C++¶
Parser¶
- class Parser : public LIEF::Parser¶
Class which parses and transforms an ELF file into a ELF::Binary object.
Subclassed by LIEF::OAT::Parser
Public Functions
- virtual ~Parser() override¶
Public Static Functions
- static std::unique_ptr<Binary> parse(const std::string &file, const ParserConfig &conf = ParserConfig::all())¶
Parse an ELF file and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols
- Parameters:
file – [in] Path to the ELF binary
conf – [in] Optional configuration for the parser
- Returns:
LIEF::ELF::Binary as a
unique_ptr
- static std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const ParserConfig &conf = ParserConfig::all())¶
Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols
- Parameters:
data – [in] Raw ELF as a std::vector of uint8_t
conf – [in] Optional configuration for the parser
- Returns:
- static std::unique_ptr<Binary> parse(std::unique_ptr<BinaryStream> stream, const ParserConfig &conf = ParserConfig::all())¶
Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use to count dynamic symbols
- Parameters:
stream – [in] The stream which wraps the ELF binary
conf – [in] Optional configuration for the parser
- Returns:
- static std::unique_ptr<Binary> parse_from_memory(uintptr_t address, const ParserConfig &conf = ParserConfig::all())¶
Parse the ELF binary from the given memory address.
- Parameters:
address – [in] Base address of the ELF binary in memory
conf – [in] Optional configuration for the parser
- Returns:
- static std::unique_ptr<Binary> parse_from_memory(uintptr_t address, size_t size, const ParserConfig &conf = ParserConfig::all())¶
Parse the ELF binary from the given memory address with the given size.
- Parameters:
address – [in] Base address of the ELF binary in memory
size – [in] Size of the memory region
conf – [in] Optional configuration for the parser
- Returns:
- static std::unique_ptr<Binary> parse_from_dump(const std::string &filepath, uint64_t addr, const ParserConfig &conf = ParserConfig::all())¶
Parse an ELF binary from a memory dump located on disk.
A dump is a raw capture of the process memory that was mapped starting at the virtual address
addr. This is typically used to parse an ELF image that has been dumped from memory (e.g. from a debugger or a runtime hook).- Parameters:
filepath – [in] Path to the file that contains the memory dump
addr – [in] Virtual address at which the dump was mapped
conf – [in] Optional configuration for the parser
- static std::unique_ptr<Binary> parse_from_dump(BinaryStream &stream, uint64_t addr, const ParserConfig &conf = ParserConfig::all())¶
Same as parse_from_dump(const std::string&, uint64_t, const ParserConfig&) but the dump is wrapped in the given non-owned stream.
- static std::unique_ptr<Binary> parse_from_dump(std::unique_ptr<BinaryStream> stream, uint64_t addr, const ParserConfig &conf = ParserConfig::all())¶
Same as parse_from_dump(const std::string&, uint64_t, const ParserConfig&) but the dump is wrapped in the given owned stream.
Public Static Attributes
- static uint32_t NB_MAX_SYMBOLS = 1000000¶
- static uint32_t DELTA_NB_SYMBOLS = 3000¶
- static uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS¶
- static uint32_t NB_MAX_CHAINS = 1000000¶
- static uint32_t NB_MAX_SEGMENTS = 10000¶
- static uint32_t NB_MAX_RELOCATIONS = 3000000¶
- static uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000¶
- static uint32_t MAX_SEGMENT_SIZE = 3_GB¶
Friends
- friend class OAT::Parser
- virtual ~Parser() override¶
- struct ParserConfig¶
This structure is used to tweak the ELF Parser (ELF::Parser).
Public Types
- enum class DYNSYM_COUNT¶
Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols.
Values:
- enumerator AUTO = 0¶
Automatic detection.
- enumerator SECTION¶
Count based on sections (not very reliable).
- enumerator HASH¶
Count based on hash table (reliable).
- enumerator RELOCATIONS¶
Count based on PLT/GOT relocations (very reliable but not accurate).
- enumerator AUTO = 0¶
Public Members
- bool parse_relocations = true¶
Whether relocations (including plt-like relocations) should be parsed.
- bool parse_dyn_symbols = true¶
Whether dynamic symbols (those from
.dynsym) should be parsed.
- bool parse_symtab_symbols = true¶
Whether debug symbols (those from
.symtab) should be parsed.
- bool parse_symbol_versions = true¶
Whether versioning symbols should be parsed.
- bool parse_notes = true¶
Whether ELF notes information should be parsed.
- bool parse_overlay = true¶
Whether the overlay data should be parsed.
- DYNSYM_COUNT count_mtd = DYNSYM_COUNT::AUTO¶
The method used to count the number of dynamic symbols.
- uint64_t page_size = 0¶
Memory page size if the binary uses a non-standard value.
For instance, SPARCV9 binary can use page size from 0x2000 to 0x100000.
Public Static Functions
- static inline ParserConfig all()¶
This returns a ParserConfig object configured to process all the ELF elements.
- enum class DYNSYM_COUNT¶
Binary¶
- class Binary : public LIEF::Binary¶
Class which represents an ELF binary.
Subclassed by LIEF::OAT::Binary
Public Types
- enum PHDR_RELOC¶
This enum describes the different ways to relocate the segments table.
Values:
- enumerator AUTO = 0¶
Defer the choice of the layout to LIEF.
- enumerator PIE_SHIFT¶
The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.
- enumerator BSS_END¶
The new segments table is relocated right after the first bss-like segment.
- enumerator BINARY_END¶
The new segments table is relocated at the end of the binary.
- enumerator SEGMENT_GAP¶
The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.
- enumerator AUTO = 0¶
- enum class SEC_INSERT_POS¶
This enum defines where the content of a newly added section should be inserted.
Values:
- enumerator AUTO = 0¶
Defer the choice to LIEF.
- enumerator POST_SEGMENT¶
Insert the section after the last valid offset in the segments table.
With this choice, the section is inserted after the loaded content but before any debug information.
- enumerator POST_SECTION¶
Insert the section after the last valid offset in the section table.
With this choice, the section is inserted at the very end of the binary.
- enumerator AUTO = 0¶
- using string_list_t = std::vector<std::string>¶
- using it_notes = ref_iterator<notes_t&, Note*>¶
Iterator which outputs Note& object.
- using it_const_notes = const_ref_iterator<const notes_t&, const Note*>¶
Iterator which outputs const Note& object.
- using symbols_version_requirement_t = std::vector<std::unique_ptr<SymbolVersionRequirement>>¶
Internal container for storing SymbolVersionRequirement.
- using it_symbols_version_requirement = ref_iterator<symbols_version_requirement_t&, SymbolVersionRequirement*>¶
Iterator which outputs SymbolVersionRequirement& object.
- using it_const_symbols_version_requirement = const_ref_iterator<const symbols_version_requirement_t&, const SymbolVersionRequirement*>¶
Iterator which outputs const SymbolVersionRequirement& object.
- using symbols_version_definition_t = std::vector<std::unique_ptr<SymbolVersionDefinition>>¶
Internal container for storing SymbolVersionDefinition.
- using it_symbols_version_definition = ref_iterator<symbols_version_definition_t&, SymbolVersionDefinition*>¶
Iterator which outputs SymbolVersionDefinition& object.
- using it_const_symbols_version_definition = const_ref_iterator<const symbols_version_definition_t&, const SymbolVersionDefinition*>¶
Iterator which outputs const SymbolVersionDefinition& object.
- using segments_t = std::vector<std::unique_ptr<Segment>>¶
Internal container for storing ELF’s Segment.
- using it_segments = ref_iterator<segments_t&, Segment*>¶
Iterator which outputs Segment& object.
- using it_const_segments = const_ref_iterator<const segments_t&, const Segment*>¶
Iterator which outputs const Segment& object.
- using dynamic_entries_t = std::vector<std::unique_ptr<DynamicEntry>>¶
Internal container for storing ELF’s DynamicEntry.
- using it_dynamic_entries = ref_iterator<dynamic_entries_t&, DynamicEntry*>¶
Iterator which outputs DynamicEntry& object.
- using it_const_dynamic_entries = const_ref_iterator<const dynamic_entries_t&, const DynamicEntry*>¶
Iterator which outputs const DynamicEntry& object.
- using symbols_version_t = std::vector<std::unique_ptr<SymbolVersion>>¶
Internal container for storing ELF’s SymbolVersion.
- using it_symbols_version = ref_iterator<symbols_version_t&, SymbolVersion*>¶
Iterator which outputs SymbolVersion& object.
- using it_const_symbols_version = const_ref_iterator<const symbols_version_t&, const SymbolVersion*>¶
Iterator which outputs const SymbolVersion& object.
- using relocations_t = std::vector<std::unique_ptr<Relocation>>¶
Internal container for storing ELF’s Relocation.
- using it_pltgot_relocations = filter_iterator<relocations_t&, Relocation*>¶
Iterator which outputs plt/got Relocation& object.
- using it_const_pltgot_relocations = const_filter_iterator<const relocations_t&, const Relocation*>¶
Iterator which outputs plt/got const Relocation& object.
- using it_dynamic_relocations = filter_iterator<relocations_t&, Relocation*>¶
Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism).
- using it_const_dynamic_relocations = const_filter_iterator<const relocations_t&, const Relocation*>¶
Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism).
- using it_object_relocations = filter_iterator<relocations_t&, Relocation*>¶
Iterator which outputs Relocation& object found in object files (.o).
- using it_const_object_relocations = const_filter_iterator<const relocations_t&, const Relocation*>¶
Iterator which outputs const Relocation& object found in object files (.o).
- using it_relocations = ref_iterator<relocations_t&, Relocation*>¶
Iterator which outputs Relocation& object.
- using it_const_relocations = const_ref_iterator<const relocations_t&, const Relocation*>¶
Iterator which outputs const Relocation& object.
- using it_dynamic_symbols = ref_iterator<symbols_t&, Symbol*>¶
Iterator which outputs the Dynamic Symbol& object.
- using it_const_dynamic_symbols = const_ref_iterator<const symbols_t&, const Symbol*>¶
Iterator which outputs the Dynamic const Symbol& object.
- using it_symtab_symbols = ref_iterator<symbols_t&, Symbol*>¶
Iterator which outputs the static/debug Symbol& object.
- using it_const_symtab_symbols = const_ref_iterator<const symbols_t&, const Symbol*>¶
Iterator which outputs the static/debug const Symbol& object.
- using it_symbols = ref_iterator<std::vector<Symbol*>>¶
Iterator which outputs static and dynamic Symbol& object.
- using it_const_symbols = const_ref_iterator<std::vector<Symbol*>>¶
Iterator which outputs static and dynamic const Symbol& object.
- using it_exported_symbols = filter_iterator<std::vector<Symbol*>>¶
Iterator which outputs exported Symbol& object.
- using it_const_exported_symbols = const_filter_iterator<std::vector<Symbol*>>¶
Iterator which outputs exported const Symbol& object.
- using it_imported_symbols = filter_iterator<std::vector<Symbol*>>¶
Iterator which outputs imported Symbol& object.
- using it_const_imported_symbols = const_filter_iterator<std::vector<Symbol*>>¶
Iterator which outputs imported const Symbol& object.
- using sections_t = std::vector<std::unique_ptr<Section>>¶
Internal container for storing ELF’s Section.
- using it_sections = ref_iterator<sections_t&, Section*>¶
Iterator which outputs Section& object.
- using it_const_sections = const_ref_iterator<const sections_t&, const Section*>¶
Iterator which outputs const Section& object.
Public Functions
- inline Header &header()¶
Return Elf header .
- uint64_t last_offset_section() const¶
Return the last offset used in binary according to sections table.
- uint64_t last_offset_segment() const¶
Return the last offset used in binary according to segments table.
- uint64_t next_virtual_address() const¶
Return the next virtual address available.
- inline it_sections sections()¶
Return an iterator over the binary’s sections.
- inline it_const_sections sections() const¶
- inline virtual uint64_t entrypoint() const override¶
Return the binary’s entrypoint.
- inline it_segments segments()¶
Return binary’s segments.
- inline it_const_segments segments() const¶
- inline it_dynamic_entries dynamic_entries()¶
Return binary’s dynamic entries.
- inline it_const_dynamic_entries dynamic_entries() const¶
- DynamicEntry &add(const DynamicEntry &entry)¶
Add the given dynamic entry and return the new entry.
- void remove(const DynamicEntry &entry)¶
Remove the given dynamic entry.
- void remove(DynamicEntry::TAG tag)¶
Remove all dynamic entries with the given tag.
- void remove(const Section §ion, bool clear = false)¶
Remove the given section. The
clearparameter can be used to zeroize the original content beforehand.- Parameters:
section – [in] The section to remove
clear – [in] Whether zeroize the original content
- void remove(const Segment &seg, bool clear = false)¶
Remove the given segment. If
clearis set, the original content of the segment will be filled with zeros before removal.
- void remove(Segment::TYPE type, bool clear = false)¶
Remove all segments associated with the given type.
If
clearis set, the original content of the segment will be filled with zeros before removal.
- inline it_dynamic_symbols dynamic_symbols()¶
Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the
.dynsymsection.
- inline it_const_dynamic_symbols dynamic_symbols() const¶
- it_exported_symbols exported_symbols()¶
Return symbols which are exported by the binary.
- it_const_exported_symbols exported_symbols() const¶
- it_imported_symbols imported_symbols()¶
Return symbols which are imported by the binary.
