Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Wed, 16 Mar 2022 05:06:10 +0000
To:     Kees Cook <keescook@chromium.org>
From:   James Jones <linux@theinnocuous.com>
Cc:     bp@alien8.de, x86@kernel.org, linux-kernel@vger.kernel.org
Reply-To: James Jones <linux@theinnocuous.com>
Subject: Re: [PATCH] x86: Remove a.out support
Message-ID: <bfbd9394-161b-0e70-00c5-79d0dd722e08@theinnocuous.com>
In-Reply-To: <202203151150.1CDB1D8DA@keescook>
References: <4c449fab-8135-5057-7d2c-7b948ce130cc@theinnocuous.com> <0b31b1d3-852d-6cab-82ae-5eecaec05679@theinnocuous.com> <202203151150.1CDB1D8DA@keescook>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On 3/15/22 12:51 PM, Kees Cook wrote:
> On Sat, Mar 12, 2022 at 06:06:26PM +0000, James Jones wrote:
>> [...]
>>> docs, including copies of the old mac and aln a.out binaries, is
>>> available here:
>>>
>>> https://github.com/cubanismo/jaguar-sdk
>
> Do these end up requiring libc4, etc? I see "uselib" syscalls in the
> disassembly...
>
> $ for i in $(objdump -b binary -D -m i386 aln mac | grep -B4 'int.*$0x80'=
 \
> =09| grep -E 'int|eax' | grep mov | awk '{print $8}' | cut -d, -f1 \
> =09| cut -c2- | sort -u); do printf "%d\n" $i; done | sort -n
> 1       exit
> 3       read
> 4       write
> 5       open
> 6       close
> 10      unlink
> 13      time
> 19      lseek
> 20      getpid
> 37      kill
> 45      brk
> 54      ioctl
> 55      fcntl
> 86      uselib
> 89      readdir
> 91      munmap
> 106     stat
> 107     lstat
> 108     fstat
> 126     sigprocmask
>
> It seems like it should be possible to create an ELF wrapper for simple
> a.out binaries...

I didn't need to dig up any ancient libraries to get these working. They
seem to be completely statically linked.

Probably getting a bit off topic, but I did spend a few hours searching
around for any existing tools to convert a binary from a.out->ELF, and
trying to come up with something myself by extracting the sections with
objdump and re-combining them into an ELF using a linker script placing
the sections at the same locations. I couldn't get it working in an
evening or two messing with it so I moved on, but I agree something like
this seems possible in theory. I got 'mac' converted to an ELF that
would load up and print its input prompt if run without parameters, but
only if run as root. As a regular user, it segfaults somewhere before it
even starts executing in the text section AFAICT. Any actual assembling
segfaults even when running as root. I never got 'aln' to do anything
but segfault.

I dug the scripts up in the state they were in when I gave up (September
2020 according to mtime), and put them on github in case anyone wants to
have a go at it:

https://github.com/cubanismo/aout-to-elf/

It was an interesting problem in its own right, and I'd be curious to
know what I missed.

Thanks,
-James

> --
> Kees Cook