Documentation ¶
Overview ¶
This package contains functions for reading ELF files.
Example usage, printing section names:
raw, e := ioutil.ReadFile("/bin/bash") // if e != nil {...} elf, e = elf_reader.ParseELF32File(raw) // if e != nil {...} for i := range elf.Sections { if i != 0 { name, e := elf.GetSectionName(uint16(i)) // if e != nil {...} fmt.Printf("Section %d: %s", i, name) } }
Index ¶
- Constants
- func ELF32Hash(data []byte) uint32
- func NullStr(data []byte) string
- func ReadStringAtOffset(offset uint32, data []byte) ([]byte, error)
- func Shrink(path string, keep []string) error
- func WriteAtOffset(destination []byte, offset uint64, endianness binary.ByteOrder, ...) ([]byte, error)
- type ELF32DynamicEntry
- type ELF32DynamicTag
- type ELF32File
- func (f *ELF32File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)
- func (f *ELF32File) GetDynamicTable(sectionIndex uint16) ([]ELF32DynamicEntry, error)
- func (f *ELF32File) GetFileType() ELFFileType
- func (f *ELF32File) GetMachineType() MachineType
- func (f *ELF32File) GetProgramHeader(index uint16) (ELFProgramHeader, error)
- func (f *ELF32File) GetRelocationTable(sectionIndex uint16) ([]ELF32Relocation, error)
- func (f *ELF32File) GetRelocations(index uint16) ([]ELFRelocation, error)
- func (f *ELF32File) GetSectionContent(sectionIndex uint16) ([]byte, error)
- func (f *ELF32File) GetSectionCount() uint16
- func (f *ELF32File) GetSectionHeader(index uint16) (ELFSectionHeader, error)
- func (f *ELF32File) GetSectionName(sectionIndex uint16) (string, error)
- func (f *ELF32File) GetSegmentContent(segmentIndex uint16) ([]byte, error)
- func (f *ELF32File) GetSegmentCount() uint16
- func (f *ELF32File) GetStringTable(sectionIndex uint16) ([]string, error)
- func (f *ELF32File) GetSymbolTable(sectionIndex uint16) ([]ELF32Symbol, []string, error)
- func (f *ELF32File) GetSymbols(index uint16) ([]ELFSymbol, []string, error)
- func (f *ELF32File) IsDynamicSection(sectionIndex uint16) bool
- func (f *ELF32File) IsRelocationTable(sectionIndex uint16) bool
- func (f *ELF32File) IsStringTable(sectionIndex uint16) bool
- func (f *ELF32File) IsSymbolTable(sectionIndex uint16) bool
- func (f *ELF32File) IsVersionDefinitionSection(sectionIndex uint16) bool
- func (f *ELF32File) IsVersionRequirementSection(sectionIndex uint16) bool
- func (f *ELF32File) ParseVersionDefinitionSection(sectionIndex uint16) ([]ELF32VersionDef, [][]ELF32VersionDefAux, error)
- func (f *ELF32File) ParseVersionRequirementSection(sectionIndex uint16) ([]ELF32VersionNeed, [][]ELF32VersionNeedAux, error)
- func (f *ELF32File) ReadStringTable(sectionIndex uint16, offset uint32) (string, error)
- func (f *ELF32File) ReparseData() error
- type ELF32Header
- type ELF32ProgramHeader
- func (h *ELF32ProgramHeader) GetAlignment() uint64
- func (h *ELF32ProgramHeader) GetFileOffset() uint64
- func (h *ELF32ProgramHeader) GetFileSize() uint64
- func (h *ELF32ProgramHeader) GetFlags() ProgramHeaderFlags
- func (h *ELF32ProgramHeader) GetMemorySize() uint64
- func (h *ELF32ProgramHeader) GetPhysicalAddress() uint64
- func (h *ELF32ProgramHeader) GetType() ProgramHeaderType
- func (h *ELF32ProgramHeader) GetVirtualAddress() uint64
- func (h *ELF32ProgramHeader) String() string
- type ELF32Rel
- type ELF32Rela
- type ELF32Relocation
- type ELF32RelocationInfo
- type ELF32SectionHeader
- func (h *ELF32SectionHeader) GetAlignment() uint64
- func (h *ELF32SectionHeader) GetEntrySize() uint64
- func (h *ELF32SectionHeader) GetFileOffset() uint64
- func (h *ELF32SectionHeader) GetFlags() ELFSectionFlags
- func (h *ELF32SectionHeader) GetInfo() uint32
- func (h *ELF32SectionHeader) GetLinkedIndex() uint32
- func (h *ELF32SectionHeader) GetSize() uint64
- func (h *ELF32SectionHeader) GetType() SectionHeaderType
- func (h *ELF32SectionHeader) GetVirtualAddress() uint64
- func (h *ELF32SectionHeader) String() string
- type ELF32Symbol
- type ELF32VersionDef
- type ELF32VersionDefAux
- type ELF32VersionNeed
- type ELF32VersionNeedAux
- type ELF64DynamicEntry
- type ELF64DynamicTag
- type ELF64File
- func (f *ELF64File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)
- func (f *ELF64File) GetDynamicTable(sectionIndex uint16) ([]ELF64DynamicEntry, error)
- func (f *ELF64File) GetFileType() ELFFileType
- func (f *ELF64File) GetMachineType() MachineType
