From e41e2aeebbd1f795966a067f46d6ad287ba2a33f Mon Sep 17 00:00:00 2001
From: jdh8d <jdh8d@git.zephyr-software.com>
Date: Sun, 5 Jul 2015 15:19:07 +0000
Subject: [PATCH] updates to scons to install targ-config.h and more updates to
 use libEXEIO instead of elfio directly

Former-commit-id: 088bc0cceece58337deaa49d8619f537be458039
---
 SConscript                             |  13 ++-
 libEXEIO/include/exeio.h               |   2 +
 libEXEIO/include/exeio_elf.h           |   3 +
 libIRDB/test/fill_in_cfg.cpp           |  35 +++----
 libIRDB/test/fill_in_indtargs.cpp      |  36 +++++--
 libIRDB/test/find_strings.cpp          | 133 ++++++++++++++-----------
 tools/transforms/PNTransformDriver.cpp |  34 ++-----
 tools/transforms/PNTransformDriver.hpp |   5 +-
 tools/transforms/SConscript            |   3 +-
 9 files changed, 148 insertions(+), 116 deletions(-)

diff --git a/SConscript b/SConscript
index 8336e266d..c8a92140b 100644
--- a/SConscript
+++ b/SConscript
@@ -11,6 +11,9 @@ if env.GetOption('clean'):
     if os.path.exists(os.environ['SECURITY_TRANSFORMS_HOME']+"/include/elfio"):
 	print 'Removing include/elfio'
     	shutil.rmtree(os.environ['SECURITY_TRANSFORMS_HOME']+"/include/elfio")
+    if os.path.exists(os.environ['SECURITY_TRANSFORMS_HOME']+"/include/targ-config.h"):
+	print 'Removing include/elfio'
+    	os.remove(os.environ['SECURITY_TRANSFORMS_HOME']+"/include/targ-config.h")
 else:
     ELFIO_DIR=os.environ['SECURITY_TRANSFORMS_HOME']+"/third_party/ELFIO/"
     if not os.path.exists(ELFIO_DIR):
@@ -20,10 +23,18 @@ else:
 	tgz.list(verbose=False)
         tgz.extractall(ELFIO_DIR)
     	shutil.copytree(ELFIO_DIR+"elfio-2.2/elfio", os.environ['SECURITY_TRANSFORMS_HOME']+"/include/elfio")
-	shutil.copy(os.environ['SECURITY_TRANSFORMS_HOME']+"/third_party/elfio.hpp", os.environ['SECURITY_TRANSFORMS_HOME']+"/include/elfio/elfio.hpp")
+	shutil.copy(os.path.join(os.environ['SECURITY_TRANSFORMS_HOME'],"third_party","elfio.hpp"), 
+		    os.path.join(os.environ['SECURITY_TRANSFORMS_HOME'],"include","elfio","elfio.hpp"))
     else:
         assert os.path.isdir(ELFIO_DIR)
 
+    # check/install targ-config.h
+    if not os.path.isfile(os.environ['SECURITY_TRANSFORMS_HOME']+"/include/targ-config.h"):
+ 	(sysname, nodename, release, version, machine)=os.uname()
+	#print "uname=", sysname, " xx ", nodename, " xx ", release, " xx ", version, " xx ", machine
+	shutil.copy( os.path.join(os.environ['SECURITY_TRANSFORMS_HOME'],"include",machine,"config.h"), 
+		     os.path.join(os.environ['SECURITY_TRANSFORMS_HOME'],"include","targ-config.h"))
+
 
 #print 'env='
 #print env.Dump()
diff --git a/libEXEIO/include/exeio.h b/libEXEIO/include/exeio.h
index c8d7d94fe..4537352e6 100644
--- a/libEXEIO/include/exeio.h
+++ b/libEXEIO/include/exeio.h
@@ -44,6 +44,7 @@ namespace EXEIO
                         virtual execlass_t get_class() =0;
 			virtual virtual_offset_t get_entry() =0;
 			virtual void* get_elfio() { return NULL; }
+			virtual bool isDLL() =0;
 
 	};
 	
