ELF

Parser

class Parser : public LIEF::Parser

Class which parses and transforms an ELF file into a ELF::Binary object.

Subclassed by LIEF::OAT::Parser

Public Types

enum ELF_TYPE

Values:

enumerator ELF_UNKNOWN
enumerator ELF32
enumerator ELF64

Public Functions

Parser &operator=(const Parser&) = delete
Parser(const Parser&) = delete

Public Static Functions

static std::unique_ptr<Binary> parse(const std::string &file, const ParserConfig &conf = ParserConfig::all())

Parse an ELF file and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols

Parameters:
  • file[in] Path to the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary as a unique_ptr

static std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const ParserConfig &conf = ParserConfig::all())

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • data[in] Raw ELF as a std::vector of uint8_t

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

static std::unique_ptr<Binary> parse(std::unique_ptr<BinaryStream> stream, const ParserConfig &conf = ParserConfig::all())

Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters:
  • stream[in] The stream which wraps the ELF binary

  • conf[in] Optional configuration for the parser

Returns:

LIEF::ELF::Binary

Public Static Attributes

static uint32_t NB_MAX_SYMBOLS = 1000000
static uint32_t DELTA_NB_SYMBOLS = 3000
static uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
static uint32_t NB_MAX_CHAINS = 1000000
static uint32_t NB_MAX_SEGMENTS = 10000
static uint32_t NB_MAX_RELOCATIONS = 3000000
static uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
static uint32_t NB_MAX_MASKWORD = 512
static uint32_t MAX_SEGMENT_SIZE = 3_GB

Friends

friend class OAT::Parser
struct ParserConfig

This structure is used to tweak the ELF Parser (ELF::Parser)

Public Types

enum class DYNSYM_COUNT

Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols

Values:

enumerator AUTO = 0

Automatic detection

enumerator SECTION = 1

Count based on sections (not very reliable)

enumerator HASH = 2

Count based on hash table (reliable)

enumerator RELOCATIONS = 3

Count based on PLT/GOT relocations (very reliable but not accurate)

Public Members

bool parse_relocations = true

Whether relocations (including plt-like relocations) should be parsed.

bool parse_dyn_symbols = true

Whether dynamic symbols (those from .dynsym) should be parsed.

bool parse_symtab_symbols = true

Whether debug symbols (those from .symtab) should be parsed.

bool parse_symbol_versions = true

Whether versioning symbols should be parsed.

bool parse_notes = true

Whether ELF notes information should be parsed.

bool parse_overlay = true

Whether the overlay data should be parsed.

DYNSYM_COUNT count_mtd = DYNSYM_COUNT::AUTO

The method used to count the number of dynamic symbols

Public Static Functions

static inline ParserConfig all()

This returns a ParserConfig object configured to process all the ELF elements.


Binary

class Binary : public LIEF::Binary

Class which represents an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

enum PHDR_RELOC

This enum describes the different ways to relocate the segments table.

Values:

enumerator AUTO = 0

Defer the choice of the layout to LIEF.

enumerator PIE_SHIFT

The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.

enumerator BSS_END

The new segments table is relocated right after the first bss-like segment.

enumerator BINARY_END

The new segments table is relocated at the end of the binary.

enumerator SEGMENT_GAP

The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.

using string_list_t = std::vector<std::string>
using notes_t = std::vector<std::unique_ptr<Note>>

Internal container for storing notes.

using it_notes = ref_iterator<notes_t&, Note*>

Iterator which outputs Note& object.

using it_const_notes = const_ref_iterator<const notes_t&, const Note*>

Iterator which outputs const Note& object.

using symbols_version_requirement_t = std::vector<std::unique_ptr<SymbolVersionRequirement>>

Internal container for storing SymbolVersionRequirement.

using it_symbols_version_requirement = ref_iterator<symbols_version_requirement_t&, SymbolVersionRequirement*>

Iterator which outputs SymbolVersionRequirement& object.

using it_const_symbols_version_requirement = const_ref_iterator<const symbols_version_requirement_t&, const SymbolVersionRequirement*>

Iterator which outputs const SymbolVersionRequirement& object.

using symbols_version_definition_t = std::vector<std::unique_ptr<SymbolVersionDefinition>>

Internal container for storing SymbolVersionDefinition.

using it_symbols_version_definition = ref_iterator<symbols_version_definition_t&, SymbolVersionDefinition*>

Iterator which outputs SymbolVersionDefinition& object.

using it_const_symbols_version_definition = const_ref_iterator<const symbols_version_definition_t&, const SymbolVersionDefinition*>

Iterator which outputs const SymbolVersionDefinition& object.

using segments_t = std::vector<std::unique_ptr<Segment>>

Internal container for storing ELF’s Segment.

using it_segments = ref_iterator<segments_t&, Segment*>

Iterator which outputs Segment& object.

using it_const_segments = const_ref_iterator<const segments_t&, const Segment*>

Iterator which outputs const Segment& object.

using dynamic_entries_t = std::vector<std::unique_ptr<DynamicEntry>>

Internal container for storing ELF’s DynamicEntry.

using it_dynamic_entries = ref_iterator<dynamic_entries_t&, DynamicEntry*>

Iterator which outputs DynamicEntry& object.

using it_const_dynamic_entries = const_ref_iterator<const dynamic_entries_t&, const DynamicEntry*>

Iterator which outputs const DynamicEntry& object.

using symbols_version_t = std::vector<std::unique_ptr<SymbolVersion>>

Internal container for storing ELF’s SymbolVersion.

using it_symbols_version = ref_iterator<symbols_version_t&, SymbolVersion*>

Iterator which outputs SymbolVersion& object.

using it_const_symbols_version = const_ref_iterator<const symbols_version_t&, const SymbolVersion*>

Iterator which outputs const SymbolVersion& object.

using relocations_t = std::vector<std::unique_ptr<Relocation>>

Internal container for storing ELF’s Relocation.

using it_pltgot_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs plt/got Relocation& object.

using it_const_pltgot_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs plt/got const Relocation& object.

using it_dynamic_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)

using it_const_dynamic_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)

using it_object_relocations = filter_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object found in object files (.o)

using it_const_object_relocations = const_filter_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object found in object files (.o)

using it_relocations = ref_iterator<relocations_t&, Relocation*>

Iterator which outputs Relocation& object.

using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>

Iterator which outputs const Relocation& object.

using symbols_t = std::vector<std::unique_ptr<Symbol>>

Internal container for storing ELF’s Symbol.

using it_dynamic_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the Dynamic Symbol& object.

using it_const_dynamic_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the Dynamic const Symbol& object.

using it_symtab_symbols = ref_iterator<symbols_t&, Symbol*>

Iterator which outputs the static/debug Symbol& object.

using it_const_symtab_symbols = const_ref_iterator<const symbols_t&, const Symbol*>

Iterator which outputs the static/debug const Symbol& object.

using it_symbols = ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic Symbol& object.

using it_const_symbols = const_ref_iterator<std::vector<Symbol*>>

Iterator which outputs static and dynamic const Symbol& object.

using it_exported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported Symbol& object.

using it_const_exported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs exported const Symbol& object.

using it_imported_symbols = filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported Symbol& object.

using it_const_imported_symbols = const_filter_iterator<std::vector<Symbol*>>

Iterator which outputs imported const Symbol& object.

using sections_t = std::vector<std::unique_ptr<Section>>

Internal container for storing ELF’s Section.

using it_sections = ref_iterator<sections_t&, Section*>

Iterator which outputs Section& object.

using it_const_sections = const_ref_iterator<const sections_t&, const Section*>

Iterator which outputs const Section& object.

