.failures).toEqual([]);
expect(control.symbols).toHaveLength(2);
const image = strippedImageWithSections([[tag, 0xffffffffffffffffn]]);
const original = Buffer.from(image);
expect(await readElfSymbols(image, names)).toEqual(control);
expect(Buffer.compare(image, original)).toBe(0);
},
);
it.each([4, 5, 6, 10, 11, 0x6ffffef5])(
"keeps representability checks for consumed dynamic tag %s",
async (tag) => {
const image = strippedImageWithSections([[tag, 0xffffffffffffffffn]]);
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [{ reason: "Dynamic entry is not representable" }],
});
},
);
it("refuses a stripped image whose PT_DYNAMIC carries no symbols", async () => {
// Drop the PT_DYNAMIC program header by leaving only PT_LOAD.
const image = strippedImageWithSections();
image.writeUInt16LE(1, 0x38); // e_phnum
const result = await readElfSymbol(image, "_kDartVmSnapshotData");
expect("failure" in result && result.failure.reason).toBe(
"symbol _kDartVmSnapshotData is not in the dynamic symbol table",
);
});
it("keeps refusing a stripped image that is not ET_DYN", async () => {
const image = buildStrippedElf64Image([]);
image.writeUInt16LE(1, 0x10); // ET_REL: the dynamic fallback must not apply
const result = await readElfSymbol(image, "_kDartVmSnapshotData");
expect("failure" in result && result.failure.reason).toBe(
"ELF section header table is missing or out of bounds",
);
});
it.each([false, true])(
"ignores undefined entries with loadable values (stripped: %s)",
async (stripped) => {
const image = stripped
? strippedImageWithSections()
: imageWithSections();
const table = stripped
? Number(
image.readBigUInt64LE(
Number(image.readBigUInt64LE(64 + 56 + 8)) + 8,
),
)
: Number(
image.readBigUInt64LE(
Number(image.readBigUInt64LE(0x28)) + 64 + 0x18,
),
);
for (const sectionIndex of [
0,
0xfff2,
0xffff,
...(stripped ? [] : [0x1234]),
]) {
image.writeUInt16LE(sectionIndex, table + 6);
expect(
await readElfSymbol(image, "_kDartVmSnapshotData"),
).toHaveProperty("failure");
expect(
await readElfSymbol(image, "_kDartIsolateSnapshotData"),
).toMatchObject({ symbol: { offset: 0x800, size: 52 } });
}
},
);
});
describe("dynamic symbols without a SHT_DYNSYM section", () => {
it.each([false, true])(
"uses PT_DYNAMIC with a retained directory (data sections: %s)",
async (retainDataSections) => {
const original = strippedImageWithSections();
const image = appendElfRanges(
original,
"section",
retainDataSections
? [
{ type: 1, offset: 0x400, size: 52 },
{ type: 1, offset: 0x800, size: 52 },
]
: [],
);
const names = ["_kDartVmSnapshotData", "_kDartIsolateSnapshotData"];
const control = await readElfSymbols(original, names);
expect(control.failures).toEqual([]);
expect(control.symbols).toHaveLength(2);
const before = Buffer.from(image);
expect(await readElfSymbols(image, names)).toEqual(control);
expect(Buffer.compare(image, before)).toBe(0);
},
);
it("keeps malformed present dynsym sections as failures despite usable PT_DYNAMIC", async () => {
const image = appendElfRanges(strippedImageWithSections(), "section", [
{ type: 11, offset: 0, size: 0 },
]);
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [{ reason: "Dynamic symbol table is malformed" }],
});
});
it("keeps bounded dynamic metadata requirements with a retained directory", async () => {
const image = appendElfRanges(strippedImageWithSections(), "section", []);
// The first entry is DT_SYMTAB, whose address must remain representable.
