Class which parses and transforms an ELF file into a ELF::Binary object.
Subclassed by LIEF::OAT::Parser
Public Static Functions
Parse an ELF file and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols
file – [in] Path to the ELF binary
count_mtd – [in] Method used to count dynamic symbols. Default: LIEF::ELF::DYNSYM_COUNT_METHODS::COUNT_AUTO
Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
data – [in] Raw ELF
count_mtd – [in] Method used to count dynamic symbols.
Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
stream – [in] The stream which wraps the ELF binary
count_mtd – [in] Method used to count dynamic symbols.
Public Static Attributes
Friends
Class which represents an ELF binary.
Subclassed by LIEF::OAT::Binary
Public Types
This enum describes the different ways to relocate the segments table.
Values:
Defer the choice of the layout to LIEF.
The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.
The new segments table is relocated right after the first bss-like segment.
The new segments table is relocated at the end of the binary.
The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.
Iterator which outputs Note& object.
Iterator which outputs const Note& object.
Internal container for storing SymbolVersionRequirement.
Iterator which outputs SymbolVersionRequirement& object.
Iterator which outputs const SymbolVersionRequirement& object.
Internal container for storing SymbolVersionDefinition.
Iterator which outputs SymbolVersionDefinition& object.
Iterator which outputs const SymbolVersionDefinition& object.
Internal container for storing ELF’s Segment.
Iterator which outputs Segment& object.
Iterator which outputs const Segment& object.
Internal container for storing ELF’s DynamicEntry.
Iterator which outputs DynamicEntry& object.
Iterator which outputs const DynamicEntry& object.
Internal container for storing ELF’s SymbolVersion.
Iterator which outputs SymbolVersion& object.
Iterator which outputs const SymbolVersion& object.
Internal container for storing ELF’s Relocation.
Iterator which outputs plt/got Relocation& object.
Iterator which outputs plt/got const Relocation& object.
Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs Relocation& object found in object files (.o)
Iterator which outputs const Relocation& object found in object files (.o)
Iterator which outputs Relocation& object.
Iterator which outputs const Relocation& object.
Iterator which outputs the Dynamic Symbol& object.
Iterator which outputs the Dynamic const Symbol& object.
Iterator which outputs the static/debug Symbol& object.
Iterator which outputs the static/debug const Symbol& object.
Iterator which outputs static and dynamic Symbol& object.
Iterator which outputs static and dynamic const Symbol& object.
Iterator which outputs exported Symbol& object.
Iterator which outputs exported const Symbol& object.
Iterator which outputs imported Symbol& object.
Iterator which outputs imported const Symbol& object.
Internal container for storing ELF’s Section.
Iterator which outputs Section& object.
Iterator which outputs const Section& object.
Public Functions
Return Elf header .
Return the last offset used in binary according to sections table.
Return the last offset used in binary according to segments table.
Return the next virtual address available.
Return an iterator over the binary’s sections.
Return the binary’s entrypoint.
Return binary’s segments.
Return binary’s dynamic entries.
Add the given dynamic entry and return the new entry.
Remove the given dynamic entry.
Remove all dynamic entries with the given tag.
Remove the given section. The clear parameter can be used to zeroize the original content beforehand.
section – [in] The section to remove
clear – [in] Whether zeroize the original content
Remove all notes with the given type.
Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.
Return symbols which are exported by the binary.
Return symbols which are imported by the binary.
Return statics symbols.
Return the symbol versions.
Return symbols version definition.
Return Symbol version requirement.
Return dynamic relocations.
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related
See: add_pltgot_relocation
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
See also: add_dynamic_relocation
Add relocation for object file (.o)
The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.
If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.
Return plt.got relocations.
Return relocations used in an object file (*.o)
Return all relocations present in the binary.
Return relocation associated with the given address. It returns a nullptr if it is not found.
Return relocation associated with the given Symbol It returns a nullptr if it is not found.
Return relocation associated with the given Symbol name It returns a nullptr if it is not found.
true if GNU hash is used
See also
Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.
true if SYSV hash is used
See also
Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.
Check if a section with the given name exists in the binary.
Check if a section that handles the given offset exists.
Check if a section that handles the given virtual address exists.
Return Section with the given name. If the section can’t be found, it returns a nullptr.
