fake_shdr.c - zygaena/hammerhead

root / base / usr / src / cmd / sgs / elfdump / common / fake_shdr.c
fake_shdr.c C 1560 lines 40.5 KB
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Generate a cache of section header information for an ELF
 * object from the information found in its program headers.
 *
 * Malicious code can remove or corrupt section headers. The
 * resulting program will be difficult to analyze, but is still
 * runnable. Hence, scribbling on the section headers or removing
 * them is an effective form of obfuscation. On the other hand,
 * program headers must be accurate or the program will not run.
 * Section headers derived from them will necessarily lack information
 * found in the originals (particularly for non-allocable sections),
 * but will provide essential symbol information. The focus is on
 * recovering information that elfdump knows how to display, and that
 * might be interesting in a forensic situation.
 *
 * There are some things we don't attempt to create sections for:
 *
 *	plt, got
 *		We have no way to determine the length of either of
 *		these sections from the information available via
 *		the program headers or dynamic section. The data in
 *		the PLT is of little use to elfdump. The data in the
 *		GOT might be somewhat more interesting, especially as
 *		it pertains to relocations. However, the sizing issue
 *		remains.
 *
 *	text, data, bss
 *		Although we could create these, there is little value
 *		to doing so. elfdump cannot display the arbitrary
 *		data in these sections, so this would amount to a
 *		simple repetition of the information already displayed
 *		in the program headers, with no additional benefit.
 */



#include	<sys/elf_amd64.h>
#include	<stdio.h>
#include	<unistd.h>
#include	<errno.h>
#include	<string.h>
#include	<strings.h>
#include	<conv.h>
#include	<msg.h>
#include	<_elfdump.h>



/*
 * Common information about the object that is needed by
 * all the routines in this module.
 */
typedef struct {
	const char	*file;
	int		fd;
	Ehdr		*ehdr;
	Phdr		*phdr;
	size_t		phnum;
} FSTATE;



/*
 * These values uniquely identify the sections that we know
 * how to recover.
 *
 * Note: We write the sections to the cache array in this same order.
 * It simplifies this code if the dynamic, dynstr, dynsym, and ldynsym
 * sections occupy known slots in the cache array. Other sections reference
 * them by index, and if they are at a known spot, there is no need
 * for a fixup pass. Putting them in positions [1-4] solves this.
 *
 * The order they are in was chosen such that if any one of them exists,
 * all of the ones before it must also exist. This means that if the
 * desired section exists, it will end up in the desired index in the
 * cache array.
 *
 * The order of the other sections is arbitrary. I've arranged them
 * in roughly related groups.
 */
typedef enum {
	SINFO_T_NULL =		0,
	SINFO_T_DYN =		1,
	SINFO_T_DYNSTR = 	2,
	SINFO_T_DYNSYM =	3,
	SINFO_T_LDYNSYM =	4,

	SINFO_T_HASH =		5,
	SINFO_T_SYMINFO =	6,
	SINFO_T_SYMSORT =	7,
	SINFO_T_TLSSORT =	8,
	SINFO_T_VERNEED =	9,
	SINFO_T_VERDEF =	10,
	SINFO_T_VERSYM =	11,
	SINFO_T_INTERP =	12,
	SINFO_T_CAP =		13,
	SINFO_T_CAPINFO =	14,
	SINFO_T_CAPCHAIN =	15,
	SINFO_T_UNWIND =	16,
	SINFO_T_MOVE =		17,
	SINFO_T_REL =		18,
	SINFO_T_RELA =		19,
	SINFO_T_PREINITARR =	20,
	SINFO_T_INITARR =	21,
	SINFO_T_FINIARR =	22,
	SINFO_T_NOTE =		23,

	SINFO_T_NUM =		24 /* Count of items. Must come last */
} SINFO_TYPE;



/*
 * Table of per-section constant data used to set up the section
 * header cache and the various sub-parts it references. Indexed by
 * SINFO_T value.
 *
 * note: The sh_flags value should be either SHF_ALLOC, or 0.
 *	get_data() sets SHF_WRITE if the program header containing the
 *	section is writable. The other flags require information that
 *	the program headers don't contain (i.e. SHF_STRINGS, etc) so
 *	we don't set them.
 */
typedef struct {
	const char	*name;
	Word		sh_type;
	Word		sh_flags;
	Word		sh_addralign;
	Word		sh_entsize;
	Elf_Type	libelf_type;
} SINFO_DATA;

/*
 * Many of these sections use an alignment given by M_WORD_ALIGN, a
 * value that varies depending on the object target machine. Since we
 * don't know that value at compile time, we settle for a value of
 * 4 for ELFCLASS32 objects, and 8 for ELFCLASS64. This matches the
 * platforms we current support (sparc and x86), and is good enough for
 * a fake section header in any event, as the resulting object is only
 * analyzed, and is not executed.
 */
#ifdef _ELF64
#define	FAKE_M_WORD_ALIGN 8
#else
#define	FAKE_M_WORD_ALIGN 4
#endif

static SINFO_DATA sinfo_data[SINFO_T_NUM] = {
	/* SINFO_T_NULL */
	{ 0 },

	/* SINFO_T_DYN */
	{ MSG_ORIG(MSG_PHDRNAM_DYN), SHT_DYNAMIC, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Dyn), ELF_T_DYN },

	/* SINFO_T_DYNSTR */
	{ MSG_ORIG(MSG_PHDRNAM_DYNSTR), SHT_STRTAB, SHF_ALLOC,
	    1, 0, ELF_T_BYTE },

	/* SINFO_T_DYNSYM */
	{ MSG_ORIG(MSG_PHDRNAM_DYNSYM), SHT_DYNSYM, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Sym), ELF_T_SYM },

	/* SINFO_T_LDYNSYM */
	{ MSG_ORIG(MSG_PHDRNAM_LDYNSYM), SHT_SUNW_LDYNSYM, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Sym), ELF_T_SYM },

	/* SINFO_T_HASH */
	{ MSG_ORIG(MSG_PHDRNAM_HASH), SHT_HASH, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Word), ELF_T_WORD },

	/* SINFO_T_SYMINFO */
	{ MSG_ORIG(MSG_PHDRNAM_SYMINFO),  SHT_SUNW_syminfo, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Syminfo), ELF_T_SYMINFO },