const dynamic = Number(image.readBigUInt64LE(64 + 56 + 8));
image.writeBigUInt64LE(0xffffffffffffffffn, dynamic + 8);
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [{ reason: "Dynamic entry is not representable" }],
});
});
});
describe("ELF symbol-table ownership", () => {
it.each([
{ address: 0x400, offset: 0x700, size: 52 },
{ address: 0x410, offset: 0x710, size: 4 },
{ address: 0x3f0, offset: 0x6f0, size: 20 },
])(
"rejects conflicting interpretations of any symbol byte: %j",
async (range) => {
const image = appendElfRanges(imageWithSections(), "program", [
{ type: 1, ...range },
]);
const names = ["_kDartVmSnapshotData", "_kDartIsolateSnapshotData"];
const result = await readElfSymbols(image, names);
expect(result.symbols).toEqual([
{ name: names[1], offset: 0x800, size: 52 },
]);
expect(result.failures).toContainEqual({
reason: expect.stringContaining("conflicting PT_LOAD"),
});
const phoff = Number(image.readBigUInt64LE(0x20));
const first = Buffer.from(image.subarray(phoff, phoff + 56));
image.copy(image, phoff, phoff + 56, phoff + 112);
first.copy(image, phoff + 56);
expect(await readElfSymbols(image, names)).toEqual(result);
},
);
it("accepts equivalent overlaps and excludes adjacent unrelated mappings", async () => {
const image = appendElfRanges(imageWithSections(), "program", [
{ type: 1, address: 0x410, offset: 0x410, size: 4 },
{ type: 1, address: 0x400 + 52, offset: 0x700, size: 4 },
]);
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [{ name: "_kDartVmSnapshotData", offset: 0x400, size: 52 }],
failures: [],
});
});
it("does not publish an earlier definition when another definition has unresolved mapping", async () => {
const image = imageWithSections();
const shoff = Number(image.readBigUInt64LE(0x28));
const symbols = Number(image.readBigUInt64LE(shoff + 64 + 0x18));
image.writeUInt32LE(image.readUInt32LE(symbols), symbols + 24);
const conflict = appendElfRanges(image, "program", [
{ type: 1, address: 0x810, offset: 0x710, size: 4 },
]);
const result = await readElfSymbols(conflict, ["_kDartVmSnapshotData"]);
expect(result.symbols).toEqual([]);
expect(result.failures).toEqual([
{
reason: "Symbol _kDartVmSnapshotData has conflicting PT_LOAD mappings",
},
]);
});
it("handles zero-width symbols at a unique segment end without choosing a conflicting shared endpoint", async () => {
const image = imageWithSections();
const shoff = Number(image.readBigUInt64LE(0x28));
const symbols = Number(image.readBigUInt64LE(shoff + 64 + 0x18));
const at = Number(image.readBigUInt64LE(64 + 0x20));
image.writeBigUInt64LE(BigInt(at), symbols + 8);
image.writeBigUInt64LE(0n, symbols + 16);
expect(
(await readElfSymbols(image, ["_kDartVmSnapshotData"])).symbols,
).toEqual([{ name: "_kDartVmSnapshotData", offset: at, size: 0 }]);
const ambiguous = appendElfRanges(image, "program", [
{ type: 1, address: at, offset: 0x700, size: 4 },
]);
expect(
(await readElfSymbols(ambiguous, ["_kDartVmSnapshotData"])).symbols,
).toEqual([]);
});
it.each(["hash", "symbols", "strings"] as const)(
"rejects partially conflicting dynamic %s mappings",
async (table) => {
const image = strippedImageWithSections();
const dynamic = Number(image.readBigUInt64LE(64 + 56 + 8));
const tagIndex = table === "hash" ? 4 : table === "symbols" ? 0 : 1;
const at = Number(image.readBigUInt64LE(dynamic + tagIndex * 16 + 8));
const conflict = appendElfRanges(image, "program", [
{ type: 1, address: at + 1, offset: 0x700, size: 1 },
]);
const result = await readElfSymbols(conflict, ["_kDartVmSnapshotData"]);
expect(result.symbols).toEqual([]);
expect(result.failures).toContainEqual({
reason: expect.stringContaining("conflicting PT_LOAD"),
});
},
);
it.each([false, true])(
"keeps a symbol terminator inside dynstr (stripped: %s)",
async (stripped) => {
const image = stripped
? strippedImageWithSections()
: imageWithSections();
const name = "_kDartVmSnapshotData";
if (stripped) {
const dynamic = Number(image.readBigUInt64LE(64 + 56 + 8));
image.writeBigUInt64LE(BigInt(name.length + 1), dynamic + 2 * 16 + 8); // DT_STRSZ, leading NUL included.