Public Functions

Binary &operator=(const Binary&) = delete
Binary(const Binary &copy) = delete
inline Header::CLASS type() const

Return binary’s class (ELF32 or ELF64)

inline Header &header()

Return Elf header .

inline const Header &header() const
uint64_t last_offset_section() const

Return the last offset used in binary according to sections table.

uint64_t last_offset_segment() const

Return the last offset used in binary according to segments table.

uint64_t next_virtual_address() const

Return the next virtual address available.

inline it_sections sections()

Return an iterator over the binary’s sections.

inline it_const_sections sections() const
inline virtual uint64_t entrypoint() const override

Return the binary’s entrypoint.

inline it_segments segments()

Return binary’s segments.

inline it_const_segments segments() const
inline it_dynamic_entries dynamic_entries()

Return binary’s dynamic entries.

inline it_const_dynamic_entries dynamic_entries() const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the new entry.

Note &add(const Note &note)

Add the given note and return the created entry.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DynamicEntry::TAG tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section. The clear parameter can be used to zeroize the original content beforehand.

Parameters:
  • section[in] The section to remove

  • clear[in] Whether zeroize the original content

void remove(const Note &note)

Remove the given note.

void remove(Note::TYPE type)

Remove all notes with the given type.

void remove(const Segment &seg)

Remove the given segment.

inline it_dynamic_symbols dynamic_symbols()

Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.

inline it_const_dynamic_symbols dynamic_symbols() const
it_exported_symbols exported_symbols()

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols() const
it_imported_symbols imported_symbols()

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols() const
inline it_symtab_symbols symtab_symbols()

Return the debug symbols from the .symtab section.

inline it_const_symtab_symbols symtab_symbols() const
inline it_symbols_version symbols_version()

Return the symbol versions.

inline it_const_symbols_version symbols_version() const
inline it_symbols_version_definition symbols_version_definition()

Return symbols version definition.

inline it_const_symbols_version_definition symbols_version_definition() const
inline it_symbols_version_requirement symbols_version_requirement()

Return Symbol version requirement.

inline it_const_symbols_version_requirement symbols_version_requirement() const
it_dynamic_relocations dynamic_relocations()

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations() const
Relocation &add_dynamic_relocation(const Relocation &relocation)

Add a new dynamic relocation.

We consider a dynamic relocation as a relocation which is not plt-related

See: add_pltgot_relocation

Relocation &add_pltgot_relocation(const Relocation &relocation)

Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.

See also: add_dynamic_relocation

Relocation *add_object_relocation(const Relocation &relocation, const Section &section)

Add relocation for object file (.o)

The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.

If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.

it_pltgot_relocations pltgot_relocations()

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations() const
it_object_relocations object_relocations()

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations() const
inline it_relocations relocations()

Return all relocations present in the binary.

inline it_const_relocations relocations() const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. It returns a nullptr if it is not found.

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol It returns a nullptr if it is not found.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name It returns a nullptr if it is not found.

Relocation *get_relocation(const std::string &symbol_name)
inline bool use_gnu_hash() const

true if GNU hash is used

inline const GnuHash *gnu_hash() const

Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.

inline bool use_sysv_hash() const

true if SYSV hash is used

inline const SysvHash *sysv_hash() const

Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handles the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handles the given virtual address exists.

Section *get_section(const std::string &name)

Return Section with the given name. If the section can’t be found, it returns a nullptr.

const Section *get_section(const std::string &name) const
inline Section *text_section()

Return the .text section. If the section can’t be found, it returns a nullptr.

Section *dynamic_section()

Return the .dynamic section. If the section can’t be found, it returns a nullptr.

Section *hash_section()

Return the hash section. If the section can’t be found, it returns a nullptr.

Section *symtab_symbols_section()

Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr.

virtual uint64_t imagebase() const override

Return program image base. For instance 0x40000

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size() const

Return the size of the mapped binary.

bool has_interpreter() const

Check if the binary uses a loader (also named linker or interpreter)

See also

interpreter

const std::string &interpreter() const

Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.

void interpreter(const std::string &interpreter)

Change the interpreter.

inline it_symbols symbols()

Return an iterator on both static and dynamic symbols.

inline it_const_symbols symbols() const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbols table.

const Symbol *get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.

Symbol *get_dynamic_symbol(const std::string &name)
inline bool has_symtab_symbol(const std::string &name) const

Check if the symbol with the given name exists in the symtab symbol table.

const Symbol *get_symtab_symbol(const std::string &name) const

Get the symtab symbol from the given name Return a nullptr if it can’t be found.

Symbol *get_symtab_symbol(const std::string &name)
string_list_t strings(size_t min_size = 5) const

Return list of the strings used by the ELF binary.

Basically, this function looks for string in the .roadata section

void remove_symbol(const std::string &name)

Remove symbols with the given name in both:

  • dynamic symbols

  • symtab symbols

void remove_symtab_symbol(const std::string &name)

Remove symtabl symbols with the given name.

void remove_symtab_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbols table.

As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol

virtual result<uint64_t> get_function_address(const std::string &func_name) const override

Return the address of the given function name.

result<uint64_t> get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters:
  • func_name[in] The function’s name target

  • demangled[in] Use the demangled name

Section *add(const Section &section, bool loaded = true)

Add a new section in the binary.

This function requires a well-formed ELF binary

Parameters:
  • section[in] The section object to insert

  • loaded[in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment

Returns:

The section added. The size and the virtual address might change.

Section *extend(const Section &section, uint64_t size)
Symbol &add_symtab_symbol(const Symbol &symbol)

Add a symtab symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr)

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library from the dependencies.

DynamicEntryLibrary *get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

const DynamicEntryLibrary *get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment *add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

This function requires a well-formed ELF binary

Returns:

The segment added. Virtual address and File Offset might change.

Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)

Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.

Warning

The original_segment is no longer valid after this function

Segment *extend(const Segment &segment, uint64_t size)
virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters:
  • address[in] Address to patch

  • patch_value[in] Patch to apply

  • size[in] Size of the value in bytes (1, 2, … 8)

  • addr_type[in] Specify if the address should be used as an absolute virtual address or an RVA

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters:
  • symbol[in] Imported symbol to patch

  • address[in] New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters:
  • symbol_name[in] Imported symbol’s name to patch

  • address[in] New address

void strip()

Strip the binary by removing symtab symbols.

virtual void remove_section(const std::string &name, bool clear = false) override

Remove a binary’s section.

Parameters:
  • name[in] The name of the section to remove

  • clear[in] Whether zeroize the original content

virtual void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

filename – Path for the written ELF binary

void write(const std::string &filename, Builder::config_t config)

Reconstruct the binary object with the given config and write it in filename

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:
  • filename – Path for the written ELF binary

  • configBuilder configuration

virtual void write(std::ostream &os) override

Reconstruct the binary object and write it in os stream.

This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).

Parameters:

os – Output stream for the written ELF binary

void write(std::ostream &os, Builder::config_t config)

Reconstruct the binary object with the given config and write it in os stream.

Parameters:
  • os – Output stream for the written ELF binary

  • configBuilder configuration

std::vector<uint8_t> raw()

Reconstruct the binary object and return its content as a byte vector.

result<uint64_t> virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to a file offset.

virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override

Convert the given offset into a virtual address.

Parameters:
  • offset[in] The offset to convert.

  • slide[in] If not 0, it will replace the default base address (if any)

virtual bool is_pie() const override

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

virtual bool has_nx() const override

Check if the binary uses the NX protection (Non executable stack)

int64_t dynsym_idx(const std::string &name) const

Symbol index in the dynamic symbol table or -1 if the symbol does not exist.

int64_t dynsym_idx(const Symbol &sym) const
int64_t symtab_idx(const std::string &name) const

Symbol index from the .symtab section or -1 if the symbol is not present.

int64_t symtab_idx(const Symbol &sym) const
const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const

Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_offset(uint64_t offset, bool skip_nobits = true)
const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const

Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.

If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)

Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true)
const Segment *segment_from_virtual_address(uint64_t address) const

Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.

Segment *segment_from_virtual_address(uint64_t address)
const Segment *segment_from_virtual_address(Segment::TYPE type, uint64_t address) const
Segment *segment_from_virtual_address(Segment::TYPE type, uint64_t address)
const Segment *segment_from_offset(uint64_t offset) const

Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.

Segment *segment_from_offset(uint64_t offset)
const DynamicEntry *get(DynamicEntry::TAG tag) const

Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.

inline DynamicEntry *get(DynamicEntry::TAG tag)
const Segment *get(Segment::TYPE type) const

Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.

Segment *get(Segment::TYPE type)
const Note *get(Note::TYPE type) const

Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.

Note *get(Note::TYPE type)
const Section *get(Section::TYPE type) const

Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.

Section *get(Section::TYPE type)
inline bool has(DynamicEntry::TAG tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

inline bool has(Segment::TYPE type) const

Check if ELF::Segment associated with the given type exists.

inline bool has(Note::TYPE type) const

Check if a ELF::Note associated with the given type exists.

inline bool has(Section::TYPE type) const

Check if a ELF::Section associated with the given type exists.

virtual span<const uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

virtual void accept(LIEF::Visitor &visitor) const override

Method associated with the visitor pattern.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

virtual LIEF::Binary::functions_t ctor_functions() const override

List of binary constructors (typically, the functions located in the .init_array)

LIEF::Binary::functions_t dtor_functions() const

List of the binary destructors (typically, the functions located in the .fini_array)

LIEF::Binary::functions_t functions() const

List of the functions found the in the binary.

bool has_notes() const

true if the binary embeds notes

inline it_const_notes notes() const

Return an iterator over the ELF’s LIEF::ELF::Note.

See also

has_note

inline it_notes notes()
uint64_t eof_offset() const

Return the last offset used by the ELF binary according to both: the sections table and the segments table.

inline bool has_overlay() const

True if data are present at the end of the binary.

inline span<const uint8_t> overlay() const

Overlay data (if any)

inline void overlay(std::vector<uint8_t> overlay)

Function to set the overlay.

uint64_t relocate_phdr_table(PHDR_RELOC type)

Force relocating the segments table in a specific way.

This function can be used to enforce a specific relocation of the segments table.

Parameters:

type[in] The relocation type to apply

Returns:

The offset of the new segments table or 0 if it fails with the given method.

std::vector<uint64_t> get_relocated_dynamic_array(DynamicEntry::TAG tag) const

Return the array defined by the given tag (e.g. DynamicEntry::TAG::INIT_ARRAY) with relocations applied (if any)

size_t hash(const std::string &name)
~Binary() override
virtual std::ostream &print(std::ostream &os) const override
inline Binary &operator+=(const DynamicEntry &entry)
inline Binary &operator+=(const Section &section)
inline Binary &operator+=(const Segment &segment)
inline Binary &operator+=(const Note &note)
inline Binary &operator-=(const DynamicEntry &entry)
inline Binary &operator-=(DynamicEntry::TAG tag)
inline Binary &operator-=(const Note &note)
inline Binary &operator-=(Note::TYPE type)
inline Segment *operator[](Segment::TYPE type)
inline const Segment *operator[](Segment::TYPE type) const
inline DynamicEntry *operator[](DynamicEntry::TAG tag)
inline const DynamicEntry *operator[](DynamicEntry::TAG tag) const
inline Note *operator[](Note::TYPE type)
inline const Note *operator[](Note::TYPE type) const
inline Section *operator[](Section::TYPE type)
inline const Section *operator[](Section::TYPE type) const

Public Static Functions

static inline bool classof(const LIEF::Binary *bin)


Section

class Section : public LIEF::Section

Class wich represents an ELF Section.