	/* SINFO_T_SYMSORT */
	{ MSG_ORIG(MSG_PHDRNAM_SYMSORT), SHT_SUNW_symsort, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Word), ELF_T_WORD },

	/* SINFO_T_TLSSORT */
	{ MSG_ORIG(MSG_PHDRNAM_TLSSORT), SHT_SUNW_tlssort, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Word), ELF_T_WORD },

	/* SINFO_T_VERNEED */
	{ MSG_ORIG(MSG_PHDRNAM_VER), SHT_SUNW_verneed, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, 1, ELF_T_VNEED },

	/* SINFO_T_VERDEF */
	{ MSG_ORIG(MSG_PHDRNAM_VER), SHT_SUNW_verdef, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, 1, ELF_T_VDEF },

	/* SINFO_T_VERSYM */
	{ MSG_ORIG(MSG_PHDRNAM_VER), SHT_SUNW_versym, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Versym), ELF_T_HALF },

	/* SINFO_T_INTERP */
	{ MSG_ORIG(MSG_PHDRNAM_INTERP), SHT_PROGBITS, SHF_ALLOC,
	    1, 0, ELF_T_BYTE },

	/* SINFO_T_CAP */
	{ MSG_ORIG(MSG_PHDRNAM_CAP), SHT_SUNW_cap, SHF_ALLOC,
	    sizeof (Addr), sizeof (Cap), ELF_T_CAP },

	/* SINFO_T_CAPINFO */
	{ MSG_ORIG(MSG_PHDRNAM_CAPINFO), SHT_SUNW_capinfo, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Capinfo), ELF_T_WORD },

	/* SINFO_T_CAPCHAIN */
	{ MSG_ORIG(MSG_PHDRNAM_CAPCHAIN), SHT_SUNW_capchain, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Capchain), ELF_T_WORD },

	/* SINFO_T_UNWIND */
	{ MSG_ORIG(MSG_PHDRNAM_UNWIND), SHT_AMD64_UNWIND, SHF_ALLOC,
	    sizeof (Addr), 0, ELF_T_BYTE },

	/* SINFO_T_MOVE */
	{ MSG_ORIG(MSG_PHDRNAM_MOVE), SHT_SUNW_move, SHF_ALLOC,
	    sizeof (Lword), sizeof (Move), ELF_T_MOVE },

	/* SINFO_T_REL */
	{ MSG_ORIG(MSG_PHDRNAM_REL), SHT_REL, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Rel), ELF_T_REL },

	/* SINFO_T_RELA */
	{ MSG_ORIG(MSG_PHDRNAM_RELA), SHT_RELA, SHF_ALLOC,
	    FAKE_M_WORD_ALIGN, sizeof (Rela), ELF_T_RELA },

	/* SINFO_T_PREINITARR */
	{ MSG_ORIG(MSG_PHDRNAM_PREINITARR), SHT_PREINIT_ARRAY, SHF_ALLOC,
	    sizeof (Addr), sizeof (Addr), ELF_T_ADDR },

	/* SINFO_T_INITARR */
	{ MSG_ORIG(MSG_PHDRNAM_INITARR), SHT_INIT_ARRAY, SHF_ALLOC,
	    sizeof (Addr), sizeof (Addr),  ELF_T_ADDR },

	/* SINFO_T_FINIARR */
	{ MSG_ORIG(MSG_PHDRNAM_FINIARR), SHT_FINI_ARRAY, SHF_ALLOC,
	    sizeof (Addr), sizeof (Addr), ELF_T_ADDR },

	/* SINFO_T_NOTE */
	{ MSG_ORIG(MSG_PHDRNAM_NOTE), SHT_NOTE, 0,
	    FAKE_M_WORD_ALIGN, 1, ELF_T_NOTE }
};





/*
 * As we read program headers and dynamic elements, we build up
 * the data for our fake section headers in variables of the
 * SINFO type. SINFO is used to track the sections that can only
 * appear a fixed number of times (usually once).
 *
 * SINFO_LISTELT is used for sections that can occur an arbitrary
 * number of times. They are kept in a doubly linked circular
 * buffer.
 */
typedef struct {
	SINFO_TYPE	type;	/* Our type code for the section */
	Addr		vaddr;	/* Virtual memory address */
	Off		offset;	/* File offset of data. Ignored unless */
				/*	vaddr is 0. Used by program headers */
	size_t		size;	/* # bytes in section */
	size_t		vercnt;	/* Used by verdef and verneed to hold count */
	Shdr		*shdr;	/* Constructed shdr */
	Elf_Data	*data;	/* Constructed data descriptor */
} SINFO;

typedef struct _sinfo_listelt {
	struct _sinfo_listelt	*next;
	struct _sinfo_listelt	*prev;
	SINFO			sinfo;
} SINFO_LISTELT;



/*
 * Free dynamic memory used by SINFO structures.
 *
 * entry:
 *	sinfo - Address of first SINFO structure to free
 *	n - # of structures to clear
 *
 * exit:
 *	For each SINFO struct, the section header, data descriptor,
 *	and data buffer are freed if non-NULL. The relevant
 *	fields are set to NULL, and the type is set to SINFO_T_NULL.
 */
static void
sinfo_free(SINFO *sinfo, size_t n)
{
	for (; n-- > 0; sinfo++) {
		if (sinfo->data != NULL) {
			if (sinfo->data->d_buf != NULL)
				free(sinfo->data->d_buf);
			free(sinfo->data);
			sinfo->data = NULL;
		}

		if (sinfo->shdr) {
			free(sinfo->shdr);
			sinfo->shdr = NULL;
		}
		sinfo->type = SINFO_T_NULL;
	}
}



