Incorrect PIE report for ld.so and musl libc.so

[wenzel]

Incorrect PIE report for ld.so and musl libc.so

[Wenzel]

Hi,

thank you for the detailed bug report.
it's a good idea to compare with checksec.sh and this project has been there for a long time.

checksec.sh PIE code

// pseudo code
switch (type) {
  case EXEC:
    -> No PIE
  case DYN:
    if 'DEBUG' in dynamic segment {
      -> PIE enabled
    } else {
      -> PIE DSO
    }
    case REL:
      -> PIE REL
    default:
      -> Not an ELF
}

I would like to rely as much as possible on LIEF, and avoid implementing custom logic in checksec.py.

LIEF's implementation of is_pie() checks looks like this

// pseudo code
if PT_INTERP and ET_DYN {
  return true
} else {
  return false
}

ping @romainthomas ➡️ what about updating is_pie() like this:

if ET_DYN or ET_REL {
  return true
} else {
  return false
}

@ekilmer in the meantime, i could update checksec.py implemtation like this:

    @property
    def pie(self) -> PIEType:
        if self.bin.header.file_type == E_TYPE.DYNAMIC:
            if self.bin.has(lief.ELF.DYNAMIC_TAGS.DEBUG):
                return PIEType.PIE
            else:
                return PIEType.DSO
        elif self.bin.header.file_type == E_TYPE.RELOCATABLE:
            return PIEType.REL
        return PIEType.No

⬆️ and this adds support for relocatable PIE type 😉

[Wenzel]

Released a new version of checksec.py, closing this issue !

[ekilmer]

This looks great! Thank you for the informative response!