Public Types

enum class TYPE : uint64_t

Values:

enumerator SHT_NULL = 0

No associated section (inactive entry).

enumerator PROGBITS = 1

Program-defined contents.

enumerator SYMTAB = 2

Symbol table.

enumerator STRTAB = 3

String table.

enumerator RELA = 4

Relocation entries; explicit addends.

enumerator HASH = 5

Symbol hash table.

enumerator DYNAMIC = 6

Information for dynamic linking.

enumerator NOTE = 7

Information about the file.

enumerator NOBITS = 8

Data occupies no space in the file.

enumerator REL = 9

Relocation entries; no explicit addends.

enumerator SHLIB = 10

Reserved.

enumerator DYNSYM = 11

Symbol table.

enumerator INIT_ARRAY = 14

Pointers to initialization functions.

enumerator FINI_ARRAY = 15

Pointers to termination functions.

enumerator PREINIT_ARRAY = 16

Pointers to pre-init functions.

enumerator GROUP = 17

Section group.

enumerator SYMTAB_SHNDX = 18

Indices for SHN_XINDEX entries.

enumerator RELR = 19

Relocation entries; only offsets.

enumerator ANDROID_REL = 0x60000001

Packed relocations (Android specific).

enumerator ANDROID_RELA = 0x60000002

Packed relocations (Android specific).

enumerator LLVM_ADDRSIG = 0x6fff4c03

This section is used to mark symbols as address-significant.

enumerator ANDROID_RELR = 0x6fffff00

New relr relocations (Android specific).

enumerator GNU_ATTRIBUTES = 0x6ffffff5

Object attributes.

enumerator GNU_HASH = 0x6ffffff6

GNU-style hash table.

enumerator GNU_VERDEF = 0x6ffffffd

GNU version definitions.

enumerator GNU_VERNEED = 0x6ffffffe

GNU version references.

enumerator GNU_VERSYM = 0x6fffffff

GNU symbol versions table.

enumerator _ID_SHIFT_ = 32
enumerator _ARM_ID_ = 1LLU
enumerator _HEX_ID_ = 2LLU
enumerator _X86_64_ID_ = 2LLU
enumerator _MIPS_ID_ = 3LLU
enumerator ARM_EXIDX = 0x70000001U + (_ARM_ID_ << _ID_SHIFT_)

Exception Index table

enumerator ARM_PREEMPTMAP = 0x70000002U + (_ARM_ID_ << _ID_SHIFT_)

BPABI DLL dynamic linking pre-emption map

enumerator ARM_ATTRIBUTES = 0x70000003U + (_ARM_ID_ << _ID_SHIFT_)

Object file compatibility attributes

enumerator ARM_DEBUGOVERLAY = 0x70000004U + (_ARM_ID_ << _ID_SHIFT_)
enumerator ARM_OVERLAYSECTION = 0x70000005U + (_ARM_ID_ << _ID_SHIFT_)
enumerator HEX_ORDERED = 0x70000000 + (_HEX_ID_ << _ID_SHIFT_)

Link editor is to sort the entries in this section based on their sizes

enumerator X86_64_UNWIND = 0x70000001 + (_X86_64_ID_ << _ID_SHIFT_)

Unwind information

enumerator MIPS_REGINFO = 0x70000006 + (_MIPS_ID_ << _ID_SHIFT_)

Register usage information

enumerator MIPS_OPTIONS = 0x7000000d + (_MIPS_ID_ << _ID_SHIFT_)

General options

enumerator MIPS_ABIFLAGS = 0x7000002a + (_MIPS_ID_ << _ID_SHIFT_)

ABI information.

enum class FLAGS : uint64_t

Values:

enumerator NONE = 0x000000000
enumerator WRITE = 0x000000001

Section data should be writable during execution.

enumerator ALLOC = 0x000000002

Section occupies memory during program execution.

enumerator EXECINSTR = 0x000000004

Section contains executable machine instructions.

enumerator MERGE = 0x000000010

The data in this section may be merged.

enumerator STRINGS = 0x000000020

The data in this section is null-terminated strings.

enumerator INFO_LINK = 0x000000040

A field in this section holds a section header table index.

Adds special ordering requirements for link editors.

enumerator OS_NONCONFORMING = 0x000000100

This section requires special OS-specific processing to avoid incorrect behavior

enumerator GROUP = 0x000000200

This section is a member of a section group.

enumerator TLS = 0x000000400

This section holds Thread-Local Storage.

enumerator COMPRESSED = 0x000000800
enumerator GNU_RETAIN = 0x000200000
enumerator EXCLUDE = 0x080000000
enumerator _ID_SHIFT_ = 32
enumerator _XCORE_ID_ = 1LLU
enumerator _HEX_ID_ = 3LLU
enumerator _X86_64_ID_ = 2LLU
enumerator _MIPS_ID_ = 4LLU
enumerator _ARM_ID_ = 5LLU
enumerator XCORE_SHF_DP_SECTION = 0x010000000 + (_XCORE_ID_ << _ID_SHIFT_)
enumerator XCORE_SHF_CP_SECTION = 0x020000000 + (_XCORE_ID_ << _ID_SHIFT_)
enumerator X86_64_LARGE = 0x010000000 + (_X86_64_ID_ << _ID_SHIFT_)
enumerator HEX_GPREL = 0x010000000 + (_HEX_ID_ << _ID_SHIFT_)
enumerator MIPS_NODUPES = 0x001000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_NAMES = 0x002000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_LOCAL = 0x004000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_NOSTRIP = 0x008000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_GPREL = 0x010000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_MERGE = 0x020000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_ADDR = 0x040000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator MIPS_STRING = 0x080000000 + (_MIPS_ID_ << _ID_SHIFT_)
enumerator ARM_PURECODE = 0x020000000 + (_ARM_ID_ << _ID_SHIFT_)
using segments_t = std::vector<Segment*>
using it_segments = ref_iterator<segments_t&>
using it_const_segments = const_ref_iterator<const segments_t&>

Public Functions

inline Section(const std::string &name, TYPE type = TYPE::PROGBITS)
Section() = default
~Section() override = default
inline Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other) noexcept
inline TYPE type() const
virtual span<const uint8_t> content() const override

Section’s content.

virtual void content(const std::vector<uint8_t> &data) override

Set section content.

void content(std::vector<uint8_t> &&data)
inline uint64_t flags() const

Section flags.

bool has(FLAGS flag) const

True if the section has the given flag

bool has(const Segment &segment) const

True if the section is wrapped by the given Segment

std::vector<FLAGS> flags_list() const

Return section flags as a std::set

inline virtual uint64_t size() const override

section’s size (size in the binary, not the virtual size)

virtual void size(uint64_t size) override

Change the section size.

virtual void offset(uint64_t offset) override
inline virtual uint64_t offset() const override

Offset in the binary.

inline uint64_t file_offset() const

See also

offset

inline uint64_t original_size() const

Original size of the section’s data.

This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data

inline uint64_t alignment() const

Section file alignment.

inline uint64_t information() const

Section information. The meaning of this value depends on the section’s type.

inline uint64_t entry_size() const

This function returns the size of an element in the case of a section that contains an array.

For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeoe(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.

inline uint32_t link() const

Index to another section.

Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(FLAGS flag)

Add the given ELF_SECTION_FLAGS.

void remove(FLAGS flag)

Remove the given ELF_SECTION_FLAGS.

inline void type(TYPE type)
inline void flags(uint64_t flags)
inline void clear_flags()
inline void file_offset(uint64_t offset)
inline void link(uint32_t link)
inline void information(uint32_t info)
inline void alignment(uint64_t alignment)
inline void entry_size(uint64_t entry_size)
inline it_segments segments()
inline it_const_segments segments() const
inline Section &as_frame()
inline bool is_frame() const
virtual void accept(Visitor &visitor) const override
inline Section &operator+=(FLAGS c)
inline Section &operator-=(FLAGS c)

Public Static Functions

static TYPE type_from(uint32_t value, ARCH arch)
static inline uint32_t to_value(TYPE type)

Public Static Attributes

static uint32_t MAX_SECTION_SIZE = 2_GB
static uint64_t FLAG_MASK = (uint64_t(1) << uint8_t(FLAGS::_ID_SHIFT_)) - 1
static uint64_t TYPE_MASK = (uint64_t(1) << uint8_t(TYPE::_ID_SHIFT_)) - 1

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class Segment : public LIEF::Object

Class which represents the ELF segments.

Public Types

enum class TYPE : uint64_t

Values:

enumerator UNKNOWN = uint64_t(-1)
enumerator PT_NULL = 0

Unused segment.

enumerator LOAD = 1

Loadable segment.

enumerator DYNAMIC = 2

Dynamic linking information.

enumerator INTERP = 3

Interpreter pathname.

enumerator NOTE = 4

Auxiliary information.

enumerator SHLIB = 5

Reserved.

enumerator PHDR = 6

The program header table itself.

enumerator TLS = 7

The thread-local storage template.

enumerator GNU_EH_FRAME = 0x6474e550
enumerator GNU_STACK = 0x6474e551

Indicates stack executability.

enumerator GNU_PROPERTY = 0x6474e553

GNU property

enumerator GNU_RELRO = 0x6474e552

Read-only after relocation.

enumerator ARM_ARCHEXT = 0x70000000 | PT_ARM

Platform architecture compatibility info

enumerator ARM_EXIDX = 0x70000001 | PT_ARM
enumerator AARCH64_MEMTAG_MTE = 0x70000002 | PT_AARCH64
enumerator MIPS_REGINFO = 0x70000000 | PT_MIPS

Register usage information.

enumerator MIPS_RTPROC = 0x70000001 | PT_MIPS

Runtime procedure table.

enumerator MIPS_OPTIONS = 0x70000002 | PT_MIPS

Options segment.

enumerator MIPS_ABIFLAGS = 0x70000003 | PT_MIPS

Abiflags segment.

enumerator RISCV_ATTRIBUTES = 0x70000003 | PT_RISCV
enum class FLAGS

Values:

enumerator NONE = 0
enumerator X = 1
enumerator W = 2
enumerator R = 4
using sections_t = std::vector<Section*>
using it_sections = ref_iterator<sections_t&>
using it_const_sections = const_ref_iterator<const sections_t&>

Public Functions

Segment() = default
~Segment() override = default
Segment &operator=(Segment other)
Segment(const Segment &other)
Segment &operator=(Segment&&) = default
Segment(Segment&&) = default
void swap(Segment &other)
inline bool is_load() const
inline bool is_interpreter() const
inline bool is_phdr() const
inline TYPE type() const

The segment’s type (LOAD, DYNAMIC, …)

inline FLAGS flags() const

The flag permissions associated with this segment.

inline uint64_t file_offset() const

The file offset of the data associated with this segment.

inline uint64_t virtual_address() const

The virtual address of the segment.

inline uint64_t physical_address() const

The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.

Usually this value matches virtual_address

inline uint64_t physical_size() const

The file size of the data associated with this segment.

inline uint64_t virtual_size() const

The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.

inline uint64_t alignment() const

The offset alignment of the segment.

span<const uint8_t> content() const

The raw data associated with this segment.

inline bool has(FLAGS flag) const

Check if the current segment has the given flag.

bool has(const Section &section) const

Check if the current segment wraps the given ELF::Section.

bool has(const std::string &section_name) const

Check if the current segment wraps the given section’s name.

void add(FLAGS flag)

Append the given ELF_SEGMENT_FLAGS.

void remove(FLAGS flag)

Remove the given ELF_SEGMENT_FLAGS.

inline void type(TYPE type)
inline void flags(FLAGS flags)
inline void flags(uint32_t flags)
inline void clear_flags()
void file_offset(uint64_t file_offset)
inline void virtual_address(uint64_t virtual_address)
inline void physical_address(uint64_t physical_address)
void physical_size(uint64_t physical_size)
inline void virtual_size(uint64_t virtual_size)
inline void alignment(uint64_t alignment)
void content(std::vector<uint8_t> content)
template<typename T>
T get_content_value(size_t offset) const
template<typename T>
void set_content_value(size_t offset, T value)
size_t get_content_size() const
inline it_sections sections()

Iterator over the sections wrapped by this segment.

inline it_const_sections sections() const
virtual void accept(Visitor &visitor) const override
inline Segment &operator+=(FLAGS flag)
inline Segment &operator-=(FLAGS flag)

Public Static Functions

static TYPE type_from(uint64_t value, ARCH arch)
static inline uint64_t to_value(TYPE type)
static result<Segment> from_raw(const uint8_t *ptr, size_t size)
static inline result<Segment> from_raw(const std::vector<uint8_t> &raw)

Public Static Attributes

static uint64_t PT_BIT = 33
static uint64_t PT_MASK = (uint64_t(1) << PT_BIT) - 1
static uint64_t PT_ARM = uint64_t(1) << PT_BIT
static uint64_t PT_AARCH64 = uint64_t(2) << PT_BIT
static uint64_t PT_MIPS = uint64_t(3) << PT_BIT
static uint64_t PT_RISCV = uint64_t(4) << PT_BIT

Friends

friend std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class DynamicEntry : public LIEF::Object

Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Types

enum class TAG : uint64_t

Values:

enumerator UNKNOWN = uint64_t(-1)
enumerator DT_NULL = 0

Marks end of dynamic array.

enumerator NEEDED = 1

String table offset of needed library.

enumerator PLTRELSZ = 2

Size of relocation entries in PLT.

enumerator PLTGOT = 3

Address associated with linkage table.

enumerator HASH = 4

Address of symbolic hash table.

enumerator STRTAB = 5

Address of dynamic string table.

enumerator SYMTAB = 6

Address of dynamic symbol table.

enumerator RELA = 7

Address of relocation table (Rela entries).

enumerator RELASZ = 8

Size of Rela relocation table.

enumerator RELAENT = 9

Size of a Rela relocation entry.

enumerator STRSZ = 10

Total size of the string table.