- it_const_imported_symbols imported_symbols() const¶
- inline it_symtab_symbols symtab_symbols()¶
Return the debug symbols from the
.symtabsection.
- inline it_const_symtab_symbols symtab_symbols() const¶
- inline it_symbols_version symbols_version()¶
Return the symbol versions.
- inline it_const_symbols_version symbols_version() const¶
- inline it_symbols_version_definition symbols_version_definition()¶
Return symbols version definition.
- inline it_const_symbols_version_definition symbols_version_definition() const¶
- inline it_symbols_version_requirement symbols_version_requirement()¶
Return Symbol version requirement.
- inline it_const_symbols_version_requirement symbols_version_requirement() const¶
- it_dynamic_relocations dynamic_relocations()¶
Return dynamic relocations.
- it_const_dynamic_relocations dynamic_relocations() const¶
- Relocation &add_dynamic_relocation(const Relocation &relocation)¶
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related
See: add_pltgot_relocation
- Relocation &add_pltgot_relocation(const Relocation &relocation)¶
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
See also: add_dynamic_relocation
- Relocation *add_object_relocation(const Relocation &relocation, const Section §ion)¶
Add relocation for object file (.o).
The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.
If there is an error, this function returns a
nullptr. Otherwise, it returns the relocation added.
- it_pltgot_relocations pltgot_relocations()¶
Return
plt.gotrelocations.
- it_const_pltgot_relocations pltgot_relocations() const¶
- it_object_relocations object_relocations()¶
Return relocations used in an object file (
*.o).
- it_const_object_relocations object_relocations() const¶
- inline it_relocations relocations()¶
Return all relocations present in the binary.
- inline it_const_relocations relocations() const¶
- const Relocation *get_relocation(uint64_t address) const¶
Return relocation associated with the given address. It returns a
nullptrif it is not found.
- inline Relocation *get_relocation(uint64_t address)¶
- const Relocation *get_relocation(const Symbol &symbol) const¶
Return relocation associated with the given Symbol It returns a
nullptrif it is not found.
- inline Relocation *get_relocation(const Symbol &symbol)¶
- const Relocation *get_relocation(const std::string &symbol_name) const¶
Return relocation associated with the given Symbol name It returns a
nullptrif it is not found.
- inline Relocation *get_relocation(const std::string &symbol_name)¶
- inline bool use_gnu_hash() const¶
trueif GNU hash is usedSee also
- inline const GnuHash *gnu_hash() const¶
Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.
- inline bool use_sysv_hash() const¶
trueif SYSV hash is usedSee also
- inline const SysvHash *sysv_hash() const¶
Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.
- inline bool has_section(const std::string &name) const¶
Check if a section with the given name exists in the binary.
- bool has_section_with_offset(uint64_t offset) const¶
Check if a section that handles the given offset exists.
- bool has_section_with_va(uint64_t va) const¶
Check if a section that handles the given virtual address exists.
- inline Section *get_section(std::string_view name)¶
Return Section with the given
name. If the section can’t be found, it returns a nullptr.
- inline Section *text_section()¶
Return the
.textsection. If the section can’t be found, it returns a nullptr.
- Section *dynamic_section()¶
Return the
.dynamicsection. If the section can’t be found, it returns a nullptr.
- Section *hash_section()¶
Return the hash section. If the section can’t be found, it returns a nullptr.
- Section *symtab_symbols_section()¶
Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr.
- virtual uint64_t imagebase() const override¶
Return program image base. For instance
0x40000.To compute the image base, we look for the PT_PHDR segment header (phdr), and we return
phdr->p_vaddr - phdr->p_offset
- virtual uint64_t virtual_size() const override¶
Return the size of the mapped binary.
- bool has_interpreter() const¶
Check if the binary uses a loader (also named linker or interpreter).
See also
- inline std::string_view interpreter() const¶
Return the ELF interpreter if any. (e.g.
/lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.See also
- inline void interpreter(const std::string &interpreter)¶
Change the interpreter.
- inline it_symbols symbols()¶
Return an iterator on both static and dynamic symbols.
- inline it_const_symbols symbols() const¶
- Symbol &export_symbol(const Symbol &symbol)¶
Export the given symbol and create it if it doesn’t exist.
- Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)¶
Export the symbol with the given name and create it if it doesn’t exist.
- inline bool has_dynamic_symbol(const std::string &name) const¶
Check if the symbol with the given
nameexists in the dynamic symbols table.
- const Symbol *get_dynamic_symbol(const std::string &name) const¶
Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.
- inline bool has_symtab_symbol(const std::string &name) const¶
Check if the symbol with the given
nameexists in the symtab symbol table.
- const Symbol *get_symtab_symbol(const std::string &name) const¶
Get the symtab symbol from the given name Return a nullptr if it can’t be found.
- string_list_t strings(size_t min_size = 5) const¶
Return list of the strings used by the ELF binary.
Basically, this function looks for strings in the
.rodatasection
- void remove_symbol(const std::string &name)¶
Remove symbols with the given name in both:
dynamic symbols
symtab symbols
- void remove_symtab_symbol(const std::string &name)¶
Remove symtab symbols with the given name.
- void remove_dynamic_symbol(const std::string &name)¶
Remove dynamic symbols with the given name.
- void remove_dynamic_symbol(Symbol *symbol)¶
Remove the given symbol from the dynamic symbols table.
As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol
- virtual result<uint64_t> get_function_address(const std::string &func_name) const override¶
Return the address of the given function name.
- result<uint64_t> get_function_address(const std::string &func_name, bool demangled) const¶
Return the address of the given function name.
- Parameters:
func_name – [in] The function’s name target
demangled – [in] Use the demangled name
- Section *add(const Section §ion, bool loaded = true, SEC_INSERT_POS pos = SEC_INSERT_POS::AUTO)¶
Add a new section in the binary.
This function requires a well-formed ELF binary
- Parameters:
section – [in] The section object to insert
loaded – [in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment
pos – [in] Position where to insert the data in the sections table
- Returns:
The section added. The
sizeand thevirtual addressmight change.
- Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion *version = nullptr)¶
Add a dynamic symbol with the associated SymbolVersion.
- Symbol &add_exported_function(uint64_t address, const std::string &name = "")¶
Create a symbol for the function at the given address and export it.
- DynamicEntryLibrary &add_library(const std::string &library_name)¶
Add a library as dependency.
- void remove_library(const std::string &library_name)¶
Remove the given library from the dependencies.
- inline DynamicEntryLibrary *get_library(const std::string &library_name)¶
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
- const DynamicEntryLibrary *get_library(const std::string &library_name) const¶
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
- inline bool has_library(const std::string &name) const¶
Check if the given library name exists in the current binary.
- Segment *add(const Segment &segment, uint64_t base = 0)¶
Add a new segment in the binary.
The segment is inserted at the end
This function requires a well-formed ELF binary
- Returns:
The segment added.
Virtual addressandFile Offsetmight change.
- Segment *replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)¶
Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.
Warning
The
original_segmentis no longer valid after this function
- virtual void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override¶
Patch the content at virtual address
addresswithpatch_value.- Parameters:
address – [in] Address to patch
patch_value – [in] Patch to apply
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
- virtual void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override¶
Patch the address with the given value.
- Parameters:
address – [in] Address to patch
patch_value – [in] Patch to apply
size – [in] Size of the value in bytes (1, 2, … 8)
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
- void patch_pltgot(const Symbol &symbol, uint64_t address)¶
Patch the imported symbol with the
address.- Parameters:
symbol – [in] Imported symbol to patch
address – [in] New address
- void patch_pltgot(const std::string &symbol_name, uint64_t address)¶
Patch the imported symbol’s name with the
address.- Parameters:
symbol_name – [in] Imported symbol’s name to patch
address – [in] New address
- void strip()¶
Strip the binary by removing symtab symbols.
- virtual void remove_section(const std::string &name, bool clear = false) override¶
Remove a binary’s section.
- Parameters:
name – [in] The name of the section to remove
clear – [in] Whether zeroize the original content
- inline void write(const std::string &filename)¶
Reconstruct the binary object and write it in
filename.This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
- Parameters:
filename – Path for the written ELF binary
- void write(const std::string &filename, const Builder::config_t &config)¶
Reconstruct the binary object with the given config and write it in
filename.This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
- Parameters:
filename – Path for the written ELF binary
config – Builder configuration
- inline void write(std::ostream &os)¶
Reconstruct the binary object and write it in
osstream.This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
- Parameters:
os – Output stream for the written ELF binary
- void write(std::ostream &os, const Builder::config_t &config)¶
Reconstruct the binary object with the given config and write it in
osstream.- Parameters:
os – Output stream for the written ELF binary
config – Builder configuration
- std::vector<uint8_t> raw()¶
Reconstruct the binary object and return its content as a byte vector.
- result<uint64_t> virtual_address_to_offset(uint64_t virtual_address) const¶
Convert a virtual address to a file offset.
- virtual result<uint64_t> offset_to_virtual_address(uint64_t offset, uint64_t slide = 0) const override¶
Convert the given offset into a virtual address.
- Parameters:
offset – [in] The offset to convert.
slide – [in] If not 0, it will replace the default base address (if any)
- virtual bool is_pie() const override¶
Check if the binary has been compiled with
-fpie -pieflags.To do so we check if there is a
PT_INTERPsegment and if the binary type isET_DYN(Shared object)
- virtual bool has_nx() const override¶
Check if the binary uses the
NXprotection (Non executable stack).
- int64_t dynsym_idx(const std::string &name) const¶
Symbol index in the dynamic symbol table or -1 if the symbol does not exist.
- int64_t symtab_idx(const std::string &name) const¶
Symbol index from the
.symtabsection or -1 if the symbol is not present.
- const Section *section_from_offset(uint64_t offset, bool skip_nobits = true) const¶
Return the ELF::Section from the given
offset. Return a nullptr if a section can’t be found.If
skip_nobitsis set (which is the case by default), this function won’t consider section for which the type isSHT_NOBITS(like.bss, .tbss, ...)
- const Section *section_from_virtual_address(uint64_t address, bool skip_nobits = true) const¶
Return the ELF::Section from the given
address. Return a nullptr if a section can’t be found.If
skip_nobitsis set (which is the case by default), this function won’t consider section for which type isSHT_NOBITS(like.bss, .tbss, ...)
- const Segment *segment_from_virtual_address(uint64_t address) const¶
Return the ELF::Segment from the given
address. Return a nullptr if a segment can’t be found.
- const Segment *segment_from_offset(uint64_t offset) const¶
Return the ELF::Segment from the
offset. Return a nullptr if a segment can’t be found.
- const DynamicEntry *get(DynamicEntry::TAG tag) const¶
Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.
- inline DynamicEntry *get(DynamicEntry::TAG tag)¶
- const Segment *get(Segment::TYPE type) const¶
Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.
- const Note *get(Note::TYPE type) const¶
Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.
- const Section *get(Section::TYPE type) const¶
Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.
- inline bool has(DynamicEntry::TAG tag) const¶
Check if an ELF::DynamicEntry associated with the given tag exists.
- inline bool has(Segment::TYPE type) const¶
Check if ELF::Segment associated with the given type exists.
- inline bool has(Section::TYPE type) const¶
Check if a ELF::Section associated with the given type exists.
- virtual span<const uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, Binary::VA_TYPES addr_type = Binary::VA_TYPES::AUTO) const override¶
Return the content located at virtual address.
- virtual void accept(LIEF::Visitor &visitor) const override¶
Method associated with the visitor pattern.
- void permute_dynamic_symbols(const std::vector<size_t> &permutation)¶
Apply the given permutation on the dynamic symbols table.
- virtual LIEF::Binary::functions_t ctor_functions() const override¶
List of binary constructors (typically, the functions located in the
.init_array).
- LIEF::Binary::functions_t dtor_functions() const¶
List of the binary destructors (typically, the functions located in the
.fini_array).
- LIEF::Binary::functions_t functions() const¶
List of the functions found in the binary.
- bool has_notes() const¶
trueif the binary embeds notes
- inline it_const_notes notes() const¶
Return an iterator over the ELF’s LIEF::ELF::Note.
See also
has_note
- uint64_t eof_offset() const¶
Return the last offset used by the ELF binary according to both: the sections table and the segments table.
- inline bool has_overlay() const¶
True if data are present at the end of the binary.
- inline span<const uint8_t> overlay() const¶
Overlay data (if any).
- uint64_t relocate_phdr_table(PHDR_RELOC type)¶
Force relocating the segments table in a specific way.
This function can be used to enforce a specific relocation of the segments table.
- Parameters:
type – [in] The relocation type to apply
- Returns:
The offset of the new segments table or 0 if it fails with the given method.
- std::vector<uint64_t> get_relocated_dynamic_array(DynamicEntry::TAG tag) const¶
Return the array defined by the given tag (e.g. DynamicEntry::TAG::INIT_ARRAY) with relocations applied (if any).
- bool is_targeting_android() const¶
True if the current ELF is targeting Android.
- inline result<size_t> get_section_idx(const Section §ion) const¶
Find the index of the section given in the first parameter.
- inline result<size_t> get_section_idx(const std::string &name) const¶
Find the index of the section with the name given in the first parameter.
- const SymbolVersionRequirement *find_version_requirement(const std::string &libname) const¶
Try to find the SymbolVersionRequirement associated with the given library name (e.g.
libc.so.6).
- inline SymbolVersionRequirement *find_version_requirement(const std::string &name)¶
- bool remove_version_requirement(const std::string &libname)¶
Deletes all required symbol versions linked to the specified library name. The function returns true if the operation succeed, false otherwise.
