Documentation
¶
Overview ¶
Package elf provides comprehensive ELF binary analysis utilities.
This package offers functionality for analyzing ELF binaries including: - Symbol resolution and offset calculation - Function instruction analysis (finding RET instructions) - Support for multiple architectures (x86_64, ARM64) - Memory-optimized symbol loading with selective caching - Support for different symbol types (Rust, C++, etc.)
The main type is ElfAnalyzer which provides a high-level interface for ELF binary analysis with efficient memory management through memory mapping and selective symbol loading.
Index ¶
- Variables
- func GetCompatibleElfMachines() []elf.Machine
- func GetHostElfMachine() elf.Machine
- func HasElfMagic(bytesArray []byte) bool
- func Is32BitMachine(machine elf.Machine) bool
- func IsElf(bytesArray []byte) bool
- func IsElfFile(filePath string) bool
- func IsMachineCompatibleWithHost(machine elf.Machine) bool
- type ElfAnalyzer
- func (ea *ElfAnalyzer) Close() error
- func (ea *ElfAnalyzer) GetFilePath() string
- func (ea *ElfAnalyzer) GetFunctionRetInsts(funcName string) ([]uint64, error)
- func (ea *ElfAnalyzer) GetGoVersion() (*GoVersion, error)
- func (ea *ElfAnalyzer) GetMachine() elf.Machine
- func (ea *ElfAnalyzer) GetSymbol(symbolName string) (*ElfSymbol, error)
- func (ea *ElfAnalyzer) GetSymbolOffset(symbolName string) (uint64, error)
- func (ea *ElfAnalyzer) Is32Bit() bool
- func (ea *ElfAnalyzer) IsArchCompatible() bool
- type ElfSymbol
- type GoVersion
- type PlainSymbolName
- type WantedSymbol
Constants ¶
This section is empty.
Variables ¶
var ErrNotGoBinary = errors.New("not a go binary")
var ErrSymbolNotFound = errors.New("symbol not found")
Functions ¶
func GetCompatibleElfMachines ¶
GetCompatibleElfMachines returns all ELF machine types that can run on the host. On 64-bit hosts, this includes both native 64-bit and 32-bit compat binaries. For example, on x86_64 hosts, both EM_X86_64 and EM_386 (i386) binaries can run.
func GetHostElfMachine ¶
GetHostElfMachine returns the ELF machine type for the host architecture. Tracee only supports x86_64 and arm64.
func HasElfMagic ¶
HasElfMagic checks if the given bytes start with the ELF magic number (0x7F 'ELF'). This is a fast check that only validates the first 4 bytes.
func Is32BitMachine ¶
Is32BitMachine returns true if the given ELF machine type is a 32-bit architecture.
func IsElf ¶
IsElf checks if the given bytes represent a valid ELF file. Currently this only checks the magic number, but can be expanded in the future to include more comprehensive ELF validation.
func IsElfFile ¶
IsElfFile checks if the file at the given path is an ELF file (fast magic-only check).
func IsMachineCompatibleWithHost ¶
IsMachineCompatibleWithHost checks if the given ELF machine type can run on this host.
Types ¶
type ElfAnalyzer ¶
type ElfAnalyzer struct {
// contains filtered or unexported fields
}
func NewElfAnalyzer ¶
func NewElfAnalyzer(filePath string, wantedSymbols []WantedSymbol) (*ElfAnalyzer, error)
func (*ElfAnalyzer) Close ¶
func (ea *ElfAnalyzer) Close() error
func (*ElfAnalyzer) GetFilePath ¶
func (ea *ElfAnalyzer) GetFilePath() string
func (*ElfAnalyzer) GetFunctionRetInsts ¶
func (ea *ElfAnalyzer) GetFunctionRetInsts(funcName string) ([]uint64, error)
func (*ElfAnalyzer) GetGoVersion ¶
func (ea *ElfAnalyzer) GetGoVersion() (*GoVersion, error)
func (*ElfAnalyzer) GetMachine ¶
func (ea *ElfAnalyzer) GetMachine() elf.Machine
GetMachine returns the ELF machine type (architecture) of the binary.
func (*ElfAnalyzer) GetSymbol ¶
func (ea *ElfAnalyzer) GetSymbol(symbolName string) (*ElfSymbol, error)
func (*ElfAnalyzer) GetSymbolOffset ¶
func (ea *ElfAnalyzer) GetSymbolOffset(symbolName string) (uint64, error)
func (*ElfAnalyzer) Is32Bit ¶
func (ea *ElfAnalyzer) Is32Bit() bool
Is32Bit returns true if the ELF binary is a 32-bit architecture.
func (*ElfAnalyzer) IsArchCompatible ¶
func (ea *ElfAnalyzer) IsArchCompatible() bool
IsArchCompatible checks if the ELF binary's architecture is compatible with the host. On x86_64 hosts, both 64-bit (EM_X86_64) and 32-bit (EM_386) binaries are compatible.
type ElfSymbol ¶
type ElfSymbol struct {
Name string
Info, Other byte
Section elf.SectionIndex
Value, Size uint64
}
func (ElfSymbol) IsImported ¶
type PlainSymbolName ¶
type PlainSymbolName string
PlainSymbolName represents a regular symbol name for exact string matching
func (PlainSymbolName) Matches ¶
func (s PlainSymbolName) Matches(symbolName string) bool
func (PlainSymbolName) String ¶
func (s PlainSymbolName) String() string
type WantedSymbol ¶
WantedSymbol interface for different types of symbols that can be searched for
func NewPlainSymbolName ¶
func NewPlainSymbolName(name string) WantedSymbol
NewPlainSymbolName creates a WantedSymbol for exact string matching
func WantedSymbolsFromStrings ¶
func WantedSymbolsFromStrings(symbols map[string]struct{}) []WantedSymbol
WantedSymbolsFromStrings converts a map of string symbols to WantedSymbol slice
Source Files