elf_reader

package module
v1.0.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 21, 2024 License: MIT Imports: 5 Imported by: 8

README

ELF Reader

About

This library is for reading ELF files using the Go programming language. Go's standard library already includes ELF-related functions, but these do not include some useful functionality for displaying or accessing some aspects of ELF files out-of-the-box.

This library supports both big and little-endian 32- and 64-bit ELF files. You can specifically read 32-bit files by calling ParseELF32File(...), or 64-bit files by ParseELF64File(...), or either type of file using ParseELFFile(...). If you use the generic ParseELFFile(...) function, then you can either use the returned ELFFile interface directly, or use type assertions to retrieve a 32-bit *ELF32File or a 64-bit *ELF64File.

Usage

The following example shows how this library can be used to output section names to standard output. For a more complete example of how to read information from an ELF file, see the command-line tool at elf_view/elf_view.go.

import (
	"fmt"
	"github.com/yalue/elf_reader"
	"os"
)

func main() {
	// Print the section names in /bin/bash. This code will work on both 32-bit
	// and 64-bit systems.
	raw, e := os.ReadFile("/bin/bash")
	if e != nil {
		fmt.Printf("Failed reading /bin/bash: %s\n", e)
		return
	}
	elf, e := elf_reader.ParseELFFile(raw)
	if e != nil {
		fmt.Printf("Failed parsing ELF file: %s\n", e)
		return
	}
	count := elf.GetSectionCount()
	for i := uint16(0); i < count; i++ {
		if i == 0 {
			fmt.Printf("Section 0: NULL section (no name)\n")
			continue
		}
		name, e := elf.GetSectionName(uint16(i))
		if e != nil {
			fmt.Printf("Failed getting section %d name: %s\n", i, e)
			continue
		}
		fmt.Printf("Section %d name: %s\n", i, name)
	}
}

Documentation

Overview

This package contains functions for reading ELF files.

Example usage, printing section names: 

raw, e := os.ReadFile("/bin/bash")
// if e != nil {...}
elf, e = elf_reader.ParseELF32File(raw)
// if e != nil {...}
for i := range elf.Sections {
    if i != 0 {
        name, e := elf.GetSectionName(uint16(i))
        // if e != nil {...}
        fmt.Printf("Section %d: %s", i, name)
    }
}

Index

Constants

View Source 
const (
	ELFTypeRelocatable           = 1
	ELFTypeExecutable            = 2
	ELFTypeShared                = 3
	ELFTypeCore                  = 4
	MachineTypeSPARC             = 0x02
	MachineTypeX86               = 0x03
	MachineTypeMIPS              = 0x08
	MachineTypePowerPC           = 0x14
	MachineTypeARM               = 0x28
	MachineTypeAMD64             = 0x3e
	MachineTypeARM64             = 0xb7
	MachineTypeAMDGPU            = 0xe0
	NullSegment                  = 0
	LoadableSegment              = 1
	DynamicLinkingSegment        = 2
	InterpreterSegment           = 3
	NoteSegment                  = 4
	ReservedSegment              = 5
	ProgramHeaderSegment         = 6
	NullSection                  = 0
	BitsSection                  = 1
	SymbolTableSection           = 2
	StringTableSection           = 3
	RelaSection                  = 4
	HashSection                  = 5
	DynamicLinkingTableSection   = 6
	NoteSection                  = 7
	UninitializedSection         = 8
	RelSection                   = 9
	ReservedSection              = 10
	DynamicLoaderSymbolSection   = 11
	GNUHashSection               = 0x6ffffff5
	GNUVersionDefinitionSection  = 0x6ffffffd
	GNUVersionRequirementSection = 0x6ffffffe
	GNUVersionSymbolSection      = 0x6fffffff
)

Variables

This section is empty.

Functions

func ELF32Hash 

func ELF32Hash(data []byte) uint32

Calculates the hash value of a given string.

func ReadStringAtOffset 

func ReadStringAtOffset(offset uint32, data []byte) ([]byte, error)

Returns a string starting at the offset in the data, or an error if the offset is invalid or the string isn't terminated. This can be used to extract strings from string table content.

func WriteAtOffset 

func WriteAtOffset(destination []byte, offset uint64,
	endianness binary.ByteOrder, toWrite interface{}) ([]byte, error)

Outputs the toWrite structure, as binary, at the given offset in the destination buffer. May append more data at the end of the destination buffer, so this should be used like append(...). Ex: 

data = []byte("Hi there")
toWrite = []byte("!!!")
data, e := WriteAtOffset(data, uint64(len(data)), binary.LittleEndian,
    toWrite)

If the write fails, the original buffer will be returned along with a non-nil error.