} else {
const shoff = Number(image.readBigUInt64LE(0x28));
image.writeBigUInt64LE(BigInt(name.length + 1), shoff + 2 * 64 + 0x20);
}
expect((await readElfSymbols(image, [name])).symbols).toEqual([]);
},
);
it("uses DT_HASH's count when strings precede symbols instead of reading following payload", async () => {
const image = strippedImageWithSections();
const dynamic = Number(image.readBigUInt64LE(64 + 56 + 8));
const symbols = Number(image.readBigUInt64LE(dynamic + 8));
image.copy(image, 0x300, symbols, symbols + 48);
image.writeBigUInt64LE(0x300n, dynamic + 8);
const hash = Number(image.readBigUInt64LE(dynamic + 4 * 16 + 8));
image.writeUInt32LE(1, hash + 4); // Only the VM entry belongs to dynsym.
const result = await readElfSymbols(image, [
"_kDartVmSnapshotData",
"_kDartIsolateSnapshotData",
]);
expect(result.symbols).toEqual([
{ name: "_kDartVmSnapshotData", offset: 0x400, size: 52 },
]);
expect(result.failures).toContainEqual({
reason:
"symbol _kDartIsolateSnapshotData is not in the dynamic symbol table",
});
image.writeBigUInt64LE(0x60000001n, dynamic + 4 * 16); // No recognized count table.
expect(
(await readElfSymbols(image, ["_kDartVmSnapshotData"])).failures,
).toContainEqual({
reason: "Stripped ELF has no DT_HASH or DT_GNU_HASH symbol count",
});
});
it("bounds GNU hash chains and resolves both requested symbols in one inventory", async () => {
const image = strippedImageWithSections();
const dynamic = Number(image.readBigUInt64LE(64 + 56 + 8));
const hash = Number(image.readBigUInt64LE(dynamic + 4 * 16 + 8));
image.writeBigUInt64LE(0x6ffffef5n, dynamic + 4 * 16);
image.fill(0, hash, hash + 32);
image.writeUInt32LE(1, hash); // nbuckets
image.writeUInt32LE(1, hash + 4); // symoffset
image.writeUInt32LE(1, hash + 8); // bloom words
image.writeUInt32LE(1, hash + 24); // bucket: last chain begins at symbol 1
image.writeUInt32LE(1, hash + 28); // chain terminator; count is 2
const names = ["_kDartVmSnapshotData", "_kDartIsolateSnapshotData"];
expect(
(await readElfSymbols(image, names)).symbols.map((symbol) => symbol.name),
).toEqual(names);
image.writeUInt32LE(0xffffffff, hash + 24);
expect((await readElfSymbols(image, names)).symbols).toEqual([]);
image.writeUInt32LE(0, hash + 24);
expect((await readElfSymbols(image, names)).failures).toHaveLength(1);
});
});
/** Section-header field positions for each ELF class. */
const ELF_CLASSES = {
elf64: {
build: buildElf64Image,
word: {
read: (image: Buffer, at: number) => Number(image.readBigUInt64LE(at)),
write: (image: Buffer, value: number, at: number) =>
image.writeBigUInt64LE(BigInt(value), at),
},
shoff: 0x28,
shent: 64,
flags: 8,
address: 0x10,
offset: 0x18,
},
elf32: {
build: buildElf32Image,
word: {
read: (image: Buffer, at: number) => image.readUInt32LE(at),
write: (image: Buffer, value: number, at: number) =>
image.writeUInt32LE(value, at),
},
shoff: 0x20,
shent: 40,
flags: 8,
address: 0x0c,
offset: 0x10,
},
} as const;
describe.each(Object.entries(ELF_CLASSES))(
"allocated %s symbol tables",
(_, layout) => {
const { word } = layout;
/** Snapshot sections, with dynamic tables allocated at their offsets. */
const allocatedTables = (): {
image: Buffer;
headers: number[];
tables: number[];
} => {
const elf = layout.build([
{ name: "_kDartVmSnapshotData", value: 0x400, size: 52 },
]);
const section = snapshotSection(GALLERY_HASH);
const image = Buffer.concat([
elf,
Buffer.alloc(0x400 - elf.length),
section,
]);
const shoff = word.read(image, layout.shoff);
