ELF

Parser

class Parser : public LIEF::Parser

Class which parses and transforms an ELF file into a ELF::Binary object.

Subclassed by LIEF::OAT::Parser

Public Functions

Parser &operator=(const Parser&) = delete
Parser(const Parser&) = delete

Public Static Functions

static std::unique_ptr<Binary> parse(const std::string &file, const ParserConfig &conf = ParserConfig::all())

Parse an ELF file and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols

Parameters:
  • file[in] Path to the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary as a unique_ptr

static std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const ParserConfig &conf = ParserConfig::all())

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • data[in] Raw ELF as a std::vector of uint8_t

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

static std::unique_ptr<Binary> parse(std::unique_ptr<BinaryStream> stream, const ParserConfig &conf = ParserConfig::all())

Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • stream[in] The stream which wraps the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

Public Static Attributes

static constexpr uint32_t NB_MAX_SYMBOLS = 1000000
static constexpr uint32_t DELTA_NB_SYMBOLS = 3000
static constexpr uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
static constexpr uint32_t NB_MAX_CHAINS = 1000000
static constexpr uint32_t NB_MAX_SEGMENTS = 10000
static constexpr uint32_t NB_MAX_RELOCATIONS = 3000000
static constexpr uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
static constexpr uint32_t NB_MAX_MASKWORD = 512
static constexpr uint32_t MAX_SECTION_SIZE = 2_GB
static constexpr uint32_t MAX_SEGMENT_SIZE = 3_GB

Friends

friend class OAT::Parser
struct ParserConfig

This structure is used to tweak the ELF Parser (ELF::Parser)

Public Members

bool parse_relocations = true

Whether relocations (including plt-like relocations) should be parsed.

bool parse_dyn_symbols = true

Whether dynamic symbols (those from .dynsym) should be parsed.

bool parse_static_symbols = true

Whether debug symbols (those from .symtab) should be parsed.

bool parse_symbol_versions = true

Whether versioning symbols should be parsed.

bool parse_notes = true

Whether ELF notes information should be parsed.

bool parse_overlay = true

Whether the overlay data should be parsed.

DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO

The method used to count the number of dynamic symbols

Public Static Functions

static inline ParserConfig all()

This returns a ParserConfig object configured to process all the ELF elements.


Binary

class Binary : public LIEF::Binary

Class which represents an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

enum PHDR_RELOC

This enum describes the different ways to relocate the segments table.

Values:

enumerator AUTO = 0

Defer the choice of the layout to LIEF.

enumerator PIE_SHIFT

The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.

enumerator BSS_END

The new segments table is relocated right after the first bss-like segment.

enumerator BINARY_END

The new segments table is relocated at the end of the binary.

enumerator SEGMENT_GAP

The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.

using string_list_t = std::vector<std::string>
using notes_t = std::vector<std::unique_ptr<Note>>

Internal container for storing notes.

using it_notes = ref_iterator<notes_t&, Note*>

Iterator which outputs Note& object.

using it_const_notes = const_ref_iterator<const notes_t&, const Note*>

Iterator which outputs const Note& object.

using symbols_version_requirement_t = std::vector<std::unique_ptr<SymbolVersionRequirement>>

Internal container for storing SymbolVersionRequirement.

using it_symbols_version_requirement = ref_iterator<symbols_version_requirement_t&, SymbolVersionRequirement*>

Iterator which outputs SymbolVersionRequirement& object.

using it_const_symbols_version_requirement = const_ref_iterator<const symbols_version_requirement_t&, const SymbolVersionRequirement*>

Iterator which outputs const SymbolVersionRequirement& object.

using symbols_version_definition_t = std::vector<std::unique_ptr<SymbolVersionDefinition>>

Internal container for storing SymbolVersionDefinition.

using it_symbols_version_definition = ref_iterator<symbols_version_definition_t&, SymbolVersionDefinition*>

Iterator which outputs SymbolVersionDefinition& object.

using it_const_symbols_version_definition = const_ref_iterator<const symbols_version_definition_t&, const SymbolVersionDefinition*>

Iterator which outputs const SymbolVersionDefinition& object.

using segments_t = std::vector<std::unique_ptr<Segment>>

Internal container for storing ELF’s Segment.

using it_segments = ref_iterator<segments_t&, Segment*>

Iterator which outputs Segment& object.

using it_const_segments = const_ref_iterator<const segments_t&, const Segment*>

Iterator which outputs const Segment& object.

using dynamic_entries_t = std::vector<std::unique_ptr<DynamicEntry>>

Internal container for storing ELF’s DynamicEntry.

using it_dynamic_entries = ref_iterator<dynamic_entries_t&, DynamicEntry*>

Iterator which outputs DynamicEntry& object.

using it_const_dynamic_entries = const_ref_iterator<const dynamic_entries_t&, const DynamicEntry*>

Iterator which outputs const DynamicEntry& object.

using symbols_version_t = std::vector<std::unique_ptr<SymbolVersion>>

Internal container for storing ELF’s SymbolVersion.

using it_symbols_version = ref_iterator<symbols_version_t&, SymbolVersion*>

Iterator which outputs SymbolVersion& object.

using it_const_symbols_version = const_ref_iterator<const symbols_version_t&, const SymbolVersion*>

Iterator which outputs const SymbolVersion& object.

using relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing ELF’s Relocation.

using it_pltgot_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs plt/got Relocation& object.

using it_const_pltgot_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs plt/got const Relocation& object.

using it_dynamic_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)

using it_const_dynamic_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)

using it_object_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object found in object files (.o)

using it_const_object_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object found in object files (.o)

using it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object.

using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object.

using symbols_t = std::vector<std::unique_ptr<Symbol>>

Internal container for storing ELF’s Symbol.

using it_dynamic_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the Dynamic Symbol& object.

using it_const_dynamic_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the Dynamic const Symbol& object.

using it_static_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the static/debug Symbol& object.

using it_const_static_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the static/debug const Symbol& object.

using it_symbols = ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic Symbol& object.

using it_const_symbols = const_ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic const Symbol& object.

using it_exported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported Symbol& object.

using it_const_exported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported const Symbol& object.

using it_imported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported Symbol& object.

using it_const_imported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported const Symbol& object.

using sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing ELF’s Section.

using it_sections = ref_iterator<sections_t&, Section*>

Iterator which outputs Section& object.

using it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator which outputs const Section& object.