enumerator SYMENT = 11

Size of a symbol table entry.

enumerator INIT = 12

Address of initialization function.

enumerator FINI = 13

Address of termination function.

enumerator SONAME = 14

String table offset of a shared objects name.

enumerator RPATH = 15

String table offset of library search path.

enumerator SYMBOLIC = 16

Changes symbol resolution algorithm.

enumerator REL = 17

Address of relocation table (Rel entries).

enumerator RELSZ = 18

Size of Rel relocation table.

enumerator RELENT = 19

Size of a Rel relocation entry.

enumerator PLTREL = 20

Type of relocation entry used for linking.

enumerator DEBUG_TAG = 21

Reserved for debugger.

enumerator TEXTREL = 22

Relocations exist for non-writable segments.

enumerator JMPREL = 23

Address of relocations associated with PLT.

enumerator BIND_NOW = 24

Process all relocations before execution.

enumerator INIT_ARRAY = 25

Pointer to array of initialization functions.

enumerator FINI_ARRAY = 26

Pointer to array of termination functions.

enumerator INIT_ARRAYSZ = 27

Size of DT_INIT_ARRAY.

enumerator FINI_ARRAYSZ = 28

Size of DT_FINI_ARRAY.

enumerator RUNPATH = 29

String table offset of lib search path.

enumerator FLAGS = 30

Flags.

enumerator PREINIT_ARRAY = 32

Pointer to array of preinit functions.

enumerator PREINIT_ARRAYSZ = 33

Size of the DT_PREINIT_ARRAY array.

enumerator SYMTAB_SHNDX = 34

Address of SYMTAB_SHNDX section

enumerator RELRSZ = 35

Total size of RELR relative relocations

enumerator RELR = 36

Address of RELR relative relocations

enumerator RELRENT = 37

Size of one RELR relative relocaction

enumerator GNU_HASH = 0x6FFFFEF5

Reference to the GNU hash table.

enumerator RELACOUNT = 0x6FFFFFF9

ELF32_Rela count.

enumerator RELCOUNT = 0x6FFFFFFA

ELF32_Rel count.

enumerator FLAGS_1 = 0x6FFFFFFB

Flags_1.

enumerator VERSYM = 0x6FFFFFF0

The address of .gnu.version section.

enumerator VERDEF = 0x6FFFFFFC

The address of the version definition table.

enumerator VERDEFNUM = 0x6FFFFFFD

The number of entries in DT_VERDEF.

enumerator VERNEED = 0x6FFFFFFE

The address of the version Dependency table.

enumerator VERNEEDNUM = 0x6FFFFFFF

The number of entries in DT_VERNEED.

enumerator ANDROID_REL_OFFSET = 0x6000000D

The offset of packed relocation data (older version < M) (Android specific).

enumerator ANDROID_REL_SIZE = 0x6000000E

The size of packed relocation data in bytes (older version < M) (Android specific).

enumerator ANDROID_REL = 0x6000000F

The offset of packed relocation data (Android specific).

enumerator ANDROID_RELSZ = 0x60000010

The size of packed relocation data in bytes (Android specific).

enumerator ANDROID_RELA = 0x60000011

The offset of packed relocation data (Android specific).

enumerator ANDROID_RELASZ = 0x60000012

The size of packed relocation data in bytes (Android specific).

enumerator ANDROID_RELR = 0x6FFFE000

The offset of new relr relocation data (Android specific).

enumerator ANDROID_RELRSZ = 0x6FFFE001

The size of nre relr relocation data in bytes (Android specific).

enumerator ANDROID_RELRENT = 0x6FFFE003

The size of a new relr relocation entry (Android specific).

enumerator ANDROID_RELRCOUNT = 0x6FFFE005

Specifies the relative count of new relr relocation entries (Android specific).

enumerator MIPS_RLD_VERSION = MIPS_DISC + 0x70000001

32 bit version number for runtime linker interface.

enumerator MIPS_TIME_STAMP = MIPS_DISC + 0x70000002

Time stamp.

enumerator MIPS_ICHECKSUM = MIPS_DISC + 0x70000003

Checksum of external strings and common sizes.

enumerator MIPS_IVERSION = MIPS_DISC + 0x70000004

Index of version string in string table.

enumerator MIPS_FLAGS = MIPS_DISC + 0x70000005

32 bits of flags.

enumerator MIPS_BASE_ADDRESS = MIPS_DISC + 0x70000006

Base address of the segment.

enumerator MIPS_MSYM = MIPS_DISC + 0x70000007

Address of .msym section.

enumerator MIPS_CONFLICT = MIPS_DISC + 0x70000008

Address of .conflict section.

enumerator MIPS_LIBLIST = MIPS_DISC + 0x70000009

Address of .liblist section.

enumerator MIPS_LOCAL_GOTNO = MIPS_DISC + 0x7000000a

Number of local global offset table entries.

enumerator MIPS_CONFLICTNO = MIPS_DISC + 0x7000000b

Number of entries in the .conflict section.

enumerator MIPS_LIBLISTNO = MIPS_DISC + 0x70000010

Number of entries in the .liblist section.

enumerator MIPS_SYMTABNO = MIPS_DISC + 0x70000011

Number of entries in the .dynsym section.

enumerator MIPS_UNREFEXTNO = MIPS_DISC + 0x70000012

Index of first external dynamic symbol not referenced locally.

enumerator MIPS_GOTSYM = MIPS_DISC + 0x70000013

Index of first dynamic symbol in global offset table.

enumerator MIPS_HIPAGENO = MIPS_DISC + 0x70000014

Number of page table entries in global offset table.

enumerator MIPS_RLD_MAP = MIPS_DISC + 0x70000016

Address of run time loader map, used for debugging.

enumerator MIPS_DELTA_CLASS = MIPS_DISC + 0x70000017

Delta C++ class definition.

enumerator MIPS_DELTA_CLASS_NO = MIPS_DISC + 0x70000018

Number of entries in DT_MIPS_DELTA_CLASS.

enumerator MIPS_DELTA_INSTANCE = MIPS_DISC + 0x70000019

Delta C++ class instances.

enumerator MIPS_DELTA_INSTANCE_NO = MIPS_DISC + 0x7000001A

Number of entries in DT_MIPS_DELTA_INSTANCE.

enumerator MIPS_DELTA_RELOC = MIPS_DISC + 0x7000001B

Delta relocations.

enumerator MIPS_DELTA_RELOC_NO = MIPS_DISC + 0x7000001C

Number of entries in DT_MIPS_DELTA_RELOC.

enumerator MIPS_DELTA_SYM = MIPS_DISC + 0x7000001D

Delta symbols that Delta relocations refer to.

