elfexec

Documentation

Overview

Package elfexec provides utility routines to examine ELF binaries.

Index

• func FindTextProgHeader(f *elf.File) *elf.ProgHeader
• func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, ...) (uint64, error)
• func GetBuildID(binary io.ReaderAt) ([]byte, error)

Functions

func FindTextProgHeader

func FindTextProgHeader(f *elf.File) *elf.ProgHeader

FindTextProgHeader finds the program segment header containing the .text section or nil if the segment cannot be found.

func GetBase

func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, start, limit, offset uint64) (uint64, error)

GetBase determines the base address to subtract from virtual address to get symbol table address. For an executable, the base is 0. Otherwise, it's a shared library, and the base is the address where the mapping starts. The kernel is special, and may use the address of the _stext symbol as the mmap start. _stext offset can be obtained with `nm vmlinux | grep _stext`

func GetBuildID

func GetBuildID(binary io.ReaderAt) ([]byte, error)

GetBuildID returns the GNU build-ID for an ELF binary.

If no build-ID was found but the binary was read without error, it returns (nil, nil).