binary

Documentation

Index

• Constants
• type Binary
  • func New(filePath string) (bin *Binary, err error)
  • func NewWithOptions(filePath string, opts *Options) (bin *Binary, err error)
  • func (b *Binary) Arch() string
  • func (b *Binary) ContainsStrings(s ...string) (match bool, err error)
  • func (b *Binary) LinkMode() (LinkMode, error)
  • func (b *Binary) OS() string
  • func (b *Binary) SetImplementation(impl binaryImplementation)
• type ELFBinary
  • func NewELFBinary(filePath string, opts *Options) (*ELFBinary, error)
  • func (elf *ELFBinary) Arch() string
  • func (elf *ELFBinary) LinkMode() (LinkMode, error)
  • func (elf *ELFBinary) OS() string
• type ELFHeader
  • func GetELFHeader(path string) (*ELFHeader, error)
  • func (eh *ELFHeader) MachineType() string
  • func (eh *ELFHeader) String() string
  • func (eh *ELFHeader) WordLength() int
• type Header
• type LinkMode
• type MachOBinary
  • func NewMachOBinary(filePath string, opts *Options) (*MachOBinary, error)
  • func (macho *MachOBinary) Arch() string
  • func (macho *MachOBinary) LinkMode() (LinkMode, error)
  • func (macho *MachOBinary) OS() string
• type MachOHeader
  • func GetMachOHeader(path string) (*MachOHeader, error)
  • func (machoh *MachOHeader) MachineType() string
  • func (machoh *MachOHeader) String() string
  • func (machoh *MachOHeader) WordLength() int
• type Options
• type PEBinary
  • func NewPEBinary(filePath string, opts *Options) (bin *PEBinary, err error)
  • func (pe *PEBinary) Arch() string
  • func (pe *PEBinary) LinkMode() (LinkMode, error)
  • func (pe *PEBinary) OS() string
• type PEFileHeader
• type PEHeader
  • func GetPEHeader(path string) (*PEHeader, error)
  • func (peh *PEHeader) MachineType() string
  • func (peh *PEHeader) String() string
  • func (peh *PEHeader) WordLength() int
• type PEOptionalHeader

Constants

const (
	// GOOS labels
	LINUX  = "linux"
	DARWIN = "darwin"
	WIN    = "windows"

	// GOARCH Architecture labels
	I386    = "386"
	AMD64   = "amd64"
	ARM     = "arm"
	ARM64   = "arm64"
	PPC     = "ppc"
	PPC64LE = "ppc64le"
	S390    = "s390x"
	RISCV   = "riscv"
)

const (
	MachO32Magic   uint32 = 0xfeedface // 32 bit, big endian
	MachO64Magic   uint32 = 0xfeedfacf // 64 bit, big endian
	MachO32LIMagic uint32 = 0xcefaedfe // 32 bit, little endian
	MachO64LIMagic uint32 = 0xcffaedfe // 64 bit, little endian
	MachOFat       uint32 = 0xcafebabe // Universal Binary
)

Types

type Binary

type Binary struct {
	// contains filtered or unexported fields
}

Binary is the base type of the package. It abstracts a binary executable

func New

func New(filePath string) (bin *Binary, err error)

New creates a new binary instance.

func NewWithOptions

func NewWithOptions(filePath string, opts *Options) (bin *Binary, err error)

NewWithOptions creates a new binary with the specified options

func (*Binary) Arch

func (b *Binary) Arch() string

Arch returns a string with the GOARCH label of the file

func (*Binary) ContainsStrings

func (b *Binary) ContainsStrings(s ...string) (match bool, err error)

ContainsStrings searches the printable strings un a binary file

func (*Binary) LinkMode

func (b *Binary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*Binary) OS

func (b *Binary) OS() string

OS returns a string with the GOOS label of the binary file

func (*Binary) SetImplementation

func (b *Binary) SetImplementation(impl binaryImplementation)

SetImplementation sets the implementation to handle this sort of executable

type ELFBinary

type ELFBinary struct {
	Header  *ELFHeader
	Options *Options
}

ELFBinary abstracts a binary in ELF format

func NewELFBinary

func NewELFBinary(filePath string, opts *Options) (*ELFBinary, error)

