binary

Documentation

Index

• Constants
• type Binary
  • func New(filePath string) (bin *Binary, err error)
  • func NewWithOptions(filePath string, opts *Options) (bin *Binary, err error)
  • func (b *Binary) Arch() string
  • func (b *Binary) ContainsStrings(s ...string) (match bool, err error)
  • func (b *Binary) LinkMode() (LinkMode, error)
  • func (b *Binary) OS() string
  • func (b *Binary) SetImplementation(impl binaryImplementation)
• type ELFBinary
  • func NewELFBinary(filePath string, opts *Options) (*ELFBinary, error)
  • func (elf *ELFBinary) Arch() string
  • func (elf *ELFBinary) LinkMode() (LinkMode, error)
  • func (elf *ELFBinary) OS() string
• type ELFHeader
  • func GetELFHeader(path string) (*ELFHeader, error)
  • func (eh *ELFHeader) MachineType() string
  • func (eh *ELFHeader) String() string
  • func (eh *ELFHeader) WordLength() int
• type Header
• type LinkMode
• type MachOBinary
  • func NewMachOBinary(filePath string, opts *Options) (*MachOBinary, error)
  • func (macho *MachOBinary) Arch() string
  • func (macho *MachOBinary) LinkMode() (LinkMode, error)
  • func (macho *MachOBinary) OS() string
• type MachOHeader
  • func GetMachOHeader(path string) (*MachOHeader, error)
  • func (machoh *MachOHeader) MachineType() string
  • func (machoh *MachOHeader) String() string
  • func (machoh *MachOHeader) WordLength() int
• type Options
• type PEBinary
  • func NewPEBinary(filePath string, opts *Options) (bin *PEBinary, err error)
  • func (pe *PEBinary) Arch() string
  • func (pe *PEBinary) LinkMode() (LinkMode, error)
  • func (pe *PEBinary) OS() string
• type PEFileHeader
• type PEHeader
  • func GetPEHeader(path string) (*PEHeader, error)
  • func (peh *PEHeader) MachineType() string
  • func (peh *PEHeader) String() string
  • func (peh *PEHeader) WordLength() int
• type PEOptionalHeader

Constants

const (
	// GOOS labels.
	LINUX  = "linux"
	DARWIN = "darwin"
	WIN    = "windows"
)

const (
	MachO32Magic   uint32 = 0xfeedface // 32 bit, big endian
	MachO64Magic   uint32 = 0xfeedfacf // 64 bit, big endian
	MachO32LIMagic uint32 = 0xcefaedfe // 32 bit, little endian
	MachO64LIMagic uint32 = 0xcffaedfe // 64 bit, little endian
	MachOFat       uint32 = 0xcafebabe // Universal Binary
)

Types

type Binary

type Binary struct {
	// contains filtered or unexported fields
}

Binary is the base type of the package. It abstracts a binary executable.

func New

func New(filePath string) (bin *Binary, err error)

New creates a new binary instance.

func NewWithOptions

func NewWithOptions(filePath string, opts *Options) (bin *Binary, err error)

NewWithOptions creates a new binary with the specified options.

func (*Binary) Arch

func (b *Binary) Arch() string

Arch returns a string with the GOARCH label of the file.

func (*Binary) ContainsStrings

func (b *Binary) ContainsStrings(s ...string) (match bool, err error)

ContainsStrings searches the printable strings un a binary file.

func (*Binary) LinkMode

func (b *Binary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*Binary) OS

func (b *Binary) OS() string

OS returns a string with the GOOS label of the binary file.

func (*Binary) SetImplementation

func (b *Binary) SetImplementation(impl binaryImplementation)

SetImplementation sets the implementation to handle this sort of executable.

type ELFBinary

type ELFBinary struct {
	Header  *ELFHeader
	Options *Options
}

ELFBinary abstracts a binary in ELF format.

func NewELFBinary

func NewELFBinary(filePath string, opts *Options) (*ELFBinary, error)

NewELFBinary opens a file and returns an ELF binary if it is one.

func (*ELFBinary) Arch

func (elf *ELFBinary) Arch() string

Arch return the GOOS label of the binary.

func (*ELFBinary) LinkMode

func (elf *ELFBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*ELFBinary) OS

func (elf *ELFBinary) OS() string

OS returns the GOOS label for the operating system.

