elflib

Documentation

Overview

Package elflib provides methods for handling ELF files.

Index

• Constants
• func GetBuildIDs(filename string, file io.ReaderAt) ([][]byte, error)
• func GetSoName(filename string, file io.ReaderAt) (string, error)
• func IsPDBFile(file io.ReaderAt) bool
• func ListSources(binary string) ([]string, error)
• func PEGetBuildIDs(filename string, file io.ReaderAt) ([][]byte, error)
• type BinaryFileRef
  • func NewBinaryFileRef(filepath, build string) BinaryFileRef
  • func ReadIDsFile(file io.Reader) ([]BinaryFileRef, error)
  • func WalkBuildIDDir(dirpath string) ([]BinaryFileRef, error)
  • func (b BinaryFileRef) HasDebugInfo() (bool, error)
  • func (b BinaryFileRef) Verify() error

Constants

const (
	DebugDirectorySize          = 28
	DebugDirectoryTypeOffset    = 12
	DebugDirectorySizeOffset    = 16
	DebugDirectoryAddressOffset = 20
	IMAGE_DEBUG_TYPE_CODEVIEW   = 2
	PDB70                       = 0x53445352
)

const DebugFileSuffix = ".debug"

DebugFileSuffix is the file suffix used by unstripped debug binaries.

const NT_GNU_BUILD_ID uint32 = 3

Functions

func GetBuildIDs

func GetBuildIDs(filename string, file io.ReaderAt) ([][]byte, error)

GetBuildIDs parses and returns all the build ids from file's section/program headers.

func GetSoName

func GetSoName(filename string, file io.ReaderAt) (string, error)

GetSoName returns the soname of the ELF file.

func IsPDBFile

func IsPDBFile(file io.ReaderAt) bool

TODO: kludge: PDB is way too complicated to decode enough to find the GUID easily. This is just a trivial hack to check if a file looks like a PDB file so it can be exempted from proper build ID checking.

func ListSources

func ListSources(binary string) ([]string, error)

ListSources reads the DWARF information in a given binary to determine the source locations that comprise it. The returned sources are deduped, but are in no particular order.

func PEGetBuildIDs

func PEGetBuildIDs(filename string, file io.ReaderAt) ([][]byte, error)

Types

type BinaryFileRef

type BinaryFileRef struct {
	BuildID  string
	Filepath string
}

BinaryFileRef represents a reference to an ELF file. The build id and filepath are stored here. BinaryFileRefs can verify that their build id matches their contents.

func NewBinaryFileRef

func NewBinaryFileRef(filepath, build string) BinaryFileRef

NewBinaryFileRef returns a BinaryFileRef with the given build id and filepath.

func ReadIDsFile

func ReadIDsFile(file io.Reader) ([]BinaryFileRef, error)

ReadIDsFile reads a list of build ids and corresponding filenames from an ids file and returns a list of BinaryFileRefs.

func WalkBuildIDDir

func WalkBuildIDDir(dirpath string) ([]BinaryFileRef, error)

WalkBuildIDDir walks the directory containing symbol files at dirpath and creates a BinaryFileRef for each symbol file it finds. Files without a ".debug" suffix are skipped. Each output BinaryFileRef's BuildID is formed by concatenating the file's basename with its parent directory's basename. For example:

Input directory:

de/
  adbeef.debug
  admeat.debug

Output BuildIDs:

deadbeef.debug
deadmeat.debug

func (BinaryFileRef) HasDebugInfo

func (b BinaryFileRef) HasDebugInfo() (bool, error)

HasDebugInfo checks if file contains debug_info section.

func (BinaryFileRef) Verify

func (b BinaryFileRef) Verify() error

Verify verifies that the build id of b matches the build id found in the file.