Return the .text section. If the section can’t be found, it returns a nullptr.
Return the .dynamic section. If the section can’t be found, it returns a nullptr.
Return the hash section. If the section can’t be found, it returns a nullptr.
Return section which holds static symbols. If the section can’t be found, it returns a nullptr.
Return program image base. For instance 0x40000
To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset
Return the size of the mapped binary.
Check if the binary uses a loader (also named linker or interpreter)
See also
Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.
See also
Change the interpreter.
Return an iterator on both static and dynamic symbols.
Export the given symbol and create it if it doesn’t exist.
Export the symbol with the given name and create it if it doesn’t exist.
Check if the symbol with the given name exists in the dynamic symbols table.
Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.
Check if the symbol with the given name exists in the static symbol table.
Get the static symbol from the given name Return a nullptr if it can’t be found.
Return list of the strings used by the ELF binary.
Basically, this function looks for string in the .roadata section
Remove symbols with the given name in both:
dynamic symbols
static symbols
Remove static symbols with the given name.
Remove dynamic symbols with the given name.
Remove the given symbol from the dynamic symbols table.
As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol
Return the address of the given function name.
Return the address of the given function name.
func_name – [in] The function’s name target
demangled – [in] Use the demangled name
Add a new section in the binary.
This function requires a well-formed ELF binary
section – [in] The section object to insert
loaded – [in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment
The section added. The size and the virtual address might change.
Add a dynamic symbol with the associated SymbolVersion.
Create a symbol for the function at the given address and export it.
Add a library as dependency.
Remove the given library from the dependencies.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Check if the given library name exists in the current binary.
Add a new segment in the binary.
The segment is inserted at the end
This function requires a well-formed ELF binary
The segment added. Virtual address and File Offset might change.
Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.
Warning
The original_segment is no longer valid after this function
Patch the content at virtual address address with patch_value.
address – [in] Address to patch
patch_value – [in] Patch to apply
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the address with the given value.
address – [in] Address to patch
patch_value – [in] Patch to apply
size – [in] Size of the value in bytes (1, 2, … 8)
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the imported symbol with the address
symbol – [in] Imported symbol to patch
address – [in] New address
Patch the imported symbol’s name with the address
symbol_name – [in] Imported symbol’s name to patch
address – [in] New address
Strip the binary by removing static symbols.
Remove a binary’s section.
name – [in] The name of the section to remove
clear – [in] Whether zeroize the original content
Reconstruct the binary object and write it in filename
filename – Path for the written ELF binary
Reconstruct the binary object with the given config and write it in filename
filename – Path for the written ELF binary
config – Builder configuration
Reconstruct the binary object and write it in os stream.
os – Output stream for the written ELF binary
Reconstruct the binary object with the given config and write it in os stream.
os – Output stream for the written ELF binary
config – Builder configuration
Reconstruct the binary object and return its content as a byte vector.
Convert a virtual address to a file offset.
Convert the given offset into a virtual address.
offset – [in] The offset to convert.
slide – [in] If not 0, it will replace the default base address (if any)
Check if the binary has been compiled with -fpie -pie flags.
To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)
Check if the binary uses the NX protection (Non executable stack)
Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.
Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.
Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.
Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.
Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.
Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.
Check if an ELF::DynamicEntry associated with the given tag exists.
Check if ELF::Segment associated with the given type exists.
Check if a ELF::Note associated with the given type exists.
Check if a ELF::Section associated with the given type exists.
Return the content located at virtual address.
Method associated with the visitor pattern.
Apply the given permutation on the dynamic symbols table.
List of binary constructors (typically, the functions located in the .init_array)
List of the binary destructors (typically, the functions located in the .fini_array)
List of the functions found the in the binary.
true if the binary embeds notes
Return an iterator over the ELF’s LIEF::ELF::Note.
See also
has_note
Return the last offset used by the ELF binary according to both: the sections table and the segments table.
True if data are present at the end of the binary.
Force relocating the segments table in a specific way.
This function can be used to enforce a specific relocation of the segments table.
type – [in] The relocation type to apply
The offset of the new segments table or 0 if it fails with the given method.
Class which represents the ELF’s header. This is the ELF structure that starts an ELF file.
