[GH-ISSUE #1938] [Feature] Admit relocatable MIPS32r2 ELF objects (kernel modules) through Ghidra #643

New issue

Closed

opened 2026-10-15 18:26:53 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:26:53 +00:00

Owner

Originally created by @AurelioB on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1938

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Current limitation

The Ghidra MIPS lane refuses every ET_REL object:

This Ghidra MIPS lane supports ET_EXEC only; relocatable objects, shared images and PSP PRX need separate load verification.

The generic ELF lane already admits relocatable x86-64 objects.

Use cases

Linux MIPS kernel modules (.ko) are ELF32 o32 MIPS32r2 ET_REL objects and usually hold the drivers that embedded-firmware analysis needs (storage, PMIC, display, input).

Desired outcome and success criteria

ELF32 o32 MIPS32r2 ET_REL admitted under its own versioned support lane; ET_DYN and PRX stay refused; executable targets keep their lane identity.
Relocation correctness is verified independently, not inferred from Ghidra's statuses: for every relocation in an allocated section, the loaded word encodes S + A (S from Ghidra's placement, A from original bytes), with HI16/LO16 checked as the effective address each LO16 forms (shared HI16, signed-low carry), plus R_MIPS_26, R_MIPS_32 and external code/data.
Session Evidence states that addresses are analysis coordinates and undefined symbols live in the EXTERNAL block.

Measured with Ghidra 12.1.4: on 30 real soft-float -mlong-calls kernel modules from a shipped Ingenic X1600 firmware, 54,972 of the 55,065 relocations in allocated sections were recomputed and matched S + A (0 mismatches, 0 failed Ghidra statuses); Ghidra reports PARTIAL for each HI16 because it applies the pair at the LO16, and the patched words are correct. The other 93 reference empty sections and have no placement to check.

Authority boundaries and non-goals

No module loading/linking emulation, no kernel symbol resolution, no ET_DYN, PRX or GP-relative relocation support.

Possible direction

Depends on #1937 (soft-float support), because kernel modules are soft-float. An implementation with a dedicated verify:ghidra:mips-relocatable real-Ghidra lane is on https://github.com/AurelioB/rea/tree/feat/mips-relocatable (stacked on the soft-float branch).

References

#1362, #1629

Originally created by @AurelioB on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1938 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Current limitation The Ghidra MIPS lane refuses every `ET_REL` object: > This Ghidra MIPS lane supports ET_EXEC only; relocatable objects, shared images and PSP PRX need separate load verification. The generic ELF lane already admits relocatable x86-64 objects. ### Use cases Linux MIPS kernel modules (`.ko`) are ELF32 o32 MIPS32r2 `ET_REL` objects and usually hold the drivers that embedded-firmware analysis needs (storage, PMIC, display, input). ### Desired outcome and success criteria - ELF32 o32 MIPS32r2 `ET_REL` admitted under its own versioned support lane; `ET_DYN` and PRX stay refused; executable targets keep their lane identity. - Relocation correctness is verified independently, not inferred from Ghidra's statuses: for every relocation in an allocated section, the loaded word encodes `S + A` (S from Ghidra's placement, A from original bytes), with HI16/LO16 checked as the effective address each LO16 forms (shared HI16, signed-low carry), plus `R_MIPS_26`, `R_MIPS_32` and external code/data. - Session Evidence states that addresses are analysis coordinates and undefined symbols live in the `EXTERNAL` block. Measured with Ghidra 12.1.4: on 30 real soft-float `-mlong-calls` kernel modules from a shipped Ingenic X1600 firmware, 54,972 of the 55,065 relocations in allocated sections were recomputed and matched `S + A` (0 mismatches, 0 failed Ghidra statuses); Ghidra reports `PARTIAL` for each HI16 because it applies the pair at the LO16, and the patched words are correct. The other 93 reference empty sections and have no placement to check. ### Authority boundaries and non-goals No module loading/linking emulation, no kernel symbol resolution, no `ET_DYN`, PRX or GP-relative relocation support. ### Possible direction Depends on #1937 (soft-float support), because kernel modules are soft-float. An implementation with a dedicated `verify:ghidra:mips-relocatable` real-Ghidra lane is on https://github.com/AurelioB/rea/tree/feat/mips-relocatable (stacked on the soft-float branch). ### References #1362, #1629

bsakaguchi

2026-10-15 18:26:53 +00:00

closed this issue
added the
area: native

enhancement
labels

bsakaguchi commented

2026-10-15 18:26:54 +00:00

Author

Owner

@AurelioB commented on GitHub (Oct 11, 2026):

Implemented in #1950 (stacked on #1949). The relocation oracle now checks every HI16 against the LO16 that resolves it, including several HI16s per LO16, which 24 of the 30 real modules contain. All 30 modules pass: 54,972 placed relocations match, 93 references to empty sections stay unchecked, and 0 relocation statuses failed.

@AurelioB commented on GitHub (Oct 11, 2026): Implemented in #1950 (stacked on #1949). The relocation oracle now checks every HI16 against the LO16 that resolves it, including several HI16s per LO16, which 24 of the 30 real modules contain. All 30 modules pass: 54,972 placed relocations match, 93 references to empty sections stay unchecked, and 0 relocation statuses failed.

bsakaguchi referenced this issue

2026-10-16 21:14:46 +00:00

[PR #644] [MERGED] chore(deps): finish toolchain upgrades and drop dead weight #2136

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:23 +00:00