ELF

Parser

class LIEF::ELF::Parser : public LIEF::Parser

Class which parses and transforms an ELF file into a ELF::Binary object.

Subclassed by LIEF::OAT::Parser

Public Functions

Parser &operator=(const Parser&) = delete
Parser(const Parser&) = delete

Public Static Functions

static std::unique_ptr<Binary> parse(const std::string &file, DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse an ELF file and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols

Parameters
Returns

LIEF::ELF::Binary

static std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const std::string &name = "", DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters
  • data[in] Raw ELF

  • name[in] Binary name (optional)

  • count_mtd[in] Method used to count dynamic symbols.

Returns

LIEF::ELF::Binary

Public Static Attributes

static constexpr uint32_t NB_MAX_SYMBOLS = 1000000
static constexpr uint32_t DELTA_NB_SYMBOLS = 3000
static constexpr uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
static constexpr uint32_t NB_MAX_CHAINS = 1000000
static constexpr uint32_t NB_MAX_SEGMENTS = 10000
static constexpr uint32_t NB_MAX_RELOCATIONS = 3000000
static constexpr uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
static constexpr uint32_t NB_MAX_MASKWORD = 512
static constexpr uint32_t MAX_NOTE_DESCRIPTION = 1_MB
static constexpr uint32_t MAX_SECTION_SIZE = 2_GB
static constexpr uint32_t MAX_SEGMENT_SIZE = 3_GB

Friends

friend class OAT::Parser
friend struct ::Profiler

Binary

class LIEF::ELF::Binary : public LIEF::Binary

Class which represents an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

using string_list_t = std::vector<std::string>
using overlay_t = std::vector<uint8_t>
using notes_t = std::vector<std::unique_ptr<Note>>

Internal container for storing notes.

using it_notes = ref_iterator<notes_t&, Note*>

Iterator which outputs Note& object.

using it_const_notes = const_ref_iterator<const notes_t&, const Note*>

Iterator which outputs const Note& object.

using symbols_version_requirement_t = std::vector<std::unique_ptr<SymbolVersionRequirement>>

Internal container for storing SymbolVersionRequirement.

using it_symbols_version_requirement = ref_iterator<symbols_version_requirement_t&, SymbolVersionRequirement*>

Iterator which outputs SymbolVersionRequirement& object.

using it_const_symbols_version_requirement = const_ref_iterator<const symbols_version_requirement_t&, const SymbolVersionRequirement*>

Iterator which outputs const SymbolVersionRequirement& object.

using symbols_version_definition_t = std::vector<std::unique_ptr<SymbolVersionDefinition>>

Internal container for storing SymbolVersionDefinition.

using it_symbols_version_definition = ref_iterator<symbols_version_definition_t&, SymbolVersionDefinition*>

Iterator which outputs SymbolVersionDefinition& object.

using it_const_symbols_version_definition = const_ref_iterator<const symbols_version_definition_t&, const SymbolVersionDefinition*>

Iterator which outputs const SymbolVersionDefinition& object.

using segments_t = std::vector<std::unique_ptr<Segment>>

Internal container for storing ELF’s Segment.

using it_segments = ref_iterator<segments_t&, Segment*>

Iterator which outputs Segment& object.

using it_const_segments = const_ref_iterator<const segments_t&, const Segment*>

Iterator which outputs const Segment& object.

using dynamic_entries_t = std::vector<std::unique_ptr<DynamicEntry>>

Internal container for storing ELF’s DynamicEntry.

using it_dynamic_entries = ref_iterator<dynamic_entries_t&, DynamicEntry*>

Iterator which outputs DynamicEntry& object.

using it_const_dynamic_entries = const_ref_iterator<const dynamic_entries_t&, const DynamicEntry*>

Iterator which outputs const DynamicEntry& object.

using symbols_version_t = std::vector<std::unique_ptr<SymbolVersion>>

Internal container for storing ELF’s SymbolVersion.

using it_symbols_version = ref_iterator<symbols_version_t&, SymbolVersion*>

Iterator which outputs SymbolVersion& object.

using it_const_symbols_version = const_ref_iterator<const symbols_version_t&, const SymbolVersion*>

Iterator which outputs const SymbolVersion& object.

using relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing ELF’s Relocation.

using it_pltgot_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs plt/got Relocation& object.

using it_const_pltgot_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs plt/got const Relocation& object.

using it_dynamic_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)

using it_const_dynamic_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)

using it_object_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object found in object files (.o)

using it_const_object_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object found in object files (.o)

using it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object.

using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object.

using symbols_t = std::vector<std::unique_ptr<Symbol>>

Internal container for storing ELF’s Symbol.

using it_dynamic_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the Dynamic Symbol& object.

using it_const_dynamic_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the Dynamic const Symbol& object.

using it_static_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the static/debug Symbol& object.

using it_const_static_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the static/debug const Symbol& object.

using it_symbols = ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic Symbol& object.

using it_const_symbols = const_ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic const Symbol& object.

using it_exported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported Symbol& object.

using it_const_exported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported const Symbol& object.

using it_imported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported Symbol& object.

using it_const_imported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported const Symbol& object.

using sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing ELF’s Section.

using it_sections = ref_iterator<sections_t&, Section*>

Iterator which outputs Section& object.

using it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator which outputs const Section& object.