Public Functions

Binary &operator=(const Binary&) = delete
Binary(const Binary &copy) = delete
ELF_CLASS type() const

Return binary’s class (ELF32 or ELF64)

Header &header()

Return Elf header .

const Header &header() const
uint64_t last_offset_section() const

Return the last offset used in binary according to sections table.

uint64_t last_offset_segment() const

Return the last offset used in binary according to segments table.

uint64_t next_virtual_address() const

Return the next virtual address available.

it_sections sections()

Return an iterator over the binary’s sections.

it_const_sections sections() const
virtual uint64_t entrypoint() const override

Return the binary’s entrypoint.

it_segments segments()

Return binary’s segments.

it_const_segments segments() const
it_dynamic_entries dynamic_entries()

Return binary’s dynamic entries.

it_const_dynamic_entries dynamic_entries() const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the new entry.

Note &add(const Note &note)

Add the given note and return the created entry.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DYNAMIC_TAGS tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section. The clear parameter can be used to zeroize the original content beforehand.

Parameters:
  • section[in] The section to remove

  • clear[in] Whether zeroize the original content

void remove(const Note &note)

Remove the given note.

void remove(Note::TYPE type)

Remove all notes with the given type.

void remove(const Segment &seg)

Remove the given segment.

it_dynamic_symbols dynamic_symbols()

Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.

it_const_dynamic_symbols dynamic_symbols() const
it_exported_symbols exported_symbols()

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols() const
it_imported_symbols imported_symbols()

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols() const
it_static_symbols static_symbols()

Return statics symbols.

it_const_static_symbols static_symbols() const
it_symbols_version symbols_version()

Return the symbol versions.

it_const_symbols_version symbols_version() const
it_symbols_version_definition symbols_version_definition()

Return symbols version definition.

it_const_symbols_version_definition symbols_version_definition() const
it_symbols_version_requirement symbols_version_requirement()

Return Symbol version requirement.

it_const_symbols_version_requirement symbols_version_requirement() const
it_dynamic_relocations dynamic_relocations()

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations() const
Relocation &add_dynamic_relocation(const Relocation &relocation)

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related

See: add_pltgot_relocation

Relocation &add_pltgot_relocation(const Relocation &relocation)

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See also: add_dynamic_relocation

Relocation *add_object_relocation(const Relocation &relocation, const Section &section)

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.

it_pltgot_relocations pltgot_relocations()

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations() const
it_object_relocations object_relocations()

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations() const
it_relocations relocations()

Return all relocations present in the binary.

it_const_relocations relocations() const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. It returns a nullptr if it is not found.

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol It returns a nullptr if it is not found.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name It returns a nullptr if it is not found.

Relocation *get_relocation(const std::string &symbol_name)
bool use_gnu_hash() const

true if GNU hash is used

const GnuHash *gnu_hash() const

Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.

bool use_sysv_hash() const

true if SYSV hash is used

const SysvHash *sysv_hash() const

Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handles the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handles the given virtual address exists.

Section *get_section(const std::string &name)

Return Section with the given name. If the section can’t be found, it returns a nullptr.

const Section *get_section(const std::string &name) const
Section *text_section()

Return the .text section. If the section can’t be found, it returns a nullptr.

Section *dynamic_section()

Return the .dynamic section. If the section can’t be found, it returns a nullptr.

Section *hash_section()

Return the hash section. If the section can’t be found, it returns a nullptr.

Section *static_symbols_section()

Return section which holds static symbols. If the section can’t be found, it returns a nullptr.

virtual uint64_t imagebase() const override

Return program image base. For instance 0x40000

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size() const

Return the size of the mapped binary.

bool has_interpreter() const

Check if the binary uses a loader (also named linker or interpreter)

See also

interpreter

const std::string &interpreter() const

Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.

void interpreter(const std::string &interpreter)

Change the interpreter.

it_symbols symbols()

Return an iterator on both static and dynamic symbols.

it_const_symbols symbols() const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbols table.

const Symbol *get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.

Symbol *get_dynamic_symbol(const std::string &name)
bool has_static_symbol(const std::string &name) const

Check if the symbol with the given name exists in the static symbol table.

const Symbol *get_static_symbol(const std::string &name) const

Get the static symbol from the given name Return a nullptr if it can’t be found.

Symbol *get_static_symbol(const std::string &name)
string_list_t strings(size_t min_size = 5) const

Return list of the strings used by the ELF binary.

Basically, this function looks for string in the .roadata section

void remove_symbol(const std::string &name)

Remove symbols with the given name in both:

  • dynamic symbols

  • static symbols

void remove_static_symbol(const std::string &name)

Remove static symbols with the given name.

void remove_static_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbols table.

As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol

virtual result<uint64_t> get_function_address(const std::string &func_name) const override

Return the address of the given function name.

result<uint64_t> get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters:
  • func_name[in] The function’s name target

  • demangled[in] Use the demangled name

Section *add(const Section &section, bool loaded = true)

Add a new section in the binary.

This function requires a well-formed ELF binary

Parameters:
  • section[in] The section object to insert

  • loaded[in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment

Returns:

The section added. The size and the virtual address might change.

Section *extend(const Section &section, uint64_t size)
Symbol &add_static_symbol(const Symbol &symbol)

Add a static symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr)

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library from the dependencies.

