elfreader

Documentation

Index

• func FindTextProgHeader(f *elf.File) *elf.ProgHeader
• func HeaderForFileOffset(headers []*elf.ProgHeader, fileOffset uint64) (*elf.ProgHeader, error)
• func IsASLRElegible(path string) (bool, error)
• func IsASLRElegibleElf(elfFile *elf.File) bool
• func ProgramHeadersForMapping(phdrs []elf.ProgHeader, mapOff, mapSz uint64) []*elf.ProgHeader

Functions

func FindTextProgHeader

func FindTextProgHeader(f *elf.File) *elf.ProgHeader

FindTextProgHeader finds the program segment header containing the .text section or nil if the segment cannot be found.

func HeaderForFileOffset

func HeaderForFileOffset(headers []*elf.ProgHeader, fileOffset uint64) (*elf.ProgHeader, error)

HeaderForFileOffset attempts to identify a unique program header that includes the given file offset. It returns an error if it cannot identify a unique header.

func IsASLRElegible

func IsASLRElegible(path string) (bool, error)

func IsASLRElegibleElf

func IsASLRElegibleElf(elfFile *elf.File) bool

IsASLRElegibleElf returns whether the elf executable could be elegible for address space layout randomization (ASLR).

Whether to enable ASLR for a process is decided in this kernel code path (https://github.com/torvalds/linux/blob/v5.0/fs/binfmt_elf.c#L955).

Note(javierhonduco): This check is a bit simplistic and might not work for every case. We might want to check across multiple kernels. It probably won't be correct for the dynamic loader itself. See link above.

func ProgramHeadersForMapping

func ProgramHeadersForMapping(phdrs []elf.ProgHeader, mapOff, mapSz uint64) []*elf.ProgHeader

ProgramHeadersForMapping returns the program segment headers that overlap the runtime mapping with file offset mapOff and memory size mapSz. We skip over segments zero file size because their file offset values are unreliable. Even if overlapping, a segment is not selected if its aligned file offset is greater than the mapping file offset, or if the mapping includes the last page of the segment, but not the full segment and the mapping includes additional pages after the segment end. The function returns a slice of pointers to the headers in the input slice, which are valid only while phdrs is not modified or discarded.