Public Functions

Binary &operator=(const Binary&) = delete
Binary(const Binary &copy) = delete
ELF_CLASS type() const

Return binary’s class (ELF32 or ELF64)

Header &header()

Return Elf header .

const Header &header() const
uint64_t last_offset_section() const

Return the last offset used in binary according to sections table.

uint64_t last_offset_segment() const

Return the last offset used in binary according to segments table.

uint64_t next_virtual_address() const

Return the next virtual address available.

it_sections sections()

Return an iterator over the binary’s sections.

it_const_sections sections() const
virtual uint64_t entrypoint() const override

Return the binary’s entrypoint.

it_segments segments()

Return binary’s segments.

it_const_segments segments() const
it_dynamic_entries dynamic_entries()

Return binary’s dynamic entries.

it_const_dynamic_entries dynamic_entries() const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the new entry.

Note &add(const Note &note)

Add the given note and return the created entry.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DYNAMIC_TAGS tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section. The clear parameter can be used to zeroize the original content beforehand.

Parameters
  • section[in] The section to remove

  • clear[in] Whether zeroize the original content

void remove(const Note &note)

Remove the given note.

void remove(NOTE_TYPES type)

Remove all notes with the given type.

void remove(const Segment &seg)

Remove the given segment.

it_dynamic_symbols dynamic_symbols()

Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.

it_const_dynamic_symbols dynamic_symbols() const
it_exported_symbols exported_symbols()

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols() const
it_imported_symbols imported_symbols()

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols() const
it_static_symbols static_symbols()

Return statics symbols.

it_const_static_symbols static_symbols() const
it_symbols_version symbols_version()

Return the symbol versions.

it_const_symbols_version symbols_version() const
it_symbols_version_definition symbols_version_definition()

Return symbols version definition.

it_const_symbols_version_definition symbols_version_definition() const
it_symbols_version_requirement symbols_version_requirement()

Return Symbol version requirement.

it_const_symbols_version_requirement symbols_version_requirement() const
it_dynamic_relocations dynamic_relocations()

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations() const
Relocation &add_dynamic_relocation(const Relocation &relocation)

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related

See: add_pltgot_relocation

Relocation &add_pltgot_relocation(const Relocation &relocation)

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See also: add_dynamic_relocation

Relocation *add_object_relocation(const Relocation &relocation, const Section &section)

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.

it_pltgot_relocations pltgot_relocations()

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations() const
it_object_relocations object_relocations()

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations() const
it_relocations relocations()

Return all relocations present in the binary.

it_const_relocations relocations() const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. It returns a nullptr if it is not found.

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol It returns a nullptr if it is not found.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name It returns a nullptr if it is not found.

Relocation *get_relocation(const std::string &symbol_name)
bool use_gnu_hash() const

true if GNU hash is used

const GnuHash *gnu_hash() const

Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.

bool use_sysv_hash() const

true if SYSV hash is used

const SysvHash *sysv_hash() const

Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handles the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handles the given virtual address exists.

Section *get_section(const std::string &name)

Return Section with the given name. If the section can’t be found, it returns a nullptr.

const Section *get_section(const std::string &name) const
Section *text_section()

Return the .text section. If the section can’t be found, it returns a nullptr.

Section *dynamic_section()

Return the .dynamic section. If the section can’t be found, it returns a nullptr.

Section *hash_section()

Return the hash section. If the section can’t be found, it returns a nullptr.

Section *static_symbols_section()

Return section which holds static symbols. If the section can’t be found, it returns a nullptr.

virtual uint64_t imagebase() const override

Return program image base. For instance 0x40000

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size() const

Return the size of the mapped binary.

bool has_interpreter() const

Check if the binary uses a loader (also named linker or interpreter)

See also

interpreter

const std::string &interpreter() const

Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.

void interpreter(const std::string &interpreter)

Change the interpreter.

it_symbols symbols()

Return an iterator on both static and dynamic symbols.

it_const_symbols symbols() const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbols table.

const Symbol *get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.

Symbol *get_dynamic_symbol(const std::string &name)
bool has_static_symbol(const std::string &name) const

Check if the symbol with the given name exists in the static symbol table.

const Symbol *get_static_symbol(const std::string &name) const

Get the static symbol from the given name Return a nullptr if it can’t be found.

Symbol *get_static_symbol(const std::string &name)
string_list_t strings(size_t min_size = 5) const

Return list of the strings used by the ELF binary.

Basically, this function looks for string in the .roadata section

void remove_symbol(const std::string &name)

Remove symbols with the given name in both:

  • dynamic symbols

  • static symbols

void remove_static_symbol(const std::string &name)

Remove static symbols with the given name.

void remove_static_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbols table.

As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol

virtual result<uint64_t> get_function_address(const std::string &func_name) const override

Return the address of the given function name.

result<uint64_t> get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters
  • func_name[in] The function’s name target

  • demangled[in] Use the demangled name

Section *add(const Section &section, bool loaded = true)

Add a new section in the binary.

Parameters
  • section[in] The section object to insert

  • loaded[in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment

Returns

The section added. The size and the virtual address might change.

Section *extend(const Section &section, uint64_t size)
Symbol &add_static_symbol(const Symbol &symbol)

Add a static symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr)

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library from the dependencies.

DynamicEntryLibrary *get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

const DynamicEntryLibrary *get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment *add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

Returns

The segment added. Virtual address and File Offset might change.

Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)

Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.