@@ -95,6 +96,7 @@ namespace EXEIO
 			virtual void dump_section_headers(std::ostream& stream) { assert(backend); backend->dump_section_headers(stream); }
                         virtual execlass_t get_class() { assert(backend); return backend->get_class(); }
 			virtual void* get_elfio() { assert(backend); return backend->get_elfio(); }
+			virtual bool isDLL() { assert(backend); return backend->isDLL(); }
 
 		private:
 			void Init() { backend=NULL; }
diff --git a/libEXEIO/include/exeio_elf.h b/libEXEIO/include/exeio_elf.h
index 4a744a22c..50db9d84a 100644
--- a/libEXEIO/include/exeio_elf.h
+++ b/libEXEIO/include/exeio_elf.h
@@ -97,6 +97,9 @@ namespace EXEIO
 
 			virtual void* get_elfio() { return (void*)e; }
 
+                        virtual bool isDLL() { return e->get_type()!=ET_EXEC; }
+
+
 	
 		private:  
 			ELFIO::elfio* e;
diff --git a/libIRDB/test/fill_in_cfg.cpp b/libIRDB/test/fill_in_cfg.cpp
index fc01ed926..72eec53f8 100644
--- a/libIRDB/test/fill_in_cfg.cpp
+++ b/libIRDB/test/fill_in_cfg.cpp
@@ -29,12 +29,7 @@
 #include <sys/mman.h>
 #include <ctype.h>
 
-#include "targ-config.h"
-
-#include "elfio/elfio.hpp"
-#include "elfio/elfio_dump.hpp"
-
-
+#include <exeio.h>
 
 #include "beaengine/BeaEngine.h"
 
@@ -44,7 +39,7 @@ int bad_fallthrough_count=0;
 
 using namespace libIRDB;
 using namespace std;
-using namespace ELFIO;
+using namespace EXEIO;
 
 set< pair<db_id_t,int> > missed_instructions;
 int failed_target_count=0;
@@ -221,7 +216,7 @@ File_t* find_file(FileIR_t* firp, db_id_t fileid)
 
 }
 
-ELFIO::elfio    elfiop;
+EXEIO::exeio    elfiop;
 
 void add_new_instructions(FileIR_t *firp)
 {
@@ -244,33 +239,33 @@ void add_new_instructions(FileIR_t *firp)
 
 
 
+#if 0
         	::Elf64_Off sec_hdr_off, sec_off;
         	::Elf_Half secnum, strndx, secndx;
         	::Elf_Word secsize;
 	
-		
-
-        	sec_hdr_off = elfiop.get_sections_offset();
-        	secnum = elfiop.sections.size(); 
-        	strndx = elfiop.get_section_name_str_index();
+#endif
+        	int secnum = elfiop.sections.size(); 
+		int secndx=0;
 
 		bool found=false;
 	
         	/* look through each section and find the missing target*/
         	for (secndx=1; secndx<secnum; secndx++)
 		{
-        		int flags = elfiop.sections[secndx]->get_flags();
+//        		int flags = elfiop.sections[secndx]->get_flags();
 
         		/* not a loaded section */
-        		if( (flags & SHF_ALLOC) != SHF_ALLOC)
+        		if( !elfiop.sections[secndx]->isLoadable()) // (flags & SHF_ALLOC) != SHF_ALLOC)
                 		continue;
 		
         		/* loaded, and contains instruction, record the bounds */
-        		if( (flags & SHF_EXECINSTR) != SHF_EXECINSTR)
+        		// if( (flags & SHF_EXECINSTR) != SHF_EXECINSTR)
+        		if( !elfiop.sections[secndx]->isExecutable()) 
                 		continue;
 		
-        		::Elf64_Addr first=elfiop.sections[secndx]->get_address();
-        		::Elf64_Addr second=elfiop.sections[secndx]->get_address()+elfiop.sections[secndx]->get_size();
+        		virtual_offset_t first=elfiop.sections[secndx]->get_address();
+        		virtual_offset_t second=elfiop.sections[secndx]->get_address()+elfiop.sections[secndx]->get_size();
 
 			/* is the missed instruction in this section */
 			if(first<=missed_address && missed_address<=second)
@@ -476,8 +471,8 @@ main(int argc, char* argv[])
                 	lo.to_file(pqxx_interface.GetTransaction(),"readeh_tmp_file.exe");
 
 			elfiop.load("readeh_tmp_file.exe");
-			ELFIO::dump::header(cout,elfiop);
-			ELFIO::dump::section_headers(cout,elfiop);
+			EXEIO::dump::header(cout,elfiop);
+			EXEIO::dump::section_headers(cout,elfiop);
 
 			fill_in_cfg(firp);
 
diff --git a/libIRDB/test/fill_in_indtargs.cpp b/libIRDB/test/fill_in_indtargs.cpp
index 8ca51fe68..2224bc76d 100644
--- a/libIRDB/test/fill_in_indtargs.cpp
+++ b/libIRDB/test/fill_in_indtargs.cpp
@@ -865,13 +865,12 @@ void check_for_PIC_switch_table64(FileIR_t* firp, Instruction_t* insn, DISASM di
 