const headers = [shoff + layout.shent, shoff + 2 * layout.shent];
const tables = headers.map((header) => {
const offset = word.read(image, header + layout.offset);
word.write(image, 2, header + layout.flags);
word.write(image, offset, header + layout.address);
return offset;
});
return { image, headers, tables };
};
it("accepts tables whose mapping matches their sections", async () => {
const { image } = allocatedTables();
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [{ name: "_kDartVmSnapshotData", offset: 0x400, size: 52 }],
failures: [],
});
});
it.each([
[0, "Dynamic symbol table has conflicting PT_LOAD mappings"],
[1, "Dynamic symbol string table has conflicting PT_LOAD mappings"],
])(
"refuses table %i under a conflicting PT_LOAD interpretation",
async (table, reason) => {
const { image, tables } = allocatedTables();
const conflict = appendElfRanges(image, "program", [
{ type: 1, address: tables[table]!, offset: 0x300, size: 4 },
]);
expect(
await readElfSymbols(conflict, ["_kDartVmSnapshotData"]),
).toEqual({ symbols: [], failures: [{ reason }] });
},
);
it("refuses a table whose section offset disagrees with its mapping", async () => {
const { image, headers } = allocatedTables();
word.write(image, 0x300, headers[0]! + layout.address);
expect(await readElfSymbols(image, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [
{
reason:
"Dynamic symbol table section offset disagrees with its PT_LOAD mapping",
},
],
});
});
},
);
describe("readSnapshotHeader", () => {
it("reads a synthesized data header", async () => {
const header = readSnapshotHeader(snapshotSection(GALLERY_HASH), 0);
expect(header.magicValid).toBe(true);
expect(header.kind).toBe(3);
});
it("reports nulls for sections without the data magic", async () => {
const header = readSnapshotHeader(Buffer.from([0, 0, 0, 0, 0, 0, 0, 0]), 0);
expect(header).toEqual({
magicValid: false,
kind: null,
headerLength: null,
hash: null,
complete: false,
});
});
});
it("keeps section admission ahead of program admission for unrepresentable raw offsets", async () => {
const bytes = buildStrippedElf64Image([]);
bytes.writeBigUInt64LE(0xffffffffffffffffn, 0x28);
bytes.writeBigUInt64LE(0xffffffffffffffffn, 0x20);
expect(await readElfSymbols(bytes, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [
{ reason: "ELF section header table is missing or out of bounds" },
],
});
bytes.writeBigUInt64LE(0n, 0x28);
expect(await readElfSymbols(bytes, ["_kDartVmSnapshotData"])).toEqual({
symbols: [],
failures: [
{ reason: "ELF program header table is missing or out of bounds" },
],
});
});
it.each([256, 257])(
"preserves Dart's narrower symbol-name window for a %i-byte name",
async (length) => {
const name = "n".repeat(length);
const original = buildElf64Image([{ name: "seed", value: 64, size: 4 }]);
const sectionTable = Number(original.readBigUInt64LE(0x28));
const stringHeader = sectionTable + 2 * 64;
const stringOffset = Number(original.readBigUInt64LE(stringHeader + 0x18));
const bytes = Buffer.concat([original, Buffer.alloc(length + 2)]);
bytes.write(name, stringOffset + 1, "latin1");
bytes[stringOffset + 1 + length] = 0;
bytes.writeBigUInt64LE(BigInt(length + 2), stringHeader + 0x20);
bytes.writeBigUInt64LE(BigInt(bytes.length), 64 + 0x20);
expect(await readElfSymbols(bytes, [name])).toEqual(
length === 256
? { symbols: [{ name, offset: 64, size: 4 }], failures: [] }
: {
symbols: [],
failures: [
{ reason: `symbol ${name} is not in the dynamic symbol table` },
],
},
);
},
);