Warning
To maintain consistency, this function also removes versions associated with dynamic symbols that are linked to the specified library name.
- inline uint8_t ptr_size() const¶
- virtual uint64_t page_size() const override¶
Get the default memory page size according to the architecture and the format of the current binary.
- uint64_t layout_pagesize() const¶
- size_t hash(const std::string &name)¶
- ~Binary() override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- inline Binary &operator+=(const DynamicEntry &entry)¶
- inline Binary &operator-=(const DynamicEntry &entry)¶
- inline Binary &operator-=(DynamicEntry::TAG tag)¶
- inline DynamicEntry *operator[](DynamicEntry::TAG tag)¶
- inline const DynamicEntry *operator[](DynamicEntry::TAG tag) const¶
- inline bool should_swap() const¶
- enum PHDR_RELOC¶
Header¶
- class Header : public LIEF::Object¶
Class which represents the ELF’s header. This class mirrors the raw ELF
Elfxx_Ehdrstructure.Public Types
- enum ELF_INDENT¶
e_ident size and indices.
Values:
- enumerator ELI_MAG0 = 0¶
File identification index.
- enumerator ELI_MAG1 = 1¶
File identification index.
- enumerator ELI_MAG2 = 2¶
File identification index.
- enumerator ELI_MAG3 = 3¶
File identification index.
- enumerator ELI_CLASS = 4¶
File class.
- enumerator ELI_DATA = 5¶
Data encoding.
- enumerator ELI_VERSION = 6¶
File version.
- enumerator ELI_OSABI = 7¶
OS/ABI identification.
- enumerator ELI_ABIVERSION = 8¶
ABI version.
- enumerator ELI_PAD = 9¶
Start of padding bytes.
- enumerator ELI_NIDENT = 16¶
Number of bytes in e_ident.
- enumerator ELI_MAG0 = 0¶
- enum class FILE_TYPE¶
The type of the underlying ELF file. This enum matches the semantic of
ET_NONE,ET_REL, …Values:
- enumerator NONE = 0¶
Can’t be determined.
- enumerator REL = 1¶
Relocatable file (or object file).
- enumerator EXEC = 2¶
non-pie executable
- enumerator DYN = 3¶
Shared library or a pie-executable.
- enumerator CORE = 4¶
Core dump file.
- enumerator NONE = 0¶
- enum class VERSION¶
Match the result of
Elfxx_Ehdr.e_version.Values:
- enumerator NONE = 0¶
Invalid ELF version.
- enumerator CURRENT = 1¶
Current version (default).
- enumerator NONE = 0¶
- enum class CLASS¶
Match the result of
Elfxx_Ehdr.e_ident[EI_CLASS].Values:
- enumerator NONE = 0¶
Invalid class.
- enumerator ELF32¶
32-bit objects
- enumerator ELF64¶
64-bit objects
- enumerator NONE = 0¶
- enum class OS_ABI¶
Match the result
Elfxx_Ehdr.e_ident[EI_OSABI].Values:
- enumerator SYSTEMV = 0¶
UNIX System V ABI.
- enumerator HPUX = 1¶
HP-UX operating system.
- enumerator NETBSD = 2¶
NetBSD.
- enumerator GNU = 3¶
GNU/Linux.
- enumerator LINUX = 3¶
Historical alias for ELFOSABI_GNU.
- enumerator HURD = 4¶
GNU/Hurd.
- enumerator SOLARIS = 6¶
Solaris.
- enumerator AIX = 7¶
AIX.
- enumerator IRIX = 8¶
IRIX.
- enumerator FREEBSD = 9¶
FreeBSD.
- enumerator TRU64 = 10¶
TRU64 UNIX.
- enumerator MODESTO = 11¶
Novell Modesto.
- enumerator OPENBSD = 12¶
OpenBSD.
- enumerator OPENVMS = 13¶
OpenVMS.
- enumerator NSK = 14¶
Hewlett-Packard Non-Stop Kernel.
- enumerator AROS = 15¶
AROS.
- enumerator FENIXOS = 16¶
FenixOS.
- enumerator CLOUDABI = 17¶
Nuxi CloudABI.
- enumerator C6000_ELFABI = 64¶
Bare-metal TMS320C6000.
- enumerator AMDGPU_HSA = 64¶
AMD HSA runtime.
- enumerator C6000_LINUX = 65¶
Linux TMS320C6000.
- enumerator ARM = 97¶
ARM.
- enumerator STANDALONE = 255¶
Standalone (embedded) application.
- enumerator SYSTEMV = 0¶
- enum class ELF_DATA¶
Match the result
Elfxx_Ehdr.e_ident[EI_DATA].Values:
- enumerator NONE = 0¶
Invalid data encoding.
- enumerator LSB = 1¶
2’s complement, little endian
- enumerator MSB = 2¶
2’s complement, big endian
- enumerator NONE = 0¶
- using identity_t = std::array<uint8_t, 16>¶
Public Functions
- Header() = default¶
- ~Header() override = default¶
- inline uint64_t entrypoint() const¶
Executable entrypoint.
- inline uint64_t program_headers_offset() const¶
Offset of the programs table (also known as segments table).
- inline uint64_t section_headers_offset() const¶
Offset of the sections table.
- inline uint32_t processor_flag() const¶
Processor-specific flags.
- inline uint32_t header_size() const¶
Size of the current header (i.e.
sizeof(Elfxx_Ehdr)) This size should be 64 for anELF64binary and 52 for anELF32.
- inline uint32_t program_header_size() const¶
Return the size of a program header (i.e.
sizeof(Elfxx_Phdr)) This size should be 56 for anELF64binary and 32 for anELF32.
- inline uint32_t numberof_segments() const¶
Return the number of segments.
- inline uint32_t section_header_size() const¶
Return the size of a section header (i.e.
sizeof(Elfxx_Shdr)) This size should be 64 for aELF64binary and 40 for anELF32.
- inline uint32_t numberof_sections() const¶
Return the number of sections.
Warning
This value could differ from the real number of sections present in the binary. It must be taken as an indication
- inline uint32_t section_name_table_idx() const¶
Return the section’s index which contains sections’ names.
- inline identity_t &identity()¶
Return the ELF identity as an
std::array.
- inline const identity_t &identity() const¶
- inline OS_ABI identity_os_abi() const¶
Identifies the version of the ABI for which the object is prepared.
- inline uint32_t identity_abi_version() const¶
ABI Version.
- bool has(PROCESSOR_FLAGS flag) const¶
- std::vector<PROCESSOR_FLAGS> flags_list() const¶
- inline void entrypoint(uint64_t entry)¶
- inline void program_headers_offset(uint64_t offset)¶
- inline void section_headers_offset(uint64_t offset)¶
- inline void processor_flag(uint32_t flags)¶
- inline void header_size(uint32_t size)¶
- inline void program_header_size(uint32_t size)¶
- inline void numberof_segments(uint32_t n)¶
- inline void section_header_size(uint32_t size)¶
- inline void numberof_sections(uint32_t n)¶
- inline void section_name_table_idx(uint32_t idx)¶
- void identity(const std::string &identity)¶
- void identity(const identity_t &identity)¶
- inline void identity_abi_version(uint8_t version)¶
- virtual void accept(Visitor &visitor) const override¶
- enum ELF_INDENT¶
Section¶
- class Section : public LIEF::Section¶
Class which represents an ELF Section.
Public Types
- enum class TYPE : uint64_t¶
Values:
- enumerator SHT_NULL_ = 0¶
No associated section (inactive entry).
- enumerator PROGBITS = 1¶
Program-defined contents.
- enumerator STRTAB = 3¶
String table.
- enumerator RELA = 4¶
Relocation entries; explicit addends.
- enumerator DYNAMIC = 6¶
Information for dynamic linking.
- enumerator NOTE = 7¶
Information about the file.
- enumerator NOBITS = 8¶
Data occupies no space in the file.
- enumerator REL = 9¶
Relocation entries; no explicit addends.
- enumerator SHLIB = 10¶
Reserved.
- enumerator INIT_ARRAY = 14¶
Pointers to initialization functions.
- enumerator FINI_ARRAY = 15¶
Pointers to termination functions.
- enumerator PREINIT_ARRAY = 16¶
Pointers to pre-init functions.
- enumerator SYMTAB_SHNDX = 18¶
Indices for SHN_XINDEX entries.
- enumerator RELR = 19¶
Relocation entries; only offsets.
- enumerator ANDROID_REL = 0x60000001¶
Packed relocations (Android specific).
- enumerator ANDROID_RELA = 0x60000002¶
Packed relocations (Android specific).
- enumerator LLVM_ADDRSIG = 0x6fff4c03¶
This section is used to mark symbols as address-significant.
- enumerator ANDROID_RELR = 0x6fffff00¶
New relr relocations (Android specific).
- enumerator GNU_ATTRIBUTES = 0x6ffffff5¶
Object attributes.
- enumerator GNU_HASH = 0x6ffffff6¶
GNU-style hash table.
- enumerator GNU_VERDEF = 0x6ffffffd¶
GNU version definitions.
- enumerator GNU_VERNEED = 0x6ffffffe¶
GNU version references.
- enumerator GNU_VERSYM = 0x6fffffff¶
GNU symbol versions table.
- enumerator _ID_SHIFT_ = 32¶
- enumerator _ARM_ID_ = 1LLU¶
- enumerator _HEX_ID_ = 2LLU¶
- enumerator _X86_64_ID_ = 2LLU¶
- enumerator _MIPS_ID_ = 3LLU¶
- enumerator _RISCV_ID_ = 4LLU¶
- enumerator _AARCH64_ID_ = 5LLU¶
- enumerator ARM_EXIDX = 0x70000001U + (_ARM_ID_ << _ID_SHIFT_)¶
Exception Index table
- enumerator ARM_PREEMPTMAP = 0x70000002U + (_ARM_ID_ << _ID_SHIFT_)¶
BPABI DLL dynamic linking pre-emption map
- enumerator ARM_ATTRIBUTES = 0x70000003U + (_ARM_ID_ << _ID_SHIFT_)¶
Object file compatibility attributes
- enumerator ARM_DEBUGOVERLAY = 0x70000004U + (_ARM_ID_ << _ID_SHIFT_)¶
- enumerator ARM_OVERLAYSECTION = 0x70000005U + (_ARM_ID_ << _ID_SHIFT_)¶
- enumerator HEX_ORDERED = 0x70000000 + (_HEX_ID_ << _ID_SHIFT_)¶
Link editor is to sort the entries in this section based on their sizes
- enumerator X86_64_UNWIND = 0x70000001 + (_X86_64_ID_ << _ID_SHIFT_)¶
Unwind information
- enumerator MIPS_LIBLIST = 0x70000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_MSYM = 0x70000001 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_CONFLICT = 0x70000002 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_GPTAB = 0x70000003 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_UCODE = 0x70000004 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DEBUG = 0x70000005 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_REGINFO = 0x70000006 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_PACKAGE = 0x70000007 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_PACKSYM = 0x70000008 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_RELD = 0x70000009 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_IFACE = 0x7000000b + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_CONTENT = 0x7000000c + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_OPTIONS = 0x7000000d + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_SHDR = 0x70000010 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_FDESC = 0x70000011 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_EXTSYM = 0x70000012 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DENSE = 0x70000013 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_PDESC = 0x70000014 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_LOCSYM = 0x70000015 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_AUXSYM = 0x70000016 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_OPTSYM = 0x70000017 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_LOCSTR = 0x70000018 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_LINE = 0x70000019 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_RFDESC = 0x7000001a + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DELTASYM = 0x7000001b + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DELTAINST = 0x7000001c + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DELTACLASS = 0x7000001d + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DWARF = 0x7000001e + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_DELTADECL = 0x7000001f + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_SYMBOL_LIB = 0x70000020 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_EVENTS = 0x70000021 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_TRANSLATE = 0x70000022 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_PIXIE = 0x70000023 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_XLATE = 0x70000024 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_XLATE_DEBUG = 0x70000025 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_WHIRL = 0x70000026 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_EH_REGION = 0x70000027 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_XLATE_OLD = 0x70000028 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_PDR_EXCEPTION = 0x70000029 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_ABIFLAGS = 0x7000002a + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_XHASH = 0x7000002b + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator RISCV_ATTRIBUTES = 0x70000003 + (_RISCV_ID_ << _ID_SHIFT_)¶
- enumerator AARCH64_ATTRIBUTES = 0x70000003 + (_AARCH64_ID_ << _ID_SHIFT_)¶
- enumerator AARCH64_AUTH_RELR = 0x70000004 + (_AARCH64_ID_ << _ID_SHIFT_)¶
- enumerator AARCH64_MEMTAG_GLOBALS_STATIC = 0x70000007 + (_AARCH64_ID_ << _ID_SHIFT_)¶
- enumerator AARCH64_MEMTAG_GLOBALS_DYNAMIC = 0x70000008 + (_AARCH64_ID_ << _ID_SHIFT_)¶
- enumerator SHT_NULL_ = 0¶
- enum class FLAGS : uint64_t¶
Values:
- enumerator NONE = 0x000000000¶
- enumerator MERGE = 0x000000010¶
The data in this section may be merged.
- enumerator STRINGS = 0x000000020¶
The data in this section is null-terminated strings.
- enumerator INFO_LINK = 0x000000040¶
A field in this section holds a section header table index.
- enumerator LINK_ORDER = 0x000000080¶
Adds special ordering requirements for link editors.