enumerator MIPS_DELTA_SYM_NO = MIPS_DISC + 0x7000001E

Number of entries in DT_MIPS_DELTA_SYM.

enumerator MIPS_DELTA_CLASSSYM = MIPS_DISC + 0x70000020

Delta symbols that hold class declarations.

enumerator MIPS_DELTA_CLASSSYM_NO = MIPS_DISC + 0x70000021

Number of entries in DT_MIPS_DELTA_CLASSSYM.

enumerator MIPS_CXX_FLAGS = MIPS_DISC + 0x70000022

Flags indicating information about C++ flavor.

enumerator MIPS_PIXIE_INIT = MIPS_DISC + 0x70000023

Pixie information.

enumerator MIPS_SYMBOL_LIB = MIPS_DISC + 0x70000024

Address of .MIPS.symlib

enumerator MIPS_LOCALPAGE_GOTIDX = MIPS_DISC + 0x70000025

The GOT index of the first PTE for a segment

enumerator MIPS_LOCAL_GOTIDX = MIPS_DISC + 0x70000026

The GOT index of the first PTE for a local symbol

enumerator MIPS_HIDDEN_GOTIDX = MIPS_DISC + 0x70000027

The GOT index of the first PTE for a hidden symbol

enumerator MIPS_PROTECTED_GOTIDX = MIPS_DISC + 0x70000028

The GOT index of the first PTE for a protected symbol

enumerator MIPS_OPTIONS = MIPS_DISC + 0x70000029

Address of .MIPS.options. */ MIPS_INTERFACE = MIPS_DISC + 0x7000002A, /**< Address of .interface.

enumerator MIPS_DYNSTR_ALIGN = MIPS_DISC + 0x7000002B

Unknown.

enumerator MIPS_INTERFACE_SIZE = MIPS_DISC + 0x7000002C

Size of the .interface section.

enumerator MIPS_RLD_TEXT_RESOLVE_ADDR = MIPS_DISC + 0x7000002D

Size of rld_text_resolve function stored in the GOT.

enumerator MIPS_PERF_SUFFIX = MIPS_DISC + 0x7000002E

Default suffix of DSO to be added by rld on dlopen() calls.

enumerator MIPS_COMPACT_SIZE = MIPS_DISC + 0x7000002F

Size of compact relocation section (O32).

enumerator MIPS_GP_VALUE = MIPS_DISC + 0x70000030

GP value for auxiliary GOTs.

enumerator MIPS_AUX_DYNAMIC = MIPS_DISC + 0x70000031

Address of auxiliary .dynamic.

enumerator MIPS_PLTGOT = MIPS_DISC + 0x70000032

Address of the base of the PLTGOT.

enumerator MIPS_RWPLT = MIPS_DISC + 0x70000034
enumerator MIPS_RLD_MAP_REL = MIPS_DISC + 0x70000035
enumerator MIPS_XHASH = MIPS_DISC + 0x70000036
enumerator AARCH64_BTI_PLT = AARCH64_DISC + 0x70000001
enumerator AARCH64_PAC_PLT = AARCH64_DISC + 0x70000003
enumerator AARCH64_VARIANT_PCS = AARCH64_DISC + 0x70000005
enumerator AARCH64_MEMTAG_MODE = AARCH64_DISC + 0x70000009
enumerator AARCH64_MEMTAG_HEAP = AARCH64_DISC + 0x7000000b
enumerator AARCH64_MEMTAG_STACK = AARCH64_DISC + 0x7000000c
enumerator AARCH64_MEMTAG_GLOBALS = AARCH64_DISC + 0x7000000d
enumerator AARCH64_MEMTAG_GLOBALSSZ = AARCH64_DISC + 0x7000000f
enumerator HEXAGON_SYMSZ = HEXAGON_DISC + 0x70000000
enumerator HEXAGON_VER = HEXAGON_DISC + 0x70000001
enumerator HEXAGON_PLT = HEXAGON_DISC + 0x70000002
enumerator PPC_GOT = PPC_DISC + 0x70000000
enumerator PPC_OPT = PPC_DISC + 0x70000001
enumerator PPC64_GLINK = PPC64_DISC + 0x70000000
enumerator PPC64_OPT = PPC64_DISC + 0x70000003
enumerator RISCV_VARIANT_CC = RISCV_DISC + 0x70000003

Public Functions

DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&) = default
DynamicEntry(const DynamicEntry&) = default
~DynamicEntry() override = default
inline virtual std::unique_ptr<DynamicEntry> clone() const
inline TAG tag() const

Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …

inline uint64_t value() const

Return the entry’s value.

The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …

inline void tag(TAG tag)
inline void value(uint64_t value)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const

Public Static Functions

static TAG from_value(uint64_t value, ARCH arch)
static uint64_t to_value(TAG tag)

Public Static Attributes

static uint64_t MIPS_DISC = 0x100000000
static uint64_t AARCH64_DISC = 0x200000000
static uint64_t HEXAGON_DISC = 0x300000000
static uint64_t PPC_DISC = 0x400000000
static uint64_t PPC64_DISC = 0x500000000
static uint64_t RISCV_DISC = 0x600000000

Friends

inline friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Class which represents a DT_NEEDED entry in the dynamic table.

This kind of entry is usually used to create library dependency.

Public Functions

inline DynamicEntryLibrary()
inline DynamicEntryLibrary(std::string name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&) = default
DynamicEntryLibrary(const DynamicEntryLibrary&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &name() const

Return the library associated with this entry (e.g. libc.so.6)

inline void name(std::string name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Shared Object

class DynamicSharedObject : public LIEF::ELF::DynamicEntry

Class which represents a DT_SONAME entry in the dynamic table This kind of entry is usually used to name the original library.

This entry is not present for executable.

Public Functions

inline DynamicSharedObject()
inline DynamicSharedObject(std::string name)
DynamicSharedObject &operator=(const DynamicSharedObject&) = default
DynamicSharedObject(const DynamicSharedObject&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &name() const

The actual name (e.g. libMyLib.so)

inline void name(std::string name)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicSharedObject() override = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Entry Run Path

class DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).

