Support automatic and manual endianness override for x86 ELF files - #7347
Merged
Conversation
Contributor
Author
|
@xusheng6 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs. I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review. |
|
|
Copilot
AI
changed the title
[WIP] Support automatically and manually override the endianness of an ELF file
Support automatic and manual endianness override for x86 ELF files
Sep 4, 2025
xusheng6
force-pushed
the
copilot/fix-7339
branch
from
December 16, 2025 04:45
a3abdb9 to
c1b4476
Compare
xusheng6
force-pushed
the
copilot/fix-7339
branch
from
December 16, 2025 04:52
c1b4476 to
39555ce
Compare
xusheng6
marked this pull request as ready for review
December 16, 2025 06:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR implements support for handling obfuscated x86 ELF files that have incorrect endianness bits in their headers, a common anti-analysis technique.
Problem
A classic obfuscation technique involves changing the endianness bit (
EI_DATA) in an x86 ELF header to big-endian, even though x86 architecture is inherently little-endian. This throws off Binary Ninja's ELF parsing, but the binary runs fine since the endianness bit is typically not checked by x86 Linux loaders.Solution
This PR adds two complementary features:
1. Automatic x86 Endianness Override
A new setting
files.elf.overrideX86Endianness(default:true) automatically forces little-endian interpretation for x86/x86_64 ELF files regardless of the header'sEI_DATAfield.Example scenario:
2. Manual Endianness Override
A new loader setting
loader.elf.endiannesswith options"default","little","big"allows users to manually override endianness for any ELF file via the "Open with Options" dialog.User workflow:
Implementation Details
ParseHeaders()Testing
Comprehensive test coverage validates:
Fixes #7339.
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.