ELF

Parser

class Parser : public LIEF::Parser

Class which parses and transforms an ELF file into a ELF::Binary object.

Subclassed by LIEF::OAT::Parser

Public Types

enum ELF_TYPE

Values:

enumerator ELF_UNKNOWN
enumerator ELF32
enumerator ELF64

Public Functions

Parser &operator=(const Parser&) = delete
Parser(const Parser&) = delete

Public Static Functions

static std::unique_ptr<Binary> parse(const std::string &file, const ParserConfig &conf = ParserConfig::all())

Parse an ELF file and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols

Parameters:
  • file[in] Path to the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary as a unique_ptr

static std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const ParserConfig &conf = ParserConfig::all())

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • data[in] Raw ELF as a std::vector of uint8_t

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

static std::unique_ptr<Binary> parse(std::unique_ptr<BinaryStream> stream, const ParserConfig &conf = ParserConfig::all())

Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • stream[in] The stream which wraps the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

Public Static Attributes

static constexpr uint32_t NB_MAX_SYMBOLS = 1000000
static constexpr uint32_t DELTA_NB_SYMBOLS = 3000
static constexpr uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
static constexpr uint32_t NB_MAX_CHAINS = 1000000
static constexpr uint32_t NB_MAX_SEGMENTS = 10000
static constexpr uint32_t NB_MAX_RELOCATIONS = 3000000
static constexpr uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
static constexpr uint32_t NB_MAX_MASKWORD = 512
static constexpr uint32_t MAX_SEGMENT_SIZE = 3_GB

Friends

friend class OAT::Parser
struct ParserConfig

This structure is used to tweak the ELF Parser (ELF::Parser)

Public Types

enum class DYNSYM_COUNT

Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols

Values:

enumerator AUTO = 0

Automatic detection

enumerator SECTION = 1

Count based on sections (not very reliable)

enumerator HASH = 2

Count based on hash table (reliable)

enumerator RELOCATIONS = 3

Count based on PLT/GOT relocations (very reliable but not accurate)

Public Members

bool parse_relocations = true

Whether relocations (including plt-like relocations) should be parsed.

bool parse_dyn_symbols = true

Whether dynamic symbols (those from .dynsym) should be parsed.

bool parse_symtab_symbols = true

Whether debug symbols (those from .symtab) should be parsed.

bool parse_symbol_versions = true

Whether versioning symbols should be parsed.

bool parse_notes = true

Whether ELF notes information should be parsed.

bool parse_overlay = true

Whether the overlay data should be parsed.

DYNSYM_COUNT count_mtd = DYNSYM_COUNT::AUTO

The method used to count the number of dynamic symbols

Public Static Functions

static inline ParserConfig all()

This returns a ParserConfig object configured to process all the ELF elements.


Binary

class Binary : public LIEF::Binary

Class which represents an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

enum PHDR_RELOC

This enum describes the different ways to relocate the segments table.

Values:

enumerator AUTO = 0

Defer the choice of the layout to LIEF.

enumerator PIE_SHIFT

The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.

enumerator BSS_END

The new segments table is relocated right after the first bss-like segment.

enumerator BINARY_END

The new segments table is relocated at the end of the binary.

enumerator SEGMENT_GAP

The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.

using string_list_t = std::vector<std::string>
using notes_t = std::vector<std::unique_ptr<Note>>

Internal container for storing notes.

using it_notes = ref_iterator<notes_t&, Note*>

Iterator which outputs Note& object.

using it_const_notes = const_ref_iterator<const notes_t&, const Note*>

Iterator which outputs const Note& object.

using symbols_version_requirement_t = std::vector<std::unique_ptr<SymbolVersionRequirement>>

Internal container for storing SymbolVersionRequirement.

using it_symbols_version_requirement = ref_iterator<symbols_version_requirement_t&, SymbolVersionRequirement*>

Iterator which outputs SymbolVersionRequirement& object.

using it_const_symbols_version_requirement = const_ref_iterator<const symbols_version_requirement_t&, const SymbolVersionRequirement*>

Iterator which outputs const SymbolVersionRequirement& object.

using symbols_version_definition_t = std::vector<std::unique_ptr<SymbolVersionDefinition>>

Internal container for storing SymbolVersionDefinition.

using it_symbols_version_definition = ref_iterator<symbols_version_definition_t&, SymbolVersionDefinition*>

Iterator which outputs SymbolVersionDefinition& object.

using it_const_symbols_version_definition = const_ref_iterator<const symbols_version_definition_t&, const SymbolVersionDefinition*>

Iterator which outputs const SymbolVersionDefinition& object.

using segments_t = std::vector<std::unique_ptr<Segment>>

Internal container for storing ELF’s Segment.

using it_segments = ref_iterator<segments_t&, Segment*>

Iterator which outputs Segment& object.

using it_const_segments = const_ref_iterator<const segments_t&, const Segment*>

Iterator which outputs const Segment& object.

using dynamic_entries_t = std::vector<std::unique_ptr<DynamicEntry>>

Internal container for storing ELF’s DynamicEntry.

using it_dynamic_entries = ref_iterator<dynamic_entries_t&, DynamicEntry*>

Iterator which outputs DynamicEntry& object.

using it_const_dynamic_entries = const_ref_iterator<const dynamic_entries_t&, const DynamicEntry*>

Iterator which outputs const DynamicEntry& object.

using symbols_version_t = std::vector<std::unique_ptr<SymbolVersion>>

Internal container for storing ELF’s SymbolVersion.

using it_symbols_version = ref_iterator<symbols_version_t&, SymbolVersion*>

Iterator which outputs SymbolVersion& object.

using it_const_symbols_version = const_ref_iterator<const symbols_version_t&, const SymbolVersion*>

Iterator which outputs const SymbolVersion& object.

using relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing ELF’s Relocation.

using it_pltgot_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs plt/got Relocation& object.

using it_const_pltgot_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs plt/got const Relocation& object.

using it_dynamic_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)

using it_const_dynamic_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)

using it_object_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object found in object files (.o)

using it_const_object_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object found in object files (.o)

using it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object.

using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object.

using symbols_t = std::vector<std::unique_ptr<Symbol>>

Internal container for storing ELF’s Symbol.

using it_dynamic_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the Dynamic Symbol& object.

using it_const_dynamic_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the Dynamic const Symbol& object.

using it_symtab_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the static/debug Symbol& object.

using it_const_symtab_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the static/debug const Symbol& object.

using it_symbols = ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic Symbol& object.

using it_const_symbols = const_ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic const Symbol& object.

using it_exported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported Symbol& object.

using it_const_exported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported const Symbol& object.

using it_imported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported Symbol& object.

using it_const_imported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported const Symbol& object.

using sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing ELF’s Section.

using it_sections = ref_iterator<sections_t&, Section*>

Iterator which outputs Section& object.

using it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator which outputs const Section& object.

Public Functions

Binary &operator=(const Binary&) = delete
Binary(const Binary &copy) = delete
inline Header::CLASS type() const

Return binary’s class (ELF32 or ELF64)

inline Header &header()

Return Elf header .

inline const Header &header() const
uint64_t last_offset_section() const

Return the last offset used in binary according to sections table.

uint64_t last_offset_segment() const

Return the last offset used in binary according to segments table.

uint64_t next_virtual_address() const

Return the next virtual address available.

inline it_sections sections()

Return an iterator over the binary’s sections.

inline it_const_sections sections() const
inline virtual uint64_t entrypoint() const override

Return the binary’s entrypoint.

inline it_segments segments()

Return binary’s segments.

inline it_const_segments segments() const
inline it_dynamic_entries dynamic_entries()

Return binary’s dynamic entries.

inline it_const_dynamic_entries dynamic_entries() const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the new entry.

Note &add(const Note &note)

Add the given note and return the created entry.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DynamicEntry::TAG tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section. The clear parameter can be used to zeroize the original content beforehand.

Parameters:
  • section[in] The section to remove

  • clear[in] Whether zeroize the original content

void remove(const Note &note)

Remove the given note.

void remove(Note::TYPE type)

Remove all notes with the given type.

void remove(const Segment &seg)

Remove the given segment.

inline it_dynamic_symbols dynamic_symbols()

Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.

inline it_const_dynamic_symbols dynamic_symbols() const
it_exported_symbols exported_symbols()

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols() const
it_imported_symbols imported_symbols()

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols() const
inline it_symtab_symbols symtab_symbols()

Return the debug symbols from the .symtab section.

inline it_const_symtab_symbols symtab_symbols() const
inline it_symbols_version symbols_version()

Return the symbol versions.

inline it_const_symbols_version symbols_version() const
inline it_symbols_version_definition symbols_version_definition()

Return symbols version definition.

inline it_const_symbols_version_definition symbols_version_definition() const
inline it_symbols_version_requirement symbols_version_requirement()

Return Symbol version requirement.

inline it_const_symbols_version_requirement symbols_version_requirement() const
it_dynamic_relocations dynamic_relocations()

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations() const
Relocation &add_dynamic_relocation(const Relocation &relocation)

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related

See: add_pltgot_relocation

Relocation &add_pltgot_relocation(const Relocation &relocation)

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See also: add_dynamic_relocation

Relocation *add_object_relocation(const Relocation &relocation, const Section &section)

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.

it_pltgot_relocations pltgot_relocations()

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations() const
it_object_relocations object_relocations()

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations() const
inline it_relocations relocations()

Return all relocations present in the binary.

inline it_const_relocations relocations() const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. It returns a nullptr if it is not found.

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol It returns a nullptr if it is not found.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name It returns a nullptr if it is not found.

Relocation *get_relocation(const std::string &symbol_name)
inline bool use_gnu_hash() const

true if GNU hash is used

inline const GnuHash *gnu_hash() const

Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.

inline bool use_sysv_hash() const

true if SYSV hash is used

inline const SysvHash *sysv_hash() const

Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handles the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handles the given virtual address exists.

Section *get_section(const std::string &name)

Return Section with the given name. If the section can’t be found, it returns a nullptr.

const Section *get_section(const std::string &name) const
inline Section *text_section()

Return the .text section. If the section can’t be found, it returns a nullptr.

Section *dynamic_section()

Return the .dynamic section. If the section can’t be found, it returns a nullptr.

Section *hash_section()

Return the hash section. If the section can’t be found, it returns a nullptr.

Section *symtab_symbols_section()

Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr.

virtual uint64_t imagebase() const override

Return program image base. For instance 0x40000

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size() const

Return the size of the mapped binary.

bool has_interpreter() const

Check if the binary uses a loader (also named linker or interpreter)

See also

interpreter

const std::string &interpreter() const

Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.

void interpreter(const std::string &interpreter)

Change the interpreter.

inline it_symbols symbols()

Return an iterator on both static and dynamic symbols.

inline it_const_symbols symbols() const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbols table.

const Symbol *get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.

Symbol *get_dynamic_symbol(const std::string &name)
inline bool has_symtab_symbol(const std::string &name) const

Check if the symbol with the given name exists in the symtab symbol table.

const Symbol *get_symtab_symbol(const std::string &name) const

Get the symtab symbol from the given name Return a nullptr if it can’t be found.

Symbol *get_symtab_symbol(const std::string &name)
string_list_t strings(size_t min_size = 5) const

Return list of the strings used by the ELF binary.

Basically, this function looks for string in the .roadata section

void remove_symbol(const std::string &name)

Remove symbols with the given name in both:

  • dynamic symbols

  • symtab symbols

void remove_symtab_symbol(const std::string &name)

Remove symtabl symbols with the given name.

void remove_symtab_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbols table.

As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol

virtual result<uint64_t> get_function_address(const std::string &func_name) const override

Return the address of the given function name.

result<uint64_t> get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters:
  • func_name[in] The function’s name target

  • demangled[in] Use the demangled name

Section *add(const Section &section, bool loaded = true)

Add a new section in the binary.

This function requires a well-formed ELF binary

Parameters:
  • section[in] The section object to insert

  • loaded[in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment

Returns:

The section added. The size and the virtual address might change.

Section *extend(const Section &section, uint64_t size)
Symbol &add_symtab_symbol(const Symbol &symbol)

Add a symtab symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr)

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library from the dependencies.

DynamicEntryLibrary *get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

const DynamicEntryLibrary *get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment *add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

This function requires a well-formed ELF binary

Returns:

The segment added. Virtual address and File Offset might change.

Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)

Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.

Warning

The original_segment is no longer valid after this function

Segment *extend(const Segment &segment, uint64_t size)
virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • size[in] Size of the value in bytes (1, 2, … 8)

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters:
  • symbol[in] Imported symbol to patch

  • address[in] New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters:
  • symbol_name[in] Imported symbol’s name to patch

  • address[in] New address

void strip()

Strip the binary by removing symtab symbols.

virtual void remove_section(const std::string &name, bool clear = false) override

Remove a binary’s section.

Parameters:
  • name[in] The name of the section to remove

  • clear[in] Whether zeroize the original content

virtual void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

filename – Path for the written ELF binary

void write(const std::string &filename, Builder::config_t config)

Reconstruct the binary object with the given config and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:
  • filename – Path for the written ELF binary

  • configBuilder configuration

virtual void write(std::ostream &os) override

Reconstruct the binary object and write it in os stream.