Warning

The original_segment is no longer valid after this function

Segment *extend(const Segment &segment, uint64_t size)
virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • size[in] Size of the value in bytes (1, 2, … 8)

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters
  • symbol[in] Imported symbol to patch

  • address[in] New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters
  • symbol_name[in] Imported symbol’s name to patch

  • address[in] New address

void strip()

Strip the binary by removing static symbols.

virtual void remove_section(const std::string &name, bool clear = false) override

Remove a binary’s section.

Parameters
  • name[in] The name of the section to remove

  • clear[in] Whether zeroize the original content

virtual void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

Parameters

filename – Path for the written ELF binary

virtual void write(std::ostream &os) override

Reconstruct the binary object and write it in os stream.

Parameters

Output – stream for the written ELF binary

std::vector<uint8_t> raw()

Reconstruct the binary object and return its content as a byte vector.

result<uint64_t> virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to a file offset.

virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override

Convert the given offset into a virtual address.

Parameters
  • offset[in] The offset to convert.

  • slide[in] If not 0, it will replace the default base address (if any)

virtual bool is_pie() const override

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

virtual bool has_nx() const override

Check if the binary uses the NX protection (Non executable stack)

const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const

Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_offset(uint64_t offset, bool skip_nobits = true)
const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const

Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true)
const Segment *segment_from_virtual_address(uint64_t address) const

Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.

Segment *segment_from_virtual_address(uint64_t address)
const Segment *segment_from_offset(uint64_t offset) const

Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.

Segment *segment_from_offset(uint64_t offset)
const DynamicEntry *get(DYNAMIC_TAGS tag) const

Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.

DynamicEntry *get(DYNAMIC_TAGS tag)
const Segment *get(SEGMENT_TYPES type) const

Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.

Segment *get(SEGMENT_TYPES type)
const Note *get(NOTE_TYPES type) const

Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.

Note *get(NOTE_TYPES type)
const Section *get(ELF_SECTION_TYPES type) const

Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.

Section *get(ELF_SECTION_TYPES type)
bool has(DYNAMIC_TAGS tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

bool has(SEGMENT_TYPES type) const

Check if ELF::Segment associated with the given type exists.

bool has(NOTE_TYPES type) const

Check if a ELF::Note associated with the given type exists.

bool has(ELF_SECTION_TYPES type) const

Check if a ELF::Section associated with the given type exists.

virtual std::vector<uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

virtual void accept(LIEF::Visitor &visitor) const override

Method associated with the visitor pattern.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

virtual LIEF::Binary::functions_t ctor_functions() const override

List of binary constructors (typically, the functions located in the .init_array)

LIEF::Binary::functions_t dtor_functions() const

List of the binary destructors (typically, the functions located in the .fini_array)

LIEF::Binary::functions_t functions() const

List of the functions found the in the binary.

bool has_notes() const

true if the binary embeds notes

it_const_notes notes() const

Return an iterator over the ELF’s LIEF::ELF::Note.

See also

has_note

it_notes notes()
uint64_t eof_offset() const

Return the last offset used by the ELF binary according to both: the sections table and the segments table.

bool has_overlay() const

True if data are present at the end of the binary.

const overlay_t &overlay() const

Overlay data (if any)

void overlay(overlay_t overlay)

Function to set the overlay.

size_t hash(const std::string &name)
virtual ~Binary() override
virtual std::ostream &print(std::ostream &os) const override
bool operator==(const Binary &rhs) const
bool operator!=(const Binary &rhs) const
Binary &operator+=(const DynamicEntry &entry)
Binary &operator+=(const Section &section)
Binary &operator+=(const Segment &segment)
Binary &operator+=(const Note &note)
Binary &operator-=(const DynamicEntry &entry)
Binary &operator-=(DYNAMIC_TAGS tag)
Binary &operator-=(const Note &note)
Binary &operator-=(NOTE_TYPES type)
Segment *operator[](SEGMENT_TYPES type)
const Segment *operator[](SEGMENT_TYPES type) const
DynamicEntry *operator[](DYNAMIC_TAGS tag)
const DynamicEntry *operator[](DYNAMIC_TAGS tag) const
Note *operator[](NOTE_TYPES type)
const Note *operator[](NOTE_TYPES type) const
Section *operator[](ELF_SECTION_TYPES type)
const Section *operator[](ELF_SECTION_TYPES type) const


Section

class LIEF::ELF::Section : public LIEF::Section

Class wich represents an ELF Section.

Public Types

using segments_t = std::vector<Segment*>
using it_segments = ref_iterator<segments_t&>
using it_const_segments = const_ref_iterator<const segments_t&>

Public Functions

Section(const uint8_t *data, ELF_CLASS type)
Section(const details::Elf64_Shdr &header)
Section(const details::Elf32_Shdr &header)
Section(const std::string &name, ELF_SECTION_TYPES type = ELF_SECTION_TYPES::SHT_PROGBITS)
Section()
virtual ~Section() override
Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other)
ELF_SECTION_TYPES type() const
virtual span<const uint8_t> content() const override

Section’s content.

virtual void content(const std::vector<uint8_t> &data) override

Set section content.

void content(std::vector<uint8_t> &&data)
uint64_t flags() const

Section flags LIEF::ELF::ELF_SECTION_FLAGS.

bool has(ELF_SECTION_FLAGS flag) const

True if the section has the given flag

Parameters

flag[in] flag to test

bool has(const Segment &segment) const

True if the section is wrapped by the given Segment

std::set<ELF_SECTION_FLAGS> flags_list() const

Return section flags as a std::set

virtual uint64_t size() const override

section’s size (size in the binary, not the virtual size)

virtual void size(uint64_t size) override

Change the section size.

virtual void offset(uint64_t offset) override
virtual uint64_t offset() const override

Offset in the binary.

uint64_t file_offset() const

See also

offset

uint64_t original_size() const

Original size of the section’s data.