/*
 * Allocate a new SINFO_LISTELT and put it at the end of the
 * doubly linked list anchored by the given list root node.
 *
 * On success, a new node has been put at the end of the circular
 * doubly linked list, and a pointer to the SINFO sub-structure is
 * returned. On failure, an error is printed, and NULL is returned.
 */

static SINFO *
sinfo_list_alloc(FSTATE *fstate, SINFO_LISTELT *root)
{
	SINFO_LISTELT *elt;

	if ((elt = malloc(sizeof (*elt))) == NULL) {
		int err = errno;
		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
		    fstate->file, strerror(err));
		return (0);
	}

	elt->next = root;
	elt->prev = root->prev;

	root->prev = elt;
	elt->prev->next = elt;

	bzero(&elt->sinfo, sizeof (elt->sinfo));
	return (&elt->sinfo);
}



/*
 * Release the memory used by the given list, restoring it to
 * an empty list.
 */
static void
sinfo_list_free_all(SINFO_LISTELT *root)
{
	SINFO_LISTELT *elt;

	for (elt = root->next; elt != root; elt = elt->next)
		sinfo_free(&elt->sinfo, 1);

	root->next = root->prev = root;
}



/*
 * Given a virtual address and desired size of the data to be found
 * at that address, look through the program headers for the PT_LOAD
 * segment that contains it and return the offset within the ELF file
 * at which it resides.
 *
 * entry:
 *	fstate - Object state
 *	addr - virtual address to be translated
 *	size - Size of the data to be found at that address, in bytes
 *	zero_bytes - NULL, or address to receive the number of data
 *		bytes at the end of the data that are not contained
 *		in the file, and which must be zero filled by the caller.
 *		If zero_bytes is NULL, the file must contain all of the
 *		desired data. If zero_bytes is not NULL, then the program
 *		header must reserve the space for all of the data (p_memsz)
 *		but it is acceptable for only part of the data to be in
 *		the file (p_filesz). *zero_bytes is set to the difference
 *		in size, and is the number of bytes the caller must
 *		set to 0 rather than reading from the file.
 *	phdr_ret - NULL, or address of variable to receive pointer
 *		to program header that contains offset.
 * exit:
 *	On success: If zero_bytes is non-NULL, it is updated. If phdr_ret
 *	is non-NULL, it is updated. The file offset is returned.
 *
 *	On failure, 0 is returned. Since any ELF file we can understand
 *	must start with an ELF magic number, 0 cannot be a valid file
 *	offset for a virtual address, and is therefore unambiguous as
 *	a failure indication.
 */
static Off
map_addr_to_offset(FSTATE *fstate, Addr addr, size_t size, size_t *zero_bytes,
    Phdr **phdr_ret)
{
	Off	offset;
	Addr	end_addr = addr + size;
	size_t	avail_file;
	Phdr	*phdr = fstate->phdr;
	size_t	phnum = fstate->phnum;

	for (; phnum--; phdr++) {
		if (phdr->p_type != PT_LOAD)
			continue;

		if ((addr >= phdr->p_vaddr) &&
		    (end_addr <= (phdr->p_vaddr + phdr->p_memsz))) {
			/*
			 * Subtract segment virtual address, leaving the
			 * offset relative to the segment (not the file).
			 */
			offset = addr - phdr->p_vaddr;
			avail_file = phdr->p_filesz - offset;

			/*
			 * The addr/size are in bounds for this segment.
			 * Is there enough data in the file to satisfy
			 * the request? If zero_bytes is NULL, it must
			 * all be in the file. Otherwise it can be
			 * zero filled.
			 */
			if (zero_bytes == NULL) {
				if (size > avail_file)
					continue;
			} else {
				*zero_bytes = (size > avail_file) ?
				    (size - avail_file) : 0;
			}

			if (phdr_ret != NULL)
				*phdr_ret = phdr;

			/* Add segment file offset, giving overall offset */
			return (phdr->p_offset + offset);
		}
	}

	/* If we get here, the mapping failed */
	return (0);
}



/*
 * This routine is the same thing as map_addr_to_offset(), except that
 * it goes the other way, mapping from offset to virtual address.
 *
 * The comments for map_addr_to_offset() are applicable if you
 * reverse offset and address.
 */

static Addr
map_offset_to_addr(FSTATE *fstate, Off offset, size_t size, size_t *zero_bytes,
    Phdr **phdr_ret)
{
	Off	end_offset = offset + size;
	size_t	avail_file;
	Phdr	*phdr = fstate->phdr;
	size_t	phnum = fstate->phnum;

	for (; phnum--; phdr++) {
		if (phdr->p_type != PT_LOAD)
			continue;

		if ((offset >= phdr->p_offset) &&
		    (end_offset <= (phdr->p_offset + phdr->p_memsz))) {
			/*
			 * Subtract segment offset, leaving the
			 * offset relative to the segment (not the file).
			 */
			offset -= phdr->p_offset;
			avail_file = phdr->p_filesz - offset;

			/*
			 * The offset/size are in bounds for this segment.
			 * Is there enough data in the file to satisfy
			 * the request? If zero_bytes is NULL, it must
			 * all be in the file. Otherwise it can be
			 * zero filled.
			 */
			if (zero_bytes == NULL) {
				if (size > avail_file)
					continue;
			} else {
				*zero_bytes = (size > avail_file) ?
				    (size - avail_file) : 0;
			}

			if (phdr_ret != NULL)
				*phdr_ret = phdr;

			/* Add segment virtual address, giving overall addr */
			return (phdr->p_vaddr + offset);
		}
	}

	/* If we get here, the mapping failed */
	return (0);
}



/*
 * Use elf_xlatetom() to convert the bytes in buf from their
 * in-file representation to their in-memory representation.
 *
 * Returns True(1) for success. On failure, an error message is printed
 * and False(0) is returned.
 */
static int
xlate_data(FSTATE *fstate, void *buf, size_t nbyte, Elf_Type xlate_type)
{
	Elf_Data	data;

	data.d_type = xlate_type;
	data.d_size = nbyte;
	data.d_off = 0;
	data.d_align = 0;
	data.d_version = fstate->ehdr->e_version;
	data.d_buf = buf;

	if (elf_xlatetom(&data, &data,
	    fstate->ehdr->e_ident[EI_DATA]) == NULL) {
		failure(fstate->file, MSG_ORIG(MSG_ELF_XLATETOM));
		return (0);
	}

	return (1);
}


/*
 * Read nbytes of data into buf, starting at the specified offset
 * within the ELF file.
 *
 * entry:
 *	fstate - Object state
 *	offset - Offset within the file at which desired data resides.
 *	buf - Buffer to receive the data
 *	nbyte - # of bytes to read into buf
 *	xlate_type - An ELF xlate type, specifying the type of data
 *		being input. If xlate_type is ELF_T_BYTE, xlate is not
 *		done. Otherwise, xlate_data() is called to convert the
 *		data into its in-memory representation.
 * exit:
 *	On success, the data has been written into buf, xlate_data()
 *	called on it if required, and True(1) is returned. Otherwise
 *	False(0) is returned.
 *
 * note:
 *	This routine does not move the file pointer.
 */
static int
read_data(FSTATE *fstate, Off offset, void *buf, size_t nbyte,
    Elf_Type xlate_type)
{
	if (pread(fstate->fd, buf, nbyte, offset) != nbyte) {
		int err = errno;