Public Types
Public Functions
LIEF abstract object type.
LIEF abstract architecture.
It returns Empty if it can’t be abstracted
LIEF abstract endianness.
Executable entrypoint.
Offset of program table (also known as segments table)
Offset of section table.
Processor-specific flags.
Check if the given flag is present in processor_flag()
Return a list of ARM_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of MIPS_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of PPC64_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of HEXAGON_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of LOONGARCH_EFLAGS present in processor_flag()
Size of the current header.
This size should be 64 for an ELF64 binary and 52 for an ELF32.
Return the size of a Segment header
This size should be 56 for a ELF64 binary and 32 for an ELF32.
Return the the number of segments.
Return the size of a Section header
This size should be 64 for a ELF64 binary and 40 for an ELF32.
Return the number of sections.
Warning
This value could differ from the real number of sections present in the binary. It must be taken as an indication
Return the section’s index which contains sections’ names.
Return the ELF identity as an std::array
ABI Version.
Class wich represents an ELF Section.
Public Types
Public Functions
Set section content.
True if the section has the given flag
flag – [in] flag to test
Return section flags as a std::set
section’s size (size in the binary, not the virtual size)
Change the section size.
Offset in the binary.
See also
offset
Original size of the section’s data.
This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data
Section information. This meaning of this value depends on the section’s type.
This function returns the size of an element in the case of a section that contains an array.
For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.
Index to another section.
Add the given ELF_SECTION_FLAGS.
Remove the given ELF_SECTION_FLAGS.
Method so that the visitor can visit us.
Class which represents the ELF segments.
Public Types
Public Functions
The segment’s type (LOAD, DYNAMIC, …)
The flag permissions associated with this segment.
The file offset of the data associated with this segment.
The virtual address of the segment.
The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.
Usually this value matches virtual_address
The file size of the data associated with this segment.
The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.
The offset alignment of the segment.
The raw data associated with this segment.
Check if the current segment has the given flag.
Check if the current segment wraps the given ELF::Section.
Check if the current segment wraps the given section’s name.
Append the given ELF_SEGMENT_FLAGS.
Remove the given ELF_SEGMENT_FLAGS.
Iterator over the sections wrapped by this segment.
Public Static Functions
Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.
Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject
Public Functions
Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …
Return the entry’s value.
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Friends
Class which represents a DT_NEEDED entry in the dynamic table.
This kind of entry is usually used to create library dependency.
Public Functions
Return the library associated with this entry (e.g. libc.so.6)
Public Static Functions
Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).
Public Functions
Constructor from (run)path.
Constructor from a list of paths.
Runpath raw value.
Runpath raw value.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)
Public Functions
Constructor from a list of paths.
The actual rpath as a string.
The actual rpath as a string.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class that represent an Array in the dynamic table. This entry is associated with constructors:
DT_PREINIT_ARRAY
DT_INIT_ARRAY
DT_FINI_ARRAY
The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.
Public Types
Public Functions
Insert the given function at pos
Append the given function.
Remove the given function.
Number of function registred in this array.
Public Static Functions
Public Types
Public Functions
If the current entry has the given DYNAMIC_FLAGS.
If the current entry has the given DYNAMIC_FLAGS_1.
Return flags as a list of integers.
Add the given DYNAMIC_FLAGS.
Add the given DYNAMIC_FLAGS_1.
Remove the given DYNAMIC_FLAGS.
Remove the given DYNAMIC_FLAGS_1.
Method so that the visitor can visit us.
Public Static Functions
Class that represents an ELF relocation.
Public Functions
Additional value that can be involved in the relocation processing.
Type of the relocation This type depends on the underlying architecture which can be accessed with architecture().
Depending on the architecture, it can return:
RELOC_x86_64
RELOC_i386
RELOC_POWERPC32
RELOC_POWERPC64
RELOC_AARCH64
RELOC_ARM
RELOC_MIPS
RELOC_HEXAGON
RELOC_SYSTEMZ
RELOC_SPARC
RELOC_LOONGARCH
Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)
Check if the relocation uses the implicit added (i.e. not present in the ELF structure)
Relocation info which contains for instance the symbol index.
Return the size (in bits) of the value associated with this relocation.
Return -1 if it fails
True if the current relocation is associated with a symbol.
