第三方预编译 SO 加固前兼容性风险检查：ABI、STL 与页大小核对指南

#!/usr/bin/env python3
import subprocess
import sys
import os
import json

def parse_elf_header(file_path):
    try:
        result = subprocess.run(
            ['readelf', '-h', file_path],
            capture_output=True,
            text=True,
            check=True
        )
        return result.stdout
    except subprocess.CalledProcessError:
        return None
    except FileNotFoundError:
        return None

def extract_machine_type(header_text):
    for line in header_text.splitlines():
        if 'Machine:' in line:
            return line.split(':', 1)[1].strip()
    return None

def scan_so_directory(base_dir):
    report = []
    if not os.path.isdir(base_dir):
        print(f"Error: Directory {base_dir} does not exist", file=sys.stderr)
        sys.exit(1)
    
    for root, dirs, files in os.walk(base_dir):
        for filename in files:
            if filename.endswith('.so'):
                full_path = os.path.join(root, filename)
                header = parse_elf_header(full_path)
                
                if header is None:
                    report.append({
                        'path': full_path,
                        'status': 'fatal',
                        'reason': 'invalid_elf_or_missing_tool'
                    })
                    continue
                
                machine = extract_machine_type(header)
                if machine is None:
                    report.append({
                        'path': full_path,
                        'status': 'warning',
                        'reason': 'machine_type_not_found'
                    })
                else:
                    report.append({
                        'path': full_path,
                        'machine': machine,
                        'status': 'pass'
                    })
    
    return report

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("Usage: python scan_so.py <library_directory>", file=sys.stderr)
        sys.exit(1)
    
    target_dir = sys.argv[1]
    results = scan_so_directory(target_dir)
    print(json.dumps(results, indent=2))
    
    has_fatal = any(item.get('status') == 'fatal' for item in results)
    if has_fatal:
        sys.exit(1)