- func (f *ELF64File) GetProgramHeader(index uint16) (ELFProgramHeader, error)
- func (f *ELF64File) GetRelocationTable(sectionIndex uint16) ([]ELF64Relocation, error)
- func (f *ELF64File) GetRelocations(index uint16) ([]ELFRelocation, error)
- func (f *ELF64File) GetSectionContent(sectionIndex uint16) ([]byte, error)
- func (f *ELF64File) GetSectionCount() uint16
- func (f *ELF64File) GetSectionHeader(index uint16) (ELFSectionHeader, error)
- func (f *ELF64File) GetSectionName(sectionIndex uint16) (string, error)
- func (f *ELF64File) GetSegmentContent(segmentIndex uint16) ([]byte, error)
- func (f *ELF64File) GetSegmentCount() uint16
- func (f *ELF64File) GetStringTable(sectionIndex uint16) ([]string, error)
- func (f *ELF64File) GetSymbolTable(sectionIndex uint16) ([]ELF64Symbol, []string, error)
- func (f *ELF64File) GetSymbols(index uint16) ([]ELFSymbol, []string, error)
- func (f *ELF64File) IsDynamicSection(sectionIndex uint16) bool
- func (f *ELF64File) IsRelocationTable(sectionIndex uint16) bool
- func (f *ELF64File) IsStringTable(sectionIndex uint16) bool
- func (f *ELF64File) IsSymbolTable(sectionIndex uint16) bool
- func (f *ELF64File) ReparseData() error
- type ELF64Header
- type ELF64ProgramHeader
- func (h *ELF64ProgramHeader) GetAlignment() uint64
- func (h *ELF64ProgramHeader) GetFileOffset() uint64
- func (h *ELF64ProgramHeader) GetFileSize() uint64
- func (h *ELF64ProgramHeader) GetFlags() ProgramHeaderFlags
- func (h *ELF64ProgramHeader) GetMemorySize() uint64
- func (h *ELF64ProgramHeader) GetPhysicalAddress() uint64
- func (h *ELF64ProgramHeader) GetType() ProgramHeaderType
- func (h *ELF64ProgramHeader) GetVirtualAddress() uint64
- func (h *ELF64ProgramHeader) String() string
- type ELF64Rel
- type ELF64Rela
- type ELF64Relocation
- type ELF64RelocationInfo
- type ELF64SectionHeader
- func (h *ELF64SectionHeader) GetAlignment() uint64
- func (h *ELF64SectionHeader) GetEntrySize() uint64
- func (h *ELF64SectionHeader) GetFileOffset() uint64
- func (h *ELF64SectionHeader) GetFlags() ELFSectionFlags
- func (h *ELF64SectionHeader) GetInfo() uint32
- func (h *ELF64SectionHeader) GetLinkedIndex() uint32
- func (h *ELF64SectionHeader) GetSize() uint64
- func (h *ELF64SectionHeader) GetType() SectionHeaderType
- func (h *ELF64SectionHeader) GetVirtualAddress() uint64
- func (h *ELF64SectionHeader) String() string
- type ELF64Symbol
- type ELFDynamicEntry
- type ELFDynamicTag
- type ELFFile
- type ELFFileType
- type ELFProgramHeader
- type ELFRelocation
- type ELFSectionFlags
- type ELFSectionHeader
- type ELFSymbol
- type ELFSymbolInfo
- type MachineType
- type ProgramHeaderFlags
- type ProgramHeaderType
- type SectionHeaderFlags32
- type SectionHeaderFlags64
- type SectionHeaderType
Constants ¶
const ( DT_NULL = 0 /* Marks end of dynamic section */ DT_NEEDED = 1 /* Name of needed library */ DT_PLTRELSZ = 2 /* Size in bytes of PLT relocs */ DT_PLTGOT = 3 /* Processor defined value */ DT_HASH = 4 /* Address of symbol hash table */ DT_STRTAB = 5 /* Address of string table */ DT_SYMTAB = 6 /* Address of symbol table */ DT_RELA = 7 /* Address of Rela relocs */ DT_RELASZ = 8 /* Total size of Rela relocs */ DT_RELAENT = 9 /* Size of one Rela reloc */ DT_STRSZ = 10 /* Size of string table */ DT_SYMENT = 11 /* Size of one symbol table entry */ DT_INIT = 12 /* Address of init function */ DT_FINI = 13 /* Address of termination function */ DT_SONAME = 14 /* Name of shared object */ DT_RPATH = 15 /* Library search path (deprecated) */ DT_SYMBOLIC = 16 /* Start symbol search here */ DT_REL = 17 /* Address of Rel relocs */ DT_RELSZ = 18 /* Total size of Rel relocs */ DT_RELENT = 19 /* Size of one Rel reloc */ DT_PLTREL = 20 /* Type of reloc in PLT */ DT_DEBUG = 21 /* For debugging; unspecified */ DT_TEXTREL = 22 /* Reloc might modify .text */ DT_JMPREL = 23 /* Address of PLT relocs */ DT_BIND_NOW = 24 /* Process relocations of object */ DT_INIT_ARRAY = 25 /* Array with addresses of init fct */ DT_FINI_ARRAY = 26 /* Array with addresses of fini fct */ DT_INIT_ARRAYSZ = 27 /* Size in bytes of DT_INIT_ARRAY */ DT_FINI_ARRAYSZ = 28 /* Size in bytes of DT_FINI_ARRAY */ DT_RUNPATH = 29 /* Library search path */ DT_FLAGS = 30 /* Flags for the object being loaded */ DT_ENCODING = 32 /* Start of encoded range */ DT_PREINIT_ARRAY = 32 /* Array with addresses of preinit fct*/ DT_PREINIT_ARRAYSZ = 33 /* size in bytes of DT_PREINIT_ARRAY */ DT_NUM = 34 /* Number used */ DT_LOOS = 0x6000000d /* Start of OS-specific */ DT_HIOS = 0x6ffff000 /* End of OS-specific */ DT_LOPROC = 0x70000000 /* Start of processor-specific */ DT_HIPROC = 0x7fffffff /* End of processor-specific */ /* DT_* entries which fall between DT_VALRNGHI & DT_VALRNGLO use the Dyn.d_un.d_val field of the Elf*_Dyn structure. This follows Sun's approach. */ DT_VALRNGLO = 0x6ffffd00 DT_GNU_PRELINKED = 0x6ffffdf5 /* Prelinking timestamp */ DT_GNU_CONFLICTSZ = 0x6ffffdf6 /* Size of conflict section */ DT_GNU_LIBLISTSZ = 0x6ffffdf7 /* Size of library list */ DT_CHECKSUM = 0x6ffffdf8 DT_PLTPADSZ = 0x6ffffdf9 DT_MOVEENT = 0x6ffffdfa DT_MOVESZ = 0x6ffffdfb DT_FEATURE_1 = 0x6ffffdfc /* Feature selection (DTF_*). */ DT_POSFLAG_1 = 0x6ffffdfd /* Flags for DT_* entries, effecting = the following DT_* entry. */ DT_SYMINSZ = 0x6ffffdfe /* Size of syminfo table (in bytes) */ DT_SYMINENT = 0x6ffffdff /* Entry size of syminfo */ DT_VALRNGHI = 0x6ffffdff )
const ( ELFTypeRelocatable = 1 ELFTypeExecutable = 2 ELFTypeCore = 4 MachineTypeSPARC = 0x02 MachineTypeX86 = 0x03 MachineTypeMIPS = 0x08 MachineTypePowerPC = 0x14 MachineTypeARM = 0x28 MachineTypeAMD64 = 0x3e MachineTypeARM64 = 0xb7 MachineTypeAMDGPU = 0xe0 NullSegment = 0 LoadableSegment = 1 DynamicLinkingSegment = 2 InterpreterSegment = 3 NoteSegment = 4 ReservedSegment = 5 ProgramHeaderSegment = 6 NullSection = 0 BitsSection = 1 SymbolTableSection = 2 StringTableSection = 3 RelaSection = 4 HashSection = 5 DynamicLinkingTableSection = 6 NoteSection = 7 UninitializedSection = 8 RelSection = 9 ReservedSection = 10 DynamicLoaderSymbolSection = 11 GNUHashSection = 0x6ffffff5 GNUVersionDefinitionSection = 0x6ffffffd GNUVersionRequirementSection = 0x6ffffffe GNUVersionSymbolSection = 0x6fffffff )
Variables ¶
This section is empty.
Functions ¶
func ReadStringAtOffset ¶
Returns a string starting at the offset in the data, or an error if the offset is invalid or the string isn't terminated. This can be used to extract strings from string table content.
func Shrink ¶
Shrink opens an ELF binary at path and minimizes the declared rpath to only include libraries that are referenced by the needs declarations.
func WriteAtOffset ¶
func WriteAtOffset(destination []byte, offset uint64, endianness binary.ByteOrder, toWrite interface{}) ([]byte, error)
Outputs the toWrite structure, as binary, at the given offset in the destination buffer. May append more data at the end of the destination buffer, so this should be used like append(...). Ex:
data = []byte("Hi there") toWrite = []byte("!!!") data, e := WriteAtOffset(data, uint64(len(data)), binary.LittleEndian, toWrite)
If the write fails, the original buffer will be returned along with a non-nil error.
Types ¶
type ELF32DynamicEntry ¶
type ELF32DynamicEntry struct { Tag ELF32DynamicTag Value uint32 }
Holds a single entry in a 32-bit ELF .dynamic section. The Value can be either an address or a value, depending on the Tag.
func (*ELF32DynamicEntry) GetTag ¶
func (n *ELF32DynamicEntry) GetTag() ELFDynamicTag
func (*ELF32DynamicEntry) GetValue ¶
func (n *ELF32DynamicEntry) GetValue() uint64
func (*ELF32DynamicEntry) String ¶
func (n *ELF32DynamicEntry) String() string
type ELF32DynamicTag ¶
type ELF32DynamicTag uint32
A constant value indicating the type of an entry in the dynamic table.
func (ELF32DynamicTag) GetValue ¶
func (t ELF32DynamicTag) GetValue() int64
func (ELF32DynamicTag) String ¶
func (t ELF32DynamicTag) String() string
type ELF32File ¶
type ELF32File struct { Header ELF32Header Sections []ELF32SectionHeader Segments []ELF32ProgramHeader Raw []byte Endianness binary.ByteOrder }
Tracks parsed data for a 32-bit ELF.
func ParseELF32File ¶
Attempts to parse the given data buffer as a 32-bit ELF file. Returns an error if the file isn't a 32-bit ELF.
func (*ELF32File) DynamicEntries ¶
func (f *ELF32File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)
func (*ELF32File) GetDynamicTable ¶
func (f *ELF32File) GetDynamicTable(sectionIndex uint16) ([]ELF32DynamicEntry, error)
Parses and returns the dynamic linking table at the given section index. May include entries past the end of the actual table, depending on the section size, so callers must check for the terminating null entry when referring to the returned slice.
