elf

Documentation

Index

• Constants
• Variables
• func DetectArchitecture(b Binary) binary.Architecture
• func DetectLibC(b Binary) binary.LibC
• func DetectToolchain(b Binary, detector toolchain.ELFDetector) toolchain.Toolchain
• func DetectToolchainFromDWARF(b Binary, detector toolchain.ELFDetector) toolchain.Toolchain
• func DynString(b Binary, tag elf.DynTag) (string, error)
• func HasDynFlag(b Binary, tag elf.DynTag, flag uint64) (bool, error)
• func HasDynTag(b Binary, tag elf.DynTag) (bool, error)
• func HasGNUProperty(b Binary, propertyType, featureFlag uint32) (bool, error)
• func ImportedLibraries(b Binary) ([]string, error)
• type Alignment
  • func (a Alignment) Pad(n int) int
• type Binary
• type DynEntry
• type File
  • func Open(r io.ReaderAt, opts ...Option) (*File, error)
  • func (b *File) BuildID() string
  • func (b *File) ByteOrder() binary.ByteOrder
  • func (b *File) Class() elf.Class
  • func (b *File) DynEntries() ([]DynEntry, error)
  • func (b *File) DynSymbols() ([]elf.Symbol, error)
  • func (b *File) Entry() uint64
  • func (b *File) Machine() elf.Machine
  • func (b *File) OSABI() elf.OSABI
  • func (b *File) Progs() []Prog
  • func (b *File) Sections() []Section
  • func (b *File) Symbols() ([]elf.Symbol, error)
  • func (b *File) Type() elf.Type
• type Option
  • func WithResolverFactory(factory func(buildID string) Resolver) Option
• type Prog
  • func (p Prog) Data() ([]byte, error)
• type Resolver
• type Section
  • func FindSection(b Binary, name string) (Section, error)
  • func (s Section) Data() ([]byte, error)

Constants

const (
	NT_GNU_BUILD_ID        = 3
	NT_GNU_PROPERTY_TYPE_0 = 5

	GNU_PROPERTY_X86_FEATURE_1_AND   = 0xc0000002
	GNU_PROPERTY_X86_FEATURE_1_IBT   = 0x1
	GNU_PROPERTY_X86_FEATURE_1_SHSTK = 0x2

	GNU_PROPERTY_AARCH64_FEATURE_1_AND = 0xc0000000
	GNU_PROPERTY_AARCH64_FEATURE_1_BTI = 0x1
	GNU_PROPERTY_AARCH64_FEATURE_1_PAC = 0x2
)

GNU note types and property constants for feature detection.

Variables

var ErrSectionMissing = errors.New("section missing")

ErrSectionMissing is returned when a section cannot be obtained.

Functions

func DetectArchitecture

func DetectArchitecture(b Binary) binary.Architecture

DetectArchitecture returns the architecture of the binary.

func DetectLibC

func DetectLibC(b Binary) binary.LibC

DetectLibC identifies the C library that the binary links against, using PT_INTERP and DT_NEEDED as evidence. Returns LibCNone when the binary declares no libc dependency at all (static executables and self-contained shared objects). Returns LibCUnknown when the binary references a libc but the specific implementation can't be classified.

func DetectToolchain

func DetectToolchain(b Binary, detector toolchain.ELFDetector) toolchain.Toolchain

DetectToolchain identifies the compiler and version that produced the binary.

func DetectToolchainFromDWARF

func DetectToolchainFromDWARF(b Binary, detector toolchain.ELFDetector) toolchain.Toolchain

DetectToolchainFromDWARF identifies the compiler and version from DW_AT_producer in .debug_info. Returns a zero-value Toolchain when DWARF is unavailable or no producer attribute is found.

func DynString

func DynString(b Binary, tag elf.DynTag) (string, error)

DynString returns the string value associated with the first occurrence of the given dynamic tag, or "" if the tag is absent.

func HasDynFlag

func HasDynFlag(b Binary, tag elf.DynTag, flag uint64) (bool, error)

HasDynFlag reports whether a dynamic tag has the specified flag set.

func HasDynTag

func HasDynTag(b Binary, tag elf.DynTag) (bool, error)

HasDynTag reports whether a dynamic tag exists.

func HasGNUProperty

func HasGNUProperty(b Binary, propertyType, featureFlag uint32) (bool, error)

HasGNUProperty reports whether the binary has a GNU property with the specified feature flag set under the given property type.

func ImportedLibraries

func ImportedLibraries(b Binary) ([]string, error)

ImportedLibraries reports the dynamically-linked shared library dependencies via DT_NEEDED entries.