DynamicEntryLibrary *get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

const DynamicEntryLibrary *get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment *add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

This function requires a well-formed ELF binary

Returns:

The segment added. Virtual address and File Offset might change.

Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)

Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.

Warning

The original_segment is no longer valid after this function

Segment *extend(const Segment &segment, uint64_t size)
virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • size[in] Size of the value in bytes (1, 2, … 8)

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters:
  • symbol[in] Imported symbol to patch

  • address[in] New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters:
  • symbol_name[in] Imported symbol’s name to patch

  • address[in] New address

void strip()

Strip the binary by removing static symbols.

virtual void remove_section(const std::string &name, bool clear = false) override

Remove a binary’s section.

Parameters:
  • name[in] The name of the section to remove

  • clear[in] Whether zeroize the original content

virtual void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

filename – Path for the written ELF binary

void write(const std::string &filename, Builder::config_t config)

Reconstruct the binary object with the given config and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:
  • filename – Path for the written ELF binary

  • configBuilder configuration

virtual void write(std::ostream &os) override

Reconstruct the binary object and write it in os stream.

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

os – Output stream for the written ELF binary

void write(std::ostream &os, Builder::config_t config)

Reconstruct the binary object with the given config and write it in os stream.

Parameters:
  • os – Output stream for the written ELF binary

  • configBuilder configuration

std::vector<uint8_t> raw()

Reconstruct the binary object and return its content as a byte vector.

result<uint64_t> virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to a file offset.

virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override

Convert the given offset into a virtual address.

Parameters:
  • offset[in] The offset to convert.

  • slide[in] If not 0, it will replace the default base address (if any)

virtual bool is_pie() const override

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

virtual bool has_nx() const override

Check if the binary uses the NX protection (Non executable stack)

const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const

Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_offset(uint64_t offset, bool skip_nobits = true)
const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const

Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true)
const Segment *segment_from_virtual_address(uint64_t address) const

Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.

Segment *segment_from_virtual_address(uint64_t address)
const Segment *segment_from_virtual_address(SEGMENT_TYPES type, uint64_t address) const
Segment *segment_from_virtual_address(SEGMENT_TYPES type, uint64_t address)
const Segment *segment_from_offset(uint64_t offset) const

Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.

Segment *segment_from_offset(uint64_t offset)
const DynamicEntry *get(DYNAMIC_TAGS tag) const

Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.

DynamicEntry *get(DYNAMIC_TAGS tag)
const Segment *get(SEGMENT_TYPES type) const

Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.

Segment *get(SEGMENT_TYPES type)
const Note *get(Note::TYPE type) const

Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.

Note *get(Note::TYPE type)
const Section *get(ELF_SECTION_TYPES type) const

Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.

Section *get(ELF_SECTION_TYPES type)
bool has(DYNAMIC_TAGS tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

bool has(SEGMENT_TYPES type) const

Check if ELF::Segment associated with the given type exists.

bool has(Note::TYPE type) const

Check if a ELF::Note associated with the given type exists.

bool has(ELF_SECTION_TYPES type) const

Check if a ELF::Section associated with the given type exists.

virtual span<const uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

virtual void accept(LIEF::Visitor &visitor) const override

Method associated with the visitor pattern.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

virtual LIEF::Binary::functions_t ctor_functions() const override

List of binary constructors (typically, the functions located in the .init_array)

LIEF::Binary::functions_t dtor_functions() const

List of the binary destructors (typically, the functions located in the .fini_array)

LIEF::Binary::functions_t functions() const

List of the functions found the in the binary.

bool has_notes() const

true if the binary embeds notes

it_const_notes notes() const

Return an iterator over the ELF’s LIEF::ELF::Note.

See also

has_note

it_notes notes()
uint64_t eof_offset() const

Return the last offset used by the ELF binary according to both: the sections table and the segments table.

inline bool has_overlay() const

True if data are present at the end of the binary.

span<const uint8_t> overlay() const

Overlay data (if any)

void overlay(std::vector<uint8_t> overlay)

Function to set the overlay.

uint64_t relocate_phdr_table(PHDR_RELOC type)

Force relocating the segments table in a specific way.

This function can be used to enforce a specific relocation of the segments table.

Parameters:

type[in] The relocation type to apply

Returns:

The offset of the new segments table or 0 if it fails with the given method.

size_t hash(const std::string &name)
~Binary() override
virtual std::ostream &print(std::ostream &os) const override
Binary &operator+=(const DynamicEntry &entry)
Binary &operator+=(const Section &section)
Binary &operator+=(const Segment &segment)
Binary &operator+=(const Note &note)
Binary &operator-=(const DynamicEntry &entry)
Binary &operator-=(DYNAMIC_TAGS tag)
Binary &operator-=(const Note &note)
Binary &operator-=(Note::TYPE type)
Segment *operator[](SEGMENT_TYPES type)
const Segment *operator[](SEGMENT_TYPES type) const
DynamicEntry *operator[](DYNAMIC_TAGS tag)
const DynamicEntry *operator[](DYNAMIC_TAGS tag) const
Note *operator[](Note::TYPE type)
const Note *operator[](Note::TYPE type) const
Section *operator[](ELF_SECTION_TYPES type)
const Section *operator[](ELF_SECTION_TYPES type) const

Public Static Functions

static inline bool classof(const LIEF::Binary *bin)


Section

class Section : public LIEF::Section

Class wich represents an ELF Section.