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

os – Output stream for the written ELF binary

void write(std::ostream &os, Builder::config_t config)

Reconstruct the binary object with the given config and write it in os stream.

Parameters:
  • os – Output stream for the written ELF binary

  • configBuilder configuration

std::vector<uint8_t> raw()

Reconstruct the binary object and return its content as a byte vector.

result<uint64_t> virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to a file offset.

virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override

Convert the given offset into a virtual address.

Parameters:
  • offset[in] The offset to convert.

  • slide[in] If not 0, it will replace the default base address (if any)

virtual bool is_pie() const override

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

virtual bool has_nx() const override

Check if the binary uses the NX protection (Non executable stack)

int64_t dynsym_idx(const std::string &name) const

Symbol index in the dynamic symbol table or -1 if the symbol does not exist.

int64_t dynsym_idx(const Symbol &sym) const
int64_t symtab_idx(const std::string &name) const

Symbol index from the .symtab section or -1 if the symbol is not present.

int64_t symtab_idx(const Symbol &sym) const
const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const

Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_offset(uint64_t offset, bool skip_nobits = true)
const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const

Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true)
const Segment *segment_from_virtual_address(uint64_t address) const

Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.

Segment *segment_from_virtual_address(uint64_t address)
const Segment *segment_from_virtual_address(Segment::TYPE type, uint64_t address) const
Segment *segment_from_virtual_address(Segment::TYPE type, uint64_t address)
const Segment *segment_from_offset(uint64_t offset) const

Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.

Segment *segment_from_offset(uint64_t offset)
const DynamicEntry *get(DynamicEntry::TAG tag) const

Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.

inline DynamicEntry *get(DynamicEntry::TAG tag)
const Segment *get(Segment::TYPE type) const

Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.

Segment *get(Segment::TYPE type)
const Note *get(Note::TYPE type) const

Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.

Note *get(Note::TYPE type)
const Section *get(Section::TYPE type) const

Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.

Section *get(Section::TYPE type)
inline bool has(DynamicEntry::TAG tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

inline bool has(Segment::TYPE type) const

Check if ELF::Segment associated with the given type exists.

inline bool has(Note::TYPE type) const

Check if a ELF::Note associated with the given type exists.

inline bool has(Section::TYPE type) const

Check if a ELF::Section associated with the given type exists.

virtual span<const uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

virtual void accept(LIEF::Visitor &visitor) const override

Method associated with the visitor pattern.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

virtual LIEF::Binary::functions_t ctor_functions() const override

List of binary constructors (typically, the functions located in the .init_array)

LIEF::Binary::functions_t dtor_functions() const

List of the binary destructors (typically, the functions located in the .fini_array)

LIEF::Binary::functions_t functions() const

List of the functions found the in the binary.

bool has_notes() const

true if the binary embeds notes

inline it_const_notes notes() const

Return an iterator over the ELF’s LIEF::ELF::Note.

See also

has_note

inline it_notes notes()
uint64_t eof_offset() const

Return the last offset used by the ELF binary according to both: the sections table and the segments table.

inline bool has_overlay() const

True if data are present at the end of the binary.

span<const uint8_t> overlay() const

Overlay data (if any)

void overlay(std::vector<uint8_t> overlay)

Function to set the overlay.

uint64_t relocate_phdr_table(PHDR_RELOC type)

Force relocating the segments table in a specific way.

This function can be used to enforce a specific relocation of the segments table.

Parameters:

type[in] The relocation type to apply

Returns:

The offset of the new segments table or 0 if it fails with the given method.

size_t hash(const std::string &name)
~Binary() override
virtual std::ostream &print(std::ostream &os) const override
inline Binary &operator+=(const DynamicEntry &entry)
inline Binary &operator+=(const Section &section)
inline Binary &operator+=(const Segment &segment)
inline Binary &operator+=(const Note &note)
inline Binary &operator-=(const DynamicEntry &entry)
inline Binary &operator-=(DynamicEntry::TAG tag)
inline Binary &operator-=(const Note &note)
inline Binary &operator-=(Note::TYPE type)
inline Segment *operator[](Segment::TYPE type)
inline const Segment *operator[](Segment::TYPE type) const
inline DynamicEntry *operator[](DynamicEntry::TAG tag)
inline const DynamicEntry *operator[](DynamicEntry::TAG tag) const
inline Note *operator[](Note::TYPE type)
inline const Note *operator[](Note::TYPE type) const
inline Section *operator[](Section::TYPE type)
inline const Section *operator[](Section::TYPE type) const

Public Static Functions

static inline bool classof(const LIEF::Binary *bin)


Section

class Section : public LIEF::Section

Class wich represents an ELF Section.

Public Types

enum class TYPE : uint64_t

Values:

enumerator SHT_NULL = 0

No associated section (inactive entry).

enumerator PROGBITS = 1

Program-defined contents.

enumerator SYMTAB = 2

Symbol table.

enumerator STRTAB = 3

String table.

enumerator RELA = 4

Relocation entries; explicit addends.

enumerator HASH = 5

Symbol hash table.

enumerator DYNAMIC = 6

Information for dynamic linking.

enumerator NOTE = 7

Information about the file.

enumerator NOBITS = 8

Data occupies no space in the file.

enumerator REL = 9

Relocation entries; no explicit addends.

enumerator SHLIB = 10

Reserved.

enumerator DYNSYM = 11

Symbol table.

enumerator INIT_ARRAY = 14

Pointers to initialization functions.

enumerator FINI_ARRAY = 15

Pointers to termination functions.

enumerator PREINIT_ARRAY = 16

Pointers to pre-init functions.

enumerator GROUP = 17

Section group.

enumerator SYMTAB_SHNDX = 18

Indices for SHN_XINDEX entries.

enumerator RELR = 19
enumerator ANDROID_REL = 0x60000001

Packed relocations (Android specific).

enumerator ANDROID_RELA = 0x60000002

Packed relocations (Android specific).

enumerator LLVM_ADDRSIG = 0x6fff4c03

This section is used to mark symbols as address-significant.

enumerator ANDROID_RELR = 0x6fffff00

New relr relocations (Android specific).

enumerator GNU_ATTRIBUTES = 0x6ffffff5

Object attributes.

enumerator GNU_HASH = 0x6ffffff6

GNU-style hash table.

enumerator GNU_VERDEF = 0x6ffffffd

GNU version definitions.

enumerator GNU_VERNEED = 0x6ffffffe

GNU version references.

enumerator GNU_VERSYM = 0x6fffffff

GNU symbol versions table.

enumerator _ID_SHIFT_ = 32
enumerator _ARM_ID_ = 1LLU
enumerator _HEX_ID_ = 2LLU
enumerator _X86_64_ID_ = 2LLU
enumerator _MIPS_ID_ = 3LLU
enumerator ARM_EXIDX = 0x70000001U + (_ARM_ID_ << _ID_SHIFT_)

Exception Index table

enumerator ARM_PREEMPTMAP = 0x70000002U + (_ARM_ID_ << _ID_SHIFT_)

BPABI DLL dynamic linking pre-emption map

enumerator ARM_ATTRIBUTES = 0x70000003U + (_ARM_ID_ << _ID_SHIFT_)

Object file compatibility attributes

enumerator ARM_DEBUGOVERLAY = 0x70000004U + (_ARM_ID_ << _ID_SHIFT_)
enumerator ARM_OVERLAYSECTION = 0x70000005U + (_ARM_ID_ << _ID_SHIFT_)
enumerator HEX_ORDERED = 0x70000000 + (_HEX_ID_ << _ID_SHIFT_)

Link editor is to sort the entries in

enumerator X86_64_UNWIND = 0x70000001 + (_X86_64_ID_ << _ID_SHIFT_)

Unwind information

enumerator MIPS_REGINFO = 0x70000006 + (_MIPS_ID_ << _ID_SHIFT_)

Register usage information

enumerator MIPS_OPTIONS = 0x7000000d + (_MIPS_ID_ << _ID_SHIFT_)

General options

enumerator MIPS_ABIFLAGS = 0x7000002a + (_MIPS_ID_ << _ID_SHIFT_)

ABI information.

enum class FLAGS : uint64_t

Values:

enumerator NONE = 0x000000000
enumerator WRITE = 0x000000001

Section data should be writable during execution.

enumerator ALLOC = 0x000000002

Section occupies memory during program execution.

enumerator EXECINSTR = 0x000000004

Section contains executable machine instructions.

enumerator MERGE = 0x000000010

The data in this section may be merged.

enumerator STRINGS = 0x000000020

The data in this section is null-terminated strings.

enumerator INFO_LINK = 0x000000040

A field in this section holds a section header table index.

Adds special ordering requirements for link editors.

enumerator OS_NONCONFORMING = 0x000000100

This section requires special OS-specific processing to avoid incorrect behavior

enumerator GROUP = 0x000000200

This section is a member of a section group.

enumerator TLS = 0x000000400

This section holds Thread-Local Storage.

enumerator COMPRESSED = 0x000000800
enumerator GNU_RETAIN = 0x000200000
enumerator EXCLUDE = 0x080000000
enumerator _ID_SHIFT_ = 32
enumerator _XCORE_ID_ = 1LLU
enumerator _HEX_ID_ = 3LLU
enumerator _X86_64_ID_ = 2LLU
enumerator _MIPS_ID_ = 4LLU
enumerator _ARM_ID_ = 5LLU
enumerator XCORE_SHF_DP_SECTION = 0x010000000 + (_XCORE_ID_ << _ID_SHIFT_)
enumerator XCORE_SHF_CP_SECTION = 0x020000000 + (_XCORE_ID_ << _ID_SHIFT_)
enumerator X86_64_LARGE = 0x010000000 + (_X86_64_ID_ << _ID_SHIFT_)
enumerator HEX_GPREL = 0x010000000 + (_HEX_ID_ << _ID_SHIFT_)
enumerator MIPS_NODUPES = 0x010000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_NAMES = 0x020000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_LOCAL = 0x040000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_NOSTRIP = 0x080000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_GPREL = 0x010000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_MERGE = 0x020000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_ADDR = 0x040000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_STRING = 0x080000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator ARM_PURECODE = 0x020000000 + (_ARM_ID_ << _ID_SHIFT_)
using segments_t = std::vector<Segment*>
using it_segments = ref_iterator<segments_t&>
using it_const_segments = const_ref_iterator<const segments_t&>

Public Functions

inline Section(const std::string &name, TYPE type = TYPE::PROGBITS)
Section() = default
~Section() override = default
Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other)
inline TYPE type() const
virtual span<const uint8_t> content() const override

Section’s content.

virtual void content(const std::vector<uint8_t> &data) override

Set section content.

void content(std::vector<uint8_t> &&data)
inline uint64_t flags() const

Section flags.

bool has(FLAGS flag) const

True if the section has the given flag

bool has(const Segment &segment) const

True if the section is wrapped by the given Segment

std::vector<FLAGS> flags_list() const

Return section flags as a std::set

inline virtual uint64_t size() const override

section’s size (size in the binary, not the virtual size)

virtual void size(uint64_t size) override

Change the section size.

virtual void offset(uint64_t offset) override
inline virtual uint64_t offset() const override

Offset in the binary.

inline uint64_t file_offset() const

See also

offset

inline uint64_t original_size() const

Original size of the section’s data.

This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data

inline uint64_t alignment() const

Section file alignment.

inline uint64_t information() const

Section information. This meaning of this value depends on the section’s type.

inline uint64_t entry_size() const

This function returns the size of an element in the case of a section that contains an array.

For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.

inline uint32_t link() const

Index to another section.

Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(FLAGS flag)

Add the given ELF_SECTION_FLAGS.

void remove(FLAGS flag)

Remove the given ELF_SECTION_FLAGS.

inline void type(TYPE type)
inline void flags(uint64_t flags)
inline void clear_flags()
inline void file_offset(uint64_t offset)
inline void link(uint32_t link)
inline void information(uint32_t info)
inline void alignment(uint64_t alignment)
inline void entry_size(uint64_t entry_size)
inline it_segments segments()
inline it_const_segments segments() const
inline Section &as_frame()
inline bool is_frame() const
virtual void accept(Visitor &visitor) const override
inline Section &operator+=(FLAGS c)
inline Section &operator-=(FLAGS c)

Public Static Functions

static TYPE type_from(uint32_t value, ARCH arch)
static inline uint32_t to_value(TYPE type)

Public Static Attributes

static constexpr uint32_t MAX_SECTION_SIZE = 2_GB
static constexpr uint64_t FLAG_MASK = (uint64_t(1) << uint8_t(FLAGS::_ID_SHIFT_)) - 1
static constexpr uint64_t TYPE_MASK = (uint64_t(1) << uint8_t(TYPE::_ID_SHIFT_)) - 1

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class Segment : public LIEF::Object

Class which represents the ELF segments.