Types

type Alignment

type Alignment int

Alignment is a byte boundary used to pad ELF fields per the spec.

func (Alignment) Pad

func (a Alignment) Pad(n int) int

Pad returns n rounded up to the next multiple of a.

type Binary

type Binary interface {
	// Class reports the ELF class (32-bit or 64-bit).
	Class() elf.Class
	// Type reports the ELF type (e.g. ET_EXEC, ET_DYN).
	Type() elf.Type
	// Machine reports the target machine.
	Machine() elf.Machine
	// OSABI reports the OS/ABI identification.
	OSABI() elf.OSABI
	// ByteOrder reports the byte order in which this binary's data is encoded.
	ByteOrder() binary.ByteOrder
	// Entry returns the virtual address of the binary's entry point.
	Entry() uint64
	// BuildID returns an opaque identifier used to look up debug artifacts for this binary.
	// The default implementation returns the GNU build ID hex string from .note.gnu.build-id, or "" if absent.
	// Wrappers may substitute any stable identifier (e.g. a manifest hash) that the configured Resolver understands.
	BuildID() string

	// Progs returns the program header table.
	Progs() []Prog
	// Sections returns the section header table.
	Sections() []Section
	// Symbols returns entries from .symtab.
	// Returns (nil, nil) when no .symtab is present, matching stdlib's elf.ErrNoSymbols treatment.
	Symbols() ([]elf.Symbol, error)
	// DynSymbols returns entries from .dynsym.
	// Returns (nil, nil) when the binary has no dynamic symbols.
	DynSymbols() ([]elf.Symbol, error)
	// DynEntries returns parsed entries from the .dynamic section.
	// Returns (nil, nil) when .dynamic is absent.
	DynEntries() ([]DynEntry, error)
}

Binary exposes ELF metadata and section/segment contents for analysis.

type DynEntry

type DynEntry struct {
	Tag elf.DynTag
	Val uint64
}

DynEntry is a parsed entry from the .dynamic section.

type File

type File struct {
	// contains filtered or unexported fields
}

File is the canonical Binary implementation. It wraps stdlib's *elf.File and, when configured with a Resolver, transparently fetches sections that have been stripped from the local file.

func Open

func Open(r io.ReaderAt, opts ...Option) (*File, error)

Open parses the ELF header and section/program header tables from r. Section and segment contents are read lazily on demand. The caller owns r and must keep it open while the returned binary is in use.

func (*File) BuildID

func (b *File) BuildID() string

func (*File) ByteOrder

func (b *File) ByteOrder() binary.ByteOrder

func (*File) Class

func (b *File) Class() elf.Class

func (*File) DynEntries

func (b *File) DynEntries() ([]DynEntry, error)

func (*File) DynSymbols

func (b *File) DynSymbols() ([]elf.Symbol, error)

func (*File) Entry

func (b *File) Entry() uint64

func (*File) Machine

func (b *File) Machine() elf.Machine

func (*File) OSABI

func (b *File) OSABI() elf.OSABI

func (*File) Progs

func (b *File) Progs() []Prog

func (*File) Sections

func (b *File) Sections() []Section

func (*File) Symbols

func (b *File) Symbols() ([]elf.Symbol, error)

func (*File) Type

func (b *File) Type() elf.Type

type Option

type Option func(*openConfig)

Option configures a File at construction time.

func WithResolverFactory

func WithResolverFactory(factory func(buildID string) Resolver) Option

WithResolverFactory supplies a factory that produces a Resolver scoped to the binary's build ID. The factory is invoked once during Open after the build ID is known. Returning nil disables remote fetching. A Resolver is consulted when an accessor needs data that isn't present locally (typically debug symbols on stripped binaries).

type Prog

type Prog struct {
	elf.ProgHeader
	// contains filtered or unexported fields
}

Prog is an ELF program header bundled with a lazy accessor for its segment content.

func (Prog) Data

func (p Prog) Data() ([]byte, error)

Data returns the segment's raw bytes, or (nil, nil) for segments with no file content.

type Resolver

type Resolver interface {
	FetchSection(name string) ([]byte, error)
}

Resolver supplies the raw bytes of an ELF section that is not present in the local file. Implementations should return ErrSectionMissing when the section is unavailable on the remote side so callers can distinguish "section legitimately absent" from transport or parsing failures.

type Section

type Section struct {
	elf.SectionHeader
	// contains filtered or unexported fields
}

Section is an ELF section header bundled with a lazy accessor for its content.

func FindSection

func FindSection(b Binary, name string) (Section, error)

FindSection returns the named section from the binary, or ErrSectionMissing if it isn't present.

func (Section) Data

func (s Section) Data() ([]byte, error)

Data returns the section's raw bytes.