type ELFHeader

type ELFHeader struct {
	WordFlag uint8 // Flag: 32 or 64 bit binary

	OSABI      uint8 // Binary Interface
	ABIVersion uint8 // ABI Version

	EType    uint16 // Executable Type: Executable, relocatable, etc
	EMachine uint16 // Machine architecture
	// contains filtered or unexported fields
}

ELFHeader abstracts the data we need from the elf header.

func GetELFHeader

func GetELFHeader(path string) (*ELFHeader, error)

GetELFHeader returns the header if the binary is and EF binary.

func (*ELFHeader) MachineType

func (eh *ELFHeader) MachineType() string

MachineType returns a string with the architecture moniker.

func (*ELFHeader) String

func (eh *ELFHeader) String() string

String returns the relevant info of the header as a string.

func (*ELFHeader) WordLength

func (eh *ELFHeader) WordLength() int

WordLength returns either 32 or 64 for 32bit or 64 bit architectures.

type Header

type Header interface {
	MachineType() string
	String() string
	WordLength() int
}

Header is a struct that captures the header of a binary executable.

type LinkMode

type LinkMode string

LinkMode is the enum for all available linking modes.

const (
	LinkModeUnknown LinkMode = "unknown"
	LinkModeStatic  LinkMode = "static"
	LinkModeDynamic LinkMode = "dynamic"
)

type MachOBinary

type MachOBinary struct {
	Header  *MachOHeader
	Options *Options
}

MachOBinary is an abstraction for a Mach-O executable.

func NewMachOBinary

func NewMachOBinary(filePath string, opts *Options) (*MachOBinary, error)

NewMachOBinary returns a Mach-O binary if the specified file is one.

func (*MachOBinary) Arch

func (macho *MachOBinary) Arch() string

Arch returns a string with the GOARCH label of the file.

func (*MachOBinary) LinkMode

func (macho *MachOBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*MachOBinary) OS

func (macho *MachOBinary) OS() string

OS returns a string with the GOOS label of the binary file.

type MachOHeader

type MachOHeader struct {
	Magic  uint32
	CPU    uint32
	SubCPU uint32
}

MachOHeader is a structure to capture the data we need from the binary header.

func GetMachOHeader

func GetMachOHeader(path string) (*MachOHeader, error)

GetMachOHeader returns a struct with the executable header information.

func (*MachOHeader) MachineType

func (machoh *MachOHeader) MachineType() string

MachineType returns the architecture as a GOARCH label.

func (*MachOHeader) String

func (machoh *MachOHeader) String() string

String returns the header information as a string.

func (*MachOHeader) WordLength

func (machoh *MachOHeader) WordLength() int

WordLength returns an integer indicating if this is a 32 or 64bit binary.

type Options

type Options struct {
	Path string
}

Options to control the binary checker.

type PEBinary

type PEBinary struct {
	Header  *PEHeader
	Options *Options
}

PEBinary is a struct that abstracts a Windows Portable Executable.

func NewPEBinary

func NewPEBinary(filePath string, opts *Options) (bin *PEBinary, err error)

NewPEBinary Returns a binary implementation for a Windows executable.

func (*PEBinary) Arch

func (pe *PEBinary) Arch() string

Arch return the architecture.

func (*PEBinary) LinkMode

func (pe *PEBinary) LinkMode() (LinkMode, error)

LinkMode returns the linking mode of the binary.

func (*PEBinary) OS

func (pe *PEBinary) OS() string

OS returns the operating system of the binary.

type PEFileHeader

type PEFileHeader struct {
	Machine              uint16
	NumberOfSections     uint16
	TimeDateStamp        uint32
	PointerToSymbolTable uint32
	NumberOfSymbols      uint32
	SizeOfOptionalHeader uint16
	Characteristics      uint16
}

PEFileHeader captures the header information of the executable.

type PEHeader

type PEHeader struct {
	Machine uint16
	Magic   uint16
}

PEHeader captures the header information of the executable.

func GetPEHeader

func GetPEHeader(path string) (*PEHeader, error)

GetPEHeader returns a portable executable header from the specified file.

func (*PEHeader) MachineType

func (peh *PEHeader) MachineType() string

MachineType returns the moniker of the binary architecture.

func (*PEHeader) String

func (peh *PEHeader) String() string

Return the header information as a string.

func (*PEHeader) WordLength

func (peh *PEHeader) WordLength() int

WordLength Returns an integer indicating if it's a 64 or 32 bit binary.

type PEOptionalHeader

type PEOptionalHeader struct {
	Magic uint16
}

PEOptionalHeader we only care about the magic number to determine the binary wordsize.