//! The generic ELF module, which gives access to ELF constants and other helper functions, which are independent of ELF bithood. Also defines an `Elf` struct which implements a unified parser that returns a wrapped `Elf64` or `Elf32` binary. //! //! To access the exact 32-bit or 64-bit versions, use [goblin::elf32::Header](header/header32/struct.Header.html)/[goblin::elf64::Header](header/header64/struct.Header.html), etc., for the various 32/64-bit structs. //! //! # Example //! //! ```rust //! use std::fs::File; //! //! pub fn read (bytes: &[u8]) { //! match goblin::elf::Elf::parse(&bytes) { //! Ok(binary) => { //! let entry = binary.entry; //! for ph in binary.program_headers { //! if ph.p_type == goblin::elf::program_header::PT_LOAD { //! // TODO: you should validate p_filesz before allocating. //! let mut _buf = vec![0u8; ph.p_filesz as usize]; //! // read responsibly //! } //! } //! }, //! Err(_) => () //! } //! } //! ``` //! //! This will properly access the underlying 32-bit or 64-bit binary automatically. Note that since //! 32-bit binaries typically have shorter 32-bit values in some cases (specifically for addresses and pointer //! values), these values are upcasted to u64/i64s when appropriate. //! //! See [goblin::elf::Elf](struct.Elf.html) for more information. //! //! You are still free to use the specific 32-bit or 64-bit versions by accessing them through `goblin::elf64`, etc., but you will have to parse and/or construct the various components yourself. //! In other words, there is no unified 32/64-bit `Elf` struct. //! //! # Note //! To use the automagic ELF datatype union parser, you _must_ enable/opt-in to the `elf64`, `elf32`, and //! `endian_fd` features if you disable `default`.
#[macro_use] pub(crate) mod gnu_hash;
// These are shareable values for the 32/64 bit implementations. // // They are publicly re-exported by the pub-using module pubmod compression_header; pubmod header; pubmod program_header; pubmod section_header; #[macro_use] pubmod sym; pubmod dynamic; #[macro_use] pubmod reloc; pubmod note; #[cfg(all(any(feature = "elf32", feature = "elf64"), feature = "alloc"))] pubmod symver;
if_sylvan! { use scroll::{ctx, Pread, Endian}; usecrate::strtab::Strtab; usecrate::error; usecrate::container::{Container, Ctx}; use alloc::vec::Vec; use core::cmp;
#[derive(Debug)] /// An ELF binary. The underlying data structures are read according to the headers byte order and container size (32 or 64). pubstruct Elf<'a> { /// The ELF header, which provides a rudimentary index into the rest of the binary pub header: Header, /// The program headers; they primarily tell the kernel and the dynamic linker /// how to load this binary pub program_headers: ProgramHeaders, /// The sections headers. These are strippable, never count on them being /// here unless you're a static linker! pub section_headers: SectionHeaders, /// The section header string table pub shdr_strtab: Strtab<'a>, /// The string table for the dynamically accessible symbols pub dynstrtab: Strtab<'a>, /// The dynamically accessible symbols, i.e., exports, imports. /// This is what the dynamic linker uses to dynamically load and link your binary, /// or find imported symbols for binaries which dynamically link against your library pub dynsyms: Symtab<'a>, /// The debugging symbol table pub syms: Symtab<'a>, /// The string table for the symbol table pub strtab: Strtab<'a>, /// Contains dynamic linking information, with the _DYNAMIC array + a preprocessed DynamicInfo for that array pub dynamic: Option<Dynamic>, /// The dynamic relocation entries (strings, copy-data, etc.) with an addend pub dynrelas: RelocSection<'a>, /// The dynamic relocation entries without an addend pub dynrels: RelocSection<'a>, /// The plt relocation entries (procedure linkage table). For 32-bit binaries these are usually Rel (no addend) pub pltrelocs: RelocSection<'a>, /// Section relocations by section index (only present if this is a relocatable object file) pub shdr_relocs: Vec<(ShdrIdx, RelocSection<'a>)>, /// The binary's soname, if it has one pub soname: Option<&'a str>, /// The binary's program interpreter (e.g., dynamic linker), if it has one pub interpreter: Option<&'a str>, /// A list of this binary's dynamic libraries it uses, if there are any pub libraries: Vec<&'a str>, /// A list of runtime search paths for this binary's dynamic libraries it uses, if there /// are any. (deprecated) pub rpaths: Vec<&'a str>, /// A list of runtime search paths for this binary's dynamic libraries it uses, if there /// are any. pub runpaths: Vec<&'a str>, /// Whether this is a 64-bit elf or not pub is_64: bool, /// Whether this is a shared object or not pub is_lib: bool, /// The binaries entry point address, if it has one pub entry: u64, /// Whether the binary is little endian or not pub little_endian: bool, /// Contains the symbol version information from the optional section /// [`SHT_GNU_VERSYM`][section_header::SHT_GNU_VERSYM] (GNU extenstion). pub versym : Option<VersymSection<'a>>, /// Contains the version definition information from the optional section /// [`SHT_GNU_VERDEF`][section_header::SHT_GNU_VERDEF] (GNU extenstion). pub verdef : Option<VerdefSection<'a>>, /// Contains the version needed information from the optional section /// [`SHT_GNU_VERNEED`][section_header::SHT_GNU_VERNEED] (GNU extenstion). pub verneed : Option<VerneedSection<'a>>,