		(void) fprintf(stderr, MSG_INTL(MSG_ERR_READ),
		    fstate->file, strerror(err));
		return (0);
	}

	if (xlate_type != ELF_T_BYTE)
		return (xlate_data(fstate, buf, nbyte, xlate_type));

	return (1);
}



/*
 * Read the hash nbucket/nchain values from the start of the hash
 * table found at the given virtual address in the mapped ELF object.
 *
 * On success, *nbucket, and *nchain have been filled in with their
 * values, *total contains the number of elements in the hash table,
 * and this routine returns True (1).
 *
 * On failure, False (0) is returned.
 */
static int
hash_size(FSTATE *fstate, SINFO *hash_sinfo,
    Word *nbucket, Word *nchain, size_t *total)
{
	Off		offset;
	Word		buf[2];

	offset = map_addr_to_offset(fstate, hash_sinfo->vaddr,
	    sizeof (buf), NULL, NULL);
	if (offset == 0)
		return (0);

	if (read_data(fstate, offset, buf, sizeof (buf), ELF_T_WORD) == 0)
		return (0);

	*nbucket = buf[0];
	*nchain = buf[1];
	*total = 2 + *nbucket + *nchain;
	return (1);
}



/*
 * Read a Verdef structure at the specified file offset and return
 * its vd_cnt, vd_aux, and vd_next fields.
 */
static int
read_verdef(FSTATE *fstate, Off offset, Half *cnt, Word *aux, Word *next)
{
	Verdef		verdef;

	if (read_data(fstate, offset, &verdef, sizeof (verdef),
	    ELF_T_BYTE) == 0)
		return (0);

	/* xlate vd_cnt */
	if (xlate_data(fstate, &verdef.vd_cnt, sizeof (verdef.vd_cnt),
	    ELF_T_HALF) == 0)
		return (0);

	/*
	 * xlate vd_aux and vd_next. These items are adjacent and are
	 * both Words, so they can be handled in a single operation.
	 */
	if (xlate_data(fstate, &verdef.vd_aux,
	    2 * sizeof (Word), ELF_T_WORD) == 0)
		return (0);

	*cnt = verdef.vd_cnt;
	*aux = verdef.vd_aux;
	*next = verdef.vd_next;

	return (1);
}



/*
 * Read a Verdaux structure at the specified file offset and return
 * its vda_next field.
 */
static int
read_verdaux(FSTATE *fstate, Off offset, Word *next)
{
	Verdaux		verdaux;

	if (read_data(fstate, offset, &verdaux, sizeof (verdaux),
	    ELF_T_BYTE) == 0)
		return (0);

	/* xlate vda_next */
	if (xlate_data(fstate, &verdaux.vda_next, sizeof (verdaux.vda_next),
	    ELF_T_WORD) == 0)
		return (0);

	*next = verdaux.vda_next;

	return (1);
}



/*
 * Read a Verneed structure at the specified file offset and return
 * its vn_cnt, vn_aux, and vn_next fields.
 */
static int
read_verneed(FSTATE *fstate, Off offset, Half *cnt, Word *aux, Word *next)
{
	Verneed		verneed;

	if (read_data(fstate, offset, &verneed, sizeof (verneed),
	    ELF_T_BYTE) == 0)
		return (0);

	/* xlate vn_cnt */
	if (xlate_data(fstate, &verneed.vn_cnt, sizeof (verneed.vn_cnt),
	    ELF_T_HALF) == 0)
		return (0);

	/*
	 * xlate vn_aux and vn_next. These items are adjacent and are
	 * both Words, so they can be handled in a single operation.
	 */
	if (xlate_data(fstate, &verneed.vn_aux,
	    2 * sizeof (Word), ELF_T_WORD) == 0)
		return (0);

	*cnt = verneed.vn_cnt;
	*aux = verneed.vn_aux;
	*next = verneed.vn_next;

	return (1);
}



/*
 * Read a Vernaux structure at the specified file offset and return
 * its vna_next field.
 */
static int
read_vernaux(FSTATE *fstate, Off offset, Word *next)
{
	Vernaux		vernaux;

	if (read_data(fstate, offset, &vernaux, sizeof (vernaux),
	    ELF_T_BYTE) == 0)
		return (0);

	/* xlate vna_next */
	if (xlate_data(fstate, &vernaux.vna_next, sizeof (vernaux.vna_next),
	    ELF_T_WORD) == 0)
		return (0);

	*next = vernaux.vna_next;

	return (1);
}



/*
 * Compute the size of Verdef and Verneed sections. Both of these
 * sections are made up of interleaved main nodes (Verdef and Verneed)
 * and auxiliary blocks (Verdaux and Vernaux). These nodes refer to
 * each other by relative offsets. The linker has a lot of flexibility
 * in how it lays out these items, and we cannot assume a standard
 * layout. To determine the size of the section, we must read each
 * main node and compute the high water mark of the memory it and its
 * auxiliary structs access.
 *
 * Although Verdef/Verdaux and Verneed/Vernaux are different types,
 * their logical organization is the same. Each main block has
 * a cnt field that tells how many auxiliary blocks it has, an
 * aux field that gives the offset of the first auxiliary block, and
 * an offset to the next main block. Each auxiliary block contains
 * an offset to the next auxiliary block. By breaking the type specific
 * code into separate sub-functions, we can process both Verdef and
 * sections Verdaux from a single routine.
 *
 * entry:
 *	fstate - Object state
 *	sec - Section to be processed (SINFO_T_VERDEF or SINFO_T_VERNEED).
 *
 * exit:
 *	On success, sec->size is set to the section size in bytes, and
 *	True (1) is returned. On failure, False (0) is returned.
 */
static int
verdefneed_size(FSTATE *fstate, SINFO *sec)
{
	int (* read_main)(FSTATE *, Off, Half *, Word *, Word *);
	int (* read_aux)(FSTATE *, Off, Word *);
	size_t	size_main, size_aux;

