bininfo

Documentation

Overview

Package bininfo provides functions for reading elf binary files and converting file/line pairs or functions to addresses.

Index

• Variables
• type BinFile
  • func Read(r io.ReaderAt, name string) (*BinFile, error)
  • func (b *BinFile) FuncToPC(name string) (uint64, error)
  • func (b *BinFile) InlinedFuncToPCs(name string) ([]InlinedFunc, error)
  • func (b *BinFile) LineToPC(file string, line int) (uint64, error)
  • func (b *BinFile) Pie() bool
  • func (b *BinFile) PieOffset(pid int) (uint64, error)
• type ErrMultipleMatches
  • func (e *ErrMultipleMatches) Error() string
• type InlinedFunc

Variables

var (
	ErrInvalidElfType = errors.New("invalid elf type")
)

Types

type BinFile

type BinFile struct {
	// contains filtered or unexported fields
}

A BinFile provides functions for converting source code structures such as functions and line numbers into addresses. The BinFile also tracks if the executable is position-independent and if so provides a function to compute the PIE offset for a running instance.

func Read

func Read(r io.ReaderAt, name string) (*BinFile, error)

Read creates a new BinFile from an io.ReaderAt.

func (*BinFile) FuncToPC

func (b *BinFile) FuncToPC(name string) (uint64, error)

FuncToPC converts a function name to a PC. It does a "fuzzy" search so if the given name is a substring of a real function name, and the substring uniquely identifies it, that function is used. If there are multiple matches it returns a multiple match error describing all the matches.

func (*BinFile) InlinedFuncToPCs

func (b *BinFile) InlinedFuncToPCs(name string) ([]InlinedFunc, error)

InlinedFuncToPCs is the same as FuncToPCs but works for inlined functions and returns all start addresses and end addresses of the various inlinings of the specified function.

func (*BinFile) LineToPC

func (b *BinFile) LineToPC(file string, line int) (uint64, error)

LineToPC converts a file/line location to a PC. It performs a "fuzzy" search on the filename similar to FuncToPC.

func (*BinFile) Pie

func (b *BinFile) Pie() bool

Pie returns true if this executable is position-independent.

func (*BinFile) PieOffset

func (b *BinFile) PieOffset(pid int) (uint64, error)

PieOffset returns the PIE/ASLR offset for a running instance of this binary file. It reads /proc/pid/maps to determine the right location, so the caller must have ptrace permissions. If possible, you should cache the result of this function instead of calling it multiple times.

type ErrMultipleMatches

type ErrMultipleMatches struct {
	Matches []string
}

ErrMultipleMatches is an error that describes a filename or function name matching multiple known files/functions.

func (*ErrMultipleMatches) Error

func (e *ErrMultipleMatches) Error() string

type InlinedFunc

type InlinedFunc struct {
	Low  uint64
	High uint64
}

An InlinedFunc is a range of addresses representing the beginning and end of the inlined function.