Types

type ELF32DynamicEntry 

type ELF32DynamicEntry struct {
	Tag   ELF32DynamicTag
	Value uint32
}

Holds a single entry in a 32-bit ELF .dynamic section. The Value can be either an address or a value, depending on the Tag.

func (*ELF32DynamicEntry) GetTag 

func (n *ELF32DynamicEntry) GetTag() ELFDynamicTag

func (*ELF32DynamicEntry) GetValue 

func (n *ELF32DynamicEntry) GetValue() uint64

func (*ELF32DynamicEntry) String 

func (n *ELF32DynamicEntry) String() string

type ELF32DynamicTag 

type ELF32DynamicTag uint32

A constant value indicating the type of an entry in the dynamic table.

func (ELF32DynamicTag) GetValue 

func (t ELF32DynamicTag) GetValue() int64

func (ELF32DynamicTag) String 

func (t ELF32DynamicTag) String() string

type ELF32File 

type ELF32File struct {
	Header     ELF32Header
	Sections   []ELF32SectionHeader
	Segments   []ELF32ProgramHeader
	Raw        []byte
	Endianness binary.ByteOrder
}

Tracks parsed data for a 32-bit ELF.

func ParseELF32File 

func ParseELF32File(raw []byte) (*ELF32File, error)

Attempts to parse the given data buffer as a 32-bit ELF file. Returns an error if the file isn't a 32-bit ELF.

func (*ELF32File) DynamicEntries 

func (f *ELF32File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)

func (*ELF32File) GetDynamicTable 

func (f *ELF32File) GetDynamicTable(sectionIndex uint16) ([]ELF32DynamicEntry,
	error)

Parses and returns the dynamic linking table at the given section index. May include entries past the end of the actual table, depending on the section size, so callers must check for the terminating null entry when referring to the returned slice.

func (*ELF32File) GetFileType 

func (f *ELF32File) GetFileType() ELFFileType

func (*ELF32File) GetMachineType 

func (f *ELF32File) GetMachineType() MachineType

func (*ELF32File) GetProgramHeader 

func (f *ELF32File) GetProgramHeader(index uint16) (ELFProgramHeader, error)

func (*ELF32File) GetRelocationTable 

func (f *ELF32File) GetRelocationTable(sectionIndex uint16) ([]ELF32Relocation,
	error)

If the given section is a relocation table (type .rel or .rela), this will parse and return the relocations.

func (*ELF32File) GetRelocations 

func (f *ELF32File) GetRelocations(index uint16) ([]ELFRelocation, error)

func (*ELF32File) GetSectionContent 

func (f *ELF32File) GetSectionContent(sectionIndex uint16) ([]byte, error)

Returns the bytes of the section at the given index, or an error if one occurs.

func (*ELF32File) GetSectionCount 

func (f *ELF32File) GetSectionCount() uint16

func (*ELF32File) GetSectionHeader 

func (f *ELF32File) GetSectionHeader(index uint16) (ELFSectionHeader, error)

func (*ELF32File) GetSectionName 

func (f *ELF32File) GetSectionName(sectionIndex uint16) (string, error)

Returns the name of the section at the given index in the section table, or an error if one occurs.

func (*ELF32File) GetSegmentContent 

func (f *ELF32File) GetSegmentContent(segmentIndex uint16) ([]byte, error)

Returns the bytes of the segment at the given index, or an error if one occurs.

func (*ELF32File) GetSegmentCount 

func (f *ELF32File) GetSegmentCount() uint16

func (*ELF32File) GetStringTable 

func (f *ELF32File) GetStringTable(sectionIndex uint16) ([]string, error)

Returns a slice of strings contained in the string table at the given index. This *includes* the first zero-length string.

func (*ELF32File) GetSymbolTable 

func (f *ELF32File) GetSymbolTable(sectionIndex uint16) ([]ELF32Symbol,
	[]string, error)

Parses a symbol table section with the given index, and a slice of the names of each symbol. The parsed symbols and names will be in the same order. Returns an error if the given index doesn't contain a valid symbol table.

func (*ELF32File) GetSymbols 

func (f *ELF32File) GetSymbols(index uint16) ([]ELFSymbol, []string, error)

func (*ELF32File) IsDynamicSection 

func (f *ELF32File) IsDynamicSection(sectionIndex uint16) bool

Returns true if the section with the given index is a dynamic linking table.

func (*ELF32File) IsRelocationTable 

func (f *ELF32File) IsRelocationTable(sectionIndex uint16) bool

Returns true if the given index is a relocation table.

func (*ELF32File) IsStringTable 

func (f *ELF32File) IsStringTable(sectionIndex uint16) bool

Returns true if the section at the given index is a string table.

func (*ELF32File) IsSymbolTable 

func (f *ELF32File) IsSymbolTable(sectionIndex uint16) bool

Returns true if the section at the given index is a symbol table.