	Off	offset, aux_offset;
	Off	highwater, extent;
	size_t	num_main = sec->vercnt;
	Half	v_cnt;
	Word	v_aux, v_next, va_next;


	/*
	 * Set up the function pointers to the type-specific code
	 * for fetching data from the main and auxiliary blocks.
	 */
	if (sec->type == SINFO_T_VERDEF) {
		read_main = read_verdef;
		read_aux = read_verdaux;
		size_main = sizeof (Verdef);
		size_aux = sizeof (Verdaux);
	} else {			/* SINFO_T_VERNEED */
		read_main = read_verneed;
		read_aux = read_vernaux;
		size_main = sizeof (Verneed);
		size_aux = sizeof (Vernaux);
	}

	/*
	 * Map starting address to file offset. Save the starting offset
	 * in the SINFO size field. Once we have the high water offset, we
	 * can subtract this from it to get the size.
	 *
	 * Note: The size argument set here is a lower bound --- the
	 * size of the main blocks without any auxiliary ones. It's
	 * the best we can do until the size has been determined for real.
	 */
	offset = highwater = map_addr_to_offset(fstate, sec->vaddr,
	    size_main * num_main, NULL, NULL);
	if (offset == 0)
		return (0);
	sec->size = offset;

	for (; num_main-- > 0; offset += v_next) {
		/* Does this move the high water mark up? */
		extent = offset + size_main;
		if (extent > highwater)
			highwater = extent;

		if ((*read_main)(fstate, offset, &v_cnt, &v_aux, &v_next) == 0)
			return (0);

		/*
		 * If there are auxiliary structures referenced,
		 * check their position to see if it pushes
		 * the high water mark.
		 */
		aux_offset = offset + v_aux;
		for (; v_cnt-- > 0; aux_offset += va_next) {
			extent = aux_offset + size_aux;
			if (extent > highwater)
				highwater = extent;

			if ((*read_aux)(fstate, aux_offset, &va_next) == 0)
				return (0);
		}
	}

	sec->size = highwater - sec->size;
	return (1);
}


/*
 * Allocate and fill in a fake section header, data descriptor,
 * and data buffer for the given section. Fill them in and read
 * the associated data into the buffer.
 *
 * entry:
 *	fstate - Object state
 *	sec - Section information
 *
 * exit:
 *	On success, the actions described above are complete, and
 *	True (1) is returned.
 *
 *	On failure, an error is reported, all resources used by sec
 *	are released, and sec->type is set to SINFO_T_NULL, effectively
 *	eliminating its contents from any further use. False (0) is
 *	returned.
 */
static int
get_data(FSTATE *fstate, SINFO *sec)
{

	SINFO_DATA	*tinfo;
	size_t		read_bytes, zero_bytes;
	Phdr		*phdr = NULL;

	/*
	 * If this is a NULL section, or if we've already processed
	 * this item, then we are already done.
	 */
	if ((sec->type == SINFO_T_NULL) || (sec->shdr != NULL))
		return (1);

	if (((sec->shdr = malloc(sizeof (*sec->shdr))) == NULL) ||
	    ((sec->data = malloc(sizeof (*sec->data))) == NULL)) {
		int err = errno;
		sinfo_free(sec, 1);
		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
		    fstate->file, strerror(err));
		return (0);
	}
	tinfo = &sinfo_data[sec->type];



	/*
	 * Fill in fake section header
	 *
	 * sh_name should be the offset of the name in the shstrtab
	 * section referenced by the ELF header. There is no
	 * value to elfdump in creating shstrtab, so we set
	 * sh_name to 0, knowing that elfdump doesn't look at it.
	 */
	sec->shdr->sh_name = 0;
	sec->shdr->sh_type = tinfo->sh_type;
	sec->shdr->sh_flags = tinfo->sh_flags;
	if ((tinfo->sh_flags & SHF_ALLOC) == 0) {
		/*
		 * Non-allocable section: Pass the addr (which is probably
		 * 0) and offset through without inspection.
		 */
		sec->shdr->sh_addr = sec->vaddr;
		sec->shdr->sh_offset = sec->offset;
		zero_bytes = 0;
	} else if (sec->vaddr == 0) {
		/*
		 * Allocable section with a 0 vaddr. Figure out the
		 * real address by mapping the offset to it using the
		 * program headers.
		 */
		sec->shdr->sh_addr = map_offset_to_addr(fstate, sec->offset,
		    sec->size, &zero_bytes, &phdr);
		sec->shdr->sh_offset = sec->offset;
	} else {
		/*
		 * Allocable section with non-0 vaddr. Use the vaddr
		 * to derive the offset.
		 */
		sec->shdr->sh_addr = sec->vaddr;
		sec->shdr->sh_offset = map_addr_to_offset(fstate,
		    sec->vaddr, sec->size, &zero_bytes, &phdr);
	}
	if (sec->shdr->sh_offset == 0) {
		sinfo_free(sec, 1);
		return (0);
	}
	/*
	 * If the program header has its write flags set, then set
	 * the section write flag.
	 */
	if (phdr && ((phdr->p_flags & PF_W) != 0))
		sec->shdr->sh_flags |= SHF_WRITE;
	sec->shdr->sh_size = sec->size;
	sec->shdr->sh_link = 0;
	sec->shdr->sh_info = 0;
	sec->shdr->sh_addralign = tinfo->sh_addralign;
	sec->shdr->sh_entsize = tinfo->sh_entsize;

