Re: [PATCH] x86: Remove a.out support

James Jones
2022-03-16T05:06:21Z

On 3/15/22 12:51 PM, Kees Cook wrote:
> On Sat, Mar 12, 2022 at 06:06:26PM +0000, James Jones wrote:
>> [...]
>>> docs, including copies of the old mac and aln a.out binaries, is
>>> available here:
>>>
>>> https://github.com/cubanismo/jaguar-sdk
>
> Do these end up requiring libc4, etc? I see "uselib" syscalls in the
> disassembly...
>
> $ for i in $(objdump -b binary -D -m i386 aln mac | grep -B4 'int.*$0x80' \
> | grep -E 'int|eax' | grep mov | awk '{print $8}' | cut -d, -f1 \
> | cut -c2- | sort -u); do printf "%d\n" $i; done | sort -n
> 1 exit
> 3 read
> 4 write
> 5 open
> 6 close
> 10 unlink
> 13 time
> 19 lseek
> 20 getpid
> 37 kill
> 45 brk
> 54 ioctl
> 55 fcntl
> 86 uselib
> 89 readdir
> 91 munmap
> 106 stat
> 107 lstat
> 108 fstat
> 126 sigprocmask
>
> It seems like it should be possible to create an ELF wrapper for simple
> a.out binaries...

I didn't need to dig up any ancient libraries to get these working. They
seem to be completely statically linked.

Probably getting a bit off topic, but I did spend a few hours searching
around for any existing tools to convert a binary from a.out->ELF, and
trying to come up with something myself by extracting the sections with
objdump and re-combining them into an ELF using a linker script placing
the sections at the same locations. I couldn't get it working in an
evening or two messing with it so I moved on, but I agree something like
this seems possible in theory. I got 'mac' converted to an ELF that
would load up and print its input prompt if run without parameters, but
only if run as root. As a regular user, it segfaults somewhere before it
even starts executing in the text section AFAICT. Any actual assembling
segfaults even when running as root. I never got 'aln' to do anything
but segfault.

I dug the scripts up in the state they were in when I gave up (September
2020 according to mtime), and put them on github in case anyone wants to
have a go at it:

https://github.com/cubanismo/aout-to-elf/

It was an interesting problem in its own right, and I'd be curious to
know what I missed.

Thanks,
-James

> --
> Kees Cook