func (*ELF32File) GetFileType ¶
func (f *ELF32File) GetFileType() ELFFileType
func (*ELF32File) GetMachineType ¶
func (f *ELF32File) GetMachineType() MachineType
func (*ELF32File) GetProgramHeader ¶
func (f *ELF32File) GetProgramHeader(index uint16) (ELFProgramHeader, error)
func (*ELF32File) GetRelocationTable ¶
func (f *ELF32File) GetRelocationTable(sectionIndex uint16) ([]ELF32Relocation, error)
If the given section is a relocation table (type .rel or .rela), this will parse and return the relocations.
func (*ELF32File) GetRelocations ¶
func (f *ELF32File) GetRelocations(index uint16) ([]ELFRelocation, error)
func (*ELF32File) GetSectionContent ¶
Returns the bytes of the section at the given index, or an error if one occurs.
func (*ELF32File) GetSectionCount ¶
func (*ELF32File) GetSectionHeader ¶
func (f *ELF32File) GetSectionHeader(index uint16) (ELFSectionHeader, error)
func (*ELF32File) GetSectionName ¶
Returns the name of the section at the given index in the section table, or an error if one occurs.
func (*ELF32File) GetSegmentContent ¶
Returns the bytes of the segment at the given index, or an error if one occurs.
func (*ELF32File) GetSegmentCount ¶
func (*ELF32File) GetStringTable ¶
Returns a slice of strings contained in the string table at the given index. This *includes* the first zero-length string.
func (*ELF32File) GetSymbolTable ¶
func (f *ELF32File) GetSymbolTable(sectionIndex uint16) ([]ELF32Symbol, []string, error)
Parses a symbol table section with the given index, and a slice of the names of each symbol. The parsed symbols and names will be in the same order. Returns an error if the given index doesn't contain a valid symbol table.
func (*ELF32File) GetSymbols ¶
func (*ELF32File) IsDynamicSection ¶
Returns true if the section with the given index is a dynamic linking table.
func (*ELF32File) IsRelocationTable ¶
Returns true if the given index is a relocation table.
func (*ELF32File) IsStringTable ¶
Returns true if the section at the given index is a string table.
func (*ELF32File) IsSymbolTable ¶
Returns true if the section at the given index is a symbol table.
func (*ELF32File) IsVersionDefinitionSection ¶
func (*ELF32File) IsVersionRequirementSection ¶
Returns true if the given section index is a .gnu.version_r section.
func (*ELF32File) ParseVersionDefinitionSection ¶
func (f *ELF32File) ParseVersionDefinitionSection(sectionIndex uint16) ( []ELF32VersionDef, [][]ELF32VersionDefAux, error)
This parses a GNU version definition section with the given index. Returns a slice of version definition structs, and a slice of auxiliary structures corresponding to each definition. This behaves similarly to ParseVersionRequirementSection().
func (*ELF32File) ParseVersionRequirementSection ¶
func (f *ELF32File) ParseVersionRequirementSection(sectionIndex uint16) ( []ELF32VersionNeed, [][]ELF32VersionNeedAux, error)
Returns an array of ELF32VersionNeed structures, in the order they appear in a .gnu.version_r section. For each version needed structure, there will be an associated slice of version aux structures (which will contain at least one entry). If a version requirement section exists but contains no entries, this function may return nil, but no error. Returns an error if the section type is incorrect or couldn't be parsed for some reason.
func (*ELF32File) ReadStringTable ¶
Returns the string at the given offset in the string table contained in the section at the given section index. Returns an error if one occurs.
func (*ELF32File) ReparseData ¶
This function must be called in order to re-parse internal data structures if the Raw buffer has been updated.
type ELF32Header ¶
type ELF32Header struct { Signature uint32 Class uint8 Endianness uint8 Version uint8 OSABI uint8 EABI uint8 Padding [7]uint8 Type ELFFileType Machine MachineType Version2 uint32 EntryPoint uint32 ProgramHeaderOffset uint32 SectionHeaderOffset uint32 Flags uint32 HeaderSize uint16 ProgramHeaderEntrySize uint16 ProgramHeaderEntries uint16 SectionHeaderEntrySize uint16 SectionHeaderEntries uint16 SectionNamesTable uint16 }
The header structure for 32-bit ELF files.
func (*ELF32Header) String ¶
func (h *ELF32Header) String() string
type ELF32ProgramHeader ¶
type ELF32ProgramHeader struct { Type ProgramHeaderType FileOffset uint32 VirtualAddress uint32 PhysicalAddress uint32 FileSize uint32 MemorySize uint32 Flags ProgramHeaderFlags Align uint32 }
Specifies the format for a single entry for a 32-bit ELF program (segment) header.
func (*ELF32ProgramHeader) GetAlignment ¶
func (h *ELF32ProgramHeader) GetAlignment() uint64
func (*ELF32ProgramHeader) GetFileOffset ¶
func (h *ELF32ProgramHeader) GetFileOffset() uint64
func (*ELF32ProgramHeader) GetFileSize ¶
func (h *ELF32ProgramHeader) GetFileSize() uint64
func (*ELF32ProgramHeader) GetFlags ¶
func (h *ELF32ProgramHeader) GetFlags() ProgramHeaderFlags
func (*ELF32ProgramHeader) GetMemorySize ¶
func (h *ELF32ProgramHeader) GetMemorySize() uint64
func (*ELF32ProgramHeader) GetPhysicalAddress ¶
func (h *ELF32ProgramHeader) GetPhysicalAddress() uint64
func (*ELF32ProgramHeader) GetType ¶
func (h *ELF32ProgramHeader) GetType() ProgramHeaderType
func (*ELF32ProgramHeader) GetVirtualAddress ¶
func (h *ELF32ProgramHeader) GetVirtualAddress() uint64
func (*ELF32ProgramHeader) String ¶
func (h *ELF32ProgramHeader) String() string
type ELF32Rel ¶
type ELF32Rel struct { Address uint32 RelocationInfo ELF32RelocationInfo }
A relocation without an addend. Satisfies the ELF32Relocation interface.
func (*ELF32Rel) SymbolIndex ¶
type ELF32Rela ¶
type ELF32Rela struct { Address uint32 RelocationInfo ELF32RelocationInfo AddendValue int32 }
A relocation with an addend. Also satisfies the ELF32Relocation interface.
func (*ELF32Rela) SymbolIndex ¶
type ELF32Relocation ¶
type ELF32Relocation interface { // Returns the address of the relocation Offset() uint32 // Returns the relocation's type from the info field. Type() uint32 // Returns the symbol index from the info field. SymbolIndex() uint32 // Returns the addent field for the relocation, or 0 if the relocation // did not include an addend. Addend() int32 String() string }
type ELF32RelocationInfo ¶
type ELF32RelocationInfo uint32
Represents the 32-bit info field in a relocation
func (ELF32RelocationInfo) String ¶
func (n ELF32RelocationInfo) String() string
func (ELF32RelocationInfo) SymbolIndex ¶
func (n ELF32RelocationInfo) SymbolIndex() uint32
Returns the 24-bit symbol index.
func (ELF32RelocationInfo) Type ¶
func (n ELF32RelocationInfo) Type() uint8
Returns the 8-bit relocation type in the 32-bit ELF relocation info field.
type ELF32SectionHeader ¶
type ELF32SectionHeader struct { Name uint32 Type SectionHeaderType Flags SectionHeaderFlags32 VirtualAddress uint32 FileOffset uint32 Size uint32 LinkedIndex uint32 Info uint32 Align uint32 EntrySize uint32 }
Specifies the format for a single entry for a 32-bit ELF section header.
func (*ELF32SectionHeader) GetAlignment ¶
func (h *ELF32SectionHeader) GetAlignment() uint64
func (*ELF32SectionHeader) GetEntrySize ¶
func (h *ELF32SectionHeader) GetEntrySize() uint64
func (*ELF32SectionHeader) GetFileOffset ¶
func (h *ELF32SectionHeader) GetFileOffset() uint64
func (*ELF32SectionHeader) GetFlags ¶
func (h *ELF32SectionHeader) GetFlags() ELFSectionFlags
func (*ELF32SectionHeader) GetInfo ¶
func (h *ELF32SectionHeader) GetInfo() uint32
func (*ELF32SectionHeader) GetLinkedIndex ¶
func (h *ELF32SectionHeader) GetLinkedIndex() uint32
func (*ELF32SectionHeader) GetSize ¶
func (h *ELF32SectionHeader) GetSize() uint64
func (*ELF32SectionHeader) GetType ¶
func (h *ELF32SectionHeader) GetType() SectionHeaderType
func (*ELF32SectionHeader) GetVirtualAddress ¶
func (h *ELF32SectionHeader) GetVirtualAddress() uint64
func (*ELF32SectionHeader) String ¶
func (h *ELF32SectionHeader) String() string
type ELF32Symbol ¶
type ELF32Symbol struct { Name uint32 Value uint32 Size uint32 Info ELFSymbolInfo Other uint8 SectionIndex uint16 }
Holds a symbol table entry for a 32-bit ELF
func (*ELF32Symbol) GetInfo ¶
func (s *ELF32Symbol) GetInfo() ELFSymbolInfo
func (*ELF32Symbol) GetName ¶
func (s *ELF32Symbol) GetName() uint32
func (*ELF32Symbol) GetOther ¶
func (s *ELF32Symbol) GetOther() uint8
func (*ELF32Symbol) GetSectionIndex ¶
func (s *ELF32Symbol) GetSectionIndex() uint16
func (*ELF32Symbol) GetSize ¶
func (s *ELF32Symbol) GetSize() uint64
func (*ELF32Symbol) GetValue ¶
func (s *ELF32Symbol) GetValue() uint64
func (*ELF32Symbol) String ¶
func (s *ELF32Symbol) String() string
type ELF32VersionDef ¶
type ELF32VersionDef struct { Version uint16 Flags uint16 Index uint16 Count uint16 Hash uint32 AuxOffset uint32 Next uint32 }
This is the analogue to the Elf32_Verdef structure, used in GNU version definition sections.
func (*ELF32VersionDef) String ¶
func (d *ELF32VersionDef) String() string
type ELF32VersionDefAux ¶
This holds an Elf32_Verdaux structure.
func (*ELF32VersionDefAux) String ¶
func (d *ELF32VersionDefAux) String() string
type ELF32VersionNeed ¶
type ELF32VersionNeed struct { Version uint16 Count uint16 File uint32 AuxOffset uint32 Next uint32 }
Holds an instance of the ELF32_Verneed structure
func (*ELF32VersionNeed) String ¶
func (n *ELF32VersionNeed) String() string
type ELF32VersionNeedAux ¶
Holds an instance of the ELF32_Vernaux structure
func (*ELF32VersionNeedAux) String ¶
func (a *ELF32VersionNeedAux) String() string
type ELF64DynamicEntry ¶
type ELF64DynamicEntry struct { Tag ELF64DynamicTag Value uint64 }
Holds a single entry in a 64-bit ELF .dynamic section. The Value can be either an address or a value, depending on the Tag.