Public Functions

inline DynamicEntryRunPath()
inline DynamicEntryRunPath(std::string runpath)

Constructor from (run)path.

inline DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&) = default
DynamicEntryRunPath(const DynamicEntryRunPath&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &runpath() const

Runpath raw value.

inline void runpath(std::string runpath)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

inline DynamicEntryRunPath &operator+=(std::string path)
inline DynamicEntryRunPath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryRunPath() = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static char delimiter = ':'

Dynamic Entry RPath

class DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)

Public Functions

inline DynamicEntryRpath()
inline DynamicEntryRpath(std::string rpath)
inline DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&) = default
DynamicEntryRpath(const DynamicEntryRpath&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline const std::string &rpath() const

The actual rpath as a string.

inline void rpath(const std::string &name)
std::vector<std::string> paths() const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string &path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

inline DynamicEntryRpath &operator+=(std::string path)
inline DynamicEntryRpath &operator-=(const std::string &path)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryRpath() = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static char delimiter = ':'

Dynamic Entry Array

class DynamicEntryArray : public LIEF::ELF::DynamicEntry

Class that represent an Array in the dynamic table. This entry is associated with constructors:

  • DT_PREINIT_ARRAY

  • DT_INIT_ARRAY

  • DT_FINI_ARRAY

The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray() = delete
inline DynamicEntryArray(DynamicEntry::TAG tag, array_t array)
DynamicEntryArray &operator=(const DynamicEntryArray&) = default
DynamicEntryArray(const DynamicEntryArray&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
inline array_t &array()

Return the array values (list of pointers)

inline const array_t &array() const
inline void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t function)

Insert the given function at pos

inline DynamicEntryArray &append(uint64_t function)

Append the given function.

DynamicEntryArray &remove(uint64_t function)

Remove the given function.

inline size_t size() const

Number of function registred in this array.

inline DynamicEntryArray &operator+=(uint64_t value)
inline DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
virtual void accept(Visitor &visitor) const override
virtual std::ostream &print(std::ostream &os) const override
~DynamicEntryArray() override = default
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline bool classof(const DynamicEntry *entry)

Dynamic Entry Flags

class DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

enum class FLAG : uint64_t

Values:

enumerator ORIGIN = 0x00000001

The object may reference $ORIGIN.

enumerator SYMBOLIC = 0x00000002

Search the shared lib before searching the exe.

enumerator TEXTREL = 0x00000004

Relocations may modify a non-writable segment.

enumerator BIND_NOW = 0x00000008

Process all relocations on load.

enumerator STATIC_TLS = 0x00000010

Reject attempts to load dynamically.

enumerator NOW = BASE + 0x000000001

Set RTLD_NOW for this object.

enumerator GLOBAL = BASE + 0x000000002

Set RTLD_GLOBAL for this object.

enumerator GROUP = BASE + 0x000000004

Set RTLD_GROUP for this object.

enumerator NODELETE = BASE + 0x000000008

Set RTLD_NODELETE for this object.

enumerator LOADFLTR = BASE + 0x000000010

Trigger filtee loading at runtime.

enumerator INITFIRST = BASE + 0x000000020

Set RTLD_INITFIRST for this object.

enumerator NOOPEN = BASE + 0x000000040

Set RTLD_NOOPEN for this object.

enumerator HANDLE_ORIGIN = BASE + 0x000000080

$ORIGIN must be handled.

enumerator DIRECT = BASE + 0x000000100

Direct binding enabled.

enumerator TRANS = BASE + 0x000000200
enumerator INTERPOSE = BASE + 0x000000400

Object is used to interpose.

enumerator NODEFLIB = BASE + 0x000000800

Ignore default lib search path.

enumerator NODUMP = BASE + 0x000001000

Object can’t be dldump’ed.

enumerator CONFALT = BASE + 0x000002000

Configuration alternative created.

enumerator ENDFILTEE = BASE + 0x000004000

Filtee terminates filters search.

enumerator DISPRELDNE = BASE + 0x000008000

Disp reloc applied at build time.

enumerator DISPRELPND = BASE + 0x000010000

Disp reloc applied at run-time.

enumerator NODIRECT = BASE + 0x000020000

Object has no-direct binding.

enumerator IGNMULDEF = BASE + 0x000040000
enumerator NOKSYMS = BASE + 0x000080000
enumerator NOHDR = BASE + 0x000100000
enumerator EDITED = BASE + 0x000200000

Object is modified after built.

enumerator NORELOC = BASE + 0x000400000
enumerator SYMINTPOSE = BASE + 0x000800000

Object has individual interposers.

enumerator GLOBAUDIT = BASE + 0x001000000

Global auditing required.

enumerator SINGLETON = BASE + 0x002000000

Singleton symbols are used.

enumerator PIE = BASE + 0x008000000

Singleton symbols are used.

enumerator KMOD = BASE + 0x010000000
enumerator WEAKFILTER = BASE + 0x020000000
enumerator NOCOMMON = BASE + 0x040000000
using flags_list_t = std::vector<FLAG>

Public Functions

DynamicEntryFlags() = delete
DynamicEntryFlags &operator=(const DynamicEntryFlags&) = default
DynamicEntryFlags(const DynamicEntryFlags&) = default
inline virtual std::unique_ptr<DynamicEntry> clone() const override
bool has(FLAG f) const

If the current entry has the given FLAG.

flags_list_t flags() const

Return flags as a list of integers.

void add(FLAG f)

Add the given FLAG.

void remove(FLAG f)

Remove the given FLAG.

inline DynamicEntryFlags &operator+=(FLAG f)
inline DynamicEntryFlags &operator-=(FLAG f)
virtual void accept(Visitor &visitor) const override
~DynamicEntryFlags() = default
virtual std::ostream &print(std::ostream &os) const override
DynamicEntry() = default
DynamicEntry(const details::Elf64_Dyn &header, ARCH arch)
DynamicEntry(const details::Elf32_Dyn &header, ARCH arch)
inline DynamicEntry(TAG tag, uint64_t value)
DynamicEntry(const DynamicEntry&) = default

Public Static Functions

static inline DynamicEntryFlags create_dt_flag(uint64_t value)
static inline DynamicEntryFlags create_dt_flag_1(uint64_t value)
static inline bool classof(const DynamicEntry *entry)

Public Static Attributes

static uint64_t BASE = 0x100000000

Relocations

class Relocation : public LIEF::Relocation

Class that represents an ELF relocation.

Public Types

enum class PURPOSE

The purpose of a relocation defines how this relocation is used by the loader.

Values:

enumerator NONE = 0
enumerator PLTGOT = 1

The relocation is associated with the PLT/GOT resolution.

enumerator DYNAMIC = 2

The relocation is used for regulard data/code relocation.

enumerator OBJECT = 3

The relocation is used in an object file.

enum class ENCODING

Values:

enumerator UNKNOWN = 0
enumerator REL

The relocation is using the regular Elf_Rel structure.

enumerator RELA

The relocation is using the regular Elf_Rela structure.

enumerator RELR

The relocation is using the relative relocation format.

enumerator ANDROID_SLEB

The relocation is using the packed Android-SLEB128 format.

enum class TYPE : uint32_t

The different types of the relocation.

Values:

enumerator UNKNOWN = uint32_t(-1)
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC
enumerator ELF_RELOC

Public Functions