Repository navigation
Conversation
N32 executables are ELF32 files flagged with EF_MIPS_ABI2 but use 64-bit registers. They were matched to the MIPS32 architecture, so registers and addresses were printed with the wrong width. Treat ELF32 MIPS files with EF_MIPS_ABI2 set as MIPS64, both when GDB reports the architecture and when falling back to the ELF header. Fixes hugsy#1226
Grazfather
reviewed
Oct 18, 2026
| ELF_64_BITS = 0x02 | ||
|
|
||
| ELF_MAGIC = 0x7F454C46 | ||
| EF_MIPS_ABI2 = 0x00000020 |
Collaborator
There was a problem hiding this comment.
what is EF? should this be ELF?
There was a problem hiding this comment.
🟡 Changes recommended
Selecting MIPS64 also assigns eight-byte pointers to N32, breaking memory decoding for its four-byte pointers.
1 open issue
What changed in this PR
This PR addresses #1226 by recognizing MIPS N32 binaries as using 64-bit registers despite their ELF32 format.
Changes:
- Adds an ELF property identifying N32 through
EF_MIPS_ABI2. - Selects MIPS64 through both GDB architecture detection and the ELF-header fallback.
| File | Description |
|---|---|
| gef.py | Adds N32 identification and updates both architecture-detection paths. |
Review effort: Balanced
| gdb_arch.startswith("mips") and gef.binary.e_class == Elf.Class.ELF_64_BITS | ||
| # N32 binaries are ELF32 files but use 64-bit registers | ||
| return gdb_arch.startswith("mips") and ( | ||
| gef.binary.e_class == Elf.Class.ELF_64_BITS or gef.binary.is_mips_n32 |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
MIPS N32 executables are ELF32 files (
EI_CLASS= 32-bit) flagged withEF_MIPS_ABI2(e_flags & 0x20), but they use 64-bit registers. GEF only checked the ELF class, so N32 binaries were matched toMIPS(32-bit) and registers/addresses were shown with the wrong width.This adds
Elf.is_mips_n32and uses it in two places:MIPS64.supports_gdb_arch, so a running N32 process is detected asMIPS64reset_architecture, so a not-yet-running N32 binary is also detected asMIPS64O32 (ELF32 without
EF_MIPS_ABI2) and N64 (ELF64) behave as before.Fixes #1226
Testing
Not tested inside GDB: I had no GDB/qemu-mips available. I verified the detection logic by loading synthetic ELF headers through
Elfwith a stubbedgdbmodule:e_flags=0x50001007, ELF32):is_mips_n32False,MIPS64.supports_gdb_archFalsee_flags=0x80000027, ELF32):is_mips_n32True,MIPS64.supports_gdb_archTrueis_mips_n32False,MIPS64.supports_gdb_archTrueNo test was added because the test suite requires GDB. A check against a real N32 binary under GDB would be welcome.
Contribution
Licensing
Checklist