Public Types

using segments_t = std::vector<Segment*>
using it_segments = ref_iterator<segments_t&>
using it_const_segments = const_ref_iterator<const segments_t&>

Public Functions

Section(const uint8_t *data, ELF_CLASS type)
Section(const details::Elf64_Shdr &header)
Section(const details::Elf32_Shdr &header)
Section(const std::string &name, ELF_SECTION_TYPES type = ELF_SECTION_TYPES::SHT_PROGBITS)
Section()
~Section() override
Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other)
ELF_SECTION_TYPES type() const
virtual span<const uint8_t> content() const override

Section’s content.

virtual void content(const std::vector<uint8_t> &data) override

Set section content.

void content(std::vector<uint8_t> &&data)
uint64_t flags() const

Section flags LIEF::ELF::ELF_SECTION_FLAGS.

bool has(ELF_SECTION_FLAGS flag) const

True if the section has the given flag

Parameters:

flag[in] flag to test

bool has(const Segment &segment) const

True if the section is wrapped by the given Segment

std::set<ELF_SECTION_FLAGS> flags_list() const

Return section flags as a std::set

virtual uint64_t size() const override

section’s size (size in the binary, not the virtual size)

virtual void size(uint64_t size) override

Change the section size.

virtual void offset(uint64_t offset) override
virtual uint64_t offset() const override

Offset in the binary.

uint64_t file_offset() const

See also

offset

uint64_t original_size() const

Original size of the section’s data.

This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data

uint64_t alignment() const

Section file alignment.

uint64_t information() const

Section information. This meaning of this value depends on the section’s type.

uint64_t entry_size() const

This function returns the size of an element in the case of a section that contains an array.

For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.

uint32_t link() const

Index to another section.

Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(ELF_SECTION_FLAGS flag)

Add the given ELF_SECTION_FLAGS.

void remove(ELF_SECTION_FLAGS flag)

Remove the given ELF_SECTION_FLAGS.

void type(ELF_SECTION_TYPES type)
void flags(uint64_t flags)
void clear_flags()
void file_offset(uint64_t offset)
void link(uint32_t link)
void information(uint32_t info)
void alignment(uint64_t alignment)
void entry_size(uint64_t entry_size)
it_segments segments()
it_const_segments segments() const
inline Section &as_frame()
inline bool is_frame() const
virtual void accept(Visitor &visitor) const override
Section &operator+=(ELF_SECTION_FLAGS c)
Section &operator-=(ELF_SECTION_FLAGS c)

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class Segment : public LIEF::Object

Class which represents the ELF segments.

Public Types

using sections_t = std::vector<Section*>
using it_sections = ref_iterator<sections_t&>
using it_const_sections = const_ref_iterator<const sections_t&>

Public Functions

Segment()
Segment(const details::Elf64_Phdr &header)
Segment(const details::Elf32_Phdr &header)
~Segment() override
Segment &operator=(Segment other)
Segment(const Segment &other)
Segment &operator=(Segment&&)
Segment(Segment&&)
void swap(Segment &other)
SEGMENT_TYPES type() const

The segment’s type (LOAD, DYNAMIC, …)

ELF_SEGMENT_FLAGS flags() const

The flag permissions associated with this segment.

uint64_t file_offset() const

The file offset of the data associated with this segment.

uint64_t virtual_address() const

The virtual address of the segment.

uint64_t physical_address() const

The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.

Usually this value matches virtual_address

uint64_t physical_size() const

The file size of the data associated with this segment.

uint64_t virtual_size() const

The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.

uint64_t alignment() const

The offset alignment of the segment.

span<const uint8_t> content() const

The raw data associated with this segment.

bool has(ELF_SEGMENT_FLAGS flag) const

Check if the current segment has the given flag.

bool has(const Section &section) const

Check if the current segment wraps the given ELF::Section.

bool has(const std::string &section_name) const

Check if the current segment wraps the given section’s name.

void add(ELF_SEGMENT_FLAGS flag)

Append the given ELF_SEGMENT_FLAGS.

void remove(ELF_SEGMENT_FLAGS flag)

Remove the given ELF_SEGMENT_FLAGS.

void type(SEGMENT_TYPES type)
void flags(ELF_SEGMENT_FLAGS flags)
void clear_flags()
void file_offset(uint64_t file_offset)
void virtual_address(uint64_t virtual_address)
void physical_address(uint64_t physical_address)
void physical_size(uint64_t physical_size)
void virtual_size(uint64_t virtual_size)
void alignment(uint64_t alignment)
void content(std::vector<uint8_t> content)
template<typename T>
T get_content_value(size_t offset) const
template<typename T>
void set_content_value(size_t offset, T value)
size_t get_content_size() const
it_sections sections()

Iterator over the sections wrapped by this segment.

it_const_sections sections() const
virtual void accept(Visitor &visitor) const override
Segment &operator+=(ELF_SEGMENT_FLAGS flag)
Segment &operator-=(ELF_SEGMENT_FLAGS flag)

Public Static Functions

static result<Segment> from_raw(const uint8_t *ptr, size_t size)
static result<Segment> from_raw(const std::vector<uint8_t> &raw)

Friends

friend std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class DynamicEntry : public LIEF::Object

Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Functions

DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&)
DynamicEntry(const DynamicEntry&)
~DynamicEntry() override
DYNAMIC_TAGS tag() const

Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …

uint64_t value() const

Return the entry’s value.

The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …

void tag(DYNAMIC_TAGS tag)
void value(uint64_t value)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const

Friends

friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Class which represents a DT_NEEDED entry in the dynamic table.

This kind of entry is usually used to create library dependency.

Public Functions

DynamicEntryLibrary()
DynamicEntryLibrary(std::string name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&)
DynamicEntryLibrary(const DynamicEntryLibrary&)
const std::string &name() const

Return the library associated with this entry (e.g. libc.so.6)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Shared Object

class DynamicSharedObject : public LIEF::ELF::DynamicEntry

Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used no name the original library.

This entry is not present for executable.

Public Functions

DynamicSharedObject()
DynamicSharedObject(std::string name)
DynamicSharedObject &operator=(const DynamicSharedObject&)
DynamicSharedObject(const DynamicSharedObject&)
const std::string &name() const

The actual name (e.g. libMyLib.so)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Entry Run Path

class DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).