Public Types

enum class TYPE : uint64_t

Values:

enumerator UNKNOWN = uint64_t(-1)
enumerator PT_NULL = 0

Unused segment.

enumerator LOAD = 1

Loadable segment.

enumerator DYNAMIC = 2

Dynamic linking information.

enumerator INTERP = 3

Interpreter pathname.

enumerator NOTE = 4

Auxiliary information.

enumerator SHLIB = 5

Reserved.

enumerator PHDR = 6

The program header table itself.

enumerator TLS = 7

The thread-local storage template.

enumerator GNU_EH_FRAME = 0x6474e550
enumerator GNU_STACK = 0x6474e551

Indicates stack executability.

enumerator GNU_PROPERTY = 0x6474e553

GNU property

enumerator GNU_RELRO = 0x6474e552

Read-only after relocation.

enumerator ARM_ARCHEXT = 0x70000000 | PT_ARM

Platform architecture compatibility info

enumerator ARM_EXIDX = 0x70000001 | PT_ARM
enumerator ARM_UNWIND = 0x70000001 | PT_ARM
enumerator AARCH64_MEMTAG_MTE = 0x70000002 | PT_AARCH64
enumerator MIPS_REGINFO = 0x70000000 | PT_MIPS

Register usage information.

enumerator MIPS_RTPROC = 0x70000001 | PT_MIPS

Runtime procedure table.

enumerator MIPS_OPTIONS = 0x70000002 | PT_MIPS

Options segment.

enumerator MIPS_ABIFLAGS = 0x70000003 | PT_MIPS

Abiflags segment.

enumerator RISCV_ATTRIBUTES = 0x70000003 | PT_RISCV
enum class FLAGS

Values:

enumerator NONE = 0
enumerator X = 1
enumerator W = 2
enumerator R = 4
using sections_t = std::vector<Section*>
using it_sections = ref_iterator<sections_t&>
using it_const_sections = const_ref_iterator<const sections_t&>

Public Functions

Segment() = default
~Segment() override = default
Segment &operator=(Segment other)
Segment(const Segment &other)
Segment &operator=(Segment&&) = default
Segment(Segment&&) = default
void swap(Segment &other)
inline bool is_load() const
inline bool is_interpreter() const
inline bool is_phdr() const
inline TYPE type() const

The segment’s type (LOAD, DYNAMIC, …)

inline FLAGS flags() const

The flag permissions associated with this segment.

inline uint64_t file_offset() const

The file offset of the data associated with this segment.

inline uint64_t virtual_address() const

The virtual address of the segment.

inline uint64_t physical_address() const

The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.

Usually this value matches virtual_address

inline uint64_t physical_size() const

The file size of the data associated with this segment.

inline uint64_t virtual_size() const

The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.

inline uint64_t alignment() const

The offset alignment of the segment.

span<const uint8_t> content() const

The raw data associated with this segment.

inline bool has(FLAGS flag) const

Check if the current segment has the given flag.

bool has(const Section &section) const

Check if the current segment wraps the given ELF::Section.

bool has(const std::string &section_name) const

Check if the current segment wraps the given section’s name.

void add(FLAGS flag)

Append the given ELF_SEGMENT_FLAGS.

void remove(FLAGS flag)

Remove the given ELF_SEGMENT_FLAGS.

inline void type(TYPE type)
inline void flags(FLAGS flags)
inline void flags(uint32_t flags)
inline void clear_flags()
void file_offset(uint64_t file_offset)
inline void virtual_address(uint64_t virtual_address)
inline void physical_address(uint64_t physical_address)
void physical_size(uint64_t physical_size)
inline void virtual_size(uint64_t virtual_size)
inline void alignment(uint64_t alignment)
void content(std::vector<uint8_t> content)
template<typename T>
T get_content_value(size_t offset) const
template<typename T>
void set_content_value(size_t offset, T value)
size_t get_content_size() const
inline it_sections sections()

Iterator over the sections wrapped by this segment.

inline it_const_sections sections() const
virtual void accept(Visitor &visitor) const override
inline Segment &operator+=(FLAGS flag)
inline Segment &operator-=(FLAGS flag)

Public Static Functions

static TYPE type_from(uint64_t value, ARCH arch)
static inline uint64_t to_value(TYPE type)
static result<Segment> from_raw(const uint8_t *ptr, size_t size)
static inline result<Segment> from_raw(const std::vector<uint8_t> &raw)

Public Static Attributes

static constexpr uint64_t PT_BIT = 33
static constexpr uint64_t PT_MASK = (uint64_t(1) << PT_BIT) - 1
static constexpr uint64_t PT_ARM = uint64_t(1) << PT_BIT
static constexpr uint64_t PT_AARCH64 = uint64_t(2) << PT_BIT
static constexpr uint64_t PT_MIPS = uint64_t(3) << PT_BIT
static constexpr uint64_t PT_RISCV = uint64_t(4) << PT_BIT

Friends

friend std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class DynamicEntry : public LIEF::Object

Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Types

enum class TAG : uint64_t

Values:

enumerator UNKNOWN = uint64_t(-1)
enumerator DT_NULL = 0

Marks end of dynamic array.

enumerator NEEDED = 1

String table offset of needed library.

enumerator PLTRELSZ = 2

Size of relocation entries in PLT.

enumerator PLTGOT = 3

Address associated with linkage table.

enumerator HASH = 4

Address of symbolic hash table.

enumerator STRTAB = 5

Address of dynamic string table.

enumerator SYMTAB = 6

Address of dynamic symbol table.

enumerator RELA = 7

Address of relocation table (Rela entries).

enumerator RELASZ = 8

Size of Rela relocation table.

enumerator RELAENT = 9

Size of a Rela relocation entry.

enumerator STRSZ = 10

Total size of the string table.

enumerator SYMENT = 11

Size of a symbol table entry.

enumerator INIT = 12

Address of initialization function.

enumerator FINI = 13

Address of termination function.

enumerator SONAME = 14

String table offset of a shared objects name.

enumerator RPATH = 15

String table offset of library search path.

enumerator SYMBOLIC = 16

Changes symbol resolution algorithm.

enumerator REL = 17

Address of relocation table (Rel entries).

enumerator RELSZ = 18

Size of Rel relocation table.

enumerator RELENT = 19

Size of a Rel relocation entry.

enumerator PLTREL = 20

Type of relocation entry used for linking.

enumerator DEBUG = 21

Reserved for debugger.

enumerator TEXTREL = 22

Relocations exist for non-writable segments.

enumerator JMPREL = 23

Address of relocations associated with PLT.

enumerator BIND_NOW = 24

Process all relocations before execution.

enumerator INIT_ARRAY = 25

Pointer to array of initialization functions.

enumerator FINI_ARRAY = 26

Pointer to array of termination functions.

enumerator INIT_ARRAYSZ = 27

Size of DT_INIT_ARRAY.

enumerator FINI_ARRAYSZ = 28

Size of DT_FINI_ARRAY.

enumerator RUNPATH = 29

String table offset of lib search path.

enumerator FLAGS = 30

Flags.

enumerator PREINIT_ARRAY = 32

Pointer to array of preinit functions.

enumerator PREINIT_ARRAYSZ = 33

Size of the DT_PREINIT_ARRAY array.

enumerator SYMTAB_SHNDX = 34

Address of SYMTAB_SHNDX section

enumerator RELRSZ = 35

Total size of RELR relative relocations

enumerator RELR = 36

Address of RELR relative relocations

enumerator RELRENT = 37

Size of one RELR relative relocaction

enumerator GNU_HASH = 0x6FFFFEF5

Reference to the GNU hash table.

enumerator RELACOUNT = 0x6FFFFFF9

ELF32_Rela count.

enumerator RELCOUNT = 0x6FFFFFFA

ELF32_Rel count.

enumerator FLAGS_1 = 0x6FFFFFFB

Flags_1.

enumerator VERSYM = 0x6FFFFFF0

The address of .gnu.version section.

enumerator VERDEF = 0x6FFFFFFC

The address of the version definition table.

enumerator VERDEFNUM = 0x6FFFFFFD

The number of entries in DT_VERDEF.

enumerator VERNEED = 0x6FFFFFFE

The address of the version Dependency table.

enumerator VERNEEDNUM = 0x6FFFFFFF

The number of entries in DT_VERNEED.

enumerator ANDROID_REL_OFFSET = 0x6000000D

The offset of packed relocation data (older version < M) (Android specific).

enumerator ANDROID_REL_SIZE = 0x6000000E

The size of packed relocation data in bytes (older version < M) (Android specific).

enumerator ANDROID_REL = 0x6000000F

The offset of packed relocation data (Android specific).

enumerator ANDROID_RELSZ = 0x60000010

The size of packed relocation data in bytes (Android specific).

enumerator ANDROID_RELA = 0x60000011

The offset of packed relocation data (Android specific).

enumerator ANDROID_RELASZ = 0x60000012

The size of packed relocation data in bytes (Android specific).

enumerator ANDROID_RELR = 0x6FFFE000

The offset of new relr relocation data (Android specific).

enumerator ANDROID_RELRSZ = 0x6FFFE001

The size of nre relr relocation data in bytes (Android specific).

enumerator ANDROID_RELRENT = 0x6FFFE003

The size of a new relr relocation entry (Android specific).

enumerator ANDROID_RELRCOUNT = 0x6FFFE005

Specifies the relative count of new relr relocation entries (Android specific).

enumerator MIPS_RLD_VERSION = MIPS_DISC + 0x70000001

32 bit version number for runtime linker interface.

enumerator MIPS_TIME_STAMP = MIPS_DISC + 0x70000002

Time stamp.

enumerator MIPS_ICHECKSUM = MIPS_DISC + 0x70000003

Checksum of external strings and common sizes.

enumerator MIPS_IVERSION = MIPS_DISC + 0x70000004

Index of version string in string table.

enumerator MIPS_FLAGS = MIPS_DISC + 0x70000005

32 bits of flags.

enumerator MIPS_BASE_ADDRESS = MIPS_DISC + 0x70000006

Base address of the segment.

enumerator MIPS_MSYM = MIPS_DISC + 0x70000007

Address of .msym section.

enumerator MIPS_CONFLICT = MIPS_DISC + 0x70000008

Address of .conflict section.

enumerator MIPS_LIBLIST = MIPS_DISC + 0x70000009

Address of .liblist section.

enumerator MIPS_LOCAL_GOTNO = MIPS_DISC + 0x7000000a

Number of local global offset table entries.

enumerator MIPS_CONFLICTNO = MIPS_DISC + 0x7000000b

Number of entries in the .conflict section.

enumerator MIPS_LIBLISTNO = MIPS_DISC + 0x70000010

Number of entries in the .liblist section.

enumerator MIPS_SYMTABNO = MIPS_DISC + 0x70000011

Number of entries in the .dynsym section.

enumerator MIPS_UNREFEXTNO = MIPS_DISC + 0x70000012

Index of first external dynamic symbol not referenced locally.

enumerator MIPS_GOTSYM = MIPS_DISC + 0x70000013

Index of first dynamic symbol in global offset table.

enumerator MIPS_HIPAGENO = MIPS_DISC + 0x70000014

Number of page table entries in global offset table.

enumerator MIPS_RLD_MAP = MIPS_DISC + 0x70000016

Address of run time loader map, used for debugging.

enumerator MIPS_DELTA_CLASS = MIPS_DISC + 0x70000017

Delta C++ class definition.

enumerator MIPS_DELTA_CLASS_NO = MIPS_DISC + 0x70000018

Number of entries in DT_MIPS_DELTA_CLASS.

enumerator MIPS_DELTA_INSTANCE = MIPS_DISC + 0x70000019

Delta C++ class instances.

enumerator MIPS_DELTA_INSTANCE_NO = MIPS_DISC + 0x7000001A

Number of entries in DT_MIPS_DELTA_INSTANCE.

enumerator MIPS_DELTA_RELOC = MIPS_DISC + 0x7000001B

Delta relocations.

enumerator MIPS_DELTA_RELOC_NO = MIPS_DISC + 0x7000001C

Number of entries in DT_MIPS_DELTA_RELOC.

enumerator MIPS_DELTA_SYM = MIPS_DISC + 0x7000001D

Delta symbols that Delta relocations refer to.

enumerator MIPS_DELTA_SYM_NO = MIPS_DISC + 0x7000001E

Number of entries in DT_MIPS_DELTA_SYM.

enumerator MIPS_DELTA_CLASSSYM = MIPS_DISC + 0x70000020

Delta symbols that hold class declarations.

enumerator MIPS_DELTA_CLASSSYM_NO = MIPS_DISC + 0x70000021

Number of entries in DT_MIPS_DELTA_CLASSSYM.

enumerator MIPS_CXX_FLAGS = MIPS_DISC + 0x70000022

Flags indicating information about C++ flavor.

enumerator MIPS_PIXIE_INIT = MIPS_DISC + 0x70000023

Pixie information.