func (*ELF32File) IsVersionDefinitionSection 

func (f *ELF32File) IsVersionDefinitionSection(sectionIndex uint16) bool

func (*ELF32File) IsVersionRequirementSection 

func (f *ELF32File) IsVersionRequirementSection(sectionIndex uint16) bool

Returns true if the given section index is a .gnu.version_r section.

func (*ELF32File) ParseVersionDefinitionSection 

func (f *ELF32File) ParseVersionDefinitionSection(sectionIndex uint16) (
	[]ELF32VersionDef, [][]ELF32VersionDefAux, error)

This parses a GNU version definition section with the given index. Returns a slice of version definition structs, and a slice of auxiliary structures corresponding to each definition. This behaves similarly to ParseVersionRequirementSection().

func (*ELF32File) ParseVersionRequirementSection 

func (f *ELF32File) ParseVersionRequirementSection(sectionIndex uint16) (
	[]ELF32VersionNeed, [][]ELF32VersionNeedAux, error)

Returns an array of ELF32VersionNeed structures, in the order they appear in a .gnu.version_r section. For each version needed structure, there will be an associated slice of version aux structures (which will contain at least one entry). If a version requirement section exists but contains no entries, this function may return nil, but no error. Returns an error if the section type is incorrect or couldn't be parsed for some reason.

func (*ELF32File) ReadStringTable 

func (f *ELF32File) ReadStringTable(sectionIndex uint16, offset uint32) (
	string, error)

Returns the string at the given offset in the string table contained in the section at the given section index. Returns an error if one occurs.

func (*ELF32File) ReparseData 

func (f *ELF32File) ReparseData() error

This function must be called in order to re-parse internal data structures if the Raw buffer has been updated.

type ELF32Header 

type ELF32Header struct {
	Signature              uint32
	Class                  uint8
	Endianness             uint8
	Version                uint8
	OSABI                  uint8
	EABI                   uint8
	Padding                [7]uint8
	Type                   ELFFileType
	Machine                MachineType
	Version2               uint32
	EntryPoint             uint32
	ProgramHeaderOffset    uint32
	SectionHeaderOffset    uint32
	Flags                  uint32
	HeaderSize             uint16
	ProgramHeaderEntrySize uint16
	ProgramHeaderEntries   uint16
	SectionHeaderEntrySize uint16
	SectionHeaderEntries   uint16
	SectionNamesTable      uint16
}

The header structure for 32-bit ELF files.

func (*ELF32Header) String 

func (h *ELF32Header) String() string

type ELF32ProgramHeader 

type ELF32ProgramHeader struct {
	Type            ProgramHeaderType
	FileOffset      uint32
	VirtualAddress  uint32
	PhysicalAddress uint32
	FileSize        uint32
	MemorySize      uint32
	Flags           ProgramHeaderFlags
	Align           uint32
}

Specifies the format for a single entry for a 32-bit ELF program (segment) header.

func (*ELF32ProgramHeader) GetAlignment 

func (h *ELF32ProgramHeader) GetAlignment() uint64

func (*ELF32ProgramHeader) GetFileOffset 

func (h *ELF32ProgramHeader) GetFileOffset() uint64

func (*ELF32ProgramHeader) GetFileSize 

func (h *ELF32ProgramHeader) GetFileSize() uint64

func (*ELF32ProgramHeader) GetFlags 

func (h *ELF32ProgramHeader) GetFlags() ProgramHeaderFlags

func (*ELF32ProgramHeader) GetMemorySize 

func (h *ELF32ProgramHeader) GetMemorySize() uint64

func (*ELF32ProgramHeader) GetPhysicalAddress 

func (h *ELF32ProgramHeader) GetPhysicalAddress() uint64

func (*ELF32ProgramHeader) GetType 

func (h *ELF32ProgramHeader) GetType() ProgramHeaderType

func (*ELF32ProgramHeader) GetVirtualAddress 

func (h *ELF32ProgramHeader) GetVirtualAddress() uint64

func (*ELF32ProgramHeader) String 

func (h *ELF32ProgramHeader) String() string

type ELF32Rel 

type ELF32Rel struct {
	Address        uint32
	RelocationInfo ELF32RelocationInfo
}

A relocation without an addend. Satisfies the ELF32Relocation interface.

func (*ELF32Rel) Addend 

func (r *ELF32Rel) Addend() int32

func (*ELF32Rel) Offset 

func (r *ELF32Rel) Offset() uint32

func (*ELF32Rel) String 

func (r *ELF32Rel) String() string

func (*ELF32Rel) SymbolIndex 

func (r *ELF32Rel) SymbolIndex() uint32

func (*ELF32Rel) Type 

func (r *ELF32Rel) Type() uint32

type ELF32Rela 

type ELF32Rela struct {
	Address        uint32
	RelocationInfo ELF32RelocationInfo
	AddendValue    int32
}

A relocation with an addend. Also satisfies the ELF32Relocation interface.