Public Functions

DynamicEntryRunPath()
DynamicEntryRunPath(std::string runpath)

Constructor from (run)path.

DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&)
DynamicEntryRunPath(const DynamicEntryRunPath&)
const std::string &name() const

Runpath raw value.

void name(const std::string &name)
const std::string &runpath() const

Runpath raw value.

void runpath(const std::string &runpath)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

DynamicEntryRunPath &operator+=(const std::string &path)
DynamicEntryRunPath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry RPath

class DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)

Public Functions

DynamicEntryRpath()
DynamicEntryRpath(std::string rpath)
DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&)
DynamicEntryRpath(const DynamicEntryRpath&)
const std::string &name() const

The actual rpath as a string.

void name(const std::string &name)
const std::string &rpath() const

The actual rpath as a string.

void rpath(const std::string &name)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

DynamicEntryRpath &operator+=(const std::string &path)
DynamicEntryRpath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry Array

class DynamicEntryArray : public LIEF::ELF::DynamicEntry

Class that represent an Array in the dynamic table. This entry is associated with constructors:

  • DT_PREINIT_ARRAY

  • DT_INIT_ARRAY

  • DT_FINI_ARRAY

The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray()
DynamicEntryArray(DYNAMIC_TAGS tag, array_t array)
DynamicEntryArray &operator=(const DynamicEntryArray&)
DynamicEntryArray(const DynamicEntryArray&)
array_t &array()

Return the array values (list of pointer)

const array_t &array() const
void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t function)

Insert the given function at pos

DynamicEntryArray &append(uint64_t function)

Append the given function.

DynamicEntryArray &remove(uint64_t function)

Remove the given function.

size_t size() const

Number of function registred in this array.

DynamicEntryArray &operator+=(uint64_t value)
DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryArray() override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Entry Flags

class DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

using flags_list_t = std::set<uint32_t>

Public Functions

DynamicEntryFlags()
DynamicEntryFlags &operator=(const DynamicEntryFlags&)
DynamicEntryFlags(const DynamicEntryFlags&)
bool has(DYNAMIC_FLAGS f) const

If the current entry has the given DYNAMIC_FLAGS.

bool has(DYNAMIC_FLAGS_1 f) const

If the current entry has the given DYNAMIC_FLAGS_1.

flags_list_t flags() const

Return flags as a list of integers.

void add(DYNAMIC_FLAGS f)

Add the given DYNAMIC_FLAGS.

void add(DYNAMIC_FLAGS_1 f)

Add the given DYNAMIC_FLAGS_1.

void remove(DYNAMIC_FLAGS f)

Remove the given DYNAMIC_FLAGS.

void remove(DYNAMIC_FLAGS_1 f)

Remove the given DYNAMIC_FLAGS_1.

DynamicEntryFlags &operator+=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator+=(DYNAMIC_FLAGS_1 f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS_1 f)
virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Relocations

class Relocation : public LIEF::Relocation

Class that represents an ELF relocation.

Public Functions

Relocation(const details::Elf32_Rel &header)
Relocation(const details::Elf32_Rela &header)
Relocation(const details::Elf64_Rel &header)
Relocation(const details::Elf64_Rela &header)
Relocation(uint64_t address, uint32_t type = 0, int64_t addend = 0, bool isRela = false)
template<class T, typename = typename std::enable_if<std::is_enum<T>::value>::type>
inline Relocation(uint64_t address, T type, int64_t addend = 0, bool isRela = false)
Relocation()
Relocation(ARCH arch)
~Relocation() override
Relocation &operator=(Relocation other)
Relocation(const Relocation &other)
void swap(Relocation &other)
int64_t addend() const

Additional value that can be involved in the relocation processing.

uint32_t type() const

Type of the relocation This type depends on the underlying architecture which can be accessed with architecture().

Depending on the architecture, it can return:

  • RELOC_x86_64

  • RELOC_i386

  • RELOC_POWERPC32

  • RELOC_POWERPC64

  • RELOC_AARCH64

  • RELOC_ARM

  • RELOC_MIPS

  • RELOC_HEXAGON

  • RELOC_SYSTEMZ

  • RELOC_SPARC

  • RELOC_LOONGARCH

bool is_rela() const

Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)

bool is_rel() const

Check if the relocation uses the implicit added (i.e. not present in the ELF structure)

uint32_t info() const

Relocation info which contains for instance the symbol index.

ARCH architecture() const
RELOCATION_PURPOSES purpose() const
virtual size_t size() const override

Return the size (in bits) of the value associated with this relocation.

Return -1 if it fails

bool has_symbol() const

True if the current relocation is associated with a symbol.

Symbol *symbol()

Symbol associated with the relocation If no symbol is tied to this relocation, it returns a nullptr.

const Symbol *symbol() const
bool has_section() const

True if the relocation has an associated section.

Section *section()

The section to which the relocation applies. If no section to which the relocation applies is associtated to this relocation, it returns a nullptr.

const Section *section() const
Section *symbol_table()

The associated symbol table. If no symbol table section is associated with this relocation, it returns a nullptr.

const Section *symbol_table() const
void addend(int64_t addend)
void type(uint32_t type)
void purpose(RELOCATION_PURPOSES purpose)
void info(uint32_t v)
void symbol(Symbol *symbol)
void section(Section *section)
void symbol_table(Section *section)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &entry)

Symbol

class Symbol : public LIEF::Symbol

Class which represents an ELF symbol.