ctx: Ctx,
}
impl<'a> Elf<'a> { /// Try to iterate notes in PT_NOTE program headers; returns `None` if there aren't any note headers in this binary pubfn iter_note_headers(&self, data: &'a [u8]) -> Option<note::NoteIterator<'a>> { letmut iters = vec![]; for phdr in &self.program_headers { if phdr.p_type == program_header::PT_NOTE { let offset = phdr.p_offset as usize; let alignment = phdr.p_align as usize;
if iters.is_empty() {
None
} else {
Some(note::NoteIterator {
iters: iters,
index: 0,
})
}
} /// Try to iterate notes in SHT_NOTE sections; returns `None` if there aren't any note sections in this binary /// /// If a section_name is given, only the section with the according name is iterated. pubfn iter_note_sections(
&self,
data: &'a [u8],
section_name: Option<&str>,
) -> Option<note::NoteIterator<'a>> { letmut iters = vec![]; for sect in &self.section_headers { if sect.sh_type != section_header::SHT_NOTE { continue;
}
if section_name.is_some() && self.shdr_strtab.get_at(sect.sh_name) != section_name { continue;
}
let offset = sect.sh_offset as usize; let alignment = sect.sh_addralign as usize;
iters.push(note::NoteDataIterator {
data,
offset,
size: offset.saturating_add(sect.sh_size as usize),
ctx: (alignment, self.ctx)
});
}
/// Parses the contents to get the Header only. This `bytes` buffer should contain at least the length for parsing Header. pubfn parse_header(bytes: &'a [u8]) -> error::Result<Header> {
bytes.pread::<Header>(0)
}
/// Lazy parse the ELF contents. This function mainly just assembles an Elf struct. Once we have the struct, we can choose to parse whatever we want. pubfn lazy_parse(header: Header) -> error::Result<Self> { let misc = parse_misc(&header)?;
/// Parses the contents of the byte stream in `bytes`, and maybe returns a unified binary pubfn parse(bytes: &'a [u8]) -> error::Result<Self> { let header = Self::parse_header(bytes)?; let misc = parse_misc(&header)?; let ctx = misc.ctx;
let program_headers = ProgramHeader::parse(bytes, header.e_phoff as usize, header.e_phnum as usize, ctx)?;
letmut interpreter = None; for ph in &program_headers { if ph.p_type == program_header::PT_INTERP && ph.p_filesz != 0 { let count = (ph.p_filesz - 1) as usize; let offset = ph.p_offset as usize;
interpreter = bytes.pread_with::<&str>(offset, ::scroll::ctx::StrCtx::Length(count)).ok();
}
}
let section_headers = SectionHeader::parse(bytes, header.e_shoff as usize, header.e_shnum as usize, ctx)?;
let get_strtab = |section_headers: &[SectionHeader], mut section_idx: usize| { if section_idx == section_header::SHN_XINDEX as usize { if section_headers.is_empty() { return Ok(Strtab::default())
}
section_idx = section_headers[0].sh_link as usize;
}
if section_idx >= section_headers.len() { // FIXME: warn! here
Ok(Strtab::default())
} else { let shdr = §ion_headers[section_idx];
shdr.check_size(bytes.len())?;
Strtab::parse(bytes, shdr.sh_offset as usize, shdr.sh_size as usize, 0x0)
}
};
let strtab_idx = header.e_shstrndx as usize; let shdr_strtab = get_strtab(§ion_headers, strtab_idx)?;
letmut syms = Symtab::default(); letmut strtab = Strtab::default(); iflet Some(shdr) = section_headers.iter().rfind(|shdr| shdr.sh_type as u32 == section_header::SHT_SYMTAB) { let size = shdr.sh_entsize; let count = if size == 0 { 0 } else { shdr.sh_size / size };
syms = Symtab::parse(bytes, shdr.sh_offset as usize, count as usize, ctx)?;
strtab = get_strtab(§ion_headers, shdr.sh_link as usize)?;
}
fn parse_misc(header: &Header) -> error::Result<Misc> { let entry = header.e_entry as usize; let is_lib = header.e_type == header::ET_DYN; let is_lsb = header.e_ident[header::EI_DATA] == header::ELFDATA2LSB; let endianness = scroll::Endian::from(is_lsb); let class = header.e_ident[header::EI_CLASS]; if class != header::ELFCLASS64 && class != header::ELFCLASS32 { return Err(error::Error::Malformed(format!("Unknown values in ELF ident header: class: {} endianness: {}",
class,
header.e_ident[header::EI_DATA])));
} let is_64 = class == header::ELFCLASS64; let container = if is_64 { Container::Big } else { Container::Little }; let ctx = Ctx::new(container, endianness);
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.