	/*
	 * Some sections define special meanings for sh_link and sh_info.
	 */
	switch (tinfo->sh_type) {
	case SHT_DYNAMIC:
		sec->shdr->sh_link = SINFO_T_DYNSTR;
		break;

	case SHT_DYNSYM:
		sec->shdr->sh_link = SINFO_T_DYNSTR;
		sec->shdr->sh_info = 1;	/* First global symbol */
		break;

	case SHT_SUNW_LDYNSYM:
		sec->shdr->sh_link = SINFO_T_DYNSTR;
		/*
		 * ldynsym is all local symbols, so the index of the
		 * first global is equivalent to the number of symbols.
		 */
		sec->shdr->sh_info = sec->shdr->sh_size / sizeof (Sym);
		break;

	case SHT_HASH:
	case SHT_SUNW_move:
	case SHT_REL:
	case SHT_RELA:
	case SHT_SUNW_versym:
		sec->shdr->sh_link = SINFO_T_DYNSYM;
		break;

	case SHT_SUNW_verdef:
	case SHT_SUNW_verneed:
		sec->shdr->sh_link = SINFO_T_DYNSTR;
		sec->shdr->sh_info = sec->vercnt;
		break;

	case SHT_SUNW_syminfo:
		sec->shdr->sh_link = SINFO_T_DYNSYM;
		sec->shdr->sh_info = SINFO_T_DYN;
		break;

	case SHT_SUNW_symsort:
	case SHT_SUNW_tlssort:
		sec->shdr->sh_link = SINFO_T_LDYNSYM;
		break;
	}



	/* Fill in fake Elf_Data descriptor */
	sec->data->d_type = tinfo->libelf_type;
	sec->data->d_size = sec->size;
	sec->data->d_off = 0;
	sec->data->d_align = tinfo->sh_addralign;
	sec->data->d_version = fstate->ehdr->e_version;

	if (sec->size == 0) {
		sec->data->d_buf = NULL;
		return (1);
	}

	if ((sec->data->d_buf = malloc(sec->size)) == NULL) {
		int err = errno;

		sinfo_free(sec, 1);
		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
		    fstate->file, strerror(err));
		return (0);
	}

	read_bytes = sec->size - zero_bytes;
	if ((read_bytes > 0) &&
	    (read_data(fstate, sec->shdr->sh_offset, sec->data->d_buf,
	    read_bytes, ELF_T_BYTE) == 0)) {
		sinfo_free(sec, 1);
		return (0);
	}
	if (zero_bytes > 0)
		bzero(read_bytes + (char *)sec->data->d_buf, zero_bytes);

	if ((tinfo->libelf_type != ELF_T_BYTE) &&
	    (elf_xlatetom(sec->data, sec->data,
	    fstate->ehdr->e_ident[EI_DATA]) == NULL)) {
		sinfo_free(sec, 1);
		failure(fstate->file, MSG_ORIG(MSG_ELF_XLATETOM));
		return (0);
	}

	return (1);
}



/*
 * Generate a section header cache made up of information derived
 * from the program headers.
 *
 * entry:
 *	file - Name of object
 *	fd - Open file handle for object
 *	elf - ELF descriptor
 *	ehdr - Elf header
 *	cache, shnum - Addresses of variables to receive resulting
 *		cache and number of sections.
 *
 * exit:
 *	On success, *cache and *shnum are set, and True (1) is returned.
 *	On failure, False (0) is returned.
 *
 * note:
 *	The cache returned by this routine must be freed using
 *	fake_shdr_cache_free(), and not by a direct call to free().
 *	Otherwise, memory will leak.
 */
int
fake_shdr_cache(const char *file, int fd, Elf *elf, Ehdr *ehdr,
    Cache **cache, size_t *shnum)
{
	/*
	 * The C language guarantees that a structure of homogeneous
	 * items will receive exactly the same layout in a structure
	 * as a plain array of the same type. Hence, this structure, which
	 * gives us by-name or by-index access to the various section
	 * info descriptors we maintain.
	 *
	 * We use this for sections where
	 *	- Only one instance is allowed
	 *	- We need to be able to access them easily by
	 *		name (for instance, when mining the .dynamic
	 *		section for information to build them up.
	 *
	 * NOTE: These fields must be in the same order as the
	 * SINFO_T_ type codes that correspond to them. Otherwise,
	 * they will end up in the wrong order in the cache array,
	 * and the sh_link/sh_info fields may be wrong.
	 */
	struct {
		/* Note: No entry is needed for SINFO_T_NULL */
		SINFO	dyn;
		SINFO	dynstr;
		SINFO	dynsym;
		SINFO	ldynsym;

		SINFO	hash;
		SINFO	syminfo;
		SINFO	symsort;
		SINFO	tlssort;
		SINFO	verneed;
		SINFO	verdef;
		SINFO	versym;
		SINFO	interp;
		SINFO	cap;
		SINFO	capinfo;
		SINFO	capchain;
		SINFO	unwind;
		SINFO	move;
		SINFO	rel;
		SINFO	rela;
		SINFO	preinitarr;
		SINFO	initarr;
		SINFO	finiarr;
	} sec;
	static const size_t sinfo_n = sizeof (sec) / sizeof (sec.dyn);
	SINFO *secarr = (SINFO *) &sec;

	/*
	 * Doubly linked circular list, used to track sections
	 * where multiple sections of a given type can exist.
	 * seclist is the root of the list. Its sinfo field is not
	 * used --- it serves to anchor the root of the list, allowing
	 * rapid access to the first and last element in the list.
	 */
	SINFO_LISTELT	seclist;

	FSTATE		fstate;
	size_t		ndx;
	size_t		num_sinfo, num_list_sinfo;
	SINFO		*sinfo;
	SINFO_LISTELT	*sinfo_list;
	Cache		*_cache;


	fstate.file = file;
	fstate.fd = fd;
	fstate.ehdr = ehdr;
	if (elf_getphdrnum(elf, &fstate.phnum) == -1) {
		failure(file, MSG_ORIG(MSG_ELF_GETPHDRNUM));
		return (0);
	}
	if ((fstate.phdr = elf_getphdr(elf)) == NULL) {
		failure(file, MSG_ORIG(MSG_ELF_GETPHDR));
		return (0);
	}

	bzero(&sec, sizeof (sec));	/* Initialize "by-name" sec info */
	seclist.next = seclist.prev = &seclist;	  /* Empty circular list */