Public Functions

Symbol(const details::Elf32_Sym &header, ARCH arch)
Symbol(const details::Elf64_Sym &header, ARCH arch)
Symbol(std::string name, ELF_SYMBOL_TYPES type = ELF_SYMBOL_TYPES::STT_NOTYPE, SYMBOL_BINDINGS binding = SYMBOL_BINDINGS::STB_WEAK, uint8_t other = 0, uint16_t shndx = 0, uint64_t value = 0, uint64_t size = 0)
Symbol()
~Symbol() override
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
ELF_SYMBOL_TYPES type() const

The symbol’s type provides a general classification for the associated entity.

SYMBOL_BINDINGS binding() const

The symbol’s binding determines the linkage visibility and behavior.

uint8_t information() const

This member specifies the symbol’s type and binding attributes.

uint8_t other() const

Alias for visibility()

uint16_t section_idx() const

ELF::Section index associated with the symbol.

ELF_SYMBOL_VISIBILITY visibility() const

Symbol visibility.

Section *section()

Section associated with the symbol or a nullptr if it does not exist.

inline virtual uint64_t value() const override

This member has slightly different interpretations:

  • In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON

  • In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.

  • In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.

inline virtual uint64_t size() const override

Symbol size.

Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.

uint16_t shndx() const

bool has_version() const

Check if this symbols has a symbol version .

SymbolVersion *symbol_version()

Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.

const SymbolVersion *symbol_version() const
std::string demangled_name() const

Symbol’s unmangled name. If not available, it returns an empty string.

void type(ELF_SYMBOL_TYPES type)
void binding(SYMBOL_BINDINGS binding)
void other(uint8_t other)
void visibility(ELF_SYMBOL_VISIBILITY visibility)
void information(uint8_t info)
void shndx(uint16_t idx)
inline virtual void value(uint64_t value) override
inline virtual void size(uint64_t size) override
inline void shndx(SYMBOL_SECTION_INDEX idx)
bool is_exported() const

Check if the current symbol is exported.

void set_exported(bool flag = true)

Set whether or not the symbol is exported.

bool is_imported() const

Check if the current symbol is imported.

void set_imported(bool flag = true)

Set whether or not the symbol is imported.

inline bool is_static() const

True if the symbol is a static one.

inline bool is_function() const

True if the symbol represent a function.

inline bool is_variable() const

True if the symbol represent a variable.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Symbol &entry)

Symbol Version

class SymbolVersion : public LIEF::Object

Class which represents an entry defined in the DT_VERSYM dynamic entry.

Public Functions

SymbolVersion(uint16_t value)
SymbolVersion()
~SymbolVersion() override
SymbolVersion &operator=(const SymbolVersion&)
SymbolVersion(const SymbolVersion&)
uint16_t value() const

Value associated with the symbol.

If the given SymbolVersion hasn’t Auxiliary version:

  • 0 means Local

  • 1 means Global

bool has_auxiliary_version() const

Whether the current SymbolVersion has an auxiliary one.

SymbolVersionAux *symbol_version_auxiliary()

SymbolVersionAux associated with the current Version if any, or a nullptr.

const SymbolVersionAux *symbol_version_auxiliary() const
void symbol_version_auxiliary(SymbolVersionAuxRequirement &svauxr)

Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.

On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement

void value(uint16_t v)
virtual void accept(Visitor &visitor) const override

Public Static Functions

static SymbolVersion local()

Generate a local SymbolVersion.

static SymbolVersion global()

Generate a global SymbolVersion.

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)

Symbol Version Auxiliary

class SymbolVersionAux : public LIEF::Object

Class which represents an Auxiliary Symbol version.

Subclassed by LIEF::ELF::SymbolVersionAuxRequirement

Public Functions

SymbolVersionAux(std::string name)
SymbolVersionAux()
~SymbolVersionAux() override
SymbolVersionAux &operator=(const SymbolVersionAux&)
SymbolVersionAux(const SymbolVersionAux&)
const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &symAux)

Symbol Version Definition

class SymbolVersionDefinition : public LIEF::Object

Class which represents an entry defined in DT_VERDEF or .gnu.version_d

Public Types

using version_aux_t = std::vector<std::unique_ptr<SymbolVersionAux>>
using it_version_aux = ref_iterator<version_aux_t&, SymbolVersionAux*>
using it_const_version_aux = const_ref_iterator<const version_aux_t&, const SymbolVersionAux*>

Public Functions

SymbolVersionDefinition()
SymbolVersionDefinition(const details::Elf64_Verdef &header)
SymbolVersionDefinition(const details::Elf32_Verdef &header)
~SymbolVersionDefinition() override
SymbolVersionDefinition &operator=(SymbolVersionDefinition other)
SymbolVersionDefinition(const SymbolVersionDefinition &other)
void swap(SymbolVersionDefinition &other)
uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

uint16_t flags() const

Version information.

uint16_t ndx() const

Version index.

Numeric value used as an index in the LIEF::ELF::SymbolVersion table

uint32_t hash() const

Hash value of the symbol’s name (using ELF hash function)

it_version_aux symbols_aux()

SymbolVersionAux entries.

it_const_version_aux symbols_aux() const
void version(uint16_t version)
void flags(uint16_t flags)
void hash(uint32_t hash)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionDefinition &sym)

Symbol Version Requirement

class SymbolVersionRequirement : public LIEF::Object

Class which represents an entry in the DT_VERNEED or .gnu.version_r table.