         /* here's the pattern we're looking for */
 #if 0
-I1:   0x000000000044425a <+218>:        cmp    DWORD PTR [rax+0x8],0xd   // bounds checking code, 0xd cases.
+I1:   0x000000000044425a <+218>:        cmp    DWORD PTR [rax+0x8],0xd   // bounds checking code, 0xd cases. switch(i) has i stored in [rax+8] in this e.g.
 I2:   0x000000000044425e <+222>:        jbe    0x444320 <_gedit_tab_get_icon+416>
-
-<snip>
+<new bb>
 I3:   0x0000000000444264 <+228>:        mov    rdi,rbp // default case, also jumped to via indirect branch below
-<snip>
-I4:   0x0000000000444320 <+416>:        mov    edx,DWORD PTR [rax+0x8]
+<snip (doesn't fall through)>
+I4:   0x0000000000444320 <+416>:        mov    edx,DWORD PTR [rax+0x8]		# load from memory into index reg EDX.
 I5:   0x0000000000444323 <+419>:        lea    rax,[rip+0x3e1b6]        # 0x4824e0
 I6:   0x000000000044432a <+426>:        movsxd rdx,DWORD PTR [rax+rdx*4]
 I7:   0x000000000044432e <+430>:        add    rax,rdx  // OR: lea rax, [rdx+rax]
@@ -879,9 +878,9 @@ I8:   0x0000000000444331 <+433>:        jmp    rax      // relatively standard s
 
 
 D1:   0x4824e0: .long 0x4824e0-L1       // L1-LN are labels in the code where case statements start.
-D2:   0x4824e0: .long 0x4824e0-L2
+D2:   0x4824e4: .long 0x4824e0-L2
 ..
-DN:   0x4824e0: .long 0x4824e0-LN
+DN:   0x4824XX: .long 0x4824e0-LN
 #endif
 
 
@@ -1449,6 +1448,25 @@ void fill_in_indtargs(FileIR_t* firp, exeio* elfiop)
 	print_targets();
 	cout<<"========================================="<<endl;
 
+
+
+	FILE* dynsymfile = popen( "$PS_READELF --dyn-syms readeh_tmp_file.exe |grep 'FUNC    GLOBAL DEFAULT'"
+		"|grep -v 'FUNC    GLOBAL DEFAULT  UND' |sed 's/.*: *//'|cut -f1 -d' '", "r");
+
+	assert(dynsymfile);
+	virtual_offset_t target=0;
+	while( fscanf(dynsymfile, "%x", &target) != -1)
+	{
+		possible_target(target);
+	}
+	cout<<"========================================="<<endl;
+	cout<<"# ATTRIBUTE total_indirect_targets_pass7="<<std::dec<<targets.size()<<endl;
+	print_targets();
+	cout<<"========================================="<<endl;
+
+
+
+
 	/* set the IR to have some instructions marked as IB targets */
 	mark_targets(firp);
 
@@ -1511,7 +1529,9 @@ main(int argc, char* argv[])
 			jmptables.clear();
 
         		EXEIO::exeio*    elfiop=new EXEIO::exeio;
-        		elfiop->load("readeh_tmp_file.exe");
+        		elfiop->load((const char*)"readeh_tmp_file.exe");
+
+
 		
         		EXEIO::dump::header(cout,*elfiop);
         		EXEIO::dump::section_headers(cout,*elfiop);
diff --git a/libIRDB/test/find_strings.cpp b/libIRDB/test/find_strings.cpp
index edf0f5730..656fff09b 100644
--- a/libIRDB/test/find_strings.cpp
+++ b/libIRDB/test/find_strings.cpp
@@ -29,6 +29,9 @@
 #include <stdlib.h>
 
 
+#include <exeio.h>
+
+#include <elf.h>
 #include "targ-config.h"
 #include "elfio/elfio.hpp"
 #include "elfio/elfio_dump.hpp"
@@ -37,7 +40,7 @@
 
 using namespace libIRDB;
 using namespace std;
-using namespace ELFIO;
+using namespace EXEIO;
 
 #define arch_ptr_bytes() (firp->GetArchitectureBitWidth()/8)
 
@@ -50,12 +53,16 @@ bool is_string_character(char c)
 
 /* the stuff we need for reading an elf file */
 typedef struct elf_info {
+#if 0
        	::Elf64_Off sec_hdr_off, sec_off;
        	::Elf_Half secnum, strndx;
        	::Elf_Word secsize;
-	char const **sec_data;
 	::Elf64_Addr got;
-	elfio *elfiop;
+#endif
+	int secnum;
+	virtual_offset_t got;
+	char const **sec_data;
+	exeio *elfiop;
 } elf_info_t;
 
 void found_string(string s, void* addr)
@@ -87,7 +94,7 @@ void found_string(string s, void* addr)
 
 void load_section(elf_info_t &ei, int i, bool alloc)
 {
-	if( alloc && (ei.elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC)
+	if( alloc && !ei.elfiop->sections[i]->isLoadable()) // (ei.elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC)
 	{
 		cerr<<"Cannot load non-alloc section\n";
 		assert(0);
@@ -96,7 +103,8 @@ void load_section(elf_info_t &ei, int i, bool alloc)
 	if(ei.sec_data[i]==NULL)
 	{
 		ei.sec_data[i]=ei.elfiop->sections[i]->get_data(); 
-		if(ei.elfiop->sections[i]->get_type()==SHT_NOBITS)
+		// if(ei.elfiop->sections[i]->get_type()==SHT_NOBITS)
+		if(ei.elfiop->sections[i]->isBSS())
 		{
 			/* no need to read anything for NOBITS sections */
 			ei.sec_data[i]=(char*)calloc(ei.elfiop->sections[i]->get_size(),1);
@@ -129,7 +137,8 @@ void is_string_pointer(void* addr, elf_info_t &ei)
 	{
 //cout << "is_string_pointer(): address: " << std::hex << intaddr << std::dec << "looking at section number: " << i << endl;
 		/* only look at loaded sections */
-		if( (ei.elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC)
+		// if( (ei.elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC)
+		if( !ei.elfiop->sections[i]->isLoadable())
 			continue;
 
 		if(ei.elfiop->sections[i]->get_address() <= intaddr 
@@ -198,7 +207,9 @@ void handle_argument(ARGTYPE *arg, elf_info_t &ei, Instruction_t *insn)
         if( (arg->ArgType & MEMORY_TYPE) == MEMORY_TYPE )
 	{
 		/* Only check without GOT offset if type is executable */
-       		if( ((arg->ArgType & ABSOLUTE_) == ABSOLUTE_)  && ei.elfiop->get_type() == ET_EXEC )
+	
+       		if( ((arg->ArgType & ABSOLUTE_) == ABSOLUTE_)  && !ei.elfiop->isDLL() )
+			//  && ei.elfiop->get_type() == ET_EXEC ) -- checks for .so/.dll vrs .exe.
 			is_string_pointer((void*)arg->Memory.Displacement,ei);
 		else
 			is_string_pointer((void*)(arg->Memory.Displacement + insn->GetDataBits().size()), ei);
@@ -215,24 +226,24 @@ void read_elf_info(elf_info_t &ei, FileIR_t* firp)
 
 
         /* Read ELF header */
-        ei.sec_hdr_off = ei.elfiop->get_sections_offset();
+//        ei.sec_hdr_off = ei.elfiop->get_sections_offset();
         ei.secnum = ei.elfiop->sections.size();
         assert(ei.secnum>0);
-        ei.strndx = ei.elfiop->get_section_name_str_index();
+//        ei.strndx = ei.elfiop->get_section_name_str_index();
 
 	ei.sec_data=(char const**)calloc(ei.secnum,sizeof(void*));
 