enumerator MIPS_SYMBOL_LIB = MIPS_DISC + 0x70000024

Address of .MIPS.symlib

enumerator MIPS_LOCALPAGE_GOTIDX = MIPS_DISC + 0x70000025

The GOT index of the first PTE for a segment

enumerator MIPS_LOCAL_GOTIDX = MIPS_DISC + 0x70000026

The GOT index of the first PTE for a local symbol

enumerator MIPS_HIDDEN_GOTIDX = MIPS_DISC + 0x70000027

The GOT index of the first PTE for a hidden symbol

enumerator MIPS_PROTECTED_GOTIDX = MIPS_DISC + 0x70000028

The GOT index of the first PTE for a protected symbol

enumerator MIPS_OPTIONS = MIPS_DISC + 0x70000029

Address of .MIPS.options.

enumerator MIPS_INTERFACE = MIPS_DISC + 0x7000002A

Address of .interface.

enumerator MIPS_DYNSTR_ALIGN = MIPS_DISC + 0x7000002B

Unknown.

enumerator MIPS_INTERFACE_SIZE = MIPS_DISC + 0x7000002C

Size of the .interface section.

enumerator MIPS_RLD_TEXT_RESOLVE_ADDR = MIPS_DISC + 0x7000002D

Size of rld_text_resolve function stored in the GOT.

enumerator MIPS_PERF_SUFFIX = MIPS_DISC + 0x7000002E

Default suffix of DSO to be added by rld on dlopen() calls.

enumerator MIPS_COMPACT_SIZE = MIPS_DISC + 0x7000002F

Size of compact relocation section (O32).

enumerator MIPS_GP_VALUE = MIPS_DISC + 0x70000030

GP value for auxiliary GOTs.

enumerator MIPS_AUX_DYNAMIC = MIPS_DISC + 0x70000031

Address of auxiliary .dynamic.

enumerator MIPS_PLTGOT = MIPS_DISC + 0x70000032

Address of the base of the PLTGOT.

enumerator MIPS_RWPLT = MIPS_DISC + 0x70000034
enumerator MIPS_RLD_MAP_REL = MIPS_DISC + 0x70000035
enumerator MIPS_XHASH = MIPS_DISC + 0x70000036
enumerator AARCH64_BTI_PLT = AARCH64_DISC + 0x70000001
enumerator AARCH64_PAC_PLT = AARCH64_DISC + 0x70000003
enumerator AARCH64_VARIANT_PCS = AARCH64_DISC + 0x70000005
enumerator AARCH64_MEMTAG_MODE = AARCH64_DISC + 0x70000009
enumerator AARCH64_MEMTAG_HEAP = AARCH64_DISC + 0x7000000b
enumerator AARCH64_MEMTAG_STACK = AARCH64_DISC + 0x7000000c
enumerator AARCH64_MEMTAG_GLOBALS = AARCH64_DISC + 0x7000000d
enumerator AARCH64_MEMTAG_GLOBALSSZ = AARCH64_DISC + 0x7000000f
enumerator HEXAGON_SYMSZ = HEXAGON_DISC + 0x70000000
enumerator HEXAGON_VER = HEXAGON_DISC + 0x70000001
enumerator HEXAGON_PLT = HEXAGON_DISC + 0x70000002
enumerator PPC_GOT = PPC_DISC + 0x70000000
enumerator PPC_OPT = PPC_DISC + 0x70000001
enumerator PPC64_GLINK = PPC64_DISC + 0x70000000
enumerator PPC64_OPT = PPC64_DISC + 0x70000003
enumerator RISCV_VARIANT_CC = RISCV_DISC + 0x70000003

Public Functions

DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&) = default
DynamicEntry(const DynamicEntry&) = default
~DynamicEntry() override = default
inline virtual std::unique_ptr<DynamicEntry> clone() const
inline TAG tag() const

Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …

inline uint64_t value() const

Return the entry’s value.

The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …

inline void tag(TAG tag)
inline void value(uint64_t value)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const

Public Static Functions

static TAG from_value(uint64_t value, ARCH arch)
static uint64_t to_value(TAG tag)

Public Static Attributes

static constexpr uint64_t MIPS_DISC = 0x100000000
static constexpr uint64_t AARCH64_DISC = 0x200000000
static constexpr uint64_t HEXAGON_DISC = 0x300000000
static constexpr uint64_t PPC_DISC = 0x400000000
static constexpr uint64_t PPC64_DISC = 0x500000000
static constexpr uint64_t RISCV_DISC = 0x600000000

Friends

inline friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Class which represents a DT_NEEDED entry in the dynamic table.

This kind of entry is usually used to create library dependency.

Public Functions

inline DynamicEntryLibrary()
inline DynamicEntryLibrary(std::string name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&) = default
DynamicEntryLibrary(const DynamicEntryLibrary&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &name() const

Return the library associated with this entry (e.g. libc.so.6)

inline void name(std::string name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Shared Object

class DynamicSharedObject : public LIEF::ELF::DynamicEntry

Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used to name the original library.

This entry is not present for executable.

Public Functions

inline DynamicSharedObject()
inline DynamicSharedObject(std::string name)
DynamicSharedObject &operator=(const DynamicSharedObject&) = default
DynamicSharedObject(const DynamicSharedObject&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &name() const

The actual name (e.g. libMyLib.so)

inline void name(std::string name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicSharedObject() override = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Entry Run Path

class DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).

Public Functions

inline DynamicEntryRunPath()
inline DynamicEntryRunPath(std::string runpath)

Constructor from (run)path.

inline DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&) = default
DynamicEntryRunPath(const DynamicEntryRunPath&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &runpath() const

Runpath raw value.

inline void runpath(std::string runpath)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

inline DynamicEntryRunPath &operator+=(std::string path)
inline DynamicEntryRunPath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryRunPath() = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry RPath

class DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)

Public Functions

inline DynamicEntryRpath()
inline DynamicEntryRpath(std::string rpath)
inline DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&) = default
DynamicEntryRpath(const DynamicEntryRpath&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &rpath() const

The actual rpath as a string.

inline void rpath(const std::string &name)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

inline DynamicEntryRpath &operator+=(std::string path)
inline DynamicEntryRpath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryRpath() = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry Array

class DynamicEntryArray : public LIEF::ELF::DynamicEntry

Class that represent an Array in the dynamic table. This entry is associated with constructors:

  • DT_PREINIT_ARRAY

  • DT_INIT_ARRAY

  • DT_FINI_ARRAY

The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray() = delete
inline DynamicEntryArray(DynamicEntry::TAG tag, array_t array)
DynamicEntryArray &operator=(const DynamicEntryArray&) = default
DynamicEntryArray(const DynamicEntryArray&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline array_t &array()

Return the array values (list of pointers)

inline const array_t &array() const
inline void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t function)

Insert the given function at pos

inline DynamicEntryArray &append(uint64_t function)

Append the given function.

DynamicEntryArray &remove(uint64_t function)

Remove the given function.

inline size_t size() const

Number of function registred in this array.

inline DynamicEntryArray &operator+=(uint64_t value)
inline DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryArray() override = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Entry Flags

class DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

enum class FLAG : uint64_t

Values:

enumerator ORIGIN = 0x00000001

The object may reference $ORIGIN.

enumerator SYMBOLIC = 0x00000002

Search the shared lib before searching the exe.

enumerator TEXTREL = 0x00000004

Relocations may modify a non-writable segment.

enumerator BIND_NOW = 0x00000008

Process all relocations on load.

enumerator STATIC_TLS = 0x00000010

Reject attempts to load dynamically.

enumerator NOW = BASE + 0x000000001

Set RTLD_NOW for this object.

enumerator GLOBAL = BASE + 0x000000002

Set RTLD_GLOBAL for this object.

enumerator GROUP = BASE + 0x000000004

Set RTLD_GROUP for this object.

enumerator NODELETE = BASE + 0x000000008

Set RTLD_NODELETE for this object.

enumerator LOADFLTR = BASE + 0x000000010

Trigger filtee loading at runtime.

enumerator INITFIRST = BASE + 0x000000020

Set RTLD_INITFIRST for this object.

enumerator NOOPEN = BASE + 0x000000040

Set RTLD_NOOPEN for this object.

enumerator HANDLE_ORIGIN = BASE + 0x000000080

$ORIGIN must be handled.

enumerator DIRECT = BASE + 0x000000100

Direct binding enabled.

enumerator TRANS = BASE + 0x000000200
enumerator INTERPOSE = BASE + 0x000000400

Object is used to interpose.

enumerator NODEFLIB = BASE + 0x000000800

Ignore default lib search path.

enumerator NODUMP = BASE + 0x000001000

Object can’t be dldump’ed.

enumerator CONFALT = BASE + 0x000002000

Configuration alternative created.

enumerator ENDFILTEE = BASE + 0x000004000

Filtee terminates filters search.

enumerator DISPRELDNE = BASE + 0x000008000

Disp reloc applied at build time.

enumerator DISPRELPND = BASE + 0x000010000

Disp reloc applied at run-time.

enumerator NODIRECT = BASE + 0x000020000

Object has no-direct binding.

enumerator IGNMULDEF = BASE + 0x000040000
enumerator NOKSYMS = BASE + 0x000080000
enumerator NOHDR = BASE + 0x000100000
enumerator EDITED = BASE + 0x000200000

Object is modified after built.

enumerator NORELOC = BASE + 0x000400000
enumerator SYMINTPOSE = BASE + 0x000800000

Object has individual interposers.

enumerator GLOBAUDIT = BASE + 0x001000000

Global auditing required.

enumerator SINGLETON = BASE + 0x002000000

Singleton symbols are used.

enumerator PIE = BASE + 0x008000000

Singleton symbols are used.

enumerator KMOD = BASE + 0x010000000
enumerator WEAKFILTER = BASE + 0x020000000
enumerator NOCOMMON = BASE + 0x040000000
using flags_list_t = std::vector<FLAG>

Public Functions

DynamicEntryFlags() = delete
DynamicEntryFlags &operator=(const DynamicEntryFlags&) = default
DynamicEntryFlags(const DynamicEntryFlags&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
bool has(FLAG f) const

If the current entry has the given FLAG.

flags_list_t flags() const

Return flags as a list of integers.

void add(FLAG f)

Add the given FLAG.

void remove(FLAG f)

Remove the given FLAG.

inline DynamicEntryFlags &operator+=(FLAG f)
inline DynamicEntryFlags &operator-=(FLAG f)
virtual void accept(Visitor &visitor) const override
~DynamicEntryFlags() = default
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline DynamicEntryFlags create_dt_flag(uint64_t value)
static inline DynamicEntryFlags create_dt_flag_1(uint64_t value)
static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr uint64_t BASE = 0x100000000

Relocations

class Relocation : public LIEF::Relocation

Class that represents an ELF relocation.

Public Types

enum class PURPOSE

The purpose of a relocation defines.

Values:

enumerator NONE = 0
enumerator PLTGOT = 1

The relocation is associated with the PLT/GOT resolution.

enumerator DYNAMIC = 2

The relocation is used for regulard data/code relocation.

enumerator OBJECT = 3

The relocation is used in an object file.

enum class ENCODING

Values:

enumerator UNKNOWN = 0
enumerator REL

The relocation is using the regular Elf_Rel structure.

enumerator RELA

The relocation is using the regular Elf_Rela structure.

enumerator RELR

The relocation is using the relative relocation format.

enumerator ANDROID_SLEB

The relocation is using the packed Android-SLEB128 format.

enum class TYPE : uint32_t

The different types of the relocation.

Values:

enumerator UNKNOWN = uint32_t(-1)
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC

Public Functions

Relocation(uint64_t address, TYPE type, ENCODING enc)
Relocation() = default
inline Relocation(ARCH arch)
~Relocation() override = default
Relocation &operator=(Relocation other)
Relocation(const Relocation &other)
void swap(Relocation &other)
inline int64_t addend() const

Additional value that can be involved in the relocation processing.

inline TYPE type() const

Type of the relocation.

inline bool is_rela() const

Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)

inline bool is_rel() const

Check if the relocation uses the implicit addend (i.e. not present in the ELF structure)

inline bool is_relatively_encoded() const

True if the relocation is using the relative encoding.

inline bool is_android_packed() const

True if the relocation is using the Android packed relocation format.

inline uint32_t info() const

Relocation info which contains, for instance, the symbol index.

inline uint64_t r_info(Header::CLASS clazz) const

(re)Compute the raw r_info attribute based on the given ELF class

inline ARCH architecture() const

Target architecture for this relocation.

inline PURPOSE purpose() const
inline ENCODING encoding() const

The encoding of the relocation.

inline bool is_relative() const

True if the semantic of the relocation is <ARCH>_RELATIVE

virtual size_t size() const override

Return the size (in bits) of the value associated with this relocation Return -1 if the size can’t be determined.

inline bool has_symbol() const

True if the current relocation is associated with a symbol.

inline Symbol *symbol()

Symbol associated with the relocation (or a nullptr)

inline const Symbol *symbol() const
inline bool has_section() const

True if the relocation has an associated section.

inline Section *section()

The section in which the relocation is applied (or a nullptr)

inline const Section *section() const
inline Section *symbol_table()

The associated symbol table (or a nullptr)

inline const Section *symbol_table() const
inline void addend(int64_t addend)
inline void type(TYPE type)
inline void purpose(PURPOSE purpose)
inline void info(uint32_t v)
inline void symbol(Symbol *symbol)
inline void section(Section *section)
inline void symbol_table(Section *section)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static TYPE type_from(uint32_t value, ARCH arch)
static inline uint32_t to_value(TYPE type)

Public Static Attributes

static constexpr uint64_t R_BIT = 27
static constexpr uint64_t R_MASK = (uint64_t(1) << R_BIT) - 1
static constexpr uint64_t R_X64 = uint64_t(1) << R_BIT
static constexpr uint64_t R_AARCH64 = uint64_t(2) << R_BIT
static constexpr uint64_t R_ARM = uint64_t(3) << R_BIT
static constexpr uint64_t R_HEXAGON = uint64_t(4) << R_BIT
static constexpr uint64_t R_X86 = uint64_t(5) << R_BIT
static constexpr uint64_t R_LARCH = uint64_t(6) << R_BIT
static constexpr uint64_t R_MIPS = uint64_t(7) << R_BIT
static constexpr uint64_t R_PPC = uint64_t(8) << R_BIT
static constexpr uint64_t R_PPC64 = uint64_t(9) << R_BIT
static constexpr uint64_t R_SPARC = uint64_t(10) << R_BIT
static constexpr uint64_t R_SYSZ = uint64_t(11) << R_BIT

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &entry)

Symbol

class Symbol : public LIEF::Symbol

Class which represents an ELF symbol.

