Hello,
On Sun, 03 Dec 2017, ckard wrote:
>On Sun, Dec 3, 2017 at 8:06 PM, <tu...@posteo.de> wrote:
>> is there any way to check, whether a compilated binary is using
>> the position-independant-code feature or is still build according
>> to old standards?
>
>You can use app-admin/checksec to see if different security features are
>enabled or not.
Nice. For this special use-case (what has been rebuilt with PIE and
what not), I've extracted a (faster) variant from checksec, though
it's unclear to me how to discern libs built with PIE and without[1].
I guess the linker'll tell me.
==== ~/bin/check-pie ====
#!/bin/bash
for arg; do
re=$(readelf -h "$arg" 2>/dev/null)
if printf '%s' -- "$re" | grep -q 'Type:[[:space:]]*EXEC'; then
pie="no pie"
elif printf '%s' -- "$re" | grep -q 'Type:[[:space:]]*DYN'; then
pie=$(readelf -d "$arg" | awk -F':' '
$1 ~ /\(FLAGS.*Flags$/ && $2 ~ / PIE/ { print "PIE"; }
$1 ~ /\(SONAME/ { print "DSO"; }')
else
printf "Not an executable: %s\n" "$arg" >&2
continue;
fi
printf "%s\t%s\n" "$arg" "$pie"
done
====
USAGE is check-pie FILE[S...]
e.g.:
# check-pie /usr/bin/* 2>/dev/null | \
awk '/PIE/{PIE++;}
/no pie/{nopie++};
END{ printf("PIE: %i, no PIE:%i\n", PIE, nopie); }'
HTH,
-dnh
[1] I've built a lib of my own both with -fpie/-fno-pie and compared
readelf -a outputs, and there's not difference besides offsets.
--
Any sufficiently advanced technology is indistinguishable from magic.
-- Arthur C. Clarke