- enumerator OS_NONCONFORMING = 0x000000100¶
This section requires special OS-specific processing to avoid incorrect behavior
- enumerator GROUP = 0x000000200¶
This section is a member of a section group.
- enumerator TLS = 0x000000400¶
This section holds Thread-Local Storage.
- enumerator COMPRESSED = 0x000000800¶
- enumerator GNU_RETAIN = 0x000200000¶
- enumerator EXCLUDE = 0x080000000¶
- enumerator _ID_SHIFT_ = 32¶
- enumerator _XCORE_ID_ = 1LLU¶
- enumerator _HEX_ID_ = 3LLU¶
- enumerator _X86_64_ID_ = 2LLU¶
- enumerator _MIPS_ID_ = 4LLU¶
- enumerator _ARM_ID_ = 5LLU¶
- enumerator _AARCH64_ID_ = 6LLU¶
- enumerator XCORE_SHF_DP_SECTION = 0x010000000 + (_XCORE_ID_ << _ID_SHIFT_)¶
- enumerator XCORE_SHF_CP_SECTION = 0x020000000 + (_XCORE_ID_ << _ID_SHIFT_)¶
- enumerator X86_64_LARGE = 0x010000000 + (_X86_64_ID_ << _ID_SHIFT_)¶
- enumerator HEX_GPREL = 0x010000000 + (_HEX_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_NODUPES = 0x001000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_NAMES = 0x002000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_LOCAL = 0x004000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_NOSTRIP = 0x008000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_GPREL = 0x010000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_MERGE = 0x020000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_ADDR = 0x040000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator MIPS_STRING = 0x080000000 + (_MIPS_ID_ << _ID_SHIFT_)¶
- enumerator ARM_PURECODE = 0x020000000 + (_ARM_ID_ << _ID_SHIFT_)¶
- enumerator AARCH64_PURECODE = 0x020000000 + (_AARCH64_ID_ << _ID_SHIFT_)¶
- enumerator NONE = 0x000000000¶
- using it_segments = ref_iterator<segments_t&>¶
- using it_const_segments = const_ref_iterator<const segments_t&>¶
Public Functions
- Section() = default¶
- ~Section() override = default¶
- virtual void content(const std::vector<uint8_t> &data) override¶
Set section content.
- void content(std::vector<uint8_t> &&data)¶
- inline virtual uint64_t size() const override¶
Section’s size (size in the binary, not the virtual size).
- virtual void size(uint64_t size) override¶
Change the section size.
- virtual void offset(uint64_t offset) override¶
- inline virtual uint64_t offset() const override¶
Offset in the binary.
- inline uint64_t original_size() const¶
Original size of the section’s data.
This value is used by the ELF::Builder to determine if it needs to be relocated to avoid an override of the data
- inline uint64_t information() const¶
Section information. The meaning of this value depends on the section’s type.
- inline uint64_t entry_size() const¶
This function returns the size of an element in the case of a section that contains an array.
For instance, the
.dynamicsection contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in an ELF64, theentry_sizeis set to this value.
- inline uint32_t link() const¶
Index to another section.
- inline void flags(uint64_t flags)¶
- inline void clear_flags()¶
- inline void file_offset(uint64_t offset)¶
- inline void link(uint32_t link)¶
- inline void information(uint32_t info)¶
- inline void alignment(uint64_t alignment)¶
- inline void entry_size(uint64_t entry_size)¶
- inline it_segments segments()¶
- inline it_const_segments segments() const¶
- inline bool is_frame() const¶
- virtual void accept(Visitor &visitor) const override¶
- std::unique_ptr<SpanStream> stream() const¶
Return a stream over the content of this section.
Public Static Functions
Public Static Attributes
- static uint32_t MAX_SECTION_SIZE = 2_GB¶
- static uint64_t FLAG_MASK = (uint64_t(1) << uint8_t(FLAGS::_ID_SHIFT_)) - 1¶
- static uint64_t TYPE_MASK = (uint64_t(1) << uint8_t(TYPE::_ID_SHIFT_)) - 1¶
- enum class TYPE : uint64_t¶
Segment¶
- class Segment : public LIEF::Object¶
Class which represents the ELF segments.
Public Types
- enum class TYPE : uint64_t¶
Values:
- enumerator UNKNOWN = uint64_t(-1)¶
- enumerator PT_NULL_ = 0¶
Unused segment.
- enumerator LOAD = 1¶
Loadable segment.
- enumerator DYNAMIC = 2¶
Dynamic linking information.
- enumerator INTERP = 3¶
Interpreter pathname.
- enumerator NOTE = 4¶
Auxiliary information.
- enumerator SHLIB = 5¶
Reserved.
- enumerator PHDR = 6¶
The program header table itself.
- enumerator TLS = 7¶
The thread-local storage template.
- enumerator GNU_EH_FRAME = 0x6474e550¶
- enumerator GNU_STACK = 0x6474e551¶
Indicates stack executability.
- enumerator GNU_PROPERTY = 0x6474e553¶
GNU property
- enumerator GNU_RELRO = 0x6474e552¶
Read-only after relocation.
- enumerator PAX_FLAGS = 0x65041580¶
- enumerator AARCH64_MEMTAG_MTE = 0x70000002 | PT_AARCH64¶
- enumerator UNKNOWN = uint64_t(-1)¶
- using it_sections = ref_iterator<sections_t&>¶
- using it_const_sections = const_ref_iterator<const sections_t&>¶
Public Functions
- Segment() = default¶
- ~Segment() override = default¶
- inline bool is_load() const¶
- inline bool is_interpreter() const¶
- inline bool is_phdr() const¶
- inline uint64_t file_offset() const¶
The file offset of the data associated with this segment.
- inline uint64_t virtual_address() const¶
The virtual address of the segment.
- inline uint64_t physical_address() const¶
The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.
Usually this value matches virtual_address
- inline uint64_t physical_size() const¶
The file size of the data associated with this segment.
- inline uint64_t virtual_size() const¶
The in-memory size of this segment. Usually, if the
.bsssegment is wrapped by this segment then, virtual_size is larger than physical_size.
- inline uint64_t alignment() const¶
The offset alignment of the segment.
- span<const uint8_t> content() const¶
The raw data associated with this segment.
- bool has(const Section §ion) const¶
Check if the current segment wraps the given ELF::Section.
- bool has(const std::string §ion_name) const¶
Check if the current segment wraps the given section’s name.
- inline void flags(uint32_t flags)¶
- inline void clear_flags()¶
- void file_offset(uint64_t file_offset)¶
- inline void virtual_address(uint64_t virtual_address)¶
- inline void physical_address(uint64_t physical_address)¶
- void physical_size(uint64_t physical_size)¶
- inline void virtual_size(uint64_t virtual_size)¶
- inline void alignment(uint64_t alignment)¶
- void content(std::vector<uint8_t> content)¶
- inline void fill(char c)¶
Fill the content of this segment with the value provided in parameter.
- inline void clear()¶
Clear the content of this segment.
- size_t get_content_size() const¶
- inline it_sections sections()¶
Iterator over the sections wrapped by this segment.
- inline it_const_sections sections() const¶
- std::unique_ptr<SpanStream> stream() const¶
- virtual void accept(Visitor &visitor) const override¶
Public Static Functions
- enum class TYPE : uint64_t¶
Dynamic Entry¶
- class DynamicEntry : public LIEF::Object¶
Class which represents an entry in the dynamic table These entries are located in the
.dynamicsection or thePT_DYNAMICsegment.Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryAuxiliary, LIEF::ELF::DynamicEntryFilter, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject
Public Types
- enum class TAG : uint64_t¶
Values:
- enumerator UNKNOWN = uint64_t(-1)¶
- enumerator DT_NULL_ = 0¶
Marks end of dynamic array.
- enumerator NEEDED = 1¶
String table offset of needed library.
- enumerator PLTRELSZ = 2¶
Size of relocation entries in PLT.
- enumerator PLTGOT = 3¶
Address associated with linkage table.
- enumerator HASH = 4¶
Address of symbolic hash table.
- enumerator STRTAB = 5¶
Address of dynamic string table.
- enumerator SYMTAB = 6¶
Address of dynamic symbol table.
- enumerator RELA = 7¶
Address of relocation table (Rela entries).
- enumerator RELASZ = 8¶
Size of Rela relocation table.
- enumerator RELAENT = 9¶
Size of a Rela relocation entry.
- enumerator STRSZ = 10¶
Total size of the string table.
- enumerator SYMENT = 11¶
Size of a symbol table entry.
- enumerator INIT = 12¶
Address of initialization function.
- enumerator FINI = 13¶
Address of termination function.
- enumerator SONAME = 14¶
String table offset of a shared objects name.
- enumerator RPATH = 15¶
String table offset of library search path.
- enumerator SYMBOLIC = 16¶
Changes symbol resolution algorithm.
- enumerator REL = 17¶
Address of relocation table (Rel entries).
- enumerator RELSZ = 18¶
Size of Rel relocation table.
- enumerator RELENT = 19¶
Size of a Rel relocation entry.
- enumerator PLTREL = 20¶
Type of relocation entry used for linking.
- enumerator DEBUG_TAG = 21¶
Reserved for debugger.
- enumerator TEXTREL = 22¶
Relocations exist for non-writable segments.
- enumerator JMPREL = 23¶
Address of relocations associated with PLT.
- enumerator BIND_NOW = 24¶
Process all relocations before execution.
- enumerator INIT_ARRAY = 25¶
Pointer to array of initialization functions.
- enumerator FINI_ARRAY = 26¶
Pointer to array of termination functions.
- enumerator INIT_ARRAYSZ = 27¶
Size of DT_INIT_ARRAY.
- enumerator FINI_ARRAYSZ = 28¶
Size of DT_FINI_ARRAY.
- enumerator RUNPATH = 29¶
String table offset of lib search path.
- enumerator FLAGS = 30¶
Flags.
- enumerator PREINIT_ARRAY = 32¶
Pointer to array of preinit functions.
- enumerator PREINIT_ARRAYSZ = 33¶
Size of the DT_PREINIT_ARRAY array.
- enumerator SYMTAB_SHNDX = 34¶
Address of SYMTAB_SHNDX section
- enumerator RELRSZ = 35¶
Total size of RELR relative relocations
- enumerator RELR = 36¶
Address of RELR relative relocations
- enumerator RELRENT = 37¶
Size of one RELR relative relocation
- enumerator GNU_HASH = 0x6FFFFEF5¶
Reference to the GNU hash table.
- enumerator TLSDESC_PLT = 0x6FFFFEF6¶
Location of PLT entry for TLS descriptor resolver calls.
- enumerator TLSDESC_GOT = 0x6FFFFEF7¶
Location of GOT entry for TLS descriptor resolver PLT entry.
- enumerator RELACOUNT = 0x6FFFFFF9¶
ELF32_Rela count.
- enumerator RELCOUNT = 0x6FFFFFFA¶
ELF32_Rel count.
- enumerator FLAGS_1 = 0x6FFFFFFB¶
Flags_1.
- enumerator VERSYM = 0x6FFFFFF0¶
The address of .gnu.version section.
- enumerator VERDEF = 0x6FFFFFFC¶
The address of the version definition table.
- enumerator VERDEFNUM = 0x6FFFFFFD¶
The number of entries in DT_VERDEF.
- enumerator VERNEED = 0x6FFFFFFE¶
The address of the version Dependency table.
- enumerator VERNEEDNUM = 0x6FFFFFFF¶
The number of entries in DT_VERNEED.
- enumerator AUXILIARY = 0x7ffffffd¶
Shared object to load before self
- enumerator FILTER = 0x7fffffff¶
Shared object to filter from
- enumerator ANDROID_REL_OFFSET = 0x6000000D¶
The offset of packed relocation data (older version < M) (Android specific).
- enumerator ANDROID_REL_SIZE = 0x6000000E¶
The size of packed relocation data in bytes (older version < M) (Android specific).
- enumerator ANDROID_REL = 0x6000000F¶
The offset of packed relocation data (Android specific).
- enumerator ANDROID_RELSZ = 0x60000010¶
The size of packed relocation data in bytes (Android specific).
- enumerator ANDROID_RELA = 0x60000011¶
The offset of packed relocation data (Android specific).
- enumerator ANDROID_RELASZ = 0x60000012¶
The size of packed relocation data in bytes (Android specific).
- enumerator ANDROID_RELR = 0x6FFFE000¶
The offset of new relr relocation data (Android specific).
- enumerator ANDROID_RELRSZ = 0x6FFFE001¶
The size of new relr relocation data in bytes (Android specific).
- enumerator ANDROID_RELRENT = 0x6FFFE003¶
The size of a new relr relocation entry (Android specific).
- enumerator ANDROID_RELRCOUNT = 0x6FFFE005¶
Specifies the relative count of new relr relocation entries (Android specific).
- enumerator MIPS_RLD_VERSION = MIPS_DISC + 0x70000001¶
32 bit version number for runtime linker interface.
- enumerator MIPS_UNREFEXTNO = MIPS_DISC + 0x70000012¶
Index of first external dynamic symbol not referenced locally.
- enumerator MIPS_GOTSYM = MIPS_DISC + 0x70000013¶
Index of first dynamic symbol in global offset table.
- enumerator MIPS_HIPAGENO = MIPS_DISC + 0x70000014¶
Number of page table entries in global offset table.
- enumerator MIPS_RLD_MAP = MIPS_DISC + 0x70000016¶
Address of run time loader map, used for debugging.
