{"action":"opened","issue":{"url":"https://api.github.com/repos/radare/radare2/issues/5305","repository_url":"https://api.github.com/repos/radare/radare2","labels_url":"https://api.github.com/repos/radare/radare2/issues/5305/labels{/name}","comments_url":"https://api.github.com/repos/radare/radare2/issues/5305/comments","events_url":"https://api.github.com/repos/radare/radare2/issues/5305/events","html_url":"https://github.com/radare/radare2/issues/5305","id":164214891,"number":5305,"title":"BigEndian support in the ELF parser","user":{"login":"unixfreaxjp","id":8689713,"avatar_url":"https://avatars.githubusercontent.com/u/8689713?v=3","gravatar_id":"","url":"https://api.github.com/users/unixfreaxjp","html_url":"https://github.com/unixfreaxjp","followers_url":"https://api.github.com/users/unixfreaxjp/followers","following_url":"https://api.github.com/users/unixfreaxjp/following{/other_user}","gists_url":"https://api.github.com/users/unixfreaxjp/gists{/gist_id}","starred_url":"https://api.github.com/users/unixfreaxjp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/unixfreaxjp/subscriptions","organizations_url":"https://api.github.com/users/unixfreaxjp/orgs","repos_url":"https://api.github.com/users/unixfreaxjp/repos","events_url":"https://api.github.com/users/unixfreaxjp/events{/privacy}","received_events_url":"https://api.github.com/users/unixfreaxjp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-07-07T02:13:10Z","updated_at":"2016-07-07T02:13:10Z","closed_at":null,"body":"## Background \r\n\r\nCurrently radare2 ELF parser is supporting to read files saved in little-endian bytes storing system order only. So, in the the Linux system which its files is using big-endian the opcodes can not be displayed well. This will occur in the native 32bit systems Linux/MIPS (predefined cpu compiler macro: __mips__ ) and native 32bit Linux/powerpc (predefined cpu compiler macro: __powerpc__ ).\r\n\r\nFor example, after successful compilation in x32 Linux/powerpc (debian wheezy):\r\n```asm\r\n[0x10001c0c]> e asm.arch =ppc\r\n[0x10001c0c]> e asm.arch\r\nppc\r\n\r\n[0x10001c0c]> ie\r\n[Entrypoints]\r\nvaddr=0x10001c0c paddr=0x10001c0c baddr=0x00000000 laddr=0x00000000 type=program\r\n\r\n1 entrypoints\r\n\r\n[0x10001c0c]> pd 5\r\n            ;-- entry0:\r\n            0x10001c0c      ffffffff       fnmadd. f31, f31, f31, f31 <=== this\r\n            0x10001c10      ffffffff       fnmadd. f31, f31, f31, f31\r\n            0x10001c14      ffffffff       fnmadd. f31, f31, f31, f31\r\n            0x10001c18      ffffffff       fnmadd. f31, f31, f31, f31\r\n            0x10001c1c      ffffffff       fnmadd. f31, f31, f31, f31\r\n\r\n[0x10001c0c]> b 100 ;x\r\n- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\r\n0x10001c0c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c1c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c2c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c3c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c4c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c5c  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x10001c6c  ffff ffff                                ....\r\n```\r\nOr, in the system x32 Linux/MIPS:\r\n```asm\r\n[0x00404380]> e asm.arch=mips\r\n[0x00404380]> e asm.arch\r\nmips\r\n[0x00404380]> pd 5\r\n            ;-- entry0:\r\n            0x00404380      ffffffff       invalid\r\n            0x00404384      ffffffff       invalid\r\n            0x00404388      ffffffff       invalid\r\n            0x0040438c      ffffffff       invalid\r\n            0x00404390      ffffffff       invalid\r\n[0x00404380]> x!100\r\n- offset -   0 1  2 3  4 5  6 7  8 9  A B  C D  E F  0123456789ABCDEF\r\n0x00404380  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404390  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043a0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043b0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043c0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043d0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043e0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x004043f0  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404400  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404410  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404420  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404430  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404440  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404450  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404460  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n0x00404470  ffff ffff ffff ffff ffff ffff ffff ffff  ................\r\n[0x00404380]>\r\n```\r\n\r\n## The development objectivity\r\n\r\nThe problem resides in the [ELF parser](https://github.com/radare/radare2/blob/182db54e57f58eb43391c5d98739638bf3567867/libr/bp/parser.c) related codes. \r\nThe ELF parser is vital for ELF related analysis in radare2. This will need a major plastic-surgery-coding to support BigEndian.\r\n\r\n## Current plan\r\n\r\nAccording to @radare it is in  0.10.5 milestone. \r\nBut this will also depend on machine preparation for his coding.\r\n\r\n## Reference:\r\nhttps://github.com/radare/radare2/issues/4969#issuecomment-230942943\r\nhttps://github.com/radare/radare2/commit/af0a865d9f11ec80d7d7141d280f7c61622c3de1\r\nhttps://github.com/radare/radare2/issues/4720#issuecomment-230424723"}}
{"actor":{"display_login":"unixfreaxjp"}}