Public Types

enum class BINDING

Values:

enumerator LOCAL = 0

Local symbol.

enumerator GLOBAL = 1

Global symbols.

enumerator WEAK = 2

Weak symbol.

enumerator GNU_UNIQUE = 10

Unique symbol.

enum class TYPE

Type of the symbol. This enum matches the STT_xxx values of the ELF specs.

Values:

enumerator NOTYPE = 0

Symbol’s type is not specified.

enumerator OBJECT = 1

Symbol is a data object (variable, array, etc.)

enumerator FUNC = 2

Symbol is executable code (function, etc.)

enumerator SECTION = 3

Symbol refers to a section.

enumerator FILE = 4

Local, absolute symbol that refers to a file.

enumerator COMMON = 5

An uninitialized common block.

enumerator TLS = 6

Thread local data object.

enumerator GNU_IFUNC = 10

GNU indirect function.

enum class VISIBILITY

Visibility of the symbol. This enum matches the STV_xxx values of the official ELF specs.

Values:

enumerator DEFAULT = 0

Visibility is specified by binding type.

enumerator INTERNAL = 1

Defined by processor supplements.

enumerator HIDDEN = 2

Not visible to other components.

enumerator PROTECTED = 3

Visible in other components but not preemptable.

enum SECTION_INDEX

Special section indices.

Values:

enumerator UNDEF = 0

Undefined section.

enumerator ABS = 0xfff1

Associated symbol is absolute.

enumerator COMMON = 0xfff2

Associated symbol is common.

Public Functions

inline Symbol(std::string name)
Symbol() = default
~Symbol() override = default
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
inline TYPE type() const

The symbol’s type provides a general classification for the associated entity.

inline BINDING binding() const

The symbol’s binding determines the linkage visibility and behavior.

uint8_t information() const

This member specifies the symbol’s type and binding attributes.

inline uint8_t other() const

Alias for visibility()

inline uint16_t section_idx() const

ELF::Section index associated with the symbol.

inline VISIBILITY visibility() const

Symbol visibility.

inline Section *section()

Section associated with the symbol or a nullptr if it does not exist.

inline const Section *section() const
inline virtual uint64_t value() const override

This member has slightly different interpretations:

  • In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON

  • In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.

  • In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.

inline virtual uint64_t size() const override

Symbol size.

Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.

inline uint16_t shndx() const

inline bool has_version() const

Check if this symbols has a symbol version .

inline SymbolVersion *symbol_version()

Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.

inline const SymbolVersion *symbol_version() const
inline bool is_local() const
inline bool is_global() const
inline bool is_weak() const
std::string demangled_name() const

Symbol’s unmangled name. If not available, it returns an empty string.

inline void type(TYPE type)
inline void binding(BINDING binding)
inline void other(uint8_t other)
inline void visibility(VISIBILITY visibility)
void information(uint8_t info)
inline void shndx(uint16_t idx)
inline virtual void value(uint64_t value) override
inline virtual void size(uint64_t size) override
bool is_exported() const

Check if the current symbol is exported.

void set_exported(bool flag = true)

Set whether or not the symbol is exported.

bool is_imported() const

Check if the current symbol is imported.

void set_imported(bool flag = true)

Set whether or not the symbol is imported.

inline bool is_static() const

True if the symbol is a static one.

inline bool is_function() const

True if the symbol represent a function.

inline bool is_variable() const

True if the symbol represent a variable.

virtual void accept(Visitor &visitor) const override

Public Static Functions

static inline BINDING binding_from(uint32_t value, ARCH)
static inline TYPE type_from(uint32_t value, ARCH)
static inline uint8_t to_value(BINDING binding)
static inline uint8_t to_value(TYPE type)

Friends

friend std::ostream &operator<<(std::ostream &os, const Symbol &entry)

Symbol Version

class SymbolVersion : public LIEF::Object

Class which represents an entry defined in the DT_VERSYM dynamic entry.

Public Functions

inline SymbolVersion(uint16_t value)
SymbolVersion() = default
~SymbolVersion() override = default
SymbolVersion &operator=(const SymbolVersion&) = default
SymbolVersion(const SymbolVersion&) = default
inline uint16_t value() const

Value associated with the symbol.

If the given SymbolVersion hasn’t Auxiliary version:

  • 0 means Local

  • 1 means Global

inline bool has_auxiliary_version() const

Whether the current SymbolVersion has an auxiliary one.

inline SymbolVersionAux *symbol_version_auxiliary()

SymbolVersionAux associated with the current Version if any, or a nullptr.

inline const SymbolVersionAux *symbol_version_auxiliary() const
void symbol_version_auxiliary(SymbolVersionAuxRequirement &svauxr)

Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.

On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement

inline void value(uint16_t v)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static inline SymbolVersion local()

Generate a local SymbolVersion.

static inline SymbolVersion global()

Generate a global SymbolVersion.

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)

Symbol Version Auxiliary

class SymbolVersionAux : public LIEF::Object

Class which represents an Auxiliary Symbol version.

Subclassed by LIEF::ELF::SymbolVersionAuxRequirement

Public Functions

inline SymbolVersionAux(std::string name)
SymbolVersionAux() = default
~SymbolVersionAux() override = default
SymbolVersionAux &operator=(const SymbolVersionAux&) = default
SymbolVersionAux(const SymbolVersionAux&) = default
inline const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

inline void name(std::string name)
virtual void accept(Visitor &visitor) const override

Friends

inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &aux)

Symbol Version Definition

class SymbolVersionDefinition : public LIEF::Object

Class which represents an entry defined in DT_VERDEF or .gnu.version_d

Public Types

using version_aux_t = std::vector<std::unique_ptr<SymbolVersionAux>>
using it_version_aux = ref_iterator<version_aux_t&, SymbolVersionAux*>
using it_const_version_aux = const_ref_iterator<const version_aux_t&, const SymbolVersionAux*>

Public Functions

SymbolVersionDefinition() = default
SymbolVersionDefinition(const details::Elf64_Verdef &header)
SymbolVersionDefinition(const details::Elf32_Verdef &header)
~SymbolVersionDefinition() override
SymbolVersionDefinition &operator=(SymbolVersionDefinition other)
SymbolVersionDefinition(const SymbolVersionDefinition &other)
void swap(SymbolVersionDefinition &other)
inline uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

inline uint16_t flags() const

Version information.

inline uint16_t ndx() const

Version index.

Numeric value used as an index in the LIEF::ELF::SymbolVersion table

inline uint32_t hash() const

Hash value of the symbol’s name (using ELF hash function)

inline it_version_aux symbols_aux()

SymbolVersionAux entries.

inline it_const_version_aux symbols_aux() const
inline void version(uint16_t version)
inline void flags(uint16_t flags)
inline void hash(uint32_t hash)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionDefinition &sym)

Symbol Version Requirement

class SymbolVersionRequirement : public LIEF::Object

Class which represents an entry in the DT_VERNEED or .gnu.version_r table.

Public Types

using aux_requirement_t = std::vector<std::unique_ptr<SymbolVersionAuxRequirement>>
using it_aux_requirement = ref_iterator<aux_requirement_t&, SymbolVersionAuxRequirement*>
using it_const_aux_requirement = const_ref_iterator<const aux_requirement_t&, const SymbolVersionAuxRequirement*>

Public Functions

SymbolVersionRequirement() = default
SymbolVersionRequirement(const details::Elf64_Verneed &header)
SymbolVersionRequirement(const details::Elf32_Verneed &header)
~SymbolVersionRequirement() override = default
SymbolVersionRequirement &operator=(SymbolVersionRequirement other)
SymbolVersionRequirement(const SymbolVersionRequirement &other)
void swap(SymbolVersionRequirement &other)
inline uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

inline size_t cnt() const

Number of auxiliary entries.

inline it_aux_requirement auxiliary_symbols()

Auxiliary entries as an iterator over SymbolVersionAuxRequirement.

inline it_const_aux_requirement auxiliary_symbols() const
inline const std::string &name() const

Return the library name associated with this requirement (e.g. libc.so.6)

inline void version(uint16_t version)
inline void name(const std::string &name)
SymbolVersionAuxRequirement &add_aux_requirement(const SymbolVersionAuxRequirement &aux_requirement)

Add a version auxiliary requirement to the existing list.

virtual void accept(Visitor &visitor) const override

Friends

inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionRequirement &symr)

Symbol Version Auxiliary Requirement

class SymbolVersionAuxRequirement : public LIEF::ELF::SymbolVersionAux

Public Functions

SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header)
SymbolVersionAuxRequirement(const details::Elf32_Vernaux &header)
SymbolVersionAuxRequirement() = default
SymbolVersionAuxRequirement &operator=(const SymbolVersionAuxRequirement&) = default
SymbolVersionAuxRequirement(const SymbolVersionAuxRequirement&) = default
~SymbolVersionAuxRequirement() override = default
inline uint32_t hash() const

Hash value of the dependency name (use ELF hashing function)

inline uint16_t flags() const

Bitmask of flags.

inline uint16_t other() const

It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.

inline void hash(uint32_t hash)
inline void flags(uint16_t flags)
inline void other(uint16_t other)
virtual void accept(Visitor &visitor) const override
inline const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

inline void name(std::string name)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAuxRequirement &aux)

GNU Hash table

class GnuHash : public LIEF::Object

Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.

Public Functions

GnuHash() = default
GnuHash(uint32_t symbol_idx, uint32_t shift2, std::vector<uint64_t> bloom_filters, std::vector<uint32_t> buckets, std::vector<uint32_t> hash_values = {})
GnuHash &operator=(const GnuHash &copy) = default
GnuHash(const GnuHash &copy) = default
GnuHash(GnuHash&&) = default
GnuHash &operator=(GnuHash&&) = default
~GnuHash() override = default
inline uint32_t nb_buckets() const

Return the number of buckets.

inline uint32_t symbol_index() const

Index of the first symbol in the dynamic symbols table which accessible with the hash table.

inline uint32_t shift2() const

Shift count used in the bloom filter.

inline uint32_t maskwords() const

Number of bloom filters used. It must be a power of 2.

inline const std::vector<uint64_t> &bloom_filters() const

Bloom filters.

inline const std::vector<uint32_t> &buckets() const

Hash buckets.

inline const std::vector<uint32_t> &hash_values() const

Hash values.

bool check_bloom_filter(uint32_t hash) const

Check if the given hash passes the bloom filter.

inline bool check_bucket(uint32_t hash) const

Check if the given hash passes the bucket filter.

bool check(const std::string &symbol_name) const

Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.

bool check(uint32_t hash) const

Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash)

SYSV Hash table

class SysvHash : public LIEF::Object

Class which represents the SYSV hash for the symbols resolution.

References:

Public Functions

SysvHash() = default
SysvHash &operator=(const SysvHash &copy) = default
SysvHash(const SysvHash &copy) = default
SysvHash &operator=(SysvHash&&) = default
SysvHash(SysvHash&&) = default
~SysvHash() override = default
inline uint32_t nbucket() const

Return the number of buckets used.

inline uint32_t nchain() const

Return the number of chain used.

inline const std::vector<uint32_t> &buckets() const

Buckets values.

inline const std::vector<uint32_t> &chains() const

Chains values.

inline void nchain(uint32_t nb)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash)

Note

class Note : public LIEF::Object

Class which represents an ELF note. This class can be instantiated using the static Note::create functions.

Subclassed by LIEF::ELF::AndroidIdent, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi, LIEF::ELF::NoteGnuProperty

Public Types

enum class TYPE

LIEF representation of the ELF NT_ values.

Values:

enumerator UNKNOWN = 0
enumerator GNU_ABI_TAG

Match NT_GNU_ABI_TAG: Operating system (OS) ABI information.