	/*
	 * Go through the program headers and look for information
	 * we can use to synthesize section headers. By far the most
	 * valuable thing is a dynamic section, the contents of
	 * which point at all sections used by ld.so.1.
	 */
	for (ndx = 0; ndx < fstate.phnum; ndx++) {
		/*
		 * A program header with no file size does
		 * not have a backing section.
		 */
		if (fstate.phdr[ndx].p_filesz == 0)
			continue;


		switch (fstate.phdr[ndx].p_type) {
		default:
			/* Header we can't use. Move on to next one */
			continue;

		case PT_DYNAMIC:
			sec.dyn.type = SINFO_T_DYN;
			sinfo = &sec.dyn;
			break;

		case PT_INTERP:
			sec.interp.type = SINFO_T_INTERP;
			sinfo = &sec.interp;
			break;

		case PT_NOTE:
			if ((sinfo = sinfo_list_alloc(&fstate, &seclist)) ==
			    NULL)
				continue;
			sinfo->type = SINFO_T_NOTE;
			break;

		case PT_SUNW_UNWIND:
		case PT_SUNW_EH_FRAME:
			sec.unwind.type = SINFO_T_UNWIND;
			sinfo = &sec.unwind;
			break;

		case PT_SUNWCAP:
			sec.cap.type = SINFO_T_CAP;
			sinfo = &sec.cap;
			break;
		}

		/*
		 * Capture the position/extent information for
		 * the header in the SINFO struct set up by the
		 * switch statement above.
		 */
		sinfo->vaddr = fstate.phdr[ndx].p_vaddr;
		sinfo->offset = fstate.phdr[ndx].p_offset;
		sinfo->size = fstate.phdr[ndx].p_filesz;
	}

	/*
	 * If we found a dynamic section, look through it and
	 * gather information about the sections it references.
	 */
	if (sec.dyn.type == SINFO_T_DYN)
		(void) get_data(&fstate, &sec.dyn);
	if ((sec.dyn.type == SINFO_T_DYN) && (sec.dyn.data->d_buf != NULL)) {
		Dyn *dyn;
		for (dyn = sec.dyn.data->d_buf; dyn->d_tag != DT_NULL; dyn++) {
			switch (dyn->d_tag) {
			case DT_HASH:
				sec.hash.type = SINFO_T_HASH;
				sec.hash.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_STRTAB:
				sec.dynstr.type = SINFO_T_DYNSTR;
				sec.dynstr.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SYMTAB:
				sec.dynsym.type = SINFO_T_DYNSYM;
				sec.dynsym.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_RELA:
				sec.rela.type = SINFO_T_RELA;
				sec.rela.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_RELASZ:
				sec.rela.size = dyn->d_un.d_val;
				break;

			case DT_STRSZ:
				sec.dynstr.size = dyn->d_un.d_val;
				break;

			case DT_REL:
				sec.rel.type = SINFO_T_REL;
				sec.rel.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_RELSZ:
				sec.rel.size = dyn->d_un.d_val;
				break;

			case DT_INIT_ARRAY:
				sec.initarr.type = SINFO_T_INITARR;
				sec.initarr.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_INIT_ARRAYSZ:
				sec.initarr.size = dyn->d_un.d_val;
				break;

			case DT_FINI_ARRAY:
				sec.finiarr.type = SINFO_T_FINIARR;
				sec.finiarr.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_FINI_ARRAYSZ:
				sec.finiarr.size = dyn->d_un.d_val;
				break;

			case DT_PREINIT_ARRAY:
				sec.preinitarr.type = SINFO_T_PREINITARR;
				sec.preinitarr.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_PREINIT_ARRAYSZ:
				sec.preinitarr.size = dyn->d_un.d_val;
				break;

			case DT_SUNW_CAPINFO:
				sec.capinfo.type = SINFO_T_CAPINFO;
				sec.capinfo.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SUNW_CAPCHAIN:
				sec.capchain.type = SINFO_T_CAPCHAIN;
				sec.capchain.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SUNW_SYMTAB:
				sec.ldynsym.type = SINFO_T_LDYNSYM;
				sec.ldynsym.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SUNW_SYMSZ:
				sec.ldynsym.size = dyn->d_un.d_val;
				break;

			case DT_SUNW_SYMSORT:
				sec.symsort.type = SINFO_T_SYMSORT;
				sec.symsort.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SUNW_SYMSORTSZ:
				sec.symsort.size = dyn->d_un.d_val;
				break;

			case DT_SUNW_TLSSORT:
				sec.tlssort.type = SINFO_T_TLSSORT;
				sec.tlssort.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SUNW_TLSSORTSZ:
				sec.tlssort.size = dyn->d_un.d_val;
				break;

			case DT_MOVETAB:
				sec.move.type = SINFO_T_MOVE;
				sec.move.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_MOVESZ:
				sec.move.size = dyn->d_un.d_val;
				break;

			case DT_SYMINFO:
				sec.syminfo.type = SINFO_T_SYMINFO;
				sec.syminfo.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_SYMINSZ:
				sec.syminfo.size = dyn->d_un.d_val;
				break;

			case DT_VERSYM:
				sec.versym.type = SINFO_T_VERSYM;
				sec.versym.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_VERDEF:
				sec.verdef.type = SINFO_T_VERDEF;
				sec.verdef.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_VERDEFNUM:
				sec.verdef.vercnt = dyn->d_un.d_val;
				sec.verdef.size = sizeof (Verdef) *
				    dyn->d_un.d_val;
				break;

			case DT_VERNEED:
				sec.verneed.type = SINFO_T_VERNEED;
				sec.verneed.vaddr = dyn->d_un.d_ptr;
				break;

			case DT_VERNEEDNUM:
				sec.verneed.vercnt = dyn->d_un.d_val;
				sec.verneed.size = sizeof (Verneed) *
				    dyn->d_un.d_val;
				break;
			}
		}
	}

	/*
	 * Different sections depend on each other, and are meaningless
	 * without them. For instance, even if a .dynsym exists,
	 * no use can be made of it without a dynstr. These relationships
	 * fan out: Disqualifying the .dynsym will disqualify the hash
	 * section, and so forth.
	 *
	 * Disqualify sections that don't have the necessary prerequisites.
	 */

	/* Things that need the dynamic string table */
	if (sec.dynstr.size == 0)
		sec.dynstr.type = SINFO_T_NULL;
	if (sec.dynstr.type != SINFO_T_DYNSTR) {
		sinfo_free(&sec.dyn, 1);	/* Data already fetched */
		sec.dynsym.type =  SINFO_T_NULL;
		sec.dynsym.type =  SINFO_T_NULL;
		sec.verdef.type =  SINFO_T_NULL;
		sec.verneed.type =  SINFO_T_NULL;
	}