- enumerator MIPS_DELTA_INSTANCE_NO = MIPS_DISC + 0x7000001A¶
Number of entries in DT_MIPS_DELTA_INSTANCE.
- enumerator MIPS_DELTA_CLASSSYM_NO = MIPS_DISC + 0x70000021¶
Number of entries in DT_MIPS_DELTA_CLASSSYM.
- enumerator MIPS_LOCALPAGE_GOTIDX = MIPS_DISC + 0x70000025¶
The GOT index of the first PTE for a segment
- enumerator MIPS_LOCAL_GOTIDX = MIPS_DISC + 0x70000026¶
The GOT index of the first PTE for a local symbol
- enumerator MIPS_HIDDEN_GOTIDX = MIPS_DISC + 0x70000027¶
The GOT index of the first PTE for a hidden symbol
- enumerator MIPS_PROTECTED_GOTIDX = MIPS_DISC + 0x70000028¶
The GOT index of the first PTE for a protected symbol
- enumerator MIPS_OPTIONS = MIPS_DISC + 0x70000029¶
Address of
.MIPS.options'. */ MIPS_INTERFACE = MIPS_DISC + 0x7000002A, /**< Address of.interface’. */ MIPS_DYNSTR_ALIGN = MIPS_DISC + 0x7000002B, /**< Unknown.
- enumerator MIPS_RLD_TEXT_RESOLVE_ADDR = MIPS_DISC + 0x7000002D¶
Size of rld_text_resolve function stored in the GOT.
- enumerator MIPS_PERF_SUFFIX = MIPS_DISC + 0x7000002E¶
Default suffix of DSO to be added by rld on dlopen() calls.
- enumerator AARCH64_BTI_PLT = AARCH64_DISC + 0x70000001¶
- enumerator AARCH64_PAC_PLT = AARCH64_DISC + 0x70000003¶
- enumerator AARCH64_VARIANT_PCS = AARCH64_DISC + 0x70000005¶
- enumerator AARCH64_MEMTAG_MODE = AARCH64_DISC + 0x70000009¶
- enumerator AARCH64_MEMTAG_HEAP = AARCH64_DISC + 0x7000000b¶
- enumerator AARCH64_MEMTAG_STACK = AARCH64_DISC + 0x7000000c¶
- enumerator AARCH64_MEMTAG_GLOBALS = AARCH64_DISC + 0x7000000d¶
- enumerator AARCH64_MEMTAG_GLOBALSSZ = AARCH64_DISC + 0x7000000f¶
- enumerator HEXAGON_SYMSZ = HEXAGON_DISC + 0x70000000¶
- enumerator HEXAGON_VER = HEXAGON_DISC + 0x70000001¶
- enumerator HEXAGON_PLT = HEXAGON_DISC + 0x70000002¶
- enumerator PPC64_GLINK = PPC64_DISC + 0x70000000¶
- enumerator PPC64_OPT = PPC64_DISC + 0x70000003¶
- enumerator RISCV_VARIANT_CC = RISCV_DISC + 0x70000003¶
- enumerator X86_64_PLT = X86_64_DISC + 0x70000000¶
- enumerator X86_64_PLTSZ = X86_64_DISC + 0x70000001¶
- enumerator X86_64_PLTENT = X86_64_DISC + 0x70000003¶
- enumerator IA_64_PLT_RESERVE = IA_64_DISC + (0x70000000 + 0)¶
- enumerator IA_64_VMS_SUBTYPE = IA_64_DISC + (0x60000000 + 0)¶
- enumerator IA_64_VMS_IMGIOCNT = IA_64_DISC + (0x60000000 + 2)¶
- enumerator IA_64_VMS_LNKFLAGS = IA_64_DISC + (0x60000000 + 8)¶
- enumerator IA_64_VMS_VIR_MEM_BLK_SIZ = IA_64_DISC + (0x60000000 + 10)¶
- enumerator IA_64_VMS_IDENT = IA_64_DISC + (0x60000000 + 12)¶
- enumerator IA_64_VMS_NEEDED_IDENT = IA_64_DISC + (0x60000000 + 16)¶
- enumerator IA_64_VMS_IMG_RELA_CNT = IA_64_DISC + (0x60000000 + 18)¶
- enumerator IA_64_VMS_SEG_RELA_CNT = IA_64_DISC + (0x60000000 + 20)¶
- enumerator IA_64_VMS_FIXUP_RELA_CNT = IA_64_DISC + (0x60000000 + 22)¶
- enumerator IA_64_VMS_FIXUP_NEEDED = IA_64_DISC + (0x60000000 + 24)¶
- enumerator IA_64_VMS_SYMVEC_CNT = IA_64_DISC + (0x60000000 + 26)¶
- enumerator IA_64_VMS_XLATED = IA_64_DISC + (0x60000000 + 30)¶
- enumerator IA_64_VMS_STACKSIZE = IA_64_DISC + (0x60000000 + 32)¶
- enumerator IA_64_VMS_UNWINDSZ = IA_64_DISC + (0x60000000 + 34)¶
- enumerator IA_64_VMS_UNWIND_CODSEG = IA_64_DISC + (0x60000000 + 36)¶
- enumerator IA_64_VMS_UNWIND_INFOSEG = IA_64_DISC + (0x60000000 + 38)¶
- enumerator IA_64_VMS_LINKTIME = IA_64_DISC + (0x60000000 + 40)¶
- enumerator IA_64_VMS_SEG_NO = IA_64_DISC + (0x60000000 + 42)¶
- enumerator IA_64_VMS_SYMVEC_OFFSET = IA_64_DISC + (0x60000000 + 44)¶
- enumerator IA_64_VMS_SYMVEC_SEG = IA_64_DISC + (0x60000000 + 46)¶
- enumerator IA_64_VMS_UNWIND_OFFSET = IA_64_DISC + (0x60000000 + 48)¶
- enumerator IA_64_VMS_UNWIND_SEG = IA_64_DISC + (0x60000000 + 50)¶
- enumerator IA_64_VMS_STRTAB_OFFSET = IA_64_DISC + (0x60000000 + 52)¶
- enumerator IA_64_VMS_SYSVER_OFFSET = IA_64_DISC + (0x60000000 + 54)¶
- enumerator IA_64_VMS_IMG_RELA_OFF = IA_64_DISC + (0x60000000 + 56)¶
- enumerator IA_64_VMS_SEG_RELA_OFF = IA_64_DISC + (0x60000000 + 58)¶
- enumerator IA_64_VMS_FIXUP_RELA_OFF = IA_64_DISC + (0x60000000 + 60)¶
- enumerator IA_64_VMS_PLTGOT_OFFSET = IA_64_DISC + (0x60000000 + 62)¶
- enumerator IA_64_VMS_PLTGOT_SEG = IA_64_DISC + (0x60000000 + 64)¶
- enumerator IA_64_VMS_FPMODE = IA_64_DISC + (0x60000000 + 66)¶
- enumerator UNKNOWN = uint64_t(-1)¶
Public Functions
- DynamicEntry() = default¶
- DynamicEntry &operator=(const DynamicEntry&) = default¶
- DynamicEntry(const DynamicEntry&) = default¶
- ~DynamicEntry() override = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const¶
- inline uint64_t value() const¶
Return the entry’s value.
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
- inline void value(uint64_t value)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const¶
- std::string to_string() const¶
Public Static Functions
- static std::unique_ptr<DynamicEntry> create(TAG tag, uint64_t value)¶
- static inline std::unique_ptr<DynamicEntry> create(TAG tag)¶
Public Static Attributes
- static uint64_t MIPS_DISC = 0x100000000¶
- static uint64_t AARCH64_DISC = 0x200000000¶
- static uint64_t HEXAGON_DISC = 0x300000000¶
- static uint64_t PPC_DISC = 0x400000000¶
- static uint64_t PPC64_DISC = 0x500000000¶
- static uint64_t RISCV_DISC = 0x600000000¶
- static uint64_t X86_64_DISC = 0x700000000¶
- static uint64_t IA_64_DISC = 0x800000000¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)¶
- enum class TAG : uint64_t¶
Dynamic Entry Library¶
- class DynamicEntryLibrary : public LIEF::ELF::DynamicEntry¶
Class which represents a
DT_NEEDEDentry in the dynamic table.This kind of entry is usually used to create library dependency.
Public Functions
- inline DynamicEntryLibrary()¶
- inline DynamicEntryLibrary(std::string name)¶
- DynamicEntryLibrary &operator=(const DynamicEntryLibrary&) = default¶
- DynamicEntryLibrary(const DynamicEntryLibrary&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- inline std::string_view name() const¶
Return the library associated with this entry (e.g.
libc.so.6).
- inline void name(std::string name)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
- inline DynamicEntryLibrary()¶
Dynamic Entry Run Path¶
- class DynamicEntryRunPath : public LIEF::ELF::DynamicEntry¶
Class that represents a
DT_RUNPATHwhich is used by the loader to resolve libraries (DynamicEntryLibrary).Public Functions
- inline DynamicEntryRunPath()¶
- inline DynamicEntryRunPath(std::string runpath)¶
Constructor from (run)path.
- inline DynamicEntryRunPath(const std::vector<std::string> &paths)¶
Constructor from a list of paths.
- DynamicEntryRunPath &operator=(const DynamicEntryRunPath&) = default¶
- DynamicEntryRunPath(const DynamicEntryRunPath&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- inline std::string_view runpath() const¶
Runpath raw value.
- inline void runpath(std::string runpath)¶
- std::vector<std::string> paths() const¶
Paths as a list.
- void paths(const std::vector<std::string> &paths)¶
- DynamicEntryRunPath &insert(size_t pos, const std::string &path)¶
Insert a
pathat the givenposition.
- DynamicEntryRunPath &append(const std::string &path)¶
Append the given
path.
- DynamicEntryRunPath &remove(const std::string &path)¶
Remove the given
path.
- inline DynamicEntryRunPath &operator+=(const std::string &path)¶
- inline DynamicEntryRunPath &operator-=(const std::string &path)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- ~DynamicEntryRunPath() override = default¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
Public Static Attributes
- static char delimiter = ':'¶
- inline DynamicEntryRunPath()¶
Dynamic Entry RPath¶
- class DynamicEntryRpath : public LIEF::ELF::DynamicEntry¶
Class which represents a
DT_RPATHentry. This attribute is deprecated (cf.man ld) in favor ofDT_RUNPATH(See DynamicEntryRunPath).Public Functions
- inline DynamicEntryRpath()¶
- inline DynamicEntryRpath(std::string rpath)¶
- inline DynamicEntryRpath(const std::vector<std::string> &paths)¶
Constructor from a list of paths.
- DynamicEntryRpath &operator=(const DynamicEntryRpath&) = default¶
- DynamicEntryRpath(const DynamicEntryRpath&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- inline std::string_view rpath() const¶
The actual rpath as a string.
- inline void rpath(std::string name)¶
- std::vector<std::string> paths() const¶
Paths as a list.
- void paths(const std::vector<std::string> &paths)¶
- DynamicEntryRpath &insert(size_t pos, const std::string &path)¶
Insert a
pathat the givenposition.
- DynamicEntryRpath &append(std::string path)¶
Append the given
path.
- DynamicEntryRpath &remove(const std::string &path)¶
Remove the given
path.
- inline DynamicEntryRpath &operator+=(std::string path)¶
- inline DynamicEntryRpath &operator-=(const std::string &path)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- ~DynamicEntryRpath() override = default¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
Public Static Attributes
- static char delimiter = ':'¶
- inline DynamicEntryRpath()¶
Dynamic Entry Array¶
- class DynamicEntryArray : public LIEF::ELF::DynamicEntry¶
Class that represent an Array in the dynamic table. This entry is associated with constructors:
DT_PREINIT_ARRAYDT_INIT_ARRAYDT_FINI_ARRAY
The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.
Public Types
- using array_t = std::vector<uint64_t>¶
Public Functions
- DynamicEntryArray() = delete¶
- inline DynamicEntryArray(DynamicEntry::TAG tag, array_t array)¶
- DynamicEntryArray &operator=(const DynamicEntryArray&) = default¶
- DynamicEntryArray(const DynamicEntryArray&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- DynamicEntryArray &insert(size_t pos, uint64_t function)¶
Insert the given function at
pos.
- inline DynamicEntryArray &append(uint64_t function)¶
Append the given function.
- DynamicEntryArray &remove(uint64_t function)¶
Remove the given function.
- inline size_t size() const¶
Number of functions registered in this array.
- inline DynamicEntryArray &operator+=(uint64_t value)¶
- inline DynamicEntryArray &operator-=(uint64_t value)¶
- const uint64_t &operator[](size_t idx) const¶
- uint64_t &operator[](size_t idx)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- ~DynamicEntryArray() override = default¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
Dynamic Entry Flags¶
- class DynamicEntryFlags : public LIEF::ELF::DynamicEntry¶
Public Types
- enum class FLAG : uint64_t¶
Values:
- enumerator ORIGIN = 0x00000001¶
The object may reference $ORIGIN.
- enumerator SYMBOLIC = 0x00000002¶
Search the shared lib before searching the exe.
- enumerator TEXTREL = 0x00000004¶
Relocations may modify a non-writable segment.
- enumerator BIND_NOW = 0x00000008¶
Process all relocations on load.
- enumerator STATIC_TLS = 0x00000010¶
Reject attempts to load dynamically.