NewELFBinary opens a file and returns an ELF binary if it is one

func (*ELFBinary) Arch

func (elf *ELFBinary) Arch() string

Arch return the GOOS label of the binary

func (*ELFBinary) LinkMode

func (elf *ELFBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*ELFBinary) OS

func (elf *ELFBinary) OS() string

OS returns the GOOS label for the operating system

type ELFHeader

type ELFHeader struct {
	WordFlag uint8 // Flag: 32 or 64 bit binary

	OSABI      uint8 // Binary Interface
	ABIVersion uint8 // ABI Version

	EType    uint16 // Executable Type: Executable, relocatable, etc
	EMachine uint16 // Machine architecture
	// contains filtered or unexported fields
}

ELFHeader abstracts the data we need from the elf header

func GetELFHeader

func GetELFHeader(path string) (*ELFHeader, error)

GetELFHeader returns the header if the binary is and EF binary

func (*ELFHeader) MachineType

func (eh *ELFHeader) MachineType() string

MachineType returns a string with the architecture moniker

func (*ELFHeader) String

func (eh *ELFHeader) String() string

String returns the relevant info of the header as a string

func (*ELFHeader) WordLength

func (eh *ELFHeader) WordLength() int

WordLength returns either 32 or 64 for 32bit or 64 bit architectures

type Header

type Header interface {
	MachineType() string
	String() string
	WordLength() int
}

Header is a struct that captures the header of a binary executable

type LinkMode

type LinkMode string

LinkMode is the enum for all available linking modes.

const (
	LinkModeUnknown LinkMode = "unknown"
	LinkModeStatic  LinkMode = "static"
	LinkModeDynamic LinkMode = "dynamic"
)

type MachOBinary

type MachOBinary struct {
	Header  *MachOHeader
	Options *Options
}

MachOBinary is an abstraction for a Mach-O executable

func NewMachOBinary

func NewMachOBinary(filePath string, opts *Options) (*MachOBinary, error)

NewMachOBinary returns a Mach-O binary if the specified file is one

func (*MachOBinary) Arch

func (macho *MachOBinary) Arch() string

Arch returns a string with the GOARCH label of the file

func (*MachOBinary) LinkMode

func (macho *MachOBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*MachOBinary) OS

func (macho *MachOBinary) OS() string

OS returns a string with the GOOS label of the binary file

type MachOHeader

type MachOHeader struct {
	Magic  uint32
	CPU    uint32
	SubCPU uint32
}

MachOHeader is a structure to capture the data we need from the binary header

func GetMachOHeader

func GetMachOHeader(path string) (*MachOHeader, error)

GetMachOHeader returns a struct with the executable header information

func (*MachOHeader) MachineType

func (machoh *MachOHeader) MachineType() string

MachineType returns the architecture as a GOARCH label

func (*MachOHeader) String

func (machoh *MachOHeader) String() string

String returns the header information as a string

func (*MachOHeader) WordLength

func (machoh *MachOHeader) WordLength() int

WordLength returns an integer indicating if this is a 32 or 64bit binary

type Options

type Options struct {
	Path string
}

Options to control the binary checker

type PEBinary

type PEBinary struct {
	Header  *PEHeader
	Options *Options
}

PEBinary is a struct that abstracts a Windows Portable Executable

func NewPEBinary

func NewPEBinary(filePath string, opts *Options) (bin *PEBinary, err error)

NewPEBinary Returns a binary implementation for a Windows executable

func (*PEBinary) Arch

func (pe *PEBinary) Arch() string

Arch return the architecture

func (*PEBinary) LinkMode

func (pe *PEBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*PEBinary) OS

func (pe *PEBinary) OS() string

OS returns the operating system of the binary

type PEFileHeader

type PEFileHeader struct {
	Machine              uint16
	NumberOfSections     uint16
	TimeDateStamp        uint32
	PointerToSymbolTable uint32
	NumberOfSymbols      uint32
	SizeOfOptionalHeader uint16
	Characteristics      uint16
}

PEFileHeader captures the header information of the executable

type PEHeader

type PEHeader struct {
	Machine uint16
	Magic   uint16
}

PEHeader captures the header information of the executable

func GetPEHeader

func GetPEHeader(path string) (*PEHeader, error)

GetPEHeader returns a portable executable header from the specified file

func (*PEHeader) MachineType

func (peh *PEHeader) MachineType() string

MachineType returns the moniker of the binary architecture

func (*PEHeader) String

func (peh *PEHeader) String() string

Return the header information as a string

func (*PEHeader) WordLength

func (peh *PEHeader) WordLength() int

WordLength Returns an integer indicating if it's a 64 or 32 bit binary

type PEOptionalHeader

type PEOptionalHeader struct {
	Magic uint16
}

PEOptionalHeader we only care about the magic number to determine the binary wordsize