Hi, On Wed, Jul 12, 2023 at 03:38:35PM -0600, Jerry James wrote: > On Wed, Jul 12, 2023 at 3:34 PM Richard W.M. Jones <rjones@xxxxxxxxxx> wrote: > > I looked through the section names with objdump -h and none of them > > looked unusual. However I think in the past when we analyzed this we > > found it was doing something really crazy, like actually appending the > > bytecode to the file (ie. not using the ELF format at all). > > That was the conclusion I had just come to. In the unstripped binary, > the ELF structure accounts for about 700K, but the file size is over > 3M. It looks like they really do just append the bytecode to the > file. Aha, yeah, then any tool that tries to process the ELF file will likely just overwrite that or throw it away because it has no way of knowing that data is even part of the file. Cheers, Mark _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