- enumerator ORIGIN = 0x00000001¶
Public Functions
- DynamicEntryFlags() = delete¶
- DynamicEntryFlags &operator=(const DynamicEntryFlags&) = default¶
- DynamicEntryFlags(const DynamicEntryFlags&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- flags_list_t flags() const¶
Return flags as a list of integers.
- inline uint64_t raw_flags() const¶
- inline DynamicEntryFlags &operator+=(FLAG f)¶
- inline DynamicEntryFlags &operator-=(FLAG f)¶
- virtual void accept(Visitor &visitor) const override¶
- ~DynamicEntryFlags() override = default¶
- virtual std::ostream &print(std::ostream &os) const override¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline DynamicEntryFlags create_dt_flag(uint64_t value)¶
- static inline DynamicEntryFlags create_dt_flag_1(uint64_t value)¶
- static inline bool classof(const DynamicEntry *entry)¶
Public Static Attributes
- static uint64_t BASE = 0x100000000¶
- enum class FLAG : uint64_t¶
Dynamic Entry Auxiliary¶
- class DynamicEntryAuxiliary : public LIEF::ELF::DynamicEntry¶
Class which represents a
DT_AUXILIARYentry in the dynamic table This kind of entry is used to specify a shared object that should be loaded before the current one.Public Functions
- inline DynamicEntryAuxiliary()¶
- inline DynamicEntryAuxiliary(std::string name)¶
- DynamicEntryAuxiliary &operator=(const DynamicEntryAuxiliary&) = default¶
- DynamicEntryAuxiliary(const DynamicEntryAuxiliary&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- inline std::string_view name() const¶
The actual name (e.g.
libaux.so).
- inline void name(std::string name)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- ~DynamicEntryAuxiliary() override = default¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
- inline DynamicEntryAuxiliary()¶
Dynamic Entry Filter¶
- class DynamicEntryFilter : public LIEF::ELF::DynamicEntry¶
Class which represents a
DT_FILTERentry in the dynamic table This kind of entry is used to specify a shared object for which the current one is a filter.Public Functions
- inline DynamicEntryFilter()¶
- inline DynamicEntryFilter(std::string name)¶
- DynamicEntryFilter &operator=(const DynamicEntryFilter&) = default¶
- DynamicEntryFilter(const DynamicEntryFilter&) = default¶
- inline virtual std::unique_ptr<DynamicEntry> clone() const override¶
- inline std::string_view name() const¶
The actual name (e.g.
libfilter.so).
- inline void name(std::string name)¶
- virtual void accept(Visitor &visitor) const override¶
- virtual std::ostream &print(std::ostream &os) const override¶
- ~DynamicEntryFilter() override = default¶
- DynamicEntry() = default¶
- inline DynamicEntry(TAG tag, uint64_t value)¶
- DynamicEntry(const DynamicEntry&) = default¶
Public Static Functions
- static inline bool classof(const DynamicEntry *entry)¶
- inline DynamicEntryFilter()¶
Relocations¶
- class Relocation : public LIEF::Relocation¶
Class that represents an ELF relocation.
Public Types
- enum class PURPOSE¶
The purpose of a relocation defines how this relocation is used by the loader.
Values:
- enumerator NONE = 0¶
- enumerator PLTGOT¶
The relocation is associated with the PLT/GOT resolution.
- enumerator DYNAMIC¶
The relocation is used for regular data/code relocation.
- enumerator OBJECT¶
The relocation is used in an object file.
- enumerator NONE = 0¶
- enum class ENCODING¶
Values:
- enumerator UNKNOWN = 0¶
- enumerator REL¶
The relocation is using the regular Elf_Rel structure.
- enumerator RELA¶
The relocation is using the regular Elf_Rela structure.
- enumerator RELR¶
The relocation is using the relative relocation format.
- enumerator ANDROID_SLEB¶
The relocation is using the packed Android-SLEB128 format.
- enumerator UNKNOWN = 0¶
Public Functions
- Relocation() = default¶
- ~Relocation() override = default¶
- inline Relocation(const Relocation &other)¶
Copy constructor.
Warning
When this constructor is invoked, referenced sections or symbols are discarded. This means that on the copied Relocation, Relocation::section, Relocation::symbol and Relocation::symbol_table are set to a nullptr.
- inline Relocation &operator=(Relocation other)¶
Copy assignment operator.
Please read the notice of the copy constructor
- inline void swap(Relocation &other)¶
- inline int64_t addend() const¶
Additional value that can be involved in the relocation processing.
- inline bool is_rela() const¶
Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries).
- inline bool is_rel() const¶
Check if the relocation uses the implicit addend (i.e. not present in the ELF structure).
- inline bool is_relatively_encoded() const¶
True if the relocation is using the relative encoding.
- inline bool is_android_packed() const¶
True if the relocation is using the Android packed relocation format.
- inline uint32_t info() const¶
Relocation info which contains, for instance, the symbol index.
- inline uint64_t r_info(Header::CLASS clazz) const¶
(re)Compute the raw
r_infoattribute based on the given ELF class
- virtual size_t size() const override¶
Return the size (in bits) of the value associated with this relocation Return -1 if the size can’t be determined.
- inline bool has_symbol() const¶
True if the current relocation is associated with a symbol.
- inline bool has_section() const¶
True if the relocation has an associated section.
- inline void addend(int64_t addend)¶
- inline void info(uint32_t v)¶
- result<uint64_t> resolve(uint64_t base_address = 0) const¶
Try to resolve the value of the relocation such as
*address() = resolve().
- virtual void accept(Visitor &visitor) const override¶
Public Static Functions
Public Static Attributes
- static uint64_t R_BIT = 27¶
Friends
- friend std::ostream &operator<<(std::ostream &os, const Relocation &entry)¶
- enum class PURPOSE¶
Symbol¶
- class Symbol : public LIEF::Symbol¶
Class which represents an ELF symbol.
Public Types
- enum class BINDING¶
Values:
- enumerator LOCAL = 0¶
Local symbol.
- enumerator GLOBAL¶
Global symbol.
- enumerator WEAK¶
Weak symbol.
- enumerator GNU_UNIQUE = 10¶
Unique symbol.
- enumerator LOCAL = 0¶
- enum class TYPE¶
Type of the symbol. This enum matches the
STT_xxxvalues of the ELF specs.Values:
- enumerator FILE¶
Local, absolute symbol that refers to a file.
- enumerator COMMON¶
An uninitialized common block.
- enumerator TLS¶
Thread local data object.
- enumerator GNU_IFUNC = 10¶
GNU indirect function.
- enumerator FILE¶
- enum class VISIBILITY¶
Visibility of the symbol. This enum matches the
STV_xxxvalues of the official ELF specs.Values:
- enumerator DEFAULT = 0¶
Visibility is specified by binding type.
- enumerator INTERNAL¶
Defined by processor supplements.
- enumerator HIDDEN¶
Not visible to other components.
- enumerator PROTECTED¶
Visible in other components but not preemptable.
- enumerator DEFAULT = 0¶
Public Functions
- inline Symbol(std::string name)¶
- Symbol() = default¶
- ~Symbol() override = default¶
- inline TYPE type() const¶
The symbol’s type provides a general classification for the associated entity.
- uint8_t information() const¶
This member specifies the symbol’s type and binding attributes.
- inline uint8_t other() const¶
Alias for visibility().
- inline uint16_t section_idx() const¶
ELF::Section index associated with the symbol.
- inline VISIBILITY visibility() const¶
Symbol visibility.
- inline virtual uint64_t value() const override¶
This member has slightly different interpretations:
In relocatable files,
valueholds alignment constraints for a symbol for which section index is SHN_COMMONIn relocatable files,
valueholds a section offset for a defined symbol. That is,valueis an offset from the beginning of the section associated with this symbol.In executable and shared object files,
valueholds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.
- inline virtual uint64_t size() const override¶
Symbol size.
Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds
0if the symbol has no size or an unknown size.
- inline uint16_t shndx() const¶
See also
- inline bool has_version() const¶
Check if this symbols has a symbol version .
- inline SymbolVersion *symbol_version()¶
Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.
- inline const SymbolVersion *symbol_version() const¶
- inline bool is_local() const¶
- inline bool is_global() const¶
- inline bool is_weak() const¶
- std::string demangled_name() const¶
Symbol’s unmangled name. If not available, it returns an empty string.
- inline void other(uint8_t other)¶
- inline void visibility(VISIBILITY visibility)¶
- void information(uint8_t info)¶
- inline void shndx(uint16_t idx)¶
- inline virtual void value(uint64_t value) override¶
- inline virtual void size(uint64_t size) override¶
- bool is_exported() const¶
Check if the current symbol is exported.
- void set_exported(bool flag = true)¶
Set whether or not the symbol is exported.
- bool is_imported() const¶
Check if the current symbol is imported.
- void set_imported(bool flag = true)¶
Set whether or not the symbol is imported.
- inline bool is_static() const¶
True if the symbol is a static one.
- inline bool is_function() const¶
True if the symbol represents a function.
- inline bool is_variable() const¶
True if the symbol represents a variable.
- virtual void accept(Visitor &visitor) const override¶
Public Static Functions
- enum class BINDING¶
Symbol Version¶
- class SymbolVersion : public LIEF::Object¶
Class which represents an entry defined in the
DT_VERSYMdynamic entry.Public Functions
- inline SymbolVersion(uint16_t value)¶
- SymbolVersion() = default¶
- ~SymbolVersion() override = default¶
- SymbolVersion &operator=(const SymbolVersion&) = default¶
- SymbolVersion(const SymbolVersion&) = default¶
- inline uint16_t value() const¶
Value associated with the symbol.
If the given SymbolVersion hasn’t Auxiliary version:
0means Local1means Global
- inline bool has_auxiliary_version() const¶
Whether the current SymbolVersion has an auxiliary one.
- inline SymbolVersionAux *symbol_version_auxiliary()¶
SymbolVersionAux associated with the current Version if any, or a nullptr.
- inline const SymbolVersionAux *symbol_version_auxiliary() const¶
- void symbol_version_auxiliary(SymbolVersionAuxRequirement &svauxr)¶
Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.
On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement
- inline void drop_version(uint16_t value)¶
Drop the versioning requirement and replace the value (local/global).
- inline void as_global()¶
Redefine this version as global by dropping its auxiliary version.
See also
- inline void as_local()¶
Redefine this version as local by dropping its auxiliary version.
See also
- inline void value(uint16_t v)¶
- virtual void accept(Visitor &visitor) const override¶
Public Static Functions
- static inline SymbolVersion local()¶
Generate a local SymbolVersion.
- static inline SymbolVersion global()¶
Generate a global SymbolVersion.
Friends
- friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)¶
- inline SymbolVersion(uint16_t value)¶
Symbol Version Auxiliary¶
- class SymbolVersionAux : public LIEF::Object¶
Class which represents an Auxiliary Symbol version.
Subclassed by LIEF::ELF::SymbolVersionAuxRequirement
Public Functions
- inline SymbolVersionAux(std::string name)¶
- SymbolVersionAux() = default¶
- ~SymbolVersionAux() override = default¶
- SymbolVersionAux &operator=(const SymbolVersionAux&) = default¶
- SymbolVersionAux(const SymbolVersionAux&) = default¶
- inline void name(std::string name)¶
- virtual void accept(Visitor &visitor) const override¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &aux)¶
- inline SymbolVersionAux(std::string name)¶
Symbol Version Definition¶
- class SymbolVersionDefinition : public LIEF::Object¶
Class which represents an entry defined in
DT_VERDEFor.gnu.version_d.Public Types
- using version_aux_t = std::vector<std::unique_ptr<SymbolVersionAux>>¶
- using it_version_aux = ref_iterator<version_aux_t&, SymbolVersionAux*>¶
- using it_const_version_aux = const_ref_iterator<const version_aux_t&, const SymbolVersionAux*>¶
Public Functions
- SymbolVersionDefinition() = default¶
- SymbolVersionDefinition(const details::Elf64_Verdef &header)¶
- SymbolVersionDefinition(const details::Elf32_Verdef &header)¶
- ~SymbolVersionDefinition() override¶
- SymbolVersionDefinition &operator=(SymbolVersionDefinition other)¶
- SymbolVersionDefinition(const SymbolVersionDefinition &other)¶
- void swap(SymbolVersionDefinition &other)¶
- inline uint16_t version() const¶
Version revision.
This field should always have the value
1. It will be changed if the versioning implementation has to be changed in an incompatible way.
- inline uint16_t flags() const¶
Version information.
- inline uint16_t ndx() const¶
Version index.
Numeric value used as an index in the LIEF::ELF::SymbolVersion table
- inline uint32_t hash() const¶
Hash value of the symbol’s name (using ELF hash function).
- inline it_version_aux symbols_aux()¶
SymbolVersionAux entries.
- inline it_const_version_aux symbols_aux() const¶
- inline void version(uint16_t version)¶
- inline void flags(uint16_t flags)¶
- inline void hash(uint32_t hash)¶
- virtual void accept(Visitor &visitor) const override¶
Friends
- friend std::ostream &operator<<(std::ostream &os, const SymbolVersionDefinition &sym)¶
- using version_aux_t = std::vector<std::unique_ptr<SymbolVersionAux>>¶
Symbol Version Requirement¶
- class SymbolVersionRequirement : public LIEF::Object¶
Class which represents an entry in the
DT_VERNEEDor.gnu.version_rtable.Public Types
- using aux_requirement_t = std::vector<std::unique_ptr<SymbolVersionAuxRequirement>>¶
- using it_aux_requirement = ref_iterator<aux_requirement_t&, SymbolVersionAuxRequirement*>¶
- using it_const_aux_requirement = const_ref_iterator<const aux_requirement_t&, const SymbolVersionAuxRequirement*>¶
Public Functions
- SymbolVersionRequirement() = default¶
- SymbolVersionRequirement(const details::Elf64_Verneed &header)¶
- SymbolVersionRequirement(const details::Elf32_Verneed &header)¶
- ~SymbolVersionRequirement() override = default¶
- SymbolVersionRequirement &operator=(SymbolVersionRequirement other)¶
- SymbolVersionRequirement(const SymbolVersionRequirement &other)¶
- void swap(SymbolVersionRequirement &other)¶
- inline uint16_t version() const¶
Version revision.