func (*ELF32Rela) Addend 

func (r *ELF32Rela) Addend() int32

func (*ELF32Rela) Offset 

func (r *ELF32Rela) Offset() uint32

func (*ELF32Rela) String 

func (r *ELF32Rela) String() string

func (*ELF32Rela) SymbolIndex 

func (r *ELF32Rela) SymbolIndex() uint32

func (*ELF32Rela) Type 

func (r *ELF32Rela) Type() uint32

type ELF32Relocation 

type ELF32Relocation interface {
	// Returns the address of the relocation
	Offset() uint32
	// Returns the relocation's type from the info field.
	Type() uint32
	// Returns the symbol index from the info field.
	SymbolIndex() uint32
	// Returns the addent field for the relocation, or 0 if the relocation
	// did not include an addend.
	Addend() int32
	String() string
}

type ELF32RelocationInfo 

type ELF32RelocationInfo uint32

Represents the 32-bit info field in a relocation

func (ELF32RelocationInfo) String 

func (n ELF32RelocationInfo) String() string

func (ELF32RelocationInfo) SymbolIndex 

func (n ELF32RelocationInfo) SymbolIndex() uint32

Returns the 24-bit symbol index.

func (ELF32RelocationInfo) Type 

func (n ELF32RelocationInfo) Type() uint8

Returns the 8-bit relocation type in the 32-bit ELF relocation info field.

type ELF32SectionHeader 

type ELF32SectionHeader struct {
	Name           uint32
	Type           SectionHeaderType
	Flags          SectionHeaderFlags32
	VirtualAddress uint32
	FileOffset     uint32
	Size           uint32
	LinkedIndex    uint32
	Info           uint32
	Align          uint32
	EntrySize      uint32
}

Specifies the format for a single entry for a 32-bit ELF section header.

func (*ELF32SectionHeader) GetAlignment 

func (h *ELF32SectionHeader) GetAlignment() uint64

func (*ELF32SectionHeader) GetEntrySize 

func (h *ELF32SectionHeader) GetEntrySize() uint64

func (*ELF32SectionHeader) GetFileOffset 

func (h *ELF32SectionHeader) GetFileOffset() uint64

func (*ELF32SectionHeader) GetFlags 

func (h *ELF32SectionHeader) GetFlags() ELFSectionFlags

func (*ELF32SectionHeader) GetInfo 

func (h *ELF32SectionHeader) GetInfo() uint32

func (*ELF32SectionHeader) GetLinkedIndex 

func (h *ELF32SectionHeader) GetLinkedIndex() uint32

func (*ELF32SectionHeader) GetSize 

func (h *ELF32SectionHeader) GetSize() uint64

func (*ELF32SectionHeader) GetType 

func (h *ELF32SectionHeader) GetType() SectionHeaderType

func (*ELF32SectionHeader) GetVirtualAddress 

func (h *ELF32SectionHeader) GetVirtualAddress() uint64

func (*ELF32SectionHeader) String 

func (h *ELF32SectionHeader) String() string

type ELF32Symbol 

type ELF32Symbol struct {
	Name         uint32
	Value        uint32
	Size         uint32
	Info         ELFSymbolInfo
	Other        uint8
	SectionIndex uint16
}

Holds a symbol table entry for a 32-bit ELF

func (*ELF32Symbol) GetInfo 

func (s *ELF32Symbol) GetInfo() ELFSymbolInfo

func (*ELF32Symbol) GetName 

func (s *ELF32Symbol) GetName() uint32

func (*ELF32Symbol) GetOther 

func (s *ELF32Symbol) GetOther() uint8

func (*ELF32Symbol) GetSectionIndex 

func (s *ELF32Symbol) GetSectionIndex() uint16

func (*ELF32Symbol) GetSize 

func (s *ELF32Symbol) GetSize() uint64

func (*ELF32Symbol) GetValue 

func (s *ELF32Symbol) GetValue() uint64

func (*ELF32Symbol) String 

func (s *ELF32Symbol) String() string

type ELF32VersionDef 

type ELF32VersionDef struct {
	Version   uint16
	Flags     uint16
	Index     uint16
	Count     uint16
	Hash      uint32
	AuxOffset uint32
	Next      uint32
}

This is the analogue to the Elf32_Verdef structure, used in GNU version definition sections.

func (*ELF32VersionDef) String 

func (d *ELF32VersionDef) String() string

type ELF32VersionDefAux 

type ELF32VersionDefAux struct {
	Name uint32
	Next uint32
}

This holds an Elf32_Verdaux structure.

func (*ELF32VersionDefAux) String 

func (d *ELF32VersionDefAux) String() string

type ELF32VersionNeed 

type ELF32VersionNeed struct {
	Version   uint16
	Count     uint16
	File      uint32
	AuxOffset uint32
	Next      uint32
}