 	ei.got = 0;
 	/* Get .got or .got.plt address, if any */
-	if (ei.strndx != SHN_UNDEF)
-	{
-		int shstr_sec;
-		if (ei.strndx < SHN_LORESERVE)
-			shstr_sec = ei.strndx;
-		else
-			shstr_sec = ei.elfiop->sections[0]->get_link();
-		assert(shstr_sec < ei.secnum);
-		load_section(ei,shstr_sec,false);
+//	if (ei.strndx != SHN_UNDEF)
+//	{
+//		int shstr_sec;
+//		if (ei.strndx < SHN_LORESERVE)
+//			shstr_sec = ei.strndx;
+//		else
+//			shstr_sec = ei.elfiop->sections[0]->get_link();
+//		assert(shstr_sec < ei.secnum);
+//		load_section(ei,shstr_sec,false);
 //		IRDB_Elf_Shdr *shstr_sec_hdr = ei.sechdrs + shstr_sec;
 		for (int i=0;i<ei.secnum;i++)
 		{
@@ -247,7 +258,7 @@ void read_elf_info(elf_info_t &ei, FileIR_t* firp)
 			if (ei.elfiop->sections[i]->get_name()==".got") // if (!strcmp(ei.sec_data[shstr_sec]+ei.sechdrs[i].sh_name, ".got"))
 				ei.got = ei.elfiop->sections[i]->get_address();
 		}
-	}
+//	}
 }
 
 void free_elf_info(elf_info_t &ei)
@@ -331,10 +342,11 @@ void find_strings_in_instructions(FileIR_t* firp, elf_info_t& ei)
 					unsigned char byte4=imm&0xff;
 					size_t argsize = disasm.Argument1.ArgSize / 8;
 
-					if (((is_string_character(byte1) || byte1==0) || argsize < 4) &&
+					if ( imm!=0 /* special case 0 which is likely from push <reg> insns, etc. */ && 
+					    (((is_string_character(byte1) || byte1==0) || argsize < 4) &&
 					    ((is_string_character(byte2) || byte2==0) || argsize < 4) &&
 					    ((is_string_character(byte3) || byte3==0) || argsize < 2) &&
-					    (is_string_character(byte4) || byte4==0))
+					    (is_string_character(byte4) || byte4==0)))
 					{
 						// printable, concatenate to built string
 						assert(str = (char *)realloc(str, size+argsize));
@@ -402,7 +414,7 @@ void find_strings_in_instructions(FileIR_t* firp, elf_info_t& ei)
 //	cout<<"Pass 2: Checking insn: "<<disasm.CompleteInstr<<" id: "<<insn->GetBaseID()<<endl;
 
 		// check for immediate string pointers in non-PIC code
-		if ( ei.elfiop->get_type() == ET_EXEC )
+		if ( !ei.elfiop->isDLL()) // ei.elfiop->get_type() == ET_EXEC )
 			is_string_pointer((void*)disasm.Instruction.Immediat,ei);
 		// always check for string pointers in memory argument displacements
 
@@ -428,49 +440,52 @@ void find_strings_in_instructions(FileIR_t* firp, elf_info_t& ei)
 
 void find_strings_in_data(FileIR_t* firp, elf_info_t& ei)
 {
+	ELFIO::elfio *the_elfiop=reinterpret_cast<ELFIO::elfio *>(ei.elfiop->get_elfio());
+	if(!the_elfiop)
+		return;
 	for(int i=0;i<ei.secnum;i++)
 	{
 		/* skip executable, hash, string table, nonloadable, and tiny sections */
-		if( (ei.elfiop->sections[i]->get_flags() & SHF_EXECINSTR)
-		    || ei.elfiop->sections[i]->get_type() == SHT_HASH
-		    || ei.elfiop->sections[i]->get_type() == SHT_GNU_HASH
-		    || ei.elfiop->sections[i]->get_type() == SHT_STRTAB
-		    || (ei.elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC
-		    || ei.elfiop->sections[i]->get_size() < arch_ptr_bytes())
+		if( (the_elfiop->sections[i]->get_flags() & SHF_EXECINSTR)
+		    || the_elfiop->sections[i]->get_type() == SHT_HASH
+		    || the_elfiop->sections[i]->get_type() == SHT_GNU_HASH
+		    || the_elfiop->sections[i]->get_type() == SHT_STRTAB
+		    || (the_elfiop->sections[i]->get_flags() & SHF_ALLOC) != SHF_ALLOC
+		    || the_elfiop->sections[i]->get_size() < arch_ptr_bytes())
 			continue;
 