This field should always have the value
1. It will be changed if the versioning implementation has to be changed in an incompatible way.
- inline size_t cnt() const¶
Number of auxiliary entries.
- inline it_aux_requirement auxiliary_symbols()¶
Auxiliary entries as an iterator over SymbolVersionAuxRequirement.
- inline it_const_aux_requirement auxiliary_symbols() const¶
- inline std::string_view name() const¶
Return the library name associated with this requirement (e.g.
libc.so.6).
- inline void version(uint16_t version)¶
- inline void name(const std::string &name)¶
- SymbolVersionAuxRequirement &add_aux_requirement(const SymbolVersionAuxRequirement &aux_requirement)¶
Add a version auxiliary requirement to the existing list.
- const SymbolVersionAuxRequirement *find_aux(const std::string &name) const¶
Try to find the SymbolVersionAuxRequirement with the given name (e.g.
GLIBC_2.27).
- inline SymbolVersionAuxRequirement *find_aux(const std::string &name)¶
- inline bool remove_aux_requirement(const std::string &name)¶
Try to remove the auxiliary requirement symbol with the given name. The function returns true if the operation succeed, false otherwise.
Warning
this function invalidates all the references (pointers) of SymbolVersionAuxRequirement. Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion)
- bool remove_aux_requirement(SymbolVersionAuxRequirement &aux)¶
Try to remove the given auxiliary requirement symbol. The function returns true if the operation succeed, false otherwise.
Warning
this function invalidates all the references (pointers) of SymbolVersionAuxRequirement. Therefore, the user is responsible to ensure that the auxiliary requirement is no longer used in the ELF binary (e.g. in SymbolVersion)
- virtual void accept(Visitor &visitor) const override¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionRequirement &symr)¶
- using aux_requirement_t = std::vector<std::unique_ptr<SymbolVersionAuxRequirement>>¶
Symbol Version Auxiliary Requirement¶
- class SymbolVersionAuxRequirement : public LIEF::ELF::SymbolVersionAux¶
Public Functions
- SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header)¶
- SymbolVersionAuxRequirement(const details::Elf32_Vernaux &header)¶
- SymbolVersionAuxRequirement() = default¶
- SymbolVersionAuxRequirement &operator=(const SymbolVersionAuxRequirement&) = default¶
- SymbolVersionAuxRequirement(const SymbolVersionAuxRequirement&) = default¶
- ~SymbolVersionAuxRequirement() override = default¶
- inline uint32_t hash() const¶
Hash value of the dependency name (use ELF hashing function).
- inline uint16_t flags() const¶
Bitmask of flags.
- inline uint16_t other() const¶
It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.
- inline void hash(uint32_t hash)¶
- inline void flags(uint16_t flags)¶
- inline void other(uint16_t other)¶
- virtual void accept(Visitor &visitor) const override¶
- inline void name(std::string name)¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAuxRequirement &aux)¶
- SymbolVersionAuxRequirement(const details::Elf64_Vernaux &header)¶
GNU Hash table¶
- class GnuHash : public LIEF::Object¶
Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.
Public Functions
- GnuHash() = default¶
- inline GnuHash(uint32_t symbol_idx, uint32_t shift2, std::vector<uint64_t> bloom_filters, std::vector<uint32_t> buckets, std::vector<uint32_t> hash_values = {})¶
- ~GnuHash() override = default¶
- inline uint32_t nb_buckets() const¶
Return the number of buckets.
See also
- inline uint32_t symbol_index() const¶
Index of the first symbol in the dynamic symbols table which is accessible with the hash table.
- inline uint32_t shift2() const¶
Shift count used in the bloom filter.
- inline uint32_t maskwords() const¶
Number of bloom filters used. It must be a power of 2.
- inline const std::vector<uint64_t> &bloom_filters() const¶
Bloom filters.
- inline const std::vector<uint32_t> &buckets() const¶
Hash buckets.
- inline const std::vector<uint32_t> &hash_values() const¶
Hash values.
- bool check_bloom_filter(uint32_t hash) const¶
Check if the given hash passes the bloom filter.
- inline bool check_bucket(uint32_t hash) const¶
Check if the given hash passes the bucket filter.
- bool check(const std::string &symbol_name) const¶
Check if the symbol probably exists. If the returned value is
falseyou can assume at100%that the symbol with the given name doesn’t exist. Iftrue, you can’t do any assumption.
- bool check(uint32_t hash) const¶
Check if the symbol associated with the given hash probably exists. If the returned value is
falseyou can assume at100%that the symbol doesn’t exist. Iftrueyou can’t do any assumption.
- virtual void accept(Visitor &visitor) const override¶
- inline uint64_t original_size() const¶
Public Static Functions
- template<class ELF_T>
static std::unique_ptr<GnuHash> parse(SpanStream &strm, uint64_t dynsymcount)¶
- template<class ELF_T>
static result<uint32_t> nb_symbols(SpanStream &strm)¶
- GnuHash() = default¶
SYSV Hash table¶
- class SysvHash : public LIEF::Object¶
Class which represents the SYSV hash for the symbols resolution.
References:
http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/
https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
Public Functions
- SysvHash() = default¶
- ~SysvHash() override = default¶
- inline uint32_t nbucket() const¶
Return the number of buckets used.
- inline uint32_t nchain() const¶
Return the number of chain used.
- inline const std::vector<uint32_t> &buckets() const¶
Buckets values.
- inline const std::vector<uint32_t> &chains() const¶
Chains values.
- inline void nchain(uint32_t nb)¶
- virtual void accept(Visitor &visitor) const override¶
Note¶
- class Note : public LIEF::Object¶
Class which represents an ELF note. This class can be instantiated using the static Note::create functions.
Subclassed by LIEF::ELF::AndroidIdent, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi, LIEF::ELF::NoteGnuProperty, LIEF::ELF::QNXStack
Public Types
- enum class TYPE¶
LIEF representation of the ELF
NT_values.Values:
- enumerator UNKNOWN = 0¶
- enumerator GNU_HWCAP¶
Match
NT_HWCAP: Synthetic hardware capabilities information.
- enumerator GNU_BUILD_ID¶
Match
NT_GNU_BUILD_ID: Unique build ID as generated by the GNU ld.
- enumerator GNU_GOLD_VERSION¶
Match
NT_GNU_GOLD_VERSION: The version of gold used to link.
- enumerator GNU_PROPERTY_TYPE_0¶
Match
NT_GNU_PROPERTY_TYPE_0: Program property note, as described in “Linux Extensions to the gABI”.
- enumerator GNU_BUILD_ATTRIBUTE_OPEN¶
- enumerator GNU_BUILD_ATTRIBUTE_FUNC¶
- enumerator CRASHPAD¶
Crashpad note used by the Chromium project.
- enumerator CORE_PRSTATUS¶
Coredump that wraps the
elf_prstatusstructure.
- enumerator CORE_FPREGSET¶
- enumerator CORE_PRPSINFO¶
Coredump that wraps the
elf_prpsinfostructure.See: CorePrPsInfo
- enumerator CORE_TASKSTRUCT¶
- enumerator CORE_AUXV¶
Coredump that contains a copy of all the auxiliary vectors (auxv).
See: CoreAuxv
- enumerator CORE_PSTATUS¶
- enumerator CORE_FPREGS¶
Coredump that wraps the
fpregsetstructure.
- enumerator CORE_PSINFO¶
Coredump that wraps the
psinfostructure.
- enumerator CORE_LWPSTATUS¶
- enumerator CORE_LWPSINFO¶
- enumerator CORE_WIN32PSTATUS¶
- enumerator CORE_FILE¶
- enumerator CORE_PRXFPREG¶
- enumerator CORE_SIGINFO¶
- enumerator CORE_ARM_VFP¶
- enumerator CORE_ARM_TLS¶
- enumerator CORE_ARM_HW_BREAK¶
- enumerator CORE_ARM_HW_WATCH¶
- enumerator CORE_ARM_SYSTEM_CALL¶
- enumerator CORE_ARM_SVE¶
- enumerator CORE_ARM_PAC_MASK¶
- enumerator CORE_ARM_PACA_KEYS¶
- enumerator CORE_ARM_PACG_KEYS¶
- enumerator CORE_TAGGED_ADDR_CTRL¶
- enumerator CORE_PAC_ENABLED_KEYS¶
- enumerator CORE_X86_TLS¶
- enumerator CORE_X86_IOPERM¶
- enumerator CORE_X86_XSTATE¶
- enumerator CORE_X86_CET¶
- enumerator ANDROID_IDENT¶
Note that is specific to Android and that describes information such as the NDK version or the SDK build number.
See AndroidIdent
- enumerator ANDROID_MEMTAG¶
- enumerator ANDROID_KUSER¶
- enumerator UNKNOWN = 0¶
- using description_t = std::vector<uint8_t>¶
Container used to handle the description data.
Public Functions
- ~Note() override = default¶
- inline virtual std::unique_ptr<Note> clone() const¶
Clone the current note and keep its polymorphic type.
- inline std::string_view name() const¶
Return the name of the note (also known as ‘owner’ ).
- inline std::string_view section_name() const¶
Return the section name in which the note is or should be stored.
- inline TYPE type() const¶
Return the type of the note. This type does not match the
NT_type value. For accessing the originalNT_value, check original_type().
- inline uint32_t original_type() const¶
The original
NT_xxxinteger value. The meaning of this value likely depends on the owner of the note.
- inline span<const uint8_t> description() const¶
Return the description associated with the note.
- inline span<uint8_t> description()¶
- inline void name(std::string name)¶
- inline void description(description_t description)¶
Change the description of the note.
- uint64_t size() const¶
Size of the raw note which includes padding.
- virtual void dump(std::ostream &os) const¶
- virtual void accept(Visitor &visitor) const override¶
Public Static Functions
- static result<TYPE> convert_type(Header::FILE_TYPE ftype, uint32_t type, const std::string &name)¶
Convert the raw integer note type into a TYPE according to the owner.
- static result<const char*> type_to_section(TYPE type)¶
Try to determine the ELF section name associated with the TYPE provided in parameter.
- static result<const char*> type_owner(TYPE type)¶
Try to determine the owner’s name of the TYPE provided in parameter.
- static std::unique_ptr<Note> create(const std::string &name, uint32_t type, description_t description, std::string section_name, Header::FILE_TYPE ftype = Header::FILE_TYPE::NONE, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)¶
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
- static std::unique_ptr<Note> create(const std::string &name, TYPE type, description_t description, std::string section_name, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)¶
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
- static std::unique_ptr<Note> create(BinaryStream &stream, std::string section_name, Header::FILE_TYPE ftype = Header::FILE_TYPE::NONE, ARCH arch = ARCH::NONE, Header::CLASS cls = Header::CLASS::NONE)¶
Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
- enum class TYPE¶
Core PrPsInfo¶
- class CorePrPsInfo : public LIEF::ELF::Note¶
Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process.
Public Functions
- inline CorePrPsInfo(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~CorePrPsInfo() override = default¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo ¬e)¶
- struct info_t¶
Public Functions
- inline std::string filename_stripped() const¶
Return the filename without the ending
\x00.
- inline std::string args_stripped() const¶
Return the args without the ending
\x00.
Public Members
- uint8_t state = 0¶
Numeric process state.
- char sname = ' '¶
Printable character representing state.
- bool zombie = false¶
Whether the process is a zombie.
- uint8_t nice = 0¶
Nice value.
- uint64_t flag = 0¶
Process flag.
- uint32_t uid = 0¶
Process user ID.
- uint32_t gid = 0¶
Process group ID.
- uint32_t pid = 0¶
Process ID.
- uint32_t ppid = 0¶
Process parent ID.
- uint32_t pgrp = 0¶
Process group.
- uint32_t sid = 0¶
Process session ID.
- std::string filename¶
Filename of the executable.
- std::string args¶
Initial part of the arguments.
- inline std::string filename_stripped() const¶
- inline CorePrPsInfo(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)¶
Core File¶
- class CoreFile : public LIEF::ELF::Note¶
Class representing a core
NT_FILEwhich describes the mapped files of the process.Public Types
Public Functions
- CoreFile(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, Note::description_t description)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- inline uint64_t count() const¶
Number of coredump file entries.
- inline const_iterator begin() const¶
- inline const_iterator end() const¶
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~CoreFile() override = default¶
- CoreFile(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, Note::description_t description)¶
Core PrStatus¶
- class CorePrStatus : public LIEF::ELF::Note¶
Class representing core PrPsInfo object.
Public Functions
- inline CorePrStatus(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- pr_status_t status() const¶
Return the pr_status_t structure.
- void status(const pr_status_t &status)¶
- result<uint64_t> return_value() const¶
The value of the register that holds the return value according to the calling convention.
- result<uint64_t> get(Registers::X86 reg) const¶
Get the value for the given X86 register or return an error.