func (*ELF64DynamicEntry) GetTag ¶
func (n *ELF64DynamicEntry) GetTag() ELFDynamicTag
func (*ELF64DynamicEntry) GetValue ¶
func (n *ELF64DynamicEntry) GetValue() uint64
func (*ELF64DynamicEntry) String ¶
func (n *ELF64DynamicEntry) String() string
type ELF64DynamicTag ¶
type ELF64DynamicTag int64
A constant value indicating the type of an entry in the dynamic table.
func (ELF64DynamicTag) GetValue ¶
func (t ELF64DynamicTag) GetValue() int64
func (ELF64DynamicTag) String ¶
func (t ELF64DynamicTag) String() string
type ELF64File ¶
type ELF64File struct { Header ELF64Header Sections []ELF64SectionHeader Segments []ELF64ProgramHeader Raw []byte Endianness binary.ByteOrder }
Tracks parsed data for a 64-bit ELF.
func ParseELF64File ¶
func (*ELF64File) DynamicEntries ¶
func (f *ELF64File) DynamicEntries(index uint16) ([]ELFDynamicEntry, error)
func (*ELF64File) GetDynamicTable ¶
func (f *ELF64File) GetDynamicTable(sectionIndex uint16) ([]ELF64DynamicEntry, error)
func (*ELF64File) GetFileType ¶
func (f *ELF64File) GetFileType() ELFFileType
func (*ELF64File) GetMachineType ¶
func (f *ELF64File) GetMachineType() MachineType
func (*ELF64File) GetProgramHeader ¶
func (f *ELF64File) GetProgramHeader(index uint16) (ELFProgramHeader, error)
func (*ELF64File) GetRelocationTable ¶
func (f *ELF64File) GetRelocationTable(sectionIndex uint16) ([]ELF64Relocation, error)
func (*ELF64File) GetRelocations ¶
func (f *ELF64File) GetRelocations(index uint16) ([]ELFRelocation, error)
func (*ELF64File) GetSectionContent ¶
Returns the bytes of the section at the given index, or an error if one occurs.
func (*ELF64File) GetSectionCount ¶
func (*ELF64File) GetSectionHeader ¶
func (f *ELF64File) GetSectionHeader(index uint16) (ELFSectionHeader, error)
func (*ELF64File) GetSectionName ¶
Returns the name of the section at the given index in the section table, or an error if one occurs.
func (*ELF64File) GetSegmentContent ¶
Returns the bytes of the segment at the given index, or an error if one occurs.
func (*ELF64File) GetSegmentCount ¶
func (*ELF64File) GetStringTable ¶
Returns a slice of strings contained in the string table section at the given index. This *includes* the first zero-length string.
func (*ELF64File) GetSymbolTable ¶
func (f *ELF64File) GetSymbolTable(sectionIndex uint16) ([]ELF64Symbol, []string, error)
Parses a symbol table section with the given index, and returns a two slices: the symbols, and their corresponding names. Returns an error if the given section index is not a valid symbol table.
func (*ELF64File) GetSymbols ¶
func (*ELF64File) IsDynamicSection ¶
Returns true if the section with the given index is a dynamic linking table.
func (*ELF64File) IsRelocationTable ¶
Returns true if the given index is a relocation table.
func (*ELF64File) IsStringTable ¶
Returns true if the section at the given index is a string table.
func (*ELF64File) IsSymbolTable ¶
Returns true if the section at the given index is a symbol table.
func (*ELF64File) ReparseData ¶
This function must be called in order to re-parse internal data structures if the Raw buffer has been updated.
type ELF64Header ¶
type ELF64Header struct { Signature uint32 Class uint8 Endianness uint8 Version uint8 OSABI uint8 EABI uint8 Padding [7]uint8 Type ELFFileType Machine MachineType Version2 uint32 EntryPoint uint64 ProgramHeaderOffset uint64 SectionHeaderOffset uint64 Flags uint32 HeaderSize uint16 ProgramHeaderEntrySize uint16 ProgramHeaderEntries uint16 SectionHeaderEntrySize uint16 SectionHeaderEntries uint16 SectionNamesTable uint16 }
The header structure for 64-bit ELF files.
type ELF64ProgramHeader ¶
type ELF64ProgramHeader struct { Type ProgramHeaderType Flags ProgramHeaderFlags FileOffset uint64 VirtualAddress uint64 PhysicalAddress uint64 FileSize uint64 MemorySize uint64 Align uint64 }
Specifies the format for a single entry for a 64-bit ELF program (segment) header.
func (*ELF64ProgramHeader) GetAlignment ¶
func (h *ELF64ProgramHeader) GetAlignment() uint64
func (*ELF64ProgramHeader) GetFileOffset ¶
func (h *ELF64ProgramHeader) GetFileOffset() uint64
func (*ELF64ProgramHeader) GetFileSize ¶
func (h *ELF64ProgramHeader) GetFileSize() uint64
func (*ELF64ProgramHeader) GetFlags ¶
func (h *ELF64ProgramHeader) GetFlags() ProgramHeaderFlags
func (*ELF64ProgramHeader) GetMemorySize ¶
func (h *ELF64ProgramHeader) GetMemorySize() uint64
func (*ELF64ProgramHeader) GetPhysicalAddress ¶
func (h *ELF64ProgramHeader) GetPhysicalAddress() uint64
func (*ELF64ProgramHeader) GetType ¶
func (h *ELF64ProgramHeader) GetType() ProgramHeaderType
func (*ELF64ProgramHeader) GetVirtualAddress ¶
func (h *ELF64ProgramHeader) GetVirtualAddress() uint64
func (*ELF64ProgramHeader) String ¶
func (h *ELF64ProgramHeader) String() string
type ELF64Rel ¶
type ELF64Rel struct { Address uint64 RelocationInfo ELF64RelocationInfo }
A relocation without an addend. Satisfies the ELF64Relocation interface.
