Module goblin::elf

source ·
Expand description

The generic ELF module, which gives access to ELF constants and other helper functions, which are independent of ELF bithood. Also defines an Elf struct which implements a unified parser that returns a wrapped Elf64 or Elf32 binary.

To access the exact 32-bit or 64-bit versions, use goblin::elf32::Header/goblin::elf64::Header, etc., for the various 32/64-bit structs.

Example

use std::fs::File;

pub fn read (bytes: &[u8]) {
  match goblin::elf::Elf::parse(&bytes) {
    Ok(binary) => {
      let entry = binary.entry;
      for ph in binary.program_headers {
        if ph.p_type == goblin::elf::program_header::PT_LOAD {
          // TODO: you should validate p_filesz before allocating.
          let mut _buf = vec![0u8; ph.p_filesz as usize];
          // read responsibly
         }
      }
    },
    Err(_) => ()
  }
}

This will properly access the underlying 32-bit or 64-bit binary automatically. Note that since 32-bit binaries typically have shorter 32-bit values in some cases (specifically for addresses and pointer values), these values are upcasted to u64/i64s when appropriate.

See goblin::elf::Elf for more information.

You are still free to use the specific 32-bit or 64-bit versions by accessing them through goblin::elf64, etc., but you will have to parse and/or construct the various components yourself. In other words, there is no unified 32/64-bit Elf struct.

Note

To use the automagic ELF datatype union parser, you must enable/opt-in to the elf64, elf32, and endian_fd features if you disable default.

Modules

Structs

  • Elf
    An ELF binary. The underlying data structures are read according to the headers byte order and container size (32 or 64).

Type Aliases