Holds an instance of the ELF32_Verneed structure

func (*ELF32VersionNeed) String 

func (n *ELF32VersionNeed) String() string

type ELF32VersionNeedAux 

type ELF32VersionNeedAux struct {
	Hash  uint32
	Flags uint16
	Other uint16
	Name  uint32
	Next  uint32
}

Holds an instance of the ELF32_Vernaux structure

func (*ELF32VersionNeedAux) String 

func (a *ELF32VersionNeedAux) String() string

type ELF64DynamicEntry 

type ELF64DynamicEntry struct {
	Tag   ELF64DynamicTag
	Value uint64
}

Holds a single entry in a 64-bit ELF .dynamic section. The Value can be either an address or a value, depending on the Tag.

func (*ELF64DynamicEntry) GetTag 

func (n *ELF64DynamicEntry) GetTag() ELFDynamicTag

func (*ELF64DynamicEntry) GetValue 

func (n *ELF64DynamicEntry) GetValue() uint64

func (*ELF64DynamicEntry) String 

func (n *ELF64DynamicEntry) String() string

type ELF64DynamicTag 

type ELF64DynamicTag int64

A constant value indicating the type of an entry in the dynamic table.

func (ELF64DynamicTag) GetValue 

func (t ELF64DynamicTag) GetValue() int64

func (ELF64DynamicTag) String 

func (t ELF64DynamicTag) String() string

type ELF64File 

type ELF64File struct {
	Header     ELF64Header
	Sections   []ELF64SectionHeader
	Segments   []ELF64ProgramHeader
	Raw        []byte
	Endianness binary.ByteOrder
}

Tracks parsed data for a 64-bit ELF.

func ParseELF64File 

func ParseELF64File(raw []byte) (*ELF64File, error)

func (*ELF64File) DynamicEntries 

func (f *ELF64File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)

func (*ELF64File) GetDynamicTable 

func (f *ELF64File) GetDynamicTable(sectionIndex uint16) ([]ELF64DynamicEntry,
	error)

func (*ELF64File) GetFileType 

func (f *ELF64File) GetFileType() ELFFileType

func (*ELF64File) GetMachineType 

func (f *ELF64File) GetMachineType() MachineType

func (*ELF64File) GetProgramHeader 

func (f *ELF64File) GetProgramHeader(index uint16) (ELFProgramHeader, error)

func (*ELF64File) GetRelocationTable 

func (f *ELF64File) GetRelocationTable(sectionIndex uint16) ([]ELF64Relocation,
	error)

func (*ELF64File) GetRelocations 

func (f *ELF64File) GetRelocations(index uint16) ([]ELFRelocation, error)

func (*ELF64File) GetSectionContent 

func (f *ELF64File) GetSectionContent(sectionIndex uint16) ([]byte, error)

Returns the bytes of the section at the given index, or an error if one occurs.

func (*ELF64File) GetSectionCount 

func (f *ELF64File) GetSectionCount() uint16

func (*ELF64File) GetSectionHeader 

func (f *ELF64File) GetSectionHeader(index uint16) (ELFSectionHeader, error)

func (*ELF64File) GetSectionName 

func (f *ELF64File) GetSectionName(sectionIndex uint16) (string, error)

Returns the name of the section at the given index in the section table, or an error if one occurs.

func (*ELF64File) GetSegmentContent 

func (f *ELF64File) GetSegmentContent(segmentIndex uint16) ([]byte, error)

Returns the bytes of the segment at the given index, or an error if one occurs.

func (*ELF64File) GetSegmentCount 

func (f *ELF64File) GetSegmentCount() uint16

func (*ELF64File) GetStringTable 

func (f *ELF64File) GetStringTable(sectionIndex uint16) ([]string, error)

Returns a slice of strings contained in the string table section at the given index. This *includes* the first zero-length string.

func (*ELF64File) GetSymbolTable 

func (f *ELF64File) GetSymbolTable(sectionIndex uint16) ([]ELF64Symbol,
	[]string, error)

Parses a symbol table section with the given index, and returns a two slices: the symbols, and their corresponding names. Returns an error if the given section index is not a valid symbol table.

func (*ELF64File) GetSymbols 

func (f *ELF64File) GetSymbols(index uint16) ([]ELFSymbol, []string, error)

func (*ELF64File) IsDynamicSection 

func (f *ELF64File) IsDynamicSection(sectionIndex uint16) bool

Returns true if the section with the given index is a dynamic linking table.

func (*ELF64File) IsRelocationTable 

func (f *ELF64File) IsRelocationTable(sectionIndex uint16) bool

Returns true if the given index is a relocation table.

func (*ELF64File) IsStringTable 

func (f *ELF64File) IsStringTable(sectionIndex uint16) bool

Returns true if the section at the given index is a string table.

func (*ELF64File) IsSymbolTable 

func (f *ELF64File) IsSymbolTable(sectionIndex uint16) bool

Returns true if the section at the given index is a symbol table.

func (*ELF64File) ReparseData 

func (f *ELF64File) ReparseData() error

This function must be called in order to re-parse internal data structures if the Raw buffer has been updated.

type ELF64Header 

type ELF64Header struct {
	Signature              uint32
	Class                  uint8
	Endianness             uint8
	Version                uint8
	OSABI                  uint8
	EABI                   uint8
	Padding                [7]uint8
	Type                   ELFFileType
	Machine                MachineType
	Version2               uint32
	EntryPoint             uint64
	ProgramHeaderOffset    uint64
	SectionHeaderOffset    uint64
	Flags                  uint32
	HeaderSize             uint16
	ProgramHeaderEntrySize uint16
	ProgramHeaderEntries   uint16
	SectionHeaderEntrySize uint16
	SectionHeaderEntries   uint16
	SectionNamesTable      uint16
}

The header structure for 64-bit ELF files.

type ELF64ProgramHeader 

type ELF64ProgramHeader struct {
	Type            ProgramHeaderType
	Flags           ProgramHeaderFlags
	FileOffset      uint64
	VirtualAddress  uint64
	PhysicalAddress uint64
	FileSize        uint64
	MemorySize      uint64
	Align           uint64
}

Specifies the format for a single entry for a 64-bit ELF program (segment) header.

func (*ELF64ProgramHeader) GetAlignment 

func (h *ELF64ProgramHeader) GetAlignment() uint64

func (*ELF64ProgramHeader) GetFileOffset 

func (h *ELF64ProgramHeader) GetFileOffset() uint64

func (*ELF64ProgramHeader) GetFileSize 

func (h *ELF64ProgramHeader) GetFileSize() uint64

func (*ELF64ProgramHeader) GetFlags 

func (h *ELF64ProgramHeader) GetFlags() ProgramHeaderFlags

func (*ELF64ProgramHeader) GetMemorySize 

func (h *ELF64ProgramHeader) GetMemorySize() uint64

func (*ELF64ProgramHeader) GetPhysicalAddress 

func (h *ELF64ProgramHeader) GetPhysicalAddress() uint64

func (*ELF64ProgramHeader) GetType 

func (h *ELF64ProgramHeader) GetType() ProgramHeaderType

func (*ELF64ProgramHeader) GetVirtualAddress 

func (h *ELF64ProgramHeader) GetVirtualAddress() uint64

func (*ELF64ProgramHeader) String 

func (h *ELF64ProgramHeader) String() string

type ELF64Rel 

type ELF64Rel struct {
	Address        uint64
	RelocationInfo ELF64RelocationInfo
}

A relocation without an addend. Satisfies the ELF64Relocation interface.

func (*ELF64Rel) Addend 

func (r *ELF64Rel) Addend() int64

func (*ELF64Rel) Info 

func (r *ELF64Rel) Info() ELF64RelocationInfo

func (*ELF64Rel) Offset 

func (r *ELF64Rel) Offset() uint64

func (*ELF64Rel) String 

func (r *ELF64Rel) String() string

func (*ELF64Rel) SymbolIndex 

func (r *ELF64Rel) SymbolIndex() uint32

func (*ELF64Rel) Type 

func (r *ELF64Rel) Type() uint32

type ELF64Rela 

type ELF64Rela struct {
	Address        uint64
	RelocationInfo ELF64RelocationInfo
	AddendValue    int64
}

A relocation with an addend. Satisfies the ELF64Relocation interface.

func (*ELF64Rela) Addend 

func (r *ELF64Rela) Addend() int64

func (*ELF64Rela) Info 

func (r *ELF64Rela) Info() ELF64RelocationInfo

func (*ELF64Rela) Offset 

func (r *ELF64Rela) Offset() uint64

func (*ELF64Rela) String 

func (r *ELF64Rela) String() string

func (*ELF64Rela) SymbolIndex 

func (r *ELF64Rela) SymbolIndex() uint32

func (*ELF64Rela) Type 

func (r *ELF64Rela) Type() uint32

type ELF64Relocation 

type ELF64Relocation interface {
	// Returns the address of the relocation
	Offset() uint64
	// Returns the relocation type.
	Type() uint32
	// Returns the relocation's symbol index.
	SymbolIndex() uint32
	// Returns the addend field for the relocation, or 0 if the relocation did
	// not include an addend.
	Addend() int64
	String() string
}

type ELF64RelocationInfo 

type ELF64RelocationInfo uint64

Represents the 64-bit info field in a relocation

func (ELF64RelocationInfo) String 

func (n ELF64RelocationInfo) String() string

func (ELF64RelocationInfo) SymbolIndex 

func (n ELF64RelocationInfo) SymbolIndex() uint32

Returns the 32-bit symbol table index for a 64-bit ELF relocation info field.

func (ELF64RelocationInfo) Type 

func (n ELF64RelocationInfo) Type() uint32

Returns the 32-bit type in the 64-bit ELF relocation info field.

type ELF64SectionHeader 

type ELF64SectionHeader struct {
	Name           uint32
	Type           SectionHeaderType
	Flags          SectionHeaderFlags64
	VirtualAddress uint64
	FileOffset     uint64
	Size           uint64
	LinkedIndex    uint32
	Info           uint32
	Align          uint64
	EntrySize      uint64
}

Specifies the format for a single entry for a 64-bit ELF section header.

func (*ELF64SectionHeader) GetAlignment 

func (h *ELF64SectionHeader) GetAlignment() uint64

func (*ELF64SectionHeader) GetEntrySize 

func (h *ELF64SectionHeader) GetEntrySize() uint64

func (*ELF64SectionHeader) GetFileOffset 

func (h *ELF64SectionHeader) GetFileOffset() uint64

func (*ELF64SectionHeader) GetFlags 

func (h *ELF64SectionHeader) GetFlags() ELFSectionFlags

func (*ELF64SectionHeader) GetInfo 

func (h *ELF64SectionHeader) GetInfo() uint32

func (*ELF64SectionHeader) GetLinkedIndex 

func (h *ELF64SectionHeader) GetLinkedIndex() uint32

func (*ELF64SectionHeader) GetSize 

func (h *ELF64SectionHeader) GetSize() uint64

func (*ELF64SectionHeader) GetType 

func (h *ELF64SectionHeader) GetType() SectionHeaderType

func (*ELF64SectionHeader) GetVirtualAddress 

func (h *ELF64SectionHeader) GetVirtualAddress() uint64

func (*ELF64SectionHeader) String 

func (h *ELF64SectionHeader) String() string

type ELF64Symbol 

type ELF64Symbol struct {
	Name         uint32
	Info         ELFSymbolInfo
	Other        uint8
	SectionIndex uint16
	Value        uint64
	Size         uint64
}

Holds a symbol table entry for a 64-bit ELF

func (*ELF64Symbol) GetInfo 

func (s *ELF64Symbol) GetInfo() ELFSymbolInfo

func (*ELF64Symbol) GetName 

func (s *ELF64Symbol) GetName() uint32

func (*ELF64Symbol) GetOther 

func (s *ELF64Symbol) GetOther() uint8

func (*ELF64Symbol) GetSectionIndex 

func (s *ELF64Symbol) GetSectionIndex() uint16

func (*ELF64Symbol) GetSize 

func (s *ELF64Symbol) GetSize() uint64

func (*ELF64Symbol) GetValue 

func (s *ELF64Symbol) GetValue() uint64

func (*ELF64Symbol) String 

func (s *ELF64Symbol) String() string

type ELFDynamicEntry 

type ELFDynamicEntry interface {
	GetTag() ELFDynamicTag
	GetValue() uint64
}

type ELFDynamicTag 

type ELFDynamicTag interface {
	GetValue() int64
	String() string
}

type ELFFile 

type ELFFile interface {
	// Returns the value specified in the ELF header of whether the ELF file is
	// an executable, relocatable, shared, or core file.
	GetFileType() ELFFileType
	// Returns the value specified in the ELF header of the type of machine
	// this file targets.
	GetMachineType() MachineType
	// Returns the number of sections defined in the ELF file.
	GetSectionCount() uint16
	// Returns the number of segments (program headers) defined in the ELF
	// file.
	GetSegmentCount() uint16
	// Returns the name of the section at the given index.
	GetSectionName(index uint16) (string, error)
	// Returns the content of the section at the given index.
	GetSectionContent(index uint16) ([]byte, error)
	// Returns the content of the segment at the given index.
	GetSegmentContent(index uint16) ([]byte, error)
	// Returns an interface that can be used to access the header metadata for
	// the section at the given index.
	GetSectionHeader(index uint16) (ELFSectionHeader, error)
	// Returns an interface that can be used to access the header metadata for
	// the program header (segment) at the given index.
	GetProgramHeader(index uint16) (ELFProgramHeader, error)
	// Returns true if the section at the given index is a string table.
	IsStringTable(index uint16) bool
	// Returns a slice of strings from the string table in the given section
	// index.
	GetStringTable(index uint16) ([]string, error)
	// Returns true if the section at the given index is a symbol table.
	IsSymbolTable(index uint16) bool
	// Parses the symbol table in the section at the given index, and returns
	// a slice of symbols in it. The slice of strings is the list of symbol
	// names, in the same order as the symbols themselves.
	GetSymbols(index uint16) ([]ELFSymbol, []string, error)
	// Returns true if the section at the given index is a relocation table.
	IsRelocationTable(index uint16) bool
	// Parses the relocation table in the section at the given index, and
	// returns a slice of the relocations contained in it.
	GetRelocations(index uint16) ([]ELFRelocation, error)
	// Returns true if the section at the given index is a dynamic table.
	IsDynamicSection(index uint16) bool
	// Parses and returns the dynamic linking table at the given section index.
	// This may return entries past the end of the actual table, depending on
	// the section size, so callers must check for the terminating null entry
	// when referring to the returned slice.
	DynamicEntries(intex uint16) ([]ELFDynamicEntry, error)
}