This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data

uint64_t alignment() const

Section file alignment.

uint64_t information() const

Section information. This meaning of this value depends on the section’s type.

uint64_t entry_size() const

This function returns the size of an element in the case of a section that contains an array.

For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.

uint32_t link() const

Index to another section.

Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(ELF_SECTION_FLAGS flag)

Add the given ELF_SECTION_FLAGS.

void remove(ELF_SECTION_FLAGS flag)

Remove the given ELF_SECTION_FLAGS.

void type(ELF_SECTION_TYPES type)
void flags(uint64_t flags)
void clear_flags()
void file_offset(uint64_t offset)
void link(uint32_t link)
void information(uint32_t info)
void alignment(uint64_t alignment)
void entry_size(uint64_t entry_size)
it_segments segments()
it_const_segments segments() const
inline Section &as_frame()
inline bool is_frame() const
virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

Section &operator+=(ELF_SECTION_FLAGS c)
Section &operator-=(ELF_SECTION_FLAGS c)
bool operator==(const Section &rhs) const
bool operator!=(const Section &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class LIEF::ELF::Segment : public LIEF::Object

Class which represents the ELF segments.

Public Types

using sections_t = std::vector<Section*>
using it_sections = ref_iterator<sections_t&>
using it_const_sections = const_ref_iterator<const sections_t&>

Public Functions

Segment()
Segment(const details::Elf64_Phdr &header)
Segment(const details::Elf32_Phdr &header)
~Segment() override
Segment &operator=(Segment other)
Segment(const Segment &other)
Segment &operator=(Segment&&)
Segment(Segment&&)
void swap(Segment &other)
SEGMENT_TYPES type() const

The segment’s type (LOAD, DYNAMIC, …)

ELF_SEGMENT_FLAGS flags() const

The flag permissions associated with this segment.

uint64_t file_offset() const

The file offset of the data associated with this segment.

uint64_t virtual_address() const

The virtual address of the segment.

uint64_t physical_address() const

The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.

Usually this value matches virtual_address

uint64_t physical_size() const

The file size of the data associated with this segment.

uint64_t virtual_size() const

The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.

uint64_t alignment() const

The offset alignment of the segment.

span<const uint8_t> content() const

The raw data associated with this segment.

bool has(ELF_SEGMENT_FLAGS flag) const

Check if the current segment has the given flag.

bool has(const Section &section) const

Check if the current segment wraps the given ELF::Section.

bool has(const std::string &section_name) const

Check if the current segment wraps the given section’s name.

void add(ELF_SEGMENT_FLAGS flag)

Append the given ELF_SEGMENT_FLAGS.

void remove(ELF_SEGMENT_FLAGS flag)

Remove the given ELF_SEGMENT_FLAGS.

void type(SEGMENT_TYPES type)
void flags(ELF_SEGMENT_FLAGS flags)
void clear_flags()
void file_offset(uint64_t file_offset)
void virtual_address(uint64_t virtual_address)
void physical_address(uint64_t physical_address)
void physical_size(uint64_t physical_size)
void virtual_size(uint64_t virtual_size)
void alignment(uint64_t alignment)
void content(std::vector<uint8_t> content)
template<typename T>
T get_content_value(size_t offset) const
template<typename T>
void set_content_value(size_t offset, T value)
size_t get_content_size() const
it_sections sections()

Iterator over the sections wrapped by this segment.

it_const_sections sections() const
virtual void accept(Visitor &visitor) const override
Segment &operator+=(ELF_SEGMENT_FLAGS flag)
Segment &operator-=(ELF_SEGMENT_FLAGS flag)
bool operator==(const Segment &rhs) const
bool operator!=(const Segment &rhs) const

Public Static Functions

static result<Segment> from_raw(const uint8_t *ptr, size_t size)
static result<Segment> from_raw(const std::vector<uint8_t> &raw)

Friends

friend std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class LIEF::ELF::DynamicEntry : public LIEF::Object

Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Functions

DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&)
DynamicEntry(const DynamicEntry&)
virtual ~DynamicEntry()
DYNAMIC_TAGS tag() const

Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …

uint64_t value() const

Return the entry’s value.

The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …

void tag(DYNAMIC_TAGS tag)
void value(uint64_t value)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const
bool operator==(const DynamicEntry &rhs) const
bool operator!=(const DynamicEntry &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class LIEF::ELF::DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Class which represents a DT_NEEDED entry in the dynamic table.

This kind of entry is usually used to create library dependency.

Public Functions

DynamicEntryLibrary()
DynamicEntryLibrary(std::string name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&)
DynamicEntryLibrary(const DynamicEntryLibrary&)
const std::string &name() const

Return the library associated with this entry (e.g. libc.so.6)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Shared Object

class LIEF::ELF::DynamicSharedObject : public LIEF::ELF::DynamicEntry

Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used no name the original library.

This entry is not present for executable.

Public Functions

DynamicSharedObject()
DynamicSharedObject(std::string name)
DynamicSharedObject &operator=(const DynamicSharedObject&)
DynamicSharedObject(const DynamicSharedObject&)
const std::string &name() const

The actual name (e.g. libMyLib.so)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Entry Run Path

class LIEF::ELF::DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).