Public Types

using aux_requirement_t = std::vector<std::unique_ptr<SymbolVersionAuxRequirement>>
using it_aux_requirement = ref_iterator<aux_requirement_t&, SymbolVersionAuxRequirement*>
using it_const_aux_requirement = const_ref_iterator<const aux_requirement_t&, const SymbolVersionAuxRequirement*>

Public Functions

SymbolVersionRequirement()
SymbolVersionRequirement(const details::Elf64_Verneed &header)
SymbolVersionRequirement(const details::Elf32_Verneed &header)
~SymbolVersionRequirement() override
SymbolVersionRequirement &operator=(SymbolVersionRequirement other)
SymbolVersionRequirement(const SymbolVersionRequirement &other)
void swap(SymbolVersionRequirement &other)
uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

uint32_t cnt() const

Number of associated auxiliary entries.

it_aux_requirement auxiliary_symbols()

Auxiliary entries as an iterator over SymbolVersionAuxRequirement.

it_const_aux_requirement auxiliary_symbols() const
const std::string &name() const

Return the library name associated with this requirement (e.g. libc.so.6)

void version(uint16_t version)
void name(const std::string &name)
SymbolVersionAuxRequirement &add_aux_requirement(const SymbolVersionAuxRequirement &aux_requirement)

Add a version auxiliary requirement to the existing list.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionRequirement &symr)

Symbol Version Auxiliary Requirement

class SymbolVersionAuxRequirement : public LIEF::ELF::SymbolVersionAux

Public Functions

SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header)
SymbolVersionAuxRequirement(const details::Elf32_Vernaux &header)
SymbolVersionAuxRequirement()
SymbolVersionAuxRequirement &operator=(const SymbolVersionAuxRequirement&)
SymbolVersionAuxRequirement(const SymbolVersionAuxRequirement&)
~SymbolVersionAuxRequirement() override
uint32_t hash() const

Hash value of the dependency name (use ELF hashing function)

uint16_t flags() const

Bitmask of flags.

uint16_t other() const

It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.

void hash(uint32_t hash)
void flags(uint16_t flags)
void other(uint16_t other)
virtual void accept(Visitor &visitor) const override
const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAuxRequirement &symAux)

GNU Hash table

class GnuHash : public LIEF::Object

Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.

Public Functions

GnuHash()
GnuHash(uint32_t symbol_idx, uint32_t shift2, std::vector<uint64_t> bloom_filters, std::vector<uint32_t> buckets, std::vector<uint32_t> hash_values = {})
GnuHash &operator=(const GnuHash &copy)
GnuHash(const GnuHash &copy)
GnuHash(GnuHash&&)
GnuHash &operator=(GnuHash&&)
~GnuHash() override
uint32_t nb_buckets() const

Return the number of buckets.

uint32_t symbol_index() const

Index of the first symbol in the dynamic symbols table which accessible with the hash table.

uint32_t shift2() const

Shift count used in the bloom filter.

uint32_t maskwords() const

Number of bloom filters used. It must be a power of 2.

const std::vector<uint64_t> &bloom_filters() const

Bloom filters.

const std::vector<uint32_t> &buckets() const

Hash buckets.

const std::vector<uint32_t> &hash_values() const

Hash values.

bool check_bloom_filter(uint32_t hash) const

Check if the given hash passes the bloom filter.

bool check_bucket(uint32_t hash) const

Check if the given hash passes the bucket filter.

bool check(const std::string &symbol_name) const

Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.

bool check(uint32_t hash) const

Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.

virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash)

SYSV Hash table

class SysvHash : public LIEF::Object

Class which represents the SYSV hash for the symbols resolution.

References:

Public Functions

SysvHash()
SysvHash &operator=(const SysvHash &copy)
SysvHash(const SysvHash &copy)
SysvHash &operator=(SysvHash&&)
SysvHash(SysvHash&&)
~SysvHash() override
uint32_t nbucket() const

Return the number of buckets used.

uint32_t nchain() const

Return the number of chain used.

const std::vector<uint32_t> &buckets() const

Buckets values.

const std::vector<uint32_t> &chains() const

Chains values.

inline void nchain(uint32_t nb)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash)

Note

class Note : public LIEF::Object

Class which represents an ELF note. This class can be instantiated using the static Note::create functions.

Subclassed by LIEF::ELF::AndroidIdent, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi

Public Types

enum class TYPE

LIEF representation of the ELF NT_ values.

Values:

enumerator UNKNOWN = 0
enumerator GNU_ABI_TAG

Match NT_GNU_ABI_TAG: Operating system (OS) ABI information.

See: NoteAbi

enumerator GNU_HWCAP

Match NT_HWCAP: Synthetic hardware capabilities information.

enumerator GNU_BUILD_ID

Match NT_GNU_BUILD_ID: Unique build ID as generated by the GNU ld.

enumerator GNU_GOLD_VERSION

Match NT_GNU_GOLD_VERSION: The version of gold used to link.

enumerator GNU_PROPERTY_TYPE_0

Match NT_GNU_PROPERTY_TYPE_0: Program property note, as described in “Linux Extensions to the gABI”.

enumerator GNU_BUILD_ATTRIBUTE_OPEN
enumerator GNU_BUILD_ATTRIBUTE_FUNC
enumerator CRASHPAD

Crashpad note used by the Chromium project.

enumerator CORE_PRSTATUS

Coredump that wraps the elf_prstatus structure.

enumerator CORE_FPREGSET
enumerator CORE_PRPSINFO

Coredump that wraps the elf_prpsinfo structure.

See: CorePrPsInfo

enumerator CORE_TASKSTRUCT
enumerator CORE_AUXV

Coredump that contains a copy of all the auxiliary vectors (auxv)

See: CoreAuxv

enumerator CORE_PSTATUS
enumerator CORE_FPREGS

Coredump that wraps the fpregset structure.

enumerator CORE_PSINFO

Coredump that wraps the psinfo structure.

enumerator CORE_LWPSTATUS
enumerator CORE_LWPSINFO
enumerator CORE_WIN32PSTATUS
enumerator CORE_FILE
enumerator CORE_PRXFPREG
enumerator CORE_SIGINFO
enumerator CORE_ARM_VFP
enumerator CORE_ARM_TLS
enumerator CORE_ARM_HW_BREAK
enumerator CORE_ARM_HW_WATCH
enumerator CORE_ARM_SYSTEM_CALL
enumerator CORE_ARM_SVE
enumerator CORE_ARM_PAC_MASK
enumerator CORE_ARM_PACA_KEYS
enumerator CORE_ARM_PACG_KEYS
enumerator CORE_TAGGED_ADDR_CTRL
enumerator CORE_PAC_ENABLED_KEYS
enumerator CORE_X86_TLS
enumerator CORE_X86_IOPERM
enumerator CORE_X86_XSTATE
enumerator CORE_X86_CET
enumerator ANDROID_IDENT

Note that is specific to Android and that describes information such as the NDK version or the SDK build number.

