foster/bitcoin-bitcoin-core
0
0
Fork 0
mirror of https://github.com/bitcoin/bitcoin.git synced 2025-02-02 09:46:52 -05:00
Code Issues Activity

contrib: consolidate PIE and NX security checks

Browse source
This commit is contained in:
fanquake 2021-04-12 11:19:44 +08:00
parent 2aa1631822
commit 955140b326
No known key found for this signature in database
GPG key ID: 2EEB9F5CC09526C1
1 changed files with 19 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
contrib/devtools/security-check.py
View file

@ -134,14 +134,6 @@ def check_ELF_separate_code(executable):
return False return False
return True return True
def check_PE_PIE(executable) -> bool:
'''
Check for position independent executable (PIE),
allowing for address space randomization.
'''
binary = lief.parse(executable)
return binary.is_pie
def check_PE_DYNAMIC_BASE(executable) -> bool: def check_PE_DYNAMIC_BASE(executable) -> bool:
'''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)''' '''PIE: DllCharacteristics bit 0x40 signifies dynamicbase (ASLR)'''
binary = lief.parse(executable) binary = lief.parse(executable)
@ -159,18 +151,6 @@ def check_PE_RELOC_SECTION(executable) -> bool:
binary = lief.parse(executable) binary = lief.parse(executable)
return binary.has_relocations return binary.has_relocations
def check_PE_NX(executable) -> bool:
'''NX: DllCharacteristics bit 0x100 signifies nxcompat (DEP)'''
binary = lief.parse(executable)
return binary.has_nx
def check_MACHO_PIE(executable) -> bool:
'''
Check for position independent executable (PIE), allowing for address space randomization.
'''
binary = lief.parse(executable)
return binary.is_pie
def check_MACHO_NOUNDEFS(executable) -> bool: def check_MACHO_NOUNDEFS(executable) -> bool:
''' '''
Check for no undefined references. Check for no undefined references.
@ -178,13 +158,6 @@ def check_MACHO_NOUNDEFS(executable) -> bool:
binary = lief.parse(executable) binary = lief.parse(executable)
return binary.header.has(lief.MachO.HEADER_FLAGS.NOUNDEFS) return binary.header.has(lief.MachO.HEADER_FLAGS.NOUNDEFS)
def check_MACHO_NX(executable) -> bool:
'''
Check for no stack execution
'''
binary = lief.parse(executable)
return binary.has_nx
def check_MACHO_LAZY_BINDINGS(executable) -> bool: def check_MACHO_LAZY_BINDINGS(executable) -> bool:
''' '''
Check for no lazy bindings. Check for no lazy bindings.
@ -200,6 +173,21 @@ def check_MACHO_Canary(executable) -> bool:
binary = lief.parse(executable) binary = lief.parse(executable)
return binary.has_symbol('___stack_chk_fail') return binary.has_symbol('___stack_chk_fail')
def check_PIE(executable) -> bool:
'''
Check for position independent executable (PIE),
allowing for address space randomization.
'''
binary = lief.parse(executable)
return binary.is_pie
def check_NX(executable) -> bool:
'''
Check for no stack execution
'''
binary = lief.parse(executable)
return binary.has_nx
CHECKS = { CHECKS = {
'ELF': [ 'ELF': [
('PIE', check_ELF_PIE), ('PIE', check_ELF_PIE),
@ -209,16 +197,16 @@ CHECKS = {
('separate_code', check_ELF_separate_code), ('separate_code', check_ELF_separate_code),
], ],
'PE': [ 'PE': [
('PIE', check_PE_PIE), ('PIE', check_PIE),
('DYNAMIC_BASE', check_PE_DYNAMIC_BASE), ('DYNAMIC_BASE', check_PE_DYNAMIC_BASE),
('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA), ('HIGH_ENTROPY_VA', check_PE_HIGH_ENTROPY_VA),
('NX', check_PE_NX), ('NX', check_NX),
('RELOC_SECTION', check_PE_RELOC_SECTION) ('RELOC_SECTION', check_PE_RELOC_SECTION)
], ],
'MACHO': [ 'MACHO': [
('PIE', check_MACHO_PIE), ('PIE', check_PIE),
('NOUNDEFS', check_MACHO_NOUNDEFS), ('NOUNDEFS', check_MACHO_NOUNDEFS),
('NX', check_MACHO_NX), ('NX', check_NX),
('LAZY_BINDINGS', check_MACHO_LAZY_BINDINGS), ('LAZY_BINDINGS', check_MACHO_LAZY_BINDINGS),
('Canary', check_MACHO_Canary) ('Canary', check_MACHO_Canary)
] ]