ELF Crimes: Program Interpreter Fun

https://nytpu.com/gemlog/2025-12-21

by nytpu • 7 months ago

67 14 7 months ago

dzdt• 7 months ago

"It just radiates jank" ... that line resonates with me, but is sonehow a bit attractive. Like this is how things might be done in some alternative grittier universe. Like this is how Kaylee would make data formats execute on the Firefly. Its steampunk programming.

saagarjha4• 7 months ago

But after getting the linked script setup working, even though it seemed like it should've been enough, it absolutely refused to work. It would only give me an opaque exec format error error, no matter how many different shotgun debugging things I tried, I ended up spending something like six hours over the course of two days on it with no real progress.

I think I would have eventually just loaded up a debugger and binary searched the codebase until I found the spot returning the error.

nytpu• 7 months ago

Because attaching a debugger to the Linux Kernel is so convenient and easy :P

But yeah, I was just being lazy and dumb. I solved it within ten minutes of someone saying "why don't you just go through the binfmt_elf code?" A debugger would've probably been more tedious than reading the relevant code directly, but would've been just as effective.

saagarjha4• 7 months ago

It's not and actually I do find it kind of amusing that Linux is possibly the hardest of the three main OSes to get a debugging set up for, but yeah I've had to do it enough that I don't mind doing and I can probably get it set up in a few minutes. Plus if the bug isn't in some architecture specific or hardware dependent thing there's this Linux compatibility userspace layer I help out on sometimes that is much easier to work with. And if it's that easy, I will generally choose to that instead of having to actually think about what I am doing ;)

tayo42• 7 months ago

I think you can do it with qemu and gdb.

Unless the other os and debugger mentioned has an easy way to do it with a machine that's not virtualized?

yjftsjthsd-h• 7 months ago

So I'm no kernel dev and only did a web search out of curiosity... Based on https://www.kernel.org/doc/html/latest/process/debugging/gdb... and https://sergioprado.blog/debugging-the-linux-kernel-with-gdb... , it reads as if it's fairly easy so long as you're willing to compile the kernel yourself. Actually, at that point I would personally favor UML, since at that point Linux is just a normal userspace program that you can attach to: https://www.kernel.org/doc/html/latest/virt/uml/user_mode_li...

But I'm not a kernel dev and it's been a very long time since I would have needed to debug the kernel; does this not actually work?

delaminator4• 7 months ago

It’s a terrible shame Linux is still a 1970s program.

Plan 9’s debugger Acid can attach to a running kernel on a remote machine and debug it.

quantummagic• 7 months ago

It’s a terrible shame Linux is still a 1970s program.

This is a needlessly snide and inaccurate characterization.

Plan 9’s debugger Acid can attach to a running kernel on a remote machine and debug it.

KGDB over Ethernet does the same on Linux.

photios• 7 months ago

OP would probably have a field day with NixOS's patchelf tool:

https://github.com/NixOS/patchelf

ELF Crimes: Program Interpreter Fun

Related Stories