func (*ELF64Rel) Info ¶
func (r *ELF64Rel) Info() ELF64RelocationInfo
func (*ELF64Rel) SymbolIndex ¶
type ELF64Rela ¶
type ELF64Rela struct { Address uint64 RelocationInfo ELF64RelocationInfo AddendValue int64 }
A relocation with an addend. Satisfies the ELF64Relocation interface.
func (*ELF64Rela) Info ¶
func (r *ELF64Rela) Info() ELF64RelocationInfo
func (*ELF64Rela) SymbolIndex ¶
type ELF64Relocation ¶
type ELF64Relocation interface { // Returns the address of the relocation Offset() uint64 // Returns the relocation type. Type() uint32 // Returns the relocation's symbol index. SymbolIndex() uint32 // Returns the addend field for the relocation, or 0 if the relocation did // not include an addend. Addend() int64 String() string }
type ELF64RelocationInfo ¶
type ELF64RelocationInfo uint64
Represents the 64-bit info field in a relocation
func (ELF64RelocationInfo) String ¶
func (n ELF64RelocationInfo) String() string
func (ELF64RelocationInfo) SymbolIndex ¶
func (n ELF64RelocationInfo) SymbolIndex() uint32
Returns the 32-bit symbol table index for a 64-bit ELF relocation info field.
func (ELF64RelocationInfo) Type ¶
func (n ELF64RelocationInfo) Type() uint32
Returns the 32-bit type in the 64-bit ELF relocation info field.
type ELF64SectionHeader ¶
type ELF64SectionHeader struct { Name uint32 Type SectionHeaderType Flags SectionHeaderFlags64 VirtualAddress uint64 FileOffset uint64 Size uint64 LinkedIndex uint32 Info uint32 Align uint64 EntrySize uint64 }
Specifies the format for a single entry for a 64-bit ELF section header.
func (*ELF64SectionHeader) GetAlignment ¶
func (h *ELF64SectionHeader) GetAlignment() uint64
func (*ELF64SectionHeader) GetEntrySize ¶
func (h *ELF64SectionHeader) GetEntrySize() uint64
func (*ELF64SectionHeader) GetFileOffset ¶
func (h *ELF64SectionHeader) GetFileOffset() uint64
func (*ELF64SectionHeader) GetFlags ¶
func (h *ELF64SectionHeader) GetFlags() ELFSectionFlags
func (*ELF64SectionHeader) GetInfo ¶
func (h *ELF64SectionHeader) GetInfo() uint32
func (*ELF64SectionHeader) GetLinkedIndex ¶
func (h *ELF64SectionHeader) GetLinkedIndex() uint32
func (*ELF64SectionHeader) GetSize ¶
func (h *ELF64SectionHeader) GetSize() uint64
func (*ELF64SectionHeader) GetType ¶
func (h *ELF64SectionHeader) GetType() SectionHeaderType
func (*ELF64SectionHeader) GetVirtualAddress ¶
func (h *ELF64SectionHeader) GetVirtualAddress() uint64
func (*ELF64SectionHeader) String ¶
func (h *ELF64SectionHeader) String() string
type ELF64Symbol ¶
type ELF64Symbol struct { Name uint32 Info ELFSymbolInfo Other uint8 SectionIndex uint16 Value uint64 Size uint64 }
Holds a symbol table entry for a 64-bit ELF
func (*ELF64Symbol) GetInfo ¶
func (s *ELF64Symbol) GetInfo() ELFSymbolInfo
func (*ELF64Symbol) GetName ¶
func (s *ELF64Symbol) GetName() uint32
func (*ELF64Symbol) GetOther ¶
func (s *ELF64Symbol) GetOther() uint8
func (*ELF64Symbol) GetSectionIndex ¶
func (s *ELF64Symbol) GetSectionIndex() uint16
func (*ELF64Symbol) GetSize ¶
func (s *ELF64Symbol) GetSize() uint64
func (*ELF64Symbol) GetValue ¶
func (s *ELF64Symbol) GetValue() uint64
func (*ELF64Symbol) String ¶
func (s *ELF64Symbol) String() string
type ELFDynamicEntry ¶
type ELFDynamicEntry interface { GetTag() ELFDynamicTag GetValue() uint64 }
type ELFDynamicTag ¶
type ELFFile ¶
type ELFFile interface { // Returns the value specified in the ELF header of whether the ELF file is // an executable, relocatable, shared, or core file. GetFileType() ELFFileType // Returns the value specified in the ELF header of the type of machine // this file targets. GetMachineType() MachineType // Returns the number of sections defined in the ELF file. GetSectionCount() uint16 // Returns the number of segments (program headers) defined in the ELF // file. GetSegmentCount() uint16 // Returns the name of the section at the given index. GetSectionName(index uint16) (string, error) // Returns the content of the section at the given index. GetSectionContent(index uint16) ([]byte, error) // Returns the content of the segment at the given index. GetSegmentContent(index uint16) ([]byte, error) // Returns an interface that can be used to access the header metadata for // the section at the given index. GetSectionHeader(index uint16) (ELFSectionHeader, error) // Returns an interface that can be used to access the header metadata for // the program header (segment) at the given index. GetProgramHeader(index uint16) (ELFProgramHeader, error) // Returns true if the section at the given index is a string table. IsStringTable(index uint16) bool // Returns a slice of strings from the string table in the given section // index. GetStringTable(index uint16) ([]string, error) // Returns true if the section at the given index is a symbol table. IsSymbolTable(index uint16) bool // Parses the symbol table in the section at the given index, and returns // a slice of symbols in it. The slice of strings is the list of symbol // names, in the same order as the symbols themselves. GetSymbols(index uint16) ([]ELFSymbol, []string, error) // Returns true if the section at the given index is a relocation table. IsRelocationTable(index uint16) bool // Parses the relocation table in the section at the given index, and // returns a slice of the relocations contained in it. GetRelocations(index uint16) ([]ELFRelocation, error) // Returns true if the section at the given index is a dynamic table. IsDynamicSection(index uint16) bool // Parses and returns the dynamic linking table at the given section index. // This may return entries past the end of the actual table, depending on // the section size, so callers must check for the terminating null entry // when referring to the returned slice. DynamicEntries(intex uint16) ([]ELFDynamicEntry, error) }
This is a 32- or 64-bit agnostic way of reading an ELF file. If needed, one can use type assertions to convert instances of this interface into either instances of *ELF64File or *ELF32File.