Public Functions

DynamicEntryRunPath()
DynamicEntryRunPath(std::string runpath)

Constructor from (run)path.

DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&)
DynamicEntryRunPath(const DynamicEntryRunPath&)
const std::string &name() const

Runpath raw value.

void name(const std::string &name)
const std::string &runpath() const

Runpath raw value.

void runpath(const std::string &runpath)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

DynamicEntryRunPath &operator+=(const std::string &path)
DynamicEntryRunPath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry RPath

class LIEF::ELF::DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)

Public Functions

DynamicEntryRpath()
DynamicEntryRpath(std::string rpath)
DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&)
DynamicEntryRpath(const DynamicEntryRpath&)
const std::string &name() const

The actual rpath as a string.

void name(const std::string &name)
const std::string &rpath() const

The actual rpath as a string.

void rpath(const std::string &name)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

DynamicEntryRpath &operator+=(const std::string &path)
DynamicEntryRpath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Public Static Attributes

static constexpr char delimiter = ':'

Dynamic Entry Array

class LIEF::ELF::DynamicEntryArray : public LIEF::ELF::DynamicEntry

Class that represent an Array in the dynamic table. This entry is associated with constructors:

  • DT_PREINIT_ARRAY

  • DT_INIT_ARRAY

  • DT_FINI_ARRAY

The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray()
DynamicEntryArray(DYNAMIC_TAGS tag, array_t array)
DynamicEntryArray &operator=(const DynamicEntryArray&)
DynamicEntryArray(const DynamicEntryArray&)
array_t &array()

Return the array values (list of pointer)

const array_t &array() const
void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t function)

Insert the given function at pos

DynamicEntryArray &append(uint64_t function)

Append the given function.

DynamicEntryArray &remove(uint64_t function)

Remove the given function.

size_t size() const

Number of function registred in this array.

DynamicEntryArray &operator+=(uint64_t value)
DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
virtual ~DynamicEntryArray()
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Dynamic Entry Flags

class LIEF::ELF::DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

using flags_list_t = std::set<uint32_t>

Public Functions

DynamicEntryFlags()
DynamicEntryFlags &operator=(const DynamicEntryFlags&)
DynamicEntryFlags(const DynamicEntryFlags&)
bool has(DYNAMIC_FLAGS f) const

If the current entry has the given DYNAMIC_FLAGS.

bool has(DYNAMIC_FLAGS_1 f) const

If the current entry has the given DYNAMIC_FLAGS_1.

flags_list_t flags() const

Return flags as a list of integers.

void add(DYNAMIC_FLAGS f)

Add the given DYNAMIC_FLAGS.

void add(DYNAMIC_FLAGS_1 f)

Add the given DYNAMIC_FLAGS_1.

void remove(DYNAMIC_FLAGS f)

Remove the given DYNAMIC_FLAGS.

void remove(DYNAMIC_FLAGS_1 f)

Remove the given DYNAMIC_FLAGS_1.

DynamicEntryFlags &operator+=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator+=(DYNAMIC_FLAGS_1 f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS_1 f)
virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

virtual std::ostream &print(std::ostream &os) const override
DynamicEntry(const details::Elf64_Dyn &header)
DynamicEntry(const details::Elf32_Dyn &header)
DynamicEntry()
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Functions

static bool classof(const DynamicEntry *entry)

Relocations

class LIEF::ELF::Relocation : public LIEF::Relocation

Class that represents an ELF relocation.

Public Functions

Relocation(const details::Elf32_Rel &header)
Relocation(const details::Elf32_Rela &header)
Relocation(const details::Elf64_Rel &header)
Relocation(const details::Elf64_Rela &header)
Relocation(uint64_t address, uint32_t type = 0, int64_t addend = 0, bool isRela = false)
template<class T, typename = typename std::enable_if<std::is_enum<T>::value>::type>
inline Relocation(uint64_t address, T type, int64_t addend = 0, bool isRela = false)
Relocation()
Relocation(ARCH arch)
virtual ~Relocation() override
Relocation &operator=(Relocation other)
Relocation(const Relocation &other)
void swap(Relocation &other)
int64_t addend() const

Additional value that can be involved in the relocation processing.

uint32_t type() const

Type of the relocation This type depends on the underlying architecture which can be accessed with architecture().

Depending on the architecture, it can return:

  • RELOC_x86_64

  • RELOC_i386

  • RELOC_POWERPC32

  • RELOC_POWERPC64

  • RELOC_AARCH64

  • RELOC_ARM

  • RELOC_MIPS

  • RELOC_HEXAGON

  • RELOC_SYSTEMZ

  • RELOC_SPARC

bool is_rela() const

Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)

bool is_rel() const

Check if the relocation uses the implicit added (i.e. not present in the ELF structure)

uint32_t info() const

Relocation info which contains for instance the symbol index.

ARCH architecture() const
RELOCATION_PURPOSES purpose() const
virtual size_t size() const override

Return the size (in bits) of the value associated with this relocation.

Return -1 if it fails

bool has_symbol() const

True if the current relocation is associated with a symbol.

Symbol *symbol()

Symbol associated with the relocation If no symbol is tied to this relocation, it returns a nullptr.

const Symbol *symbol() const
bool has_section() const

True if the relocation has an associated section.