See: NoteAbi

enumerator GNU_HWCAP

Match NT_HWCAP: Synthetic hardware capabilities information.

enumerator GNU_BUILD_ID

Match NT_GNU_BUILD_ID: Unique build ID as generated by the GNU ld.

enumerator GNU_GOLD_VERSION

Match NT_GNU_GOLD_VERSION: The version of gold used to link.

enumerator GNU_PROPERTY_TYPE_0

Match NT_GNU_PROPERTY_TYPE_0: Program property note, as described in “Linux Extensions to the gABI”.

enumerator GNU_BUILD_ATTRIBUTE_OPEN
enumerator GNU_BUILD_ATTRIBUTE_FUNC
enumerator CRASHPAD

Crashpad note used by the Chromium project.

enumerator CORE_PRSTATUS

Coredump that wraps the elf_prstatus structure.

enumerator CORE_FPREGSET
enumerator CORE_PRPSINFO

Coredump that wraps the elf_prpsinfo structure.

See: CorePrPsInfo

enumerator CORE_TASKSTRUCT
enumerator CORE_AUXV

Coredump that contains a copy of all the auxiliary vectors (auxv)

See: CoreAuxv

enumerator CORE_PSTATUS
enumerator CORE_FPREGS

Coredump that wraps the fpregset structure.

enumerator CORE_PSINFO

Coredump that wraps the psinfo structure.

enumerator CORE_LWPSTATUS
enumerator CORE_LWPSINFO
enumerator CORE_WIN32PSTATUS
enumerator CORE_FILE
enumerator CORE_PRXFPREG
enumerator CORE_SIGINFO
enumerator CORE_ARM_VFP
enumerator CORE_ARM_TLS
enumerator CORE_ARM_HW_BREAK
enumerator CORE_ARM_HW_WATCH
enumerator CORE_ARM_SYSTEM_CALL
enumerator CORE_ARM_SVE
enumerator CORE_ARM_PAC_MASK
enumerator CORE_ARM_PACA_KEYS
enumerator CORE_ARM_PACG_KEYS
enumerator CORE_TAGGED_ADDR_CTRL
enumerator CORE_PAC_ENABLED_KEYS
enumerator CORE_X86_TLS
enumerator CORE_X86_IOPERM
enumerator CORE_X86_XSTATE
enumerator CORE_X86_CET
enumerator ANDROID_IDENT

Note that is specific to Android and that describes information such as the NDK version or the SDK build number.

See AndroidIdent

enumerator ANDROID_MEMTAG
enumerator ANDROID_KUSER
enumerator GO_BUILDID

Note specific to Go binaries.

enumerator STAPSDT

Note for SystemTap probes.

using description_t = std::vector<uint8_t>

Container used to handle the description data.

Public Functions

Note &operator=(const Note &copy) = default
Note(const Note &copy) = default
~Note() override = default
inline virtual std::unique_ptr<Note> clone() const

Clone the current note and keep its polymorphic type.

inline const std::string &name() const

Return the name of the note (also known as ‘owner’ )

inline TYPE type() const

Return the type of the note. This type does not match the NT_ type value. For accessing the original NT_ value, check original_type()

inline uint32_t original_type() const

The original NT_xxx integer value. The meaning of this value likely depends on the owner of the note.

inline span<const uint8_t> description() const

Return the description associated with the note.

inline span<uint8_t> description()
inline void name(std::string name)
inline void description(description_t description)

Change the description of the note.

uint64_t size() const

Size of the raw note which includes padding.

virtual void dump(std::ostream &os) const
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<TYPE> convert_type(Header::FILE_TYPE ftype, uint32_t type, const std::string &name)

Convert the raw integer note type into a TYPE according to the owner.

static result<const char*> type_to_section(TYPE type)

Try to determine the ELF section name associated with the TYPE provided in parameter.

static inline result<const char*> note_to_section(const Note &note)
static result<const char*> type_owner(TYPE type)

Try to determine the owner’s name of the TYPE provided in parameter.

static std::unique_ptr<Note> create(const std::string &name, uint32_t type, description_t description, Header::FILE_TYPE ftype = Header::FILE_TYPE::NONE, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)

Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

static std::unique_ptr<Note> create(const std::string &name, TYPE type, description_t description, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)

Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

static std::unique_ptr<Note> create(BinaryStream &stream, Header::FILE_TYPE ftype = Header::FILE_TYPE::NONE, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)

Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Note &note)

Core PrPsInfo

class CorePrPsInfo : public LIEF::ELF::Note

Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process.

Public Functions

inline CorePrPsInfo(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

result<info_t> info() const

Return a elf_prpsinfo-like structure or an error if it can’t be parsed.

void info(const info_t &info)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CorePrPsInfo() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo &note)
struct info_t

Public Functions

inline std::string filename_stripped() const

Initial part of the arguments.

Return the filename without the ending \x00

inline std::string args_stripped() const

Return the args without the ending \x00

Public Members

uint8_t state = 0
char sname = ' '

Numeric process state.

bool zombie = false

printable character representing state

uint8_t nice = 0

Whether the process is a zombie.

uint64_t flag = 0

Nice value.

uint32_t uid = 0

Process flag.

uint32_t gid = 0

Process user ID.

uint32_t pid = 0

Process group ID.

uint32_t ppid = 0

Process ID.

uint32_t pgrp = 0

Process parent ID.

uint32_t sid = 0

Process group.

std::string filename

Process session id.

std::string args

Filename of the executable.


Core File

class CoreFile : public LIEF::ELF::Note

Class representing a core NT_FILE which describes the mapped files of the process.

Public Types

using files_t = std::vector<entry_t>
using iterator = files_t::iterator
using const_iterator = files_t::const_iterator

Public Functions

CoreFile(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, Note::description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

inline uint64_t count() const

Number of coredump file entries.

inline const files_t &files() const

Coredump file entries.

inline iterator begin()
inline iterator end()
inline const_iterator begin() const
inline const_iterator end() const
void files(const files_t &file)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CoreFile() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CoreFile &note)
struct entry_t

Core file entry.

Public Members

uint64_t start = 0
uint64_t end = 0

Start address of mapped file.

End address of mapped file

uint64_t file_ofs = 0

Offset (in core) of mapped file.

std::string path

Path of mapped file.

Friends

friend std::ostream &operator<<(std::ostream &os, const entry_t &entry)

Core PrStatus

class CorePrStatus : public LIEF::ELF::Note

Class representing core PrPsInfo object.

Public Functions

inline CorePrStatus(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

pr_status_t status() const

Return the pr_status_t structure.

void status(const pr_status_t &status)
inline ARCH architecture() const
result<uint64_t> pc() const

The program counter or an error if not found.

result<uint64_t> sp() const

The stack pointer or an error if not found.

result<uint64_t> return_value() const

The value of the register that holds the return value according to the calling convention.

result<uint64_t> get(Registers::X86 reg) const

Get the value for the given X86 register or return an error.

result<uint64_t> get(Registers::X86_64 reg) const

Get the value for the given X86_64 register or return an error.

result<uint64_t> get(Registers::ARM reg) const

Get the value for the given ARM register or return an error.

result<uint64_t> get(Registers::AARCH64 reg) const

Get the value for the given AARCH64 register or return an error.

ok_error_t set(Registers::X86 reg, uint64_t value)
ok_error_t set(Registers::X86_64 reg, uint64_t value)
ok_error_t set(Registers::ARM reg, uint64_t value)
ok_error_t set(Registers::AARCH64 reg, uint64_t value)
std::vector<uint64_t> register_values() const

A list of the register values. This list is guarantee to be as long as the Registers::ARM::_COUNT or empty if it can’t be resolved. Thus, one can access a specific register with:

if (architecture() == ARCH::AARCH64) {
  auto reg_vals = register_values()
  if (!reg_vals.empty()) {
    auto x20 = reg_vals[static_cast<size_t>(Register::AARCH64::X20)]
  }
}
inline result<uint64_t> operator[](Registers::X86 reg) const
inline result<uint64_t> operator[](Registers::X86_64 reg) const
inline result<uint64_t> operator[](Registers::ARM reg) const
inline result<uint64_t> operator[](Registers::AARCH64 reg) const
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CorePrStatus() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CorePrStatus &note)
struct pr_status_t

Public Members

siginfo_t info
uint16_t cursig = 0
uint16_t reserved = 0
uint64_t sigpend = 0
uint64_t sighold = 0
int32_t pid = 0
int32_t ppid = 0
int32_t pgrp = 0
int32_t sid = 0
timeval_t utime
timeval_t stime
timeval_t cutime
timeval_t cstime
struct Registers

Public Types

enum class X86

Register for the x86 architecture (ARCH::I386).

Values:

enumerator EBX = 0
enumerator ECX
enumerator EDX
enumerator ESI
enumerator EDI
enumerator EBP
enumerator EAX
enumerator DS
enumerator ES
enumerator FS
enumerator GS
enumerator ORIG_EAX
enumerator EIP
enumerator CS
enumerator EFLAGS
enumerator ESP
enumerator SS
enumerator _COUNT
enum class X86_64

Register for the x86-64 architecture (ARCH::X86_64).

Values:

enumerator R15 = 0
enumerator R14
enumerator R13
enumerator R12
enumerator RBP
enumerator RBX
enumerator R11
enumerator R10
enumerator R9
enumerator R8
enumerator RAX
enumerator RCX
enumerator RDX
enumerator RSI
enumerator RDI
enumerator ORIG_RAX
enumerator RIP
enumerator CS
enumerator EFLAGS
enumerator RSP
enumerator SS
enumerator _COUNT
enum class ARM

Register for the ARM architecture (ARCH::ARM).

Values:

enumerator R0 = 0
enumerator R1
enumerator R2
enumerator R3
enumerator R4
enumerator R5
enumerator R6
enumerator R7
enumerator R8
enumerator R9
enumerator R10
enumerator R11
enumerator R12
enumerator R13
enumerator R14
enumerator R15
enumerator CPSR
enumerator _COUNT
enum class AARCH64

Register for the AARCH64 architecture (ARCH::AARCH64).

Values:

enumerator X0 = 0
enumerator X1
enumerator X2
enumerator X3
enumerator X4
enumerator X5
enumerator X6
enumerator X7
enumerator X8
enumerator X9
enumerator X10
enumerator X11
enumerator X12
enumerator X13
enumerator X14
enumerator X15
enumerator X16
enumerator X17
enumerator X18
enumerator X19
enumerator X20
enumerator X21
enumerator X22
enumerator X23
enumerator X24
enumerator X25
enumerator X26
enumerator X27
enumerator X28
enumerator X29
enumerator X30
enumerator X31
enumerator PC
enumerator PSTATE
enumerator _COUNT
struct siginfo_t

Public Members

int32_t signo = 0
int32_t code = 0
int32_t err = 0
struct timeval_t

Public Members

uint64_t sec = 0
uint64_t usec = 0

Core Siginfo

class CoreSigInfo : public LIEF::ELF::Note

Class representing a core siginfo object.

Public Functions

inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

result<int32_t> signo() const

Signal number of an error if it can’t be resolved.

result<int32_t> sigcode() const

Signal code of an error if it can’t be resolved.

result<int32_t> sigerrno() const

Signal error number of an error if it can’t be resolved.

void signo(uint32_t value)
void sigcode(uint32_t value)
void sigerrno(uint32_t value)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CoreSigInfo() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CoreSigInfo &note)

Core Auxiliary Vector

class CoreAuxv : public LIEF::ELF::Note

Class representing core auxv object.

Public Types

enum class TYPE

Values:

enumerator END = 0

End of vector

enumerator IGNORE

Entry should be ignored

enumerator EXECFD

File descriptor of program

enumerator PHDR

Program headers for program

enumerator PHENT

Size of program header entry

enumerator PHNUM

Number of program headers

enumerator PAGESZ

System page size

enumerator BASE

Base address of interpreter

enumerator FLAGS

Flags

enumerator ENTRY

Entry point of program

enumerator NOTELF

Program is not ELF

enumerator UID

Real uid

enumerator EUID

Effective uid

enumerator GID

Real gid

enumerator EGID

Effective gid

enumerator TGT_PLATFORM

String identifying platform.

enumerator HWCAP

Machine dependent hints about processor capabilities.

enumerator CLKTCK

Frequency of times()

enumerator FPUCW

Used FPU control word.

enumerator DCACHEBSIZE

Data cache block size.

enumerator ICACHEBSIZE

Instruction cache block size.

enumerator UCACHEBSIZE

Instruction cache block size.

enumerator IGNOREPPC

Entry should be ignored.

enumerator SECURE

Boolean, was exec setuid-like?.

enumerator BASE_PLATFORM

String identifying real platform

enumerator RANDOM

Address of 16 random bytes

enumerator HWCAP2

Extension of AT_HWCAP

enumerator EXECFN = 31

Filename of executable

enumerator SYSINFO

Filename of executable

enumerator SYSINFO_EHDR

Pointer to ELF header of system-supplied DSO.