 		int offset = 0;
 		int step;
 		/* step over relocation info */
-		switch( ei.elfiop->sections[i]->get_type() )
+		switch( the_elfiop->sections[i]->get_type() )
 		{
-		case SHT_REL:
-			if(arch_ptr_bytes()==4)
-				step = sizeof(ELFIO::Elf32_Rel);
-			else
-				step = sizeof(ELFIO::Elf64_Rel);
-			break;
-		case SHT_RELA:
-			if(arch_ptr_bytes()==4)
-				step = sizeof(ELFIO::Elf32_Rela);
-			else
-				step = sizeof(ELFIO::Elf64_Rela);
-			break;
-		case SHT_SYMTAB:
-		case SHT_DYNSYM:
-			if(arch_ptr_bytes()==4)
-			{
-				offset = sizeof(::Elf32_Word);
-				step = sizeof(ELFIO::Elf32_Sym);
-			}
-			else
-			{
-				offset = sizeof(::Elf64_Word);
-				step = sizeof(ELFIO::Elf64_Sym);
-			}
-			break;
-		default:
-			step = 1;
+			case SHT_REL:
+				if(arch_ptr_bytes()==4)
+					step = sizeof(ELFIO::Elf32_Rel);
+				else
+					step = sizeof(ELFIO::Elf64_Rel);
+				break;
+			case SHT_RELA:
+				if(arch_ptr_bytes()==4)
+					step = sizeof(ELFIO::Elf32_Rela);
+				else
+					step = sizeof(ELFIO::Elf64_Rela);
+				break;
+			case SHT_SYMTAB:
+			case SHT_DYNSYM:
+				if(arch_ptr_bytes()==4)
+				{
+					offset = sizeof(ELFIO::Elf32_Word);
+					step = sizeof(ELFIO::Elf32_Sym);
+				}
+				else
+				{
+					offset = sizeof(ELFIO::Elf64_Word);
+					step = sizeof(ELFIO::Elf64_Sym);
+				}
+				break;
+			default:
+				step = 1;
 		}
 
 		load_section(ei,i,true);
@@ -502,10 +517,10 @@ void find_strings(VariantID_t *pidp, FileIR_t* firp)
 
 	pqxx::largeobject lo(elfoid);
 	lo.to_file(pqxx_interface->GetTransaction(),"readeh_tmp_file.exe");
-	ELFIO::elfio    elfiop;
+	EXEIO::exeio    elfiop;
 	elfiop.load("readeh_tmp_file.exe");
-	ELFIO::dump::header(cout,elfiop);
-	ELFIO::dump::section_headers(cout,elfiop);
+	EXEIO::dump::header(cout,elfiop);
+	EXEIO::dump::section_headers(cout,elfiop);
 
 
 
diff --git a/tools/transforms/PNTransformDriver.cpp b/tools/transforms/PNTransformDriver.cpp
index e66e0d10d..58f628e5a 100644
--- a/tools/transforms/PNTransformDriver.cpp
+++ b/tools/transforms/PNTransformDriver.cpp
@@ -562,11 +562,11 @@ void PNTransformDriver::InitNewFileIR(File_t* this_file)
 	pqxx::largeobject lo(elfoid);
 	lo.to_file(pqxx_interface->GetTransaction(),"readeh_tmp_file.exe");
 
-	elfiop=new ELFIO::elfio;
-	elfiop->load("readeh_tmp_file.exe");
+	elfiop=new EXEIO::exeio;
+	elfiop->load((char*)"readeh_tmp_file.exe");
 	
-	ELFIO::dump::header(cout,*elfiop);
-	ELFIO::dump::section_headers(cout,*elfiop);
+	EXEIO::dump::header(cout,*elfiop);
+	EXEIO::dump::section_headers(cout,*elfiop);
 
 	//Calc preds is used for sanity checks.
 	//I believe it determines the predecessors of instructions
@@ -655,20 +655,6 @@ void PNTransformDriver::GenerateTransforms()
 
 			// read the db  
 			InitNewFileIR(this_file);
-#if 0
-orig_virp=new FileIR_t(*pidp,this_file);
-assert(orig_virp && pidp);
-int elfoid=firp->GetFile()->GetELFOID();
-pqxx::largeobject lo(elfoid);
-lo.to_file(pqxx_interface.GetTransaction(),"readeh_tmp_file.exe");
-
-ELFIO::elfio*    elfiop=new ELFIO::elfio;
-elfiop->load("readeh_tmp_file.exe");
-
-ELFIO::dump::header(cout,*elfiop);
-ELFIO::dump::section_headers(cout,*elfiop);
-#endif
-
 
 			map<string,double> file_coverage_map;
 
