Support automatic and manual endianness override for x86 ELF files #7347
+47
−1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements support for handling obfuscated x86 ELF files that have incorrect endianness bits in their headers, a common anti-analysis technique.
Problem
A classic obfuscation technique involves changing the endianness bit (
EI_DATA
) in an x86 ELF header to big-endian, even though x86 architecture is inherently little-endian. This throws off Binary Ninja's ELF parsing, but the binary runs fine since the endianness bit is typically not checked by x86 Linux loaders.Solution
This PR adds two complementary features:
1. Automatic x86 Endianness Override
A new setting
files.elf.overrideX86Endianness
(default:true
) automatically forces little-endian interpretation for x86/x86_64 ELF files regardless of the header'sEI_DATA
field.Example scenario:
2. Manual Endianness Override
A new loader setting
loader.elf.endianness
with options"default"
,"little"
,"big"
allows users to manually override endianness for any ELF file via the "Open with Options" dialog.User workflow:
Implementation Details
ParseHeaders()
Testing
Comprehensive test coverage validates:
Fixes #7339.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.