func ParseELFFile ¶
This function parses any ELF file and returns an instance of the ELFFile interface if no errors occur.
type ELFFileType ¶
type ELFFileType uint16
func (ELFFileType) String ¶
func (t ELFFileType) String() string
type ELFProgramHeader ¶
type ELFProgramHeader interface { GetType() ProgramHeaderType GetFlags() ProgramHeaderFlags GetFileOffset() uint64 GetVirtualAddress() uint64 GetPhysicalAddress() uint64 GetFileSize() uint64 GetMemorySize() uint64 GetAlignment() uint64 String() string }
This is a 32- or 64-bit agnostic way of accessing an ELF program header.
type ELFRelocation ¶
type ELFRelocation interface { Offset() uint64 Type() uint32 SymbolIndex() uint32 Addend() int64 String() string }
This holds a generic entry in a relocation table for either a 32- or 64-bit ELF file.
type ELFSectionFlags ¶
type ELFSectionFlags interface { Executable() bool Allocated() bool Writable() bool String() string }
This is a 32- or 64-bit agnostic interface for accessing an ELF section's flags. Can be converted using type assertions into either SectionHeaderFlags64 or SectionHeaderFlags32 values.
type ELFSectionHeader ¶
type ELFSectionHeader interface { GetType() SectionHeaderType GetFlags() ELFSectionFlags GetVirtualAddress() uint64 GetFileOffset() uint64 GetSize() uint64 GetLinkedIndex() uint32 GetInfo() uint32 GetAlignment() uint64 GetEntrySize() uint64 String() string }
This is a 32- or 64-bit agnostic way of accessing an ELF section header.
type ELFSymbol ¶
type ELFSymbol interface { GetName() uint32 GetInfo() ELFSymbolInfo GetOther() uint8 GetSectionIndex() uint16 GetValue() uint64 GetSize() uint64 String() string }
This is an interface used to access either 64- or 32-bit ELF symbol table entries.
type ELFSymbolInfo ¶
type ELFSymbolInfo uint8
Represents the 8-bit info field in symbol table entries
func (ELFSymbolInfo) Binding ¶
func (n ELFSymbolInfo) Binding() uint8
func (ELFSymbolInfo) String ¶
func (n ELFSymbolInfo) String() string
func (ELFSymbolInfo) SymbolType ¶
func (n ELFSymbolInfo) SymbolType() uint8
type MachineType ¶
type MachineType uint16
func (MachineType) String ¶
func (t MachineType) String() string
type ProgramHeaderFlags ¶
type ProgramHeaderFlags uint32
func (ProgramHeaderFlags) String ¶
func (t ProgramHeaderFlags) String() string
type ProgramHeaderType ¶
type ProgramHeaderType uint32
func (ProgramHeaderType) String ¶
func (ht ProgramHeaderType) String() string
type SectionHeaderFlags32 ¶
type SectionHeaderFlags32 uint32
func (SectionHeaderFlags32) Allocated ¶
func (f SectionHeaderFlags32) Allocated() bool
func (SectionHeaderFlags32) Executable ¶
func (f SectionHeaderFlags32) Executable() bool
func (SectionHeaderFlags32) String ¶
func (f SectionHeaderFlags32) String() string
func (SectionHeaderFlags32) Writable ¶
func (f SectionHeaderFlags32) Writable() bool
type SectionHeaderFlags64 ¶
type SectionHeaderFlags64 uint64
func (SectionHeaderFlags64) Allocated ¶
func (f SectionHeaderFlags64) Allocated() bool
func (SectionHeaderFlags64) Executable ¶
func (f SectionHeaderFlags64) Executable() bool
func (SectionHeaderFlags64) String ¶
func (f SectionHeaderFlags64) String() string
func (SectionHeaderFlags64) Writable ¶
func (f SectionHeaderFlags64) Writable() bool
type SectionHeaderType ¶
type SectionHeaderType uint32
func (SectionHeaderType) String ¶
func (ht SectionHeaderType) String() string