it("checks raw symbol precision only after definition and requested-name selection", async () => {
const bytes = buildElf64Image([
{ name: "unselected", value: 64, size: 4 },
{ name: "selected", value: 64, size: 4 },
]);
const expected = await readElfSymbols(bytes, ["selected"]);
const sectionTable = Number(bytes.readBigUInt64LE(0x28));
const symbols = Number(bytes.readBigUInt64LE(sectionTable + 64 + 0x18));
bytes.writeBigUInt64LE(0xffffffffffffffffn, symbols + 8);
bytes.writeBigUInt64LE(0xffffffffffffffffn, symbols + 16);
expect(await readElfSymbols(bytes, ["selected"])).toEqual(expected);
expect(await readElfSymbols(bytes, ["unselected"])).toEqual({
symbols: [],
failures: [{ reason: "Symbol unselected has unrepresentable bounds" }],
});
bytes.writeUInt16LE(0, symbols + 6);
expect(await readElfSymbols(bytes, ["unselected"])).toEqual({
symbols: [],
failures: [
{ reason: "symbol unselected is not in the dynamic symbol table" },
],
});
});
it("keeps precision admission limited to consumed ELF program fields and types", async () => {
const original = buildElf64Image([{ name: "selected", value: 64, size: 4 }]);
const expected = await readElfSymbols(original, ["selected"]);
const bytes = appendElfRanges(original, "program", [
{ type: 0x70000001, offset: 0, size: 0 },
]);
const table = Number(bytes.readBigUInt64LE(32));
const width = bytes.readUInt16LE(54);
for (const relative of [8, 16, 24, 32, 40, 48])
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + width + relative);
// The load mapping does not consume physical address, memory size or alignment.
for (const relative of [24, 40, 48])
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + relative);
expect(await readElfSymbols(bytes, ["selected"])).toEqual(expected);
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + 32);
expect(await readElfSymbols(bytes, ["selected"])).toEqual({
symbols: [],
failures: [{ reason: "ELF segment 0 is not file-backed" }],
});
});
it("keeps section precision checks on consumed declarations and mapping fields", async () => {
const bytes = buildElf64Image([{ name: "selected", value: 64, size: 4 }]);
const expected = await readElfSymbols(bytes, ["selected"]);
const table = Number(bytes.readBigUInt64LE(40));
// An unrelated null record may carry uninterpreted declaration words.
for (const relative of [8, 16, 24, 32, 48, 56])
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + relative);
// Alignment is not consumed for this symbol-table mapping.
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + 64 + 48);
expect(await readElfSymbols(bytes, ["selected"])).toEqual(expected);
bytes.writeBigUInt64LE(0xffffffffffffffffn, table + 64 + 8);
expect(await readElfSymbols(bytes, ["selected"])).toEqual({
symbols: [],
failures: [
{ reason: "Dynamic symbol table has an unrepresentable section header" },
],
});
});
it("keeps ignored DT_NULL payloads separate from unsigned tag precision admission", async () => {
const names = ["_kDartVmSnapshotData"];
const control = await readElfSymbols(strippedImageWithSections(), names);
expect(control.failures).toEqual([]);
expect(
await readElfSymbols(
strippedImageWithSections([[0, 0xffffffffffffffffn]]),
names,
),
).toEqual(control);
const bytes = strippedImageWithSections([[16, 0n]]);
const table = Number(bytes.readBigUInt64LE(64 + 56 + 8));
bytes.writeBigInt64LE(-1n, table + 5 * 16);
expect(await readElfSymbols(bytes, names)).toEqual({
symbols: [],
failures: [{ reason: "Dynamic entry is not representable" }],
});
});