	/*
	 * The length of the hash section is encoded in its first two
	 * elements (nbucket, and nchain). The length of the dynsym,
	 * ldynsym, and versym are not given in the dynamic section,
	 * but are known to be the same as nchain.
	 *
	 * If we don't have a hash table, or cannot read nbuckets and
	 * nchain, we have to invalidate all of these.
	 */
	if (sec.hash.type == SINFO_T_HASH) {
		Word nbucket;
		Word nchain;
		size_t total;

		if (hash_size(&fstate, &sec.hash,
		    &nbucket, &nchain, &total) == 0) {
			sec.hash.type = SINFO_T_NULL;
		} else {
			/* Use these counts to set sizes for related sections */
			sec.hash.size = total * sizeof (Word);
			sec.dynsym.size = nchain * sizeof (Sym);
			sec.versym.size = nchain * sizeof (Versym);

			/*
			 * The ldynsym size received the DT_SUNW_SYMSZ
			 * value, which is the combined size of .dynsym
			 * and .ldynsym. Now that we have the dynsym size,
			 * use it to lower the ldynsym size to its real size.
			 */
			if (sec.ldynsym.size > sec.dynsym.size)
				sec.ldynsym.size  -= sec.dynsym.size;
		}
	}
	/*
	 * If the hash table is not present, or if the call to
	 * hash_size() failed, then discard the sections that
	 * need it to determine their length.
	 */
	if (sec.hash.type != SINFO_T_HASH) {
		sec.dynsym.type = SINFO_T_NULL;
		sec.ldynsym.type = SINFO_T_NULL;
		sec.versym.type = SINFO_T_NULL;
	}

	/*
	 * The runtime linker does not receive size information for
	 * Verdef and Verneed sections. We have to read their data
	 * in pieces and calculate it.
	 */
	if ((sec.verdef.type == SINFO_T_VERDEF) &&
	    (verdefneed_size(&fstate, &sec.verdef) == 0))
		sec.verdef.type = SINFO_T_NULL;
	if ((sec.verneed.type == SINFO_T_VERNEED) &&
	    (verdefneed_size(&fstate, &sec.verneed) == 0))
		sec.verneed.type = SINFO_T_NULL;

	/* Discard any section with a zero length */
	ndx = sinfo_n;
	for (sinfo = secarr; ndx-- > 0; sinfo++)
		if ((sinfo->type != SINFO_T_NULL) && (sinfo->size == 0))
			sinfo->type = SINFO_T_NULL;

	/* Things that need the dynamic symbol table */
	if (sec.dynsym.type != SINFO_T_DYNSYM) {
		sec.ldynsym.type = SINFO_T_NULL;
		sec.hash.type = SINFO_T_NULL;
		sec.syminfo.type = SINFO_T_NULL;
		sec.versym.type = SINFO_T_NULL;
		sec.move.type = SINFO_T_NULL;
		sec.rel.type = SINFO_T_NULL;
		sec.rela.type = SINFO_T_NULL;
	}

	/* Things that need the dynamic local symbol table */
	if (sec.ldynsym.type != SINFO_T_DYNSYM) {
		sec.symsort.type = SINFO_T_NULL;
		sec.tlssort.type = SINFO_T_NULL;
	}

	/*
	 * Look through the results and fetch the data for any sections
	 * we have found. At the same time, count the number.
	 */
	num_sinfo = num_list_sinfo = 0;
	ndx = sinfo_n;
	for (sinfo = secarr; ndx-- > 0; sinfo++) {
		if ((sinfo->type != SINFO_T_NULL) && (sinfo->data == NULL))
			(void) get_data(&fstate, sinfo);
		if (sinfo->data != NULL)
			num_sinfo++;
	}
	for (sinfo_list = seclist.next; sinfo_list != &seclist;
	    sinfo_list = sinfo_list->next) {
		sinfo = &sinfo_list->sinfo;
		if ((sinfo->type != SINFO_T_NULL) && (sinfo->data == NULL))
			(void) get_data(&fstate, sinfo);
		if (sinfo->data != NULL)
			num_list_sinfo++;
	}

	/*
	 * Allocate the cache array and fill it in. The cache array
	 * ends up taking all the dynamic memory we've allocated
	 * to build up sec and seclist, so on success, we have nothing
	 * left to clean up. If we can't allocate the cache array
	 * though, we have to free up everything else.
	 */
	*shnum = num_sinfo + num_list_sinfo + 1; /* Extra for 1st NULL sec. */
	if ((*cache = _cache = malloc((*shnum) * sizeof (Cache))) == NULL) {
		int err = errno;
		(void) fprintf(stderr, MSG_INTL(MSG_ERR_MALLOC),
		    file, strerror(err));
		sinfo_free(secarr, num_sinfo);
		sinfo_list_free_all(&seclist);
		return (0);
	}
	*_cache = cache_init;
	_cache++;
	ndx = 1;
	for (sinfo = secarr; num_sinfo > 0; sinfo++) {
		if (sinfo->data != NULL) {
			_cache->c_scn = NULL;
			_cache->c_shdr = sinfo->shdr;
			_cache->c_data = sinfo->data;
			_cache->c_name = (char *)sinfo_data[sinfo->type].name;
			_cache->c_ndx = ndx++;
			_cache++;
			num_sinfo--;
		}
	}
	for (sinfo_list = seclist.next; num_list_sinfo > 0;
	    sinfo_list = sinfo_list->next) {
		sinfo = &sinfo_list->sinfo;
		if (sinfo->data != NULL) {
			_cache->c_scn = NULL;
			_cache->c_shdr = sinfo->shdr;
			_cache->c_data = sinfo->data;
			_cache->c_name = (char *)sinfo_data[sinfo->type].name;
			_cache->c_ndx = ndx++;
			_cache++;
			num_list_sinfo--;
		}
	}

	return (1);
}





/*
 * Release all the memory referenced by a cache array allocated
 * by fake_shdr_cache().
 */
void
fake_shdr_cache_free(Cache *cache, size_t shnum)
{
	Cache *_cache;

	for (_cache = cache; shnum--; _cache++) {
		if (_cache->c_data != NULL) {
			if (_cache->c_data->d_buf != NULL)
				free(_cache->c_data->d_buf);
			free(_cache->c_data);
		}
		if (_cache->c_shdr)
			free(_cache->c_shdr);
	}

	free(cache);
}