See AndroidIdent

enumerator ANDROID_MEMTAG
enumerator ANDROID_KUSER
enumerator GO_BUILDID

Note specific to Go binaries.

enumerator STAPSDT

Note for SystemTap probes.

using description_t = std::vector<uint8_t>

Container used to handle the description data.

Public Functions

Note &operator=(const Note &copy) = default
Note(const Note &copy) = default
~Note() override = default
inline virtual std::unique_ptr<Note> clone() const

Clone the current note and keep its polymorphic type.

inline const std::string &name() const

Return the name of the note (also known as ‘owner’ )

inline TYPE type() const

Return the type of the note. This type does not match the NT_ type value. For accessing the original NT_ value, check original_type()

inline uint32_t original_type() const

The original NT_xxx integer value. The meaning of this value likely depends on the owner of the note.

inline span<const uint8_t> description() const

Return the description associated with the note.

inline span<uint8_t> description()
inline void name(std::string name)
inline void description(description_t description)

Change the description of the note.

uint64_t size() const

Size of the raw note which includes padding.

virtual void dump(std::ostream &os) const
virtual void accept(Visitor &visitor) const override

Public Static Functions

static result<TYPE> convert_type(E_TYPE ftype, uint32_t type, const std::string &name)

Convert the raw integer note type into a TYPE according to the owner.

static result<const char*> type_to_section(TYPE type)

Try to determine the ELF section name associated with the TYPE provided in parameter.

static inline result<const char*> note_to_section(const Note &note)
static result<const char*> type_owner(TYPE type)

Try to determine the owner’s name of the TYPE provided in parameter.

static std::unique_ptr<Note> create(const std::string &name, uint32_t type, description_t description, E_TYPE ftype = E_TYPE::ET_NONE, ARCH arch = ARCH::EM_NONE, ELF_CLASS cls = ELF_CLASS::ELFCLASSNONE)

Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

static std::unique_ptr<Note> create(const std::string &name, TYPE type, description_t description, ARCH arch = ARCH::EM_NONE, ELF_CLASS cls = ELF_CLASS::ELFCLASSNONE)

Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

static std::unique_ptr<Note> create(BinaryStream &stream, E_TYPE ftype = E_TYPE::ET_NONE, ARCH arch = ARCH::EM_NONE, ELF_CLASS cls = ELF_CLASS::ELFCLASSNONE)

Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.

Friends

inline friend std::ostream &operator<<(std::ostream &os, const Note &note)

Core PrPsInfo

class CorePrPsInfo : public LIEF::ELF::Note

Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process.

Public Functions

inline CorePrPsInfo(ARCH arch, ELF_CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

result<info_t> info() const

Return a elf_prpsinfo-like structure or an error if it can’t be parsed.

void info(const info_t &info)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CorePrPsInfo() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo &note)
struct info_t

Public Functions

inline std::string filename_stripped() const

Initial part of the arguments.

Return the filename without the ending ‘\x00’

inline std::string args_stripped() const

Return the args without the ending ‘\x00’.

Public Members

uint8_t state = 0
char sname = ' '

Numeric process state.

bool zombie = false

printable character representing state

uint8_t nice = 0

Whether the process is a zombie.

uint64_t flag = 0

Nice value.

uint32_t uid = 0

Process flag.

uint32_t gid = 0

Process user ID.

uint32_t pid = 0

Process group ID.

uint32_t ppid = 0

Process ID.

uint32_t pgrp = 0

Process parent ID.

uint32_t sid = 0

Process group.

std::string filename

Process session id.

std::string args

Filename of the executable.


Core File

class CoreFile : public LIEF::ELF::Note

Class representing a core NT_FILE which describes the mapped files of the process.

Public Types

using files_t = std::vector<entry_t>
using iterator = files_t::iterator
using const_iterator = files_t::const_iterator

Public Functions

CoreFile(ARCH arch, ELF_CLASS cls, std::string name, uint32_t type, Note::description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

inline uint64_t count() const

Number of coredump file entries.

inline const files_t &files() const

Coredump file entries.

inline iterator begin()
inline iterator end()
inline const_iterator begin() const
inline const_iterator end() const
void files(const files_t &file)
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
~CoreFile() override = default

Public Static Functions

static inline bool classof(const Note *note)

Friends

inline friend std::ostream &operator<<(std::ostream &os, const CoreFile &note)
struct entry_t

Core file entry.

Public Members

uint64_t start = 0
uint64_t end = 0

Start address of mapped file.

End address of mapped file

uint64_t file_ofs = 0

Offset (in core) of mapped file.

std::string path

Path of mapped file.

Friends

friend std::ostream &operator<<(std::ostream &os, const entry_t &entry)

Core PrStatus

class CorePrStatus : public LIEF::ELF::Note

Class representing core PrPsInfo object.

Public Functions

inline CorePrStatus(ARCH arch, ELF_CLASS cls, std::string name, uint32_t type, description_t description)
inline virtual std::unique_ptr<Note> clone() const override

Clone the current note and keep its polymorphic type.

pr_status_t status() const

Return the pr_status_t structure.

void status(const pr_status_t &status)
inline ARCH architecture() const
result<uint64_t> pc() const

The program counter or an error if not found.

result<uint64_t> sp() const

The stack pointer or an error if not found.

result<uint64_t> return_value() const

The value of the register that holds the return value according to the calling convention.