Section *section()

Section associated with this relocation. If no section is tied to this relocation, it returns a nullptr.

const Section *section() const
void addend(int64_t addend)
void type(uint32_t type)
void purpose(RELOCATION_PURPOSES purpose)
void info(uint32_t v)
void symbol(Symbol *symbol)
void section(Section *section)
virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Relocation &rhs) const
bool operator!=(const Relocation &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &entry)

Symbol

class LIEF::ELF::Symbol : public LIEF::Symbol

Class which represents an ELF symbol.

Public Functions

Symbol(const details::Elf32_Sym &header)
Symbol(const details::Elf64_Sym &header)
Symbol(std::string name, ELF_SYMBOL_TYPES type = ELF_SYMBOL_TYPES::STT_NOTYPE, SYMBOL_BINDINGS binding = SYMBOL_BINDINGS::STB_WEAK, uint8_t other = 0, uint16_t shndx = 0, uint64_t value = 0, uint64_t size = 0)
Symbol()
virtual ~Symbol() override
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
ELF_SYMBOL_TYPES type() const

The symbol’s type provides a general classification for the associated entity.

SYMBOL_BINDINGS binding() const

The symbol’s binding determines the linkage visibility and behavior.

uint8_t information() const

This member specifies the symbol’s type and binding attributes.

uint8_t other() const

Alias for visibility()

uint16_t section_idx() const

ELF::Section index associated with the symbol.

ELF_SYMBOL_VISIBILITY visibility() const

Symbol visibility.

Section *section()

Section associated with the symbol or a nullptr if it does not exist.

uint16_t shndx() const

This member have slightly different interpretations:

  • In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON

  • In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.

  • In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant. Symbol size

Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.

bool has_version() const

Check if this symbols has a symbol version .

SymbolVersion *symbol_version()

Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.

const SymbolVersion *symbol_version() const
std::string demangled_name() const

Symbol’s unmangled name. If not available, it returns an empty string.

void type(ELF_SYMBOL_TYPES type)
void binding(SYMBOL_BINDINGS binding)
void other(uint8_t other)
void visibility(ELF_SYMBOL_VISIBILITY visibility)
void information(uint8_t info)
void shndx(uint16_t idx)
inline void shndx(SYMBOL_SECTION_INDEX idx)
bool is_exported() const

Check if the current symbol is exported.

void set_exported(bool flag = true)

Set whether or not the symbol is exported.

bool is_imported() const

Check if the current symbol is imported.

void set_imported(bool flag = true)

Set whether or not the symbol is imported.

inline bool is_static() const

True if the symbol is a static one.

inline bool is_function() const

True if the symbol represent a function.

inline bool is_variable() const

True if the symbol represent a variable.

virtual void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Symbol &rhs) const
bool operator!=(const Symbol &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Symbol &entry)

Symbol Version

class LIEF::ELF::SymbolVersion : public LIEF::Object

Class which represents an entry defined in the DT_VERSYM dynamic entry.

Public Functions

SymbolVersion(uint16_t value)
SymbolVersion()
virtual ~SymbolVersion()
SymbolVersion &operator=(const SymbolVersion&)
SymbolVersion(const SymbolVersion&)
uint16_t value() const

Value associated with the symbol.

If the given SymbolVersion hasn’t Auxiliary version:

  • 0 means Local

  • 1 means Global

bool has_auxiliary_version() const

Whether the current SymbolVersion has an auxiliary one.

SymbolVersionAux *symbol_version_auxiliary()

SymbolVersionAux associated with the current Version if any, or a nullptr.

const SymbolVersionAux *symbol_version_auxiliary() const
void symbol_version_auxiliary(SymbolVersionAuxRequirement &svauxr)

Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.

On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement

void value(uint16_t v)
virtual void accept(Visitor &visitor) const override
bool operator==(const SymbolVersion &rhs) const
bool operator!=(const SymbolVersion &rhs) const

Public Static Functions

static SymbolVersion local()

Generate a local SymbolVersion.

static SymbolVersion global()

Generate a global SymbolVersion.

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)

Symbol Version Auxiliary

class LIEF::ELF::SymbolVersionAux : public LIEF::Object

Class which represents an Auxiliary Symbol version.

Subclassed by LIEF::ELF::SymbolVersionAuxRequirement

Public Functions

SymbolVersionAux(std::string name)
SymbolVersionAux()
virtual ~SymbolVersionAux()
SymbolVersionAux &operator=(const SymbolVersionAux&)
SymbolVersionAux(const SymbolVersionAux&)
const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)
virtual void accept(Visitor &visitor) const override
bool operator==(const SymbolVersionAux &rhs) const
bool operator!=(const SymbolVersionAux &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &symAux)

Symbol Version Definition

class LIEF::ELF::SymbolVersionDefinition : public LIEF::Object

Class which represents an entry defined in DT_VERDEF or .gnu.version_d

Public Types

using version_aux_t = std::vector<std::unique_ptr<SymbolVersionAux>>
using it_version_aux = ref_iterator<version_aux_t&, SymbolVersionAux*>
using it_const_version_aux = const_ref_iterator<const version_aux_t&, const SymbolVersionAux*>

Public Functions

SymbolVersionDefinition()
SymbolVersionDefinition(const details::Elf64_Verdef &header)
SymbolVersionDefinition(const details::Elf32_Verdef &header)
virtual ~SymbolVersionDefinition()
SymbolVersionDefinition &operator=(SymbolVersionDefinition other)
SymbolVersionDefinition(const SymbolVersionDefinition &other)
void swap(SymbolVersionDefinition &other)
uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

uint16_t flags() const

Version information.

uint16_t ndx() const

Version index.