- result<uint64_t> get(Registers::X86_64 reg) const¶
Get the value for the given X86_64 register or return an error.
- result<uint64_t> get(Registers::ARM reg) const¶
Get the value for the given ARM register or return an error.
- result<uint64_t> get(Registers::AARCH64 reg) const¶
Get the value for the given AARCH64 register or return an error.
- ok_error_t set(Registers::X86 reg, uint64_t value)¶
- ok_error_t set(Registers::X86_64 reg, uint64_t value)¶
- ok_error_t set(Registers::ARM reg, uint64_t value)¶
- ok_error_t set(Registers::AARCH64 reg, uint64_t value)¶
- std::vector<uint64_t> register_values() const¶
A list of the register values. This list is guarantee to be as long as the Registers::ARM::_COUNT or empty if it can’t be resolved. Thus, one can access a specific register with:
if (architecture() == ARCH::AARCH64) { auto reg_vals = register_values() if (!reg_vals.empty()) { auto x20 = reg_vals[static_cast<size_t>(Register::AARCH64::X20)] } }
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~CorePrStatus() override = default¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const CorePrStatus ¬e)¶
- struct siginfo_t¶
- struct timeval_t¶
- struct pr_status_t¶
Status information from a core dump.
This structure mirrors the kernel’s
prstatusdata embedded inNT_PRSTATUScore-dump notes and exposes signal state, process identifiers, and CPU-time accounting.
- struct Registers¶
Public Types
- enum class X86¶
Register for the x86 architecture (ARCH::I386).
Values:
- enumerator EBX = 0¶
- enumerator ECX¶
- enumerator EDX¶
- enumerator ESI¶
- enumerator EDI¶
- enumerator EBP¶
- enumerator EAX¶
- enumerator DS¶
- enumerator ES¶
- enumerator FS¶
- enumerator GS¶
- enumerator ORIG_EAX¶
- enumerator EIP¶
- enumerator CS¶
- enumerator EFLAGS¶
- enumerator ESP¶
- enumerator SS¶
- enumerator _COUNT¶
- enumerator EBX = 0¶
- enum class X86_64¶
Register for the x86-64 architecture (ARCH::X86_64).
Values:
- enumerator R15 = 0¶
- enumerator R14¶
- enumerator R13¶
- enumerator R12¶
- enumerator RBP¶
- enumerator RBX¶
- enumerator R11¶
- enumerator R10¶
- enumerator R9¶
- enumerator R8¶
- enumerator RAX¶
- enumerator RCX¶
- enumerator RDX¶
- enumerator RSI¶
- enumerator RDI¶
- enumerator ORIG_RAX¶
- enumerator RIP¶
- enumerator CS¶
- enumerator EFLAGS¶
- enumerator RSP¶
- enumerator SS¶
- enumerator FS_BASE¶
- enumerator GS_BASE¶
- enumerator DS¶
- enumerator ES¶
- enumerator _COUNT¶
- enumerator R15 = 0¶
- enum class ARM¶
Register for the ARM architecture (ARCH::ARM).
Values:
- enumerator R0 = 0¶
- enumerator R1¶
- enumerator R2¶
- enumerator R3¶
- enumerator R4¶
- enumerator R5¶
- enumerator R6¶
- enumerator R7¶
- enumerator R8¶
- enumerator R9¶
- enumerator R10¶
- enumerator R11¶
- enumerator R12¶
- enumerator R13¶
- enumerator R14¶
- enumerator R15¶
- enumerator CPSR¶
- enumerator _COUNT¶
- enumerator R0 = 0¶
- enum class AARCH64¶
Register for the AARCH64 architecture (ARCH::AARCH64).
Values:
- enumerator X0 = 0¶
- enumerator X1¶
- enumerator X2¶
- enumerator X3¶
- enumerator X4¶
- enumerator X5¶
- enumerator X6¶
- enumerator X7¶
- enumerator X8¶
- enumerator X9¶
- enumerator X10¶
- enumerator X11¶
- enumerator X12¶
- enumerator X13¶
- enumerator X14¶
- enumerator X15¶
- enumerator X16¶
- enumerator X17¶
- enumerator X18¶
- enumerator X19¶
- enumerator X20¶
- enumerator X21¶
- enumerator X22¶
- enumerator X23¶
- enumerator X24¶
- enumerator X25¶
- enumerator X26¶
- enumerator X27¶
- enumerator X28¶
- enumerator X29¶
- enumerator X30¶
- enumerator X31¶
- enumerator PC¶
- enumerator PSTATE¶
- enumerator _COUNT¶
- enumerator X0 = 0¶
- enum class X86¶
- inline CorePrStatus(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)¶
Core Siginfo¶
- class CoreSigInfo : public LIEF::ELF::Note¶
Class representing a core siginfo object.
Public Functions
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- void signo(uint32_t value)¶
- void sigcode(uint32_t value)¶
- void sigerrno(uint32_t value)¶
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~CoreSigInfo() override = default¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const CoreSigInfo ¬e)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Core Auxiliary Vector¶
- class CoreAuxv : public LIEF::ELF::Note¶
Class representing core auxv object.
Public Types
- enum class TYPE¶
Values:
- enumerator END = 0¶
End of vector
- enumerator IGNORE_TY¶
Entry should be ignored
- enumerator EXECFD¶
File descriptor of program
- enumerator PHDR¶
Program headers for program
- enumerator PHENT¶
Size of program header entry
- enumerator PHNUM¶
Number of program headers
- enumerator PAGESZ¶
System page size
- enumerator BASE¶
Base address of interpreter
- enumerator FLAGS¶
Flags
- enumerator ENTRY¶
Entry point of program
- enumerator NOTELF¶
Program is not ELF
- enumerator UID¶
Real uid
- enumerator EUID¶
Effective uid
- enumerator GID¶
Real gid
- enumerator EGID¶
Effective gid
- enumerator TGT_PLATFORM¶
String identifying platform.
- enumerator HWCAP¶
Machine dependent hints about processor capabilities.
- enumerator CLKTCK¶
Frequency of times()
- enumerator FPUCW¶
Used FPU control word.
- enumerator DCACHEBSIZE¶
Data cache block size.
- enumerator ICACHEBSIZE¶
Instruction cache block size.
- enumerator UCACHEBSIZE¶
Unified cache block size.
- enumerator IGNOREPPC¶
Entry should be ignored.
- enumerator SECURE¶
Boolean, was exec setuid-like?.
- enumerator BASE_PLATFORM¶
String identifying real platform
- enumerator RANDOM¶
Address of 16 random bytes
- enumerator HWCAP2¶
Extension of AT_HWCAP
- enumerator EXECFN = 31¶
Filename of executable
- enumerator SYSINFO¶
Filename of executable
- enumerator SYSINFO_EHDR¶
Pointer to ELF header of system-supplied DSO.
- enumerator END = 0¶
Public Functions
- inline CoreAuxv(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- std::map<TYPE, uint64_t> values() const¶
A map of CoreAuxv::TYPE and the value.
- result<uint64_t> get(TYPE type) const¶
Return the value associated with the provided TYPE or a lief_errors::not_found if the type is not present.
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~CoreAuxv() override = default¶
- enum class TYPE¶
Android Identity¶
- class AndroidIdent : public LIEF::ELF::Note¶
Class representing the “.note.android.ident” section.
Public Functions
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- uint32_t sdk_version() const¶
Target SDK version (or 0 if it can’t be resolved).
- std::string ndk_version() const¶
NDK version used (or an empty string if it can’t be parsed).
- std::string ndk_build_number() const¶
NDK build number (or an empty string if it can’t be parsed).
- void sdk_version(uint32_t version)¶
- void ndk_version(const std::string &ndk_version)¶
- void ndk_build_number(const std::string &ndk_build_number)¶
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~AndroidIdent() override = default¶
Public Static Functions
- static inline size_t description_size()¶
Public Static Attributes
- static size_t sdk_version_size = sizeof(uint32_t)¶
- static size_t ndk_version_size = 64 * sizeof(char)¶
- static size_t ndk_build_number_size = 64 * sizeof(char)¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const AndroidIdent ¬e)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
QNX Stack¶
- class QNXStack : public LIEF::ELF::Note¶
Class representing the QNX
QNT_STACKnote.Public Functions
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- uint32_t stack_size() const¶
Size of the stack.
- uint32_t stack_allocated() const¶
Size of the stack pre-allocated (upfront).
- bool is_executable() const¶
Whether the stack is executable.
- void stack_size(uint32_t value)¶
- void stack_allocated(uint32_t value)¶
- void set_is_executable(bool value)¶
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~QNXStack() override = default¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Note ABI¶
- class NoteAbi : public LIEF::ELF::Note¶
Class that wraps the
NT_GNU_ABI_TAGnote.Public Types
- enum class ABI¶
ABI recognized by this note.
Values:
- enumerator LINUX = 0¶
- enumerator GNU¶
- enumerator SOLARIS2¶
- enumerator FREEBSD¶
- enumerator NETBSD¶
- enumerator SYLLABLE¶
- enumerator NACL¶
- enumerator LINUX = 0¶
- using version_t = std::array<uint32_t, 3>¶
Version type: (Major, Minor, Patch).
Public Functions
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~NoteAbi() override = default¶
Public Static Functions
- static inline uint8_t description_size()¶
Size of the description content.
- enum class ABI¶
Note Gnu Property¶
- class NoteGnuProperty : public LIEF::ELF::Note¶
Class that wraps the
NT_GNU_PROPERTY_TYPE_0note.Public Types
- using properties_t = std::vector<std::unique_ptr<NoteGnuProperty::Property>>¶
Public Functions
- inline NoteGnuProperty(ARCH arch, Header::CLASS cls, std::string name, uint32_t type, description_t description, std::string secname)¶
- inline virtual std::unique_ptr<Note> clone() const override¶
Clone the current note and keep its polymorphic type.
- std::unique_ptr<NoteGnuProperty::Property> find(Property::TYPE type) const¶
Find the property with the given type or return a
nullptr.
- properties_t properties() const¶
Return the properties as a list of Property.
- virtual void dump(std::ostream &os) const override¶
- virtual void accept(Visitor &visitor) const override¶
- ~NoteGnuProperty() override = default¶
Friends
- inline friend std::ostream &operator<<(std::ostream &os, const NoteGnuProperty ¬e)¶
- class Property¶
This class wraps the different properties that can be used in a
NT_GNU_PROPERTY_TYPE_0note.Subclassed by LIEF::ELF::AArch64Feature, LIEF::ELF::AArch64PAuth, LIEF::ELF::Generic, LIEF::ELF::Needed, LIEF::ELF::NoteNoCopyOnProtected, LIEF::ELF::StackSize, LIEF::ELF::X86Features, LIEF::ELF::X86ISA
Public Types
- enum class TYPE¶
LIEF’s mirror types of the original
GNU_PROPERTY_values.Values:
- enumerator UNKNOWN = 0¶
- enumerator AARCH64_FEATURES¶
Mirror of
GNU_PROPERTY_AARCH64_FEATURE_1_AND.
- enumerator AARCH64_PAUTH¶
Mirror of
GNU_PROPERTY_AARCH64_FEATURE_PAUTH.
- enumerator STACK_SIZE¶
Mirror of
GNU_PROPERTY_STACK_SIZE.
- enumerator NO_COPY_ON_PROTECTED¶
Mirror of
GNU_PROPERTY_NO_COPY_ON_PROTECTED.
- enumerator X86_ISA¶
Mirror of
GNU_PROPERTY_X86_ISA_1_*andGNU_PROPERTY_X86_COMPAT_*.Mirror of
GNU_PROPERTY_X86_FEATURE_*
- enumerator X86_FEATURE¶
- enumerator NEEDED¶
- enumerator UNKNOWN = 0¶
- enum class TYPE¶
- using properties_t = std::vector<std::unique_ptr<NoteGnuProperty::Property>>¶
Generic¶
- class Generic : public LIEF::ELF::NoteGnuProperty::Property¶
This class represents a property which doesn’t have a concrete LIEF implementation.
Public Functions
- inline uint32_t type() const¶
The original raw type as an integer. This value might depends on the architecture and/or the file type.
- ~Generic() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- inline uint32_t type() const¶
AArch64 Feature¶
- class AArch64Feature : public LIEF::ELF::NoteGnuProperty::Property¶
This class represents the
GNU_PROPERTY_AARCH64_FEATURE_1_ANDproperty.Public Types
Public Functions
- virtual void dump(std::ostream &os) const override¶
- ~AArch64Feature() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static std::unique_ptr<AArch64Feature> create(BinaryStream &stream)¶
- virtual void dump(std::ostream &os) const override¶
AArch64 PAuth¶
- class AArch64PAuth : public LIEF::ELF::NoteGnuProperty::Property¶
This class represents the
GNU_PROPERTY_AARCH64_FEATURE_PAUTHproperty.Note
If both AArch64PAuth::platform and AArch64PAuth::version are set to 0, this means that the binary is incompatible with PAuth ABI extension.
Public Functions
- inline uint64_t platform() const¶
64-bit value that specifies the platform vendor.
A
0value is associated with an invalid platform while the value1is associated with a baremetal platform.
- inline uint64_t version() const¶
64-bit value that identifies the signing schema used by the ELF file.
- virtual void dump(std::ostream &os) const override¶
- ~AArch64PAuth() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static std::unique_ptr<AArch64PAuth> create(BinaryStream &stream)¶
- inline uint64_t platform() const¶
Needed¶
- class Needed : public LIEF::