Struct goblin::elf::Elf

pub struct Elf<'a> {

    pub header: Header,
    pub program_headers: ProgramHeaders,
    pub section_headers: SectionHeaders,
    pub shdr_strtab: Strtab<'a>,
    pub dynstrtab: Strtab<'a>,
    pub dynsyms: Symtab<'a>,
    pub syms: Symtab<'a>,
    pub strtab: Strtab<'a>,
    pub dynamic: Option<Dynamic>,
    pub dynrelas: RelocSection<'a>,
    pub dynrels: RelocSection<'a>,
    pub pltrelocs: RelocSection<'a>,
    pub shdr_relocs: Vec<(ShdrIdx, RelocSection<'a>)>,
    pub soname: Option<&'a str>,
    pub interpreter: Option<&'a str>,
    pub libraries: Vec<&'a str>,
    pub is_64: bool,
    pub is_lib: bool,
    pub entry: u64,
    pub little_endian: bool,
    /* private fields */
}

An ELF binary. The underlying data structures are read according to the headers byte order and container size (32 or 64).

Fields

header: Header

The ELF header, which provides a rudimentary index into the rest of the binary

program_headers: ProgramHeaders

The program headers; they primarily tell the kernel and the dynamic linker how to load this binary

section_headers: SectionHeaders

The sections headers. These are strippable, never count on them being here unless you’re a static linker!

shdr_strtab: Strtab<'a>

The section header string table

dynstrtab: Strtab<'a>

The string table for the dynamically accessible symbols

dynsyms: Symtab<'a>

The dynamically accessible symbols, i.e., exports, imports. This is what the dynamic linker uses to dynamically load and link your binary, or find imported symbols for binaries which dynamically link against your library

syms: Symtab<'a>

The debugging symbol table

strtab: Strtab<'a>

The string table for the symbol table

dynamic: Option<Dynamic>

Contains dynamic linking information, with the _DYNAMIC array + a preprocessed DynamicInfo for that array

dynrelas: RelocSection<'a>

The dynamic relocation entries (strings, copy-data, etc.) with an addend

dynrels: RelocSection<'a>

The dynamic relocation entries without an addend

pltrelocs: RelocSection<'a>

The plt relocation entries (procedure linkage table). For 32-bit binaries these are usually Rel (no addend)

shdr_relocs: Vec<(ShdrIdx, RelocSection<'a>)>

Section relocations by section index (only present if this is a relocatable object file)

soname: Option<&'a str>

The binary’s soname, if it has one

interpreter: Option<&'a str>

The binary’s program interpreter (e.g., dynamic linker), if it has one

libraries: Vec<&'a str>

A list of this binary’s dynamic libraries it uses, if there are any

is_64: bool

Whether this is a 64-bit elf or not

is_lib: bool

Whether this is a shared object or not

entry: u64

The binaries entry point address, if it has one

little_endian: bool

Whether the binary is little endian or not

Implementations

impl<'a> Elf<'a>

pub fn iter_note_headers(&self, data: &'a [u8]) -> Option<NoteIterator<'a>>

Try to iterate notes in PT_NOTE program headers; returns None if there aren’t any note headers in this binary

pub fn iter_note_sections( &self, data: &'a [u8], section_name: Option<&str> ) -> Option<NoteIterator<'a>>

Try to iterate notes in SHT_NOTE sections; returns None if there aren’t any note sections in this binary

If a section_name is given, only the section with the according name is iterated.

pub fn is_object_file(&self) -> bool

pub fn parse_header(bytes: &'a [u8]) -> Result<Header>

Parses the contents to get the Header only. This bytes buffer should contain at least the length for parsing Header.

pub fn lazy_parse(header: Header) -> Result<Self>

Lazy parse the ELF contents. This function mainly just assembles an Elf struct. Once we have the struct, we can choose to parse whatever we want.

pub fn parse(bytes: &'a [u8]) -> Result<Self>

Parses the contents of the byte stream in bytes, and maybe returns a unified binary

Trait Implementations

impl<'a> Debug for Elf<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'a> TryFromCtx<'a, (usize, Endian)> for Elf<'a>

type Error = Error

fn try_from_ctx( src: &'a [u8], (_, _): (usize, Endian) ) -> Result<(Elf<'a>, usize), Self::Error>