Public Functions

inline CoreAuxv(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

std::map<TYPE, uint64_t> values() const

A map of CoreAuxv::TYPE and the value.

result<uint64_t> get(TYPE type) const

Return the value associated with the provided TYPE or a lief_errors::not_found if the type is not present.

inline result<uint64_t> operator[](TYPE type) const
bool set(TYPE type, uint64_t value)
bool set(std::map<TYPE, uint64_t> values)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CoreAuxv() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CoreAuxv &note)

Android Identity

class AndroidIdent : public LIEF::ELF::Note

Class representing the “.note.android.ident” section.

Public Functions

inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

uint32_t sdk_version() const

Target SDK version (or 0 if it can’t be resolved)

std::string ndk_version() const

NDK version used (or an empty string if it can’t be parsed)

std::string ndk_build_number() const

NDK build number (or an empty string if it can’t be parsed)

void sdk_version(uint32_t version)
void ndk_version(const std::string &ndk_version)
void ndk_build_number(const std::string &ndk_build_number)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~AndroidIdent() override = default

Public Static Functions

static inline bool classof(const Note *note)
static inline constexpr size_t description_size()

Public Static Attributes

static constexpr size_t sdk_version_size = sizeof(uint32_t)
static constexpr size_t ndk_version_size = 64 * sizeof(char)
static constexpr size_t ndk_build_number_size = 64 * sizeof(char)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const AndroidIdent &note)

Note ABI

class NoteAbi : public LIEF::ELF::Note

Class that wraps the NT_GNU_ABI_TAG note.

Public Types

enum class ABI

ABI recognized by this note.

Values:

enumerator LINUX = 0
enumerator GNU
enumerator SOLARIS2
enumerator FREEBSD
enumerator NETBSD
enumerator SYLLABLE
enumerator NACL
using version_t = std::array<uint32_t, 3>

Version type: (Major, Minor, Patch)

Public Functions

inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

result<version_t> version() const

Return the version or an error if it can’t be parsed.

result<ABI> abi() const

Return the ABI or an error if it can’t be parsed.

void version(const version_t &version)
void version(ABI abi)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~NoteAbi() override = default
Note(const Note &copy) = default

Public Static Functions

static inline bool classof(const Note *note)
static inline constexpr uint8_t description_size()

Public Static Attributes

static constexpr size_t abi_offset = 0
static constexpr size_t abi_size = sizeof(uint32_t)
static constexpr size_t version_offset = abi_size
static constexpr size_t version_size = 3 * sizeof(uint32_t)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const NoteAbi &note)

Note Gnu Property

class NoteGnuProperty : public LIEF::ELF::Note

Class that wraps the NT_GNU_PROPERTY_TYPE_0 note.

Public Types

using properties_t = std::vector<std::unique_ptr<NoteGnuProperty::Property>>

Public Functions

inline NoteGnuProperty(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

std::unique_ptr<NoteGnuProperty::Property> find(Property::TYPE type) const

Find the property with the given type or return a nullptr

properties_t properties() const

Return the properties as a list of Property.

virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~NoteGnuProperty() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const NoteGnuProperty &note)
class Property

This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note.

Subclassed by LIEF::ELF::AArch64Feature, LIEF::ELF::Generic, LIEF::ELF::Needed, LIEF::ELF::NoteNoCopyOnProtected, LIEF::ELF::StackSize, LIEF::ELF::X86Features, LIEF::ELF::X86ISA

Public Types

enum class TYPE

LIEF’s mirror types of the original GNU_PROPERTY_ values.

Values:

enumerator UNKNOWN = 0
enumerator GENERIC

Property that dont’ have special implementation.

enumerator AARCH64_FEATURES

Mirror of GNU_PROPERTY_AARCH64_FEATURE_1_AND

enumerator STACK_SIZE

Mirror of GNU_PROPERTY_STACK_SIZE

enumerator NO_COPY_ON_PROTECTED

Mirror of GNU_PROPERTY_NO_COPY_ON_PROTECTED

enumerator X86_ISA

Mirror of GNU_PROPERTY_X86_ISA_1_* and GNU_PROPERTY_X86_COMPAT_*

enumerator X86_FEATURE

Mirror of GNU_PROPERTY_X86_FEATURE_*

enumerator NEEDED

Public Functions

inline TYPE type() const

Return the LIEF’s mirror type of the note.

virtual void dump(std::ostream &os) const
virtual ~Property() = default

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Property &prop)

Generic

class Generic : public LIEF::ELF::NoteGnuProperty::Property

This class represents a property which doesn’t have a concrete LIEF implementation.

Public Functions

inline uint32_t type() const

The original raw type as an integer. This value might depends on the architecture and/or the file type.

~Generic() override = default

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static inline std::unique_ptr<Generic> create(uint32_t raw_type)

AArch64 Feature

class AArch64Feature : public LIEF::ELF::NoteGnuProperty::Property

This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND property.

Public Types

enum class FEATURE

Values:

enumerator UNKNOWN = 0
enumerator BTI

Support Branch Target Identification (BTI)

enumerator PAC

Support Pointer authentication (PAC)

Public Functions

inline const std::vector<FEATURE> &features() const

Return the list of the supported features.

virtual void dump(std::ostream &os) const override
~AArch64Feature() override = default

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static std::unique_ptr<AArch64Feature> create(BinaryStream &stream)

No Copy on Protected

class NoteNoCopyOnProtected : public LIEF::ELF::NoteGnuProperty::Property

This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols.

Public Functions

~NoteNoCopyOnProtected() override = default

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static inline std::unique_ptr<NoteNoCopyOnProtected> create()

Stack Size

class StackSize : public LIEF::ELF::NoteGnuProperty::Property

This class provides an interface over the GNU_PROPERTY_STACK_SIZE property.

This property can be used by the loader to raise the stack limit.

Public Functions

inline uint64_t stack_size() const

The indicated stack size.

virtual void dump(std::ostream &os) const override
~StackSize() override = default

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static inline std::unique_ptr<StackSize> create(uint64_t stack_size)

X86 Feature

class X86Features : public LIEF::ELF::NoteGnuProperty::Property

This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes:

  • GNU_PROPERTY_X86_FEATURE_1_AND

  • GNU_PROPERTY_X86_FEATURE_2_USED

  • GNU_PROPERTY_X86_FEATURE_2_NEEDED

Public Types

enum class FLAG

Flag according to the _AND, _USED or _NEEDED suffixes.

Values:

enumerator NONE = 0

For the original GNU_PROPERTY_X86_FEATURE_1_AND property.

enumerator USED

For the original GNU_PROPERTY_X86_FEATURE_2_USED property.

enumerator NEEDED

For the original GNU_PROPERTY_X86_FEATURE_2_NEEDED property.

enum class FEATURE

Features provided by these different properties.

Values:

enumerator UNKNOWN = 0
enumerator IBT
enumerator SHSTK
enumerator LAM_U48
enumerator LAM_U57
enumerator X86
enumerator X87
enumerator MMX
enumerator XMM
enumerator YMM
enumerator ZMM
enumerator FXSR
enumerator XSAVE
enumerator XSAVEOPT
enumerator XSAVEC
enumerator TMM
enumerator MASK
using features_t = std::vector<std::pair<FLAG, FEATURE>>

List of the features as a pair of FLAG, FEATURE.

For instance, if the raw property is GNU_PROPERTY_X86_FEATURE_2_USED with a bitmask set to GNU_PROPERTY_X86_FEATURE_2_XSAVE, it generates the pair: FLAG::USED, FEATURE::XSAVE

Public Functions

inline const features_t &features() const

List of the features.

virtual void dump(std::ostream &os) const override
~X86Features() override = default

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static std::unique_ptr<X86Features> create(uint32_t type, BinaryStream &stream)

X86 ISA

class X86ISA : public LIEF::ELF::NoteGnuProperty::Property

This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes:

  • GNU_PROPERTY_X86_ISA_1_USED

  • GNU_PROPERTY_X86_ISA_1_NEEDED

  • GNU_PROPERTY_X86_COMPAT_ISA_1_USED

  • GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED

  • GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED

  • GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED

Public Types

enum class FLAG

Values:

enumerator NONE = 0
enumerator USED
enumerator NEEDED
enum class ISA

Values:

enumerator UNKNOWN = 0
enumerator BASELINE
enumerator V2
enumerator V3
enumerator V4
enumerator CMOV
enumerator FMA
enumerator I486
enumerator I586
enumerator I686
enumerator SSE
enumerator SSE2
enumerator SSE3
enumerator SSSE3
enumerator SSE4_1
enumerator SSE4_2
enumerator AVX
enumerator AVX2
enumerator AVX512F
enumerator AVX512CD
enumerator AVX512ER
enumerator AVX512PF
enumerator AVX512VL
enumerator AVX512DQ
enumerator AVX512BW
enumerator AVX512_4FMAPS
enumerator AVX512_4VNNIW
enumerator AVX512_BITALG
enumerator AVX512_IFMA
enumerator AVX512_VBMI
enumerator AVX512_VBMI2
enumerator AVX512_VNNI
enumerator AVX512_BF16
using values_t = std::vector<std::pair<FLAG, ISA>>

Public Functions

inline const values_t &values() const

List of the ISA values in this property.

~X86ISA() override = default
virtual void dump(std::ostream &os) const override

Public Static Functions

static inline bool classof(const NoteGnuProperty::Property *prop)
static std::unique_ptr<X86ISA> create(uint32_t type, BinaryStream &stream)

Builder

class Builder

Class which takes an ELF::Binary object and reconstructs a valid binary.

This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run).

Public Functions

Builder(Binary &binary)
Builder() = delete
~Builder()
void build()

Perform the build of the provided ELF binary.

inline Builder &set_config(config_t conf)

Tweak the ELF builder with the provided config parameter.

inline config_t &config()
const std::vector<uint8_t> &get_build()

Return the built ELF binary as a byte vector.

void write(const std::string &filename) const

Write the built ELF binary in the filename given in parameter.

void write(std::ostream &os) const

Write the built ELF binary in the stream os given in parameter.

struct config_t

Configuration options to tweak the building process.

Public Members

bool dt_hash = true
bool dyn_str = true

Rebuild DT_HASH.

bool dynamic_section = true

Rebuild DT_STRTAB.

bool fini_array = true

Rebuild PT_DYNAMIC segment.

bool gnu_hash = true

Rebuild DT_FINI_ARRAY.

bool init_array = true

Rebuild DT_GNU_HASH.

bool interpreter = true

Rebuild DT_INIT_ARRAY.

bool jmprel = true

Rebuild PT_INTERPRETER.

bool notes = false

Rebuild DT_JMPREL.

bool preinit_array = true

Disable note building since it can break the default layout.

bool relr = true

Rebuild DT_PREINIT_ARRAY.

bool android_rela = true

Rebuild DT_RELR.

bool rela = true

Rebuild DT_ANDROID_REL[A].

bool static_symtab = true

Rebuild DT_REL[A].

bool sym_verdef = true

Rebuild .symtab

bool sym_verneed = true

Rebuild DT_VERDEF.

bool sym_versym = true

Rebuild DT_VERNEED.

bool symtab = true

Rebuild DT_VERSYM.

bool force_relocate = false

Rebuild DT_SYMTAB.


Utilities

bool LIEF::ELF::is_elf(const std::string &file)

Check if the given file is an ELF one.

bool LIEF::ELF::is_elf(const std::vector<uint8_t> &raw)

check if the raw data is a ELF file


Enums

Architectures

enum class LIEF::ELF::ARCH

Machine architectures See current registered ELF machine architectures at: http://www.sco.com/developers/gabi/latest/ch4.eheader.html.