Symbol associated with the relocation If no symbol is tied to this relocation, it returns a nullptr.
True if the relocation has an associated section.
The section to which the relocation applies. If no section to which the relocation applies is associtated to this relocation, it returns a nullptr.
The associated symbol table. If no symbol table section is associated with this relocation, it returns a nullptr.
Method so that the visitor can visit us.
Friends
Class which represents an ELF symbol.
Public Functions
The symbol’s type provides a general classification for the associated entity.
The symbol’s binding determines the linkage visibility and behavior.
This member specifies the symbol’s type and binding attributes.
Alias for visibility()
ELF::Section index associated with the symbol.
Symbol visibility.
This member have slightly different interpretations:
In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON
In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.
In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant. Symbol size
Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.
See also
Check if this symbols has a symbol version .
Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.
Symbol’s unmangled name. If not available, it returns an empty string.
Check if the current symbol is exported.
Set whether or not the symbol is exported.
Check if the current symbol is imported.
Set whether or not the symbol is imported.
True if the symbol is a static one.
True if the symbol represent a function.
True if the symbol represent a variable.
Method so that the visitor can visit us.
Class which represents an entry defined in the DT_VERSYM dynamic entry.
Public Functions
Value associated with the symbol.
If the given SymbolVersion hasn’t Auxiliary version:
0 means Local
1 means Global
Whether the current SymbolVersion has an auxiliary one.
SymbolVersionAux associated with the current Version if any, or a nullptr.
Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.
On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement
Public Static Functions
Generate a local SymbolVersion.
Generate a global SymbolVersion.
Friends
Class which represents an Auxiliary Symbol version.
Subclassed by LIEF::ELF::SymbolVersionAuxRequirement
Public Functions
Smybol’s aux name (e.g. GLIBC_2.2.5)
Friends
Class which represents an entry defined in DT_VERDEF or .gnu.version_d
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Version information.
Version index.
Numeric value used as an index in the LIEF::ELF::SymbolVersion table
Hash value of the symbol’s name (using ELF hash function)
SymbolVersionAux entries.
Friends
Class which represents an entry in the DT_VERNEED or .gnu.version_r table.
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Number of associated auxiliary entries.
Auxiliary entries as an iterator over SymbolVersionAuxRequirement.
Return the library name associated with this requirement (e.g. libc.so.6)
Add a version auxiliary requirement to the existing list.
Friends
Public Functions
Hash value of the dependency name (use ELF hashing function)
Bitmask of flags.
It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.
Smybol’s aux name (e.g. GLIBC_2.2.5)
Friends
Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.
Public Functions
Return the number of buckets.
See also
Index of the first symbol in the dynamic symbols table which accessible with the hash table.
Shift count used in the bloom filter.
Number of bloom filters used. It must be a power of 2.
Bloom filters.
Hash buckets.
Hash values.
Check if the given hash passes the bloom filter.
Check if the given hash passes the bucket filter.
Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.
Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.
Class which represents the SYSV hash for the symbols resolution.
References:
http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/
https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
Public Functions
Return the number of buckets used.
Return the number of chain used.
Buckets values.
Chains values.
Class which represents an ELF note.
Public Types
Container used to handle the description data.
Public Functions
Return the name of the note.
Return the type of the note. It could be one of the NOTE_TYPES values.
Return the type of the note for core ELF (ET_CORE). It could be one of the NOTE_TYPES_CORE values.
Return the description associated with the note.
True if the current note is associated with a core dump.
True if the current note is specific to Android.
If true, details() returns a reference to the LIEF::ELF::AndroidNote object
Size of the raw note.
Subclassed by LIEF::ELF::AndroidNote, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi
Public Types
Public Functions
Friends
Class representing core PrPsInfo object.
Public Functions
Process file name.
Process flag.
Process user id.
Process group id.
Process ID.
Process parent ID.
Process session group ID.
Process session ID.
Public Static Functions
Friends
Class representing core PrPsInfo object.
Public Types
Public Functions
Number of coredump file entries.
Core file entry.
Public Members
Start address of mapped file.
End address of mapped file.
Offset (in core) of mapped file.
Path of mapped file.
Friends
Class representing core PrPsInfo object.
Public Types
Values: