elfexec

Documentation

Overview

Package elfexec provides utility routines to examine ELF binaries.

Index

• func FindTextProgHeader(f *elf.File) *elf.ProgHeader
• func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, ...) (uint64, error)
• func GetBuildID(binary io.ReaderAt) ([]byte, error)
• func HeaderForFileOffset(headers []*elf.ProgHeader, fileOffset uint64) (*elf.ProgHeader, error)
• func ProgramHeadersForMapping(phdrs []elf.ProgHeader, mapOff, mapSz uint64) []*elf.ProgHeader

Functions

func FindTextProgHeader

func FindTextProgHeader(f *elf.File) *elf.ProgHeader

FindTextProgHeader finds the program segment header containing the .text section or nil if the segment cannot be found.

func GetBase

func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, start, limit, offset uint64) (uint64, error)

GetBase determines the base address to subtract from virtual address to get symbol table address. For an executable, the base is 0. Otherwise, it's a shared library, and the base is the address where the mapping starts. The kernel needs special handling.

func GetBuildID

func GetBuildID(binary io.ReaderAt) ([]byte, error)

GetBuildID returns the GNU build-ID for an ELF binary.

If no build-ID was found but the binary was read without error, it returns (nil, nil).

func HeaderForFileOffset

func HeaderForFileOffset(headers []*elf.ProgHeader, fileOffset uint64) (*elf.ProgHeader, error)

HeaderForFileOffset attempts to identify a unique program header that includes the given file offset. It returns an error if it cannot identify a unique header.

func ProgramHeadersForMapping

func ProgramHeadersForMapping(phdrs []elf.ProgHeader, mapOff, mapSz uint64) []*elf.ProgHeader

ProgramHeadersForMapping returns the program segment headers that overlap the runtime mapping with file offset mapOff and memory size mapSz. We skip over segments zero file size because their file offset values are unreliable. Even if overlapping, a segment is not selected if its aligned file offset is greater than the mapping file offset, or if the mapping includes the last page of the segment, but not the full segment and the mapping includes additional pages after the segment end. The function returns a slice of pointers to the headers in the input slice, which are valid only while phdrs is not modified or discarded.