Values:

enumerator NONE = 0

No machine

enumerator M32 = 1

AT&T WE 32100

enumerator SPARC = 2

SPARC

enumerator I386 = 3

Intel 386

enumerator M68K = 4

Motorola 68000

enumerator M88K = 5

Motorola 88000

enumerator IAMCU = 6

Intel MCU

enumerator I860 = 7

Intel 80860

enumerator MIPS = 8

MIPS R3000

enumerator S370 = 9

IBM System/370

enumerator MIPS_RS3_LE = 10

MIPS RS3000 Little-endian

enumerator PARISC = 15

Hewlett-Packard PA-RISC

enumerator VPP500 = 17

Fujitsu VPP500

enumerator SPARC32PLUS = 18

Enhanced instruction set SPARC

enumerator I60 = 19

Intel 80960

enumerator PPC = 20

PowerPC

enumerator PPC64 = 21

PowerPC64

enumerator S390 = 22

IBM System/390

enumerator SPU = 23

IBM SPU/SPC

enumerator V800 = 36

NEC V800

enumerator FR20 = 37

Fujitsu FR20

enumerator RH32 = 38

TRW RH-32

enumerator RCE = 39

Motorola RCE

enumerator ARM = 40

ARM

enumerator ALPHA = 41

DEC Alpha

enumerator SH = 42

Hitachi SH

enumerator SPARCV9 = 43

SPARC V9

enumerator TRICORE = 44

Siemens TriCore

enumerator ARC = 45

Argonaut RISC Core

enumerator H8_300 = 46

Hitachi H8/300

enumerator H8_300H = 47

Hitachi H8/300H

enumerator H8S = 48

Hitachi H8S

enumerator H8_500 = 49

Hitachi H8/500

enumerator IA_64 = 50

Intel IA-64 processor architecture

enumerator MIPS_X = 51

Stanford MIPS-X

enumerator COLDFIRE = 52

Motorola ColdFire

enumerator M68HC12 = 53

Motorola M68HC12

enumerator MMA = 54

Fujitsu MMA Multimedia Accelerator

enumerator PCP = 55

Siemens PCP

enumerator NCPU = 56

Sony nCPU embedded RISC processor

enumerator NDR1 = 57

Denso NDR1 microprocessor

enumerator STARCORE = 58

Motorola Star*Core processor

enumerator ME16 = 59

Toyota ME16 processor

enumerator ST100 = 60

STMicroelectronics ST100 processor

enumerator TINYJ = 61

Advanced Logic Corp. TinyJ embedded processor family

enumerator X86_64 = 62

AMD x86-64 architecture

enumerator PDSP = 63

Sony DSP Processor

enumerator PDP10 = 64

Digital Equipment Corp. PDP-10

enumerator PDP11 = 65

Digital Equipment Corp. PDP-11

enumerator FX66 = 66

Siemens FX66 microcontroller

enumerator ST9PLUS = 67

STMicroelectronics ST9+ 8/16 bit microcontroller

enumerator ST7 = 68

STMicroelectronics ST7 8-bit microcontroller

enumerator M68HC16 = 69

Motorola MC68HC16 Microcontroller

enumerator M68HC11 = 70

Motorola MC68HC11 Microcontroller

enumerator M68HC08 = 71

Motorola MC68HC08 Microcontroller

enumerator M68HC05 = 72

Motorola MC68HC05 Microcontroller

enumerator SVX = 73

Silicon Graphics SVx

enumerator ST19 = 74

STMicroelectronics ST19 8-bit microcontroller

enumerator VAX = 75

Digital VAX

enumerator CRIS = 76

Axis Communications 32-bit embedded processor

enumerator JAVELIN = 77

Infineon Technologies 32-bit embedded processor

enumerator FIREPATH = 78

Element 14 64-bit DSP Processor

enumerator ZSP = 79

LSI Logic 16-bit DSP Processor

enumerator MMIX = 80

Donald Knuth’s educational 64-bit processor

enumerator HUANY = 81

Harvard University machine-independent object files

enumerator PRISM = 82

SiTera Prism

enumerator AVR = 83

Atmel AVR 8-bit microcontroller

enumerator FR30 = 84

Fujitsu FR30

enumerator D10V = 85

Mitsubishi D10V

enumerator D30V = 86

Mitsubishi D30V

enumerator V850 = 87

NEC v850

enumerator M32R = 88

Mitsubishi M32R

enumerator MN10300 = 89

Matsushita MN10300

enumerator MN10200 = 90

Matsushita MN10200

enumerator PJ = 91

picoJava

enumerator OPENRISC = 92

OpenRISC 32-bit embedded processor

enumerator ARC_COMPACT = 93

ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)

enumerator XTENSA = 94

Tensilica Xtensa Architecture

enumerator VIDEOCORE = 95

Alphamosaic VideoCore processor

enumerator TMM_GPP = 96

Thompson Multimedia General Purpose Processor

enumerator NS32K = 97

National Semiconductor 32000 series

enumerator TPC = 98

Tenor Network TPC processor

enumerator SNP1K = 99

Trebia SNP 1000 processor

enumerator ST200 = 100

STMicroelectronics (www.st.com) ST200

enumerator IP2K = 101

Ubicom IP2xxx microcontroller family

enumerator MAX = 102

MAX Processor

enumerator CR = 103

National Semiconductor CompactRISC microprocessor

enumerator F2MC16 = 104

Fujitsu F2MC16

enumerator MSP430 = 105

Texas Instruments embedded microcontroller msp430

enumerator BLACKFIN = 106

Analog Devices Blackfin (DSP) processor

enumerator SE_C33 = 107

S1C33 Family of Seiko Epson processors

enumerator SEP = 108

Sharp embedded microprocessor

enumerator ARCA = 109

Arca RISC Microprocessor

enumerator UNICORE = 110

Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University

enumerator EXCESS = 111

eXcess: 16/32/64-bit configurable embedded CPU

enumerator DXP = 112

Icera Semiconductor Inc. Deep Execution Processor

enumerator ALTERA_NIOS2 = 113

Altera Nios II soft-core processor

enumerator CRX = 114

National Semiconductor CompactRISC CRX

enumerator XGATE = 115

Motorola XGATE embedded processor

enumerator C166 = 116

Infineon C16x/XC16x processor

enumerator M16C = 117

Renesas M16C series microprocessors

enumerator DSPIC30F = 118

Microchip Technology dsPIC30F Digital Signal

enumerator CE = 119

Freescale Communication Engine RISC core

enumerator M32C = 120

Renesas M32C series microprocessors

enumerator TSK3000 = 131

Altium TSK3000 core

enumerator RS08 = 132

Freescale RS08 embedded processor

enumerator SHARC = 133

Analog Devices SHARC family of 32-bit DSP

enumerator ECOG2 = 134

Cyan Technology eCOG2 microprocessor

enumerator SCORE7 = 135

Sunplus S+core7 RISC processor

enumerator DSP24 = 136

New Japan Radio (NJR) 24-bit DSP Processor

enumerator VIDEOCORE3 = 137

Broadcom VideoCore III processor

enumerator LATTICEMICO32 = 138

RISC processor for Lattice FPGA architecture

enumerator SE_C17 = 139

Seiko Epson C17 family

enumerator TI_C6000 = 140

The Texas Instruments TMS320C6000 DSP family

enumerator TI_C2000 = 141

The Texas Instruments TMS320C2000 DSP family

enumerator TI_C5500 = 142

The Texas Instruments TMS320C55x DSP family

enumerator MMDSP_PLUS = 160

STMicroelectronics 64bit VLIW Data Signal Processor

enumerator CYPRESS_M8C = 161

Cypress M8C microprocessor

enumerator R32C = 162

Renesas R32C series microprocessors

enumerator TRIMEDIA = 163

NXP Semiconductors TriMedia architecture family

enumerator HEXAGON = 164

Qualcomm Hexagon processor

enumerator M8051 = 165

Intel 8051 and variants

enumerator STXP7X = 166

STMicroelectronics STxP7x family of configurable

enumerator NDS32 = 167
enumerator ECOG1 = 168

Cyan Technology eCOG1X family

enumerator ECOG1X = 168

Cyan Technology eCOG1X family

enumerator MAXQ30 = 169

Dallas Semiconductor MAXQ30 Core Micro-controllers

enumerator XIMO16 = 170

New Japan Radio (NJR) 16-bit DSP Processor

enumerator MANIK = 171

M2000 Reconfigurable RISC Microprocessor

enumerator CRAYNV2 = 172

Cray Inc. NV2 vector architecture

enumerator RX = 173

Renesas RX family

enumerator METAG = 174

Imagination Technologies META processor

enumerator MCST_ELBRUS = 175

MCST Elbrus general purpose hardware architecture

enumerator ECOG16 = 176

Cyan Technology eCOG16 family

enumerator CR16 = 177

National Semiconductor CompactRISC CR16 16-bit

enumerator ETPU = 178

Freescale Extended Time Processing Unit

enumerator SLE9X = 179

Infineon Technologies SLE9X core

enumerator L10M = 180

Intel L10M

enumerator K10M = 181

Intel K10M

enumerator AARCH64 = 183

ARM AArch64

enumerator AVR32 = 185

Atmel Corporation 32-bit microprocessor family

enumerator STM8 = 186

STMicroeletronics STM8 8-bit microcontroller

enumerator TILE64 = 187

Tilera TILE64 multicore architecture family

enumerator TILEPRO = 188

Tilera TILEPro multicore architecture family

enumerator CUDA = 190

NVIDIA CUDA architecture

enumerator TILEGX = 191

Tilera TILE-Gx multicore architecture family

enumerator CLOUDSHIELD = 192

CloudShield architecture family

enumerator COREA_1ST = 193

KIPO-KAIST Core-A 1st generation processor family

enumerator COREA_2ND = 194

KIPO-KAIST Core-A 2nd generation processor family

enumerator ARC_COMPACT2 = 195

Synopsys ARCompact V2

enumerator OPEN8 = 196

Open8 8-bit RISC soft processor core

enumerator RL78 = 197

Renesas RL78 family

enumerator VIDEOCORE5 = 198

Broadcom VideoCore V processor

enumerator M78KOR = 199

Renesas 78KOR family

enumerator M56800EX = 200

Freescale 56800EX Digital Signal Controller (DSC)

enumerator BA1 = 201

Beyond BA1 CPU architecture

enumerator BA2 = 202

Beyond BA2 CPU architecture

enumerator XCORE = 203

XMOS xCORE processor family

enumerator MCHP_PIC = 204

Microchip 8-bit PIC(r) family

enumerator INTEL205 = 205

Reserved by Intel

enumerator INTEL206 = 206

Reserved by Intel

enumerator INTEL207 = 207

Reserved by Intel

enumerator INTEL208 = 208

Reserved by Intel

enumerator INTEL209 = 209

Reserved by Intel

enumerator KM32 = 210

KM211 KM32 32-bit processor

enumerator KMX32 = 211

KM211 KMX32 32-bit processor

enumerator KMX16 = 212

KM211 KMX16 16-bit processor

enumerator KMX8 = 213

KM211 KMX8 8-bit processor

enumerator KVARC = 214

KM211 KVARC processor

enumerator CDP = 215

Paneve CDP architecture family

enumerator COGE = 216

Cognitive Smart Memory Processor

enumerator COOL = 217

iCelero CoolEngine

enumerator NORC = 218

Nanoradio Optimized RISC

enumerator CSR_KALIMBA = 219

CSR Kalimba architecture family

enumerator AMDGPU = 224

AMD GPU architecture

enumerator RISCV = 243

RISC-V

enumerator BPF = 247

eBPF Filter

enumerator LOONGARCH = 258

LoongArch

Processor Flags

enum class LIEF::ELF::PROCESSOR_FLAGS : uint64_t

Values:

enumerator ARM_EABI_UNKNOWN = 0x00000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_SOFT_FLOAT = 0x00000200 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_VFP_FLOAT = 0x00000400 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_EABI_VER1 = 0x01000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_EABI_VER2 = 0x02000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_EABI_VER3 = 0x03000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_EABI_VER4 = 0x04000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator ARM_EABI_VER5 = 0x05000000 | (PF_ARM_ID << PFLAGS_BIT)
enumerator HEXAGON_MACH_V2 = 0x00000001 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_MACH_V3 = 0x00000002 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_MACH_V4 = 0x00000003 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_MACH_V5 = 0x00000004 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_ISA_V2 = 0x00000010 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_ISA_V3 = 0x00000020 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_ISA_V4 = 0x00000030 | (PF_HEX_ID << PFLAGS_BIT)
enumerator HEXAGON_ISA_V5 = 0x00000040 | (PF_HEX_ID << PFLAGS_BIT)
enumerator LOONGARCH_ABI_SOFT_FLOAT = 0x1 | (PF_LOONGARCH_ID << PFLAGS_BIT)
enumerator LOONGARCH_ABI_SINGLE_FLOAT = 0x2 | (PF_LOONGARCH_ID << PFLAGS_BIT)
enumerator LOONGARCH_ABI_DOUBLE_FLOAT = 0x3 | (PF_LOONGARCH_ID << PFLAGS_BIT)
enumerator MIPS_NOREORDER = 0x00000001 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_PIC = 0x00000002 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_CPIC = 0x00000004 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ABI2 = 0x00000020 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_32BITMODE = 0x00000100 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_FP64 = 0x00000200 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_NAN2008 = 0x00000400 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ABI_O32 = 0x00001000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ABI_O64 = 0x00002000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ABI_EABI32 = 0x00003000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ABI_EABI64 = 0x00004000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_3900 = 0x00810000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_4010 = 0x00820000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_4100 = 0x00830000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_4650 = 0x00850000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_4120 = 0x00870000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_4111 = 0x00880000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_SB1 = 0x008a0000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_OCTEON = 0x008b0000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_XLR = 0x008c0000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_OCTEON2 = 0x008d0000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_OCTEON3 = 0x008e0000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_5400 = 0x00910000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_5900 = 0x00920000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_5500 = 0x00980000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_9000 = 0x00990000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_LS2E = 0x00a00000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_LS2F = 0x00a10000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MACH_LS3A = 0x00a20000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_MICROMIPS = 0x02000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_ASE_M16 = 0x04000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_ASE_MDMX = 0x08000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_1 = 0x00000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_2 = 0x10000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_3 = 0x20000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_4 = 0x30000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_5 = 0x40000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_32 = 0x50000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_64 = 0x60000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_32R2 = 0x70000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_64R2 = 0x80000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_32R6 = 0x90000000 | (PF_MIPS_ID << PFLAGS_BIT)
enumerator MIPS_ARCH_64R6 = 0xa0000000 | (PF_MIPS_ID << PFLAGS_BIT)