@@ -936,11 +922,11 @@ bool	check_for_bad_variadic_funcs(Function_t *func, const ControlFlowGraph_t* cf
 }
 
 
-static ELFIO::section*  find_section(unsigned int addr, ELFIO::elfio *elfiop)
+static EXEIO::section*  find_section(virtual_offset_t addr, EXEIO::exeio *elfiop)
 {
          for ( int i = 0; i < elfiop->sections.size(); ++i )
          {
-                 ELFIO::section* pSec = elfiop->sections[i];
+                 EXEIO::section* pSec = elfiop->sections[i];
                  assert(pSec);
                  if(pSec->get_address() > addr)
                          continue;
@@ -980,7 +966,7 @@ bool PNTransformDriver::check_jump_tables(Instruction_t* insn)
 
 	int displacement=d.Argument1.Memory.Displacement;
 
-	ELFIO::section* pSec=find_section(displacement,elfiop);
+	EXEIO::section* pSec=find_section(displacement,elfiop);
 
 	if(!pSec)
 		return true;	
@@ -995,7 +981,7 @@ bool PNTransformDriver::check_jump_tables(Instruction_t* insn)
 	set<int> jump_tab_entries;
 	for(int i=0;jump_tab_entries.size()<5;i++)
 	{
-		if(offset+i*4+sizeof(int) > pSec->get_size())
+		if(offset+i*4+sizeof(int) > (int) pSec->get_size())
 			break;
 
 		const int *table_entry_ptr=(const int*)&(secdata[offset+i*4]);
@@ -1162,7 +1148,7 @@ DN:   0x4824e0: .long 0x4824e0-LN
         int D1=strtol(disasm.Argument2.ArgMnemonic, NULL, 16);
 
         // find the section with the data table
-        ELFIO::section *pSec=find_section(D1,elfiop);
+        EXEIO::section *pSec=find_section(D1,elfiop);
 
         // sanity check there's a section
         if(!pSec)
@@ -1180,7 +1166,7 @@ DN:   0x4824e0: .long 0x4824e0-LN
         for(int i=0;table_entries.size()<5;i++)
         {
                 // check that we can still grab a word from this section
-                if(offset+sizeof(int) > pSec->get_size())
+                if(offset+sizeof(int) > (int)pSec->get_size())
                         break;
 
                 const int *table_entry_ptr=(const int*)&(secdata[offset]);
diff --git a/tools/transforms/PNTransformDriver.hpp b/tools/transforms/PNTransformDriver.hpp
index d36de2aef..2592f6b7c 100644
--- a/tools/transforms/PNTransformDriver.hpp
+++ b/tools/transforms/PNTransformDriver.hpp
@@ -24,8 +24,7 @@
 
 #include <vector>
 #include <set>
-#include "elfio/elfio.hpp"
-#include "elfio/elfio_dump.hpp"
+#include <exeio.h>
 #include "PNStackLayoutInference.hpp"
 #include "PNRegularExpressions.hpp"
 #include <csignal>
@@ -68,7 +67,7 @@ class PNTransformDriver
 
     	libIRDB::VariantID_t *pidp;
     	libIRDB::FileIR_t *orig_virp;
-	ELFIO::elfio* elfiop;
+	EXEIO::exeio* elfiop;
     	std::string BED_script;
     	int orig_progid;
     	bool do_canaries;
diff --git a/tools/transforms/SConscript b/tools/transforms/SConscript
index fa4e18109..e61cc656c 100644
--- a/tools/transforms/SConscript
+++ b/tools/transforms/SConscript
@@ -15,10 +15,11 @@ cpppath='''
 	$SECURITY_TRANSFORMS_HOME/libMEDSannotation/include/
 	$SECURITY_TRANSFORMS_HOME/libtransform/include/
 	$SECURITY_TRANSFORMS_HOME/beaengine/include
+	$SECURITY_TRANSFORMS_HOME/libEXEIO/include
 	$SECURITY_TRANSFORMS_HOME/beaengine/beaengineSources/Includes/
 	'''
 
-LIBS="xform IRDB-core IRDB-cfg BeaEngine_s_d pqxx  MEDSannotation transform pq"
+LIBS="xform IRDB-core IRDB-cfg BeaEngine_s_d pqxx  MEDSannotation transform pq EXEIO"
 LIBPATH="$SECURITY_TRANSFORMS_HOME/lib"
 
 integer_files="transformutils.cpp integertransformdriver.cpp"
-- 
GitLab