Numeric value used as an index in the LIEF::ELF::SymbolVersion table

uint32_t hash() const

Hash value of the symbol’s name (using ELF hash function)

it_version_aux symbols_aux()

SymbolVersionAux entries.

it_const_version_aux symbols_aux() const
void version(uint16_t version)
void flags(uint16_t flags)
void hash(uint32_t hash)
virtual void accept(Visitor &visitor) const override
bool operator==(const SymbolVersionDefinition &rhs) const
bool operator!=(const SymbolVersionDefinition &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionDefinition &sym)

Symbol Version Requirement

class LIEF::ELF::SymbolVersionRequirement : public LIEF::Object

Class which represents an entry in the DT_VERNEED or .gnu.version_r table.

Public Types

using aux_requirement_t = std::vector<std::unique_ptr<SymbolVersionAuxRequirement>>
using it_aux_requirement = ref_iterator<aux_requirement_t&, SymbolVersionAuxRequirement*>
using it_const_aux_requirement = const_ref_iterator<const aux_requirement_t&, const SymbolVersionAuxRequirement*>

Public Functions

SymbolVersionRequirement()
SymbolVersionRequirement(const details::Elf64_Verneed &header)
SymbolVersionRequirement(const details::Elf32_Verneed &header)
virtual ~SymbolVersionRequirement()
SymbolVersionRequirement &operator=(SymbolVersionRequirement other)
SymbolVersionRequirement(const SymbolVersionRequirement &other)
void swap(SymbolVersionRequirement &other)
uint16_t version() const

Version revision.

This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.

uint32_t cnt() const

Number of associated auxiliary entries.

it_aux_requirement auxiliary_symbols()

Auxiliary entries as an iterator over SymbolVersionAuxRequirement.

it_const_aux_requirement auxiliary_symbols() const
const std::string &name() const

Return the library name associated with this requirement (e.g. libc.so.6)

void version(uint16_t version)
void name(const std::string &name)
SymbolVersionAuxRequirement &add_aux_requirement(const SymbolVersionAuxRequirement &aux_requirement)

Add a version auxiliary requirement to the existing list.

virtual void accept(Visitor &visitor) const override
bool operator==(const SymbolVersionRequirement &rhs) const
bool operator!=(const SymbolVersionRequirement &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionRequirement &symr)

Symbol Version Auxiliary Requirement

class LIEF::ELF::SymbolVersionAuxRequirement : public LIEF::ELF::SymbolVersionAux

Public Functions

SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header)
SymbolVersionAuxRequirement(const details::Elf32_Vernaux &header)
SymbolVersionAuxRequirement()
SymbolVersionAuxRequirement &operator=(const SymbolVersionAuxRequirement&)
SymbolVersionAuxRequirement(const SymbolVersionAuxRequirement&)
virtual ~SymbolVersionAuxRequirement()
uint32_t hash() const

Hash value of the dependency name (use ELF hashing function)

uint16_t flags() const

Bitmask of flags.

uint16_t other() const

It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.

void hash(uint32_t hash)
void flags(uint16_t flags)
void other(uint16_t other)
virtual void accept(Visitor &visitor) const override
bool operator==(const SymbolVersionAuxRequirement &rhs) const
bool operator!=(const SymbolVersionAuxRequirement &rhs) const
const std::string &name() const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAuxRequirement &symAux)

GNU Hash table

class LIEF::ELF::GnuHash : public LIEF::Object

Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.

Public Functions

GnuHash()
GnuHash(uint32_t symbol_idx, uint32_t shift2, std::vector<uint64_t> bloom_filters, std::vector<uint32_t> buckets, std::vector<uint32_t> hash_values = {})
GnuHash &operator=(const GnuHash &copy)
GnuHash(const GnuHash &copy)
GnuHash(GnuHash&&)
GnuHash &operator=(GnuHash&&)
~GnuHash() override
uint32_t nb_buckets() const

Return the number of buckets.

uint32_t symbol_index() const

Index of the first symbol in the dynamic symbols table which accessible with the hash table.

uint32_t shift2() const

Shift count used in the bloom filter.

uint32_t maskwords() const

Number of bloom filters used. It must be a power of 2.

const std::vector<uint64_t> &bloom_filters() const

Bloom filters.

const std::vector<uint32_t> &buckets() const

Hash buckets.

const std::vector<uint32_t> &hash_values() const

Hash values.

bool check_bloom_filter(uint32_t hash) const

Check if the given hash passes the bloom filter.

bool check_bucket(uint32_t hash) const

Check if the given hash passes the bucket filter.

bool check(const std::string &symbol_name) const

Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.

bool check(uint32_t hash) const

Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.

bool operator==(const GnuHash &rhs) const
bool operator!=(const GnuHash &rhs) const
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash)

SYSV Hash table

class LIEF::ELF::SysvHash : public LIEF::Object

Class which represents the SYSV hash for the symbols resolution.

References:

Public Functions

SysvHash()
SysvHash &operator=(const SysvHash &copy)
SysvHash(const SysvHash &copy)
SysvHash &operator=(SysvHash&&)
SysvHash(SysvHash&&)
~SysvHash() override
uint32_t nbucket() const

Return the number of buckets used.

uint32_t nchain() const

Return the number of chain used.

const std::vector<uint32_t> &buckets() const

Buckets values.

const std::vector<uint32_t> &chains() const

Chains values.

inline void nchain(uint32_t nb)
bool operator==(const SysvHash &rhs) const
bool operator!=(const SysvHash &rhs) const
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash)

Note

class LIEF::ELF::Note : public LIEF::Object

Class which represents an ELF note.