This is a 32- or 64-bit agnostic way of reading an ELF file. If needed, one can use type assertions to convert instances of this interface into either instances of *ELF64File or *ELF32File.

func ParseELFFile 

func ParseELFFile(raw []byte) (ELFFile, error)

This function parses any ELF file and returns an instance of the ELFFile interface if no errors occur.

type ELFFileType 

type ELFFileType uint16

func (ELFFileType) String 

func (t ELFFileType) String() string

type ELFProgramHeader 

type ELFProgramHeader interface {
	GetType() ProgramHeaderType
	GetFlags() ProgramHeaderFlags
	GetFileOffset() uint64
	GetVirtualAddress() uint64
	GetPhysicalAddress() uint64
	GetFileSize() uint64
	GetMemorySize() uint64
	GetAlignment() uint64
	String() string
}

This is a 32- or 64-bit agnostic way of accessing an ELF program header.

type ELFRelocation 

type ELFRelocation interface {
	Offset() uint64
	Type() uint32
	SymbolIndex() uint32
	Addend() int64
	String() string
}

This holds a generic entry in a relocation table for either a 32- or 64-bit ELF file.

type ELFSectionFlags 

type ELFSectionFlags interface {
	Executable() bool
	Allocated() bool
	Writable() bool
	String() string
}

This is a 32- or 64-bit agnostic interface for accessing an ELF section's flags. Can be converted using type assertions into either SectionHeaderFlags64 or SectionHeaderFlags32 values.

type ELFSectionHeader 

type ELFSectionHeader interface {
	GetType() SectionHeaderType
	GetFlags() ELFSectionFlags
	GetVirtualAddress() uint64
	GetFileOffset() uint64
	GetSize() uint64
	GetLinkedIndex() uint32
	GetInfo() uint32
	GetAlignment() uint64
	GetEntrySize() uint64
	String() string
}

This is a 32- or 64-bit agnostic way of accessing an ELF section header.

type ELFSymbol 

type ELFSymbol interface {
	GetName() uint32
	GetInfo() ELFSymbolInfo
	GetOther() uint8
	GetSectionIndex() uint16
	GetValue() uint64
	GetSize() uint64
	String() string
}

This is an interface used to access either 64- or 32-bit ELF symbol table entries.

type ELFSymbolInfo 

type ELFSymbolInfo uint8

Represents the 8-bit info field in symbol table entries

func (ELFSymbolInfo) Binding 

func (n ELFSymbolInfo) Binding() uint8

func (ELFSymbolInfo) String 

func (n ELFSymbolInfo) String() string

func (ELFSymbolInfo) SymbolType 

func (n ELFSymbolInfo) SymbolType() uint8

type MachineType 

type MachineType uint16

func (MachineType) String 

func (t MachineType) String() string

type ProgramHeaderFlags 

type ProgramHeaderFlags uint32

func (ProgramHeaderFlags) String 

func (t ProgramHeaderFlags) String() string

type ProgramHeaderType 

type ProgramHeaderType uint32

func (ProgramHeaderType) String 

func (ht ProgramHeaderType) String() string

type SectionHeaderFlags32 

type SectionHeaderFlags32 uint32

func (SectionHeaderFlags32) Allocated 

func (f SectionHeaderFlags32) Allocated() bool

func (SectionHeaderFlags32) Executable 

func (f SectionHeaderFlags32) Executable() bool

func (SectionHeaderFlags32) String 

func (f SectionHeaderFlags32) String() string

func (SectionHeaderFlags32) Writable 

func (f SectionHeaderFlags32) Writable() bool

type SectionHeaderFlags64 

type SectionHeaderFlags64 uint64

func (SectionHeaderFlags64) Allocated 

func (f SectionHeaderFlags64) Allocated() bool

func (SectionHeaderFlags64) Executable 

func (f SectionHeaderFlags64) Executable() bool

func (SectionHeaderFlags64) String 

func (f SectionHeaderFlags64) String() string

func (SectionHeaderFlags64) Writable 

func (f SectionHeaderFlags64) Writable() bool

type SectionHeaderType 

type SectionHeaderType uint32

func (SectionHeaderType) String 

func (ht SectionHeaderType) String() string

Source Files

View all Source files

Directories

Path Synopsis
The elf_view executable is yet-another-ELF-viewer program joining the likes of objdump and readelf, but is probably less complete.
 The elf_view executable is yet-another-ELF-viewer program joining the likes of objdump and readelf, but is probably less complete.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.