Public Types

using description_t = std::vector<uint8_t>

Container used to handle the description data.

Public Functions

Note()
Note(std::string name, uint32_t type, description_t description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES type, const description_t &description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES_CORE type, const description_t &description, Binary *binary = nullptr)
Note &operator=(Note copy)
Note(const Note &copy)
virtual ~Note()
const std::string &name() const

Return the name of the note.

NOTE_TYPES type() const

Return the type of the note. It could be one of the NOTE_TYPES values.

NOTE_TYPES_CORE type_core() const

Return the type of the note for core ELF (ET_CORE). It could be one of the NOTE_TYPES_CORE values.

const description_t &description() const

Return the description associated with the note.

description_t &description()
bool is_core() const

True if the current note is associated with a core dump.

bool is_android() const

True if the current note is specific to Android.

If true, details() returns a reference to the LIEF::ELF::AndroidNote object

const NoteDetails &details() const
NoteDetails &details()
void name(const std::string &name)
void type(NOTE_TYPES type)
void type_core(NOTE_TYPES_CORE type)
void description(const description_t &description)
uint64_t size() const

Size of the raw note.

virtual void dump(std::ostream &os) const
bool operator==(const Note &rhs) const
bool operator!=(const Note &rhs) const
void swap(Note &other)
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Note &note)

Note Details

class LIEF::ELF::NoteDetails : public LIEF::Object

Subclassed by LIEF::ELF::AndroidNote, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi

Public Types

using description_t = std::vector<uint8_t>

Public Functions

NoteDetails()
virtual ~NoteDetails()
virtual NoteDetails *clone() const
const description_t &description() const
virtual void dump(std::ostream &os) const
bool operator==(const NoteDetails &rhs) const
bool operator!=(const NoteDetails &rhs) const
virtual void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const NoteDetails &note)

Core PrPsInfo

class LIEF::ELF::CorePrPsInfo : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Functions

virtual CorePrPsInfo *clone() const override
std::string file_name() const

Process file name.

uint64_t flags() const

Process flag.

uint32_t uid() const

Process user id.

uint32_t gid() const

Process group id.

int32_t pid() const

Process ID.

int32_t ppid() const

Process parent ID.

int32_t pgrp() const

Process session group ID.

int32_t sid() const

Process session ID.

void file_name(const std::string &file_name)
void flags(uint64_t)
void uid(uint32_t)
void gid(uint32_t)
void pid(int32_t)
void ppid(int32_t)
void pgrp(int32_t)
void sid(int32_t)
bool operator==(const CorePrPsInfo &rhs) const
bool operator!=(const CorePrPsInfo &rhs) const
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
virtual ~CorePrPsInfo()
NoteDetails()

Public Static Functions

static CorePrPsInfo make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo &note)

Core File

class LIEF::ELF::CoreFile : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

using files_t = std::vector<CoreFileEntry>
using iterator = files_t::iterator
using const_iterator = files_t::const_iterator

Public Functions

virtual CoreFile *clone() const override
uint64_t count() const

Number of coredump file entries.

const files_t &files() const

Coredump file entries.

iterator begin()
iterator end()
const_iterator begin() const
const_iterator end() const
void files(const files_t&)
bool operator==(const CoreFile &rhs) const
bool operator!=(const CoreFile &rhs) const
virtual void dump(std::ostream &os) const override
virtual void accept(Visitor &visitor) const override
virtual ~CoreFile()
NoteDetails()

Public Static Functions

static CoreFile make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CoreFile &note)

Core File Entry

struct LIEF::ELF::CoreFileEntry

Core file entry.

Public Members

uint64_t start

Start address of mapped file.

uint64_t end

End address of mapped file.

uint64_t file_ofs

Offset (in core) of mapped file.

std::string path

Path of mapped file.

Friends

friend std::ostream &operator<<(std::ostream &os, const CoreFileEntry &entry)

Core PrStatus

class LIEF::ELF::CorePrStatus : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

enum class REGISTERS

Values:

enumerator UNKNOWN
enumerator X86_START
enumerator X86_EBX
enumerator X86_ECX
enumerator X86_EDX
enumerator X86_ESI
enumerator X86_EDI
enumerator X86_EBP
enumerator X86_EAX
enumerator X86_DS
enumerator X86_ES
enumerator X86_FS
enumerator X86_GS
enumerator X86__
enumerator X86_EIP
enumerator X86_CS
enumerator X86_EFLAGS
enumerator X86_ESP
enumerator X86_SS
enumerator X86_END
enumerator X86_64_START
enumerator X86_64_R15
enumerator X86_64_R14
enumerator X86_64_R13
enumerator X86_64_R12
enumerator X86_64_RBP
enumerator X86_64_RBX
enumerator X86_64_R11
enumerator X86_64_R10
enumerator X86_64_R9
enumerator X86_64_R8
enumerator X86_64_RAX
enumerator X86_64_RCX
enumerator X86_64_RDX
enumerator X86_64_RSI
enumerator X86_64_RDI
enumerator X86_64__
enumerator X86_64_RIP
enumerator X86_64_CS
enumerator X86_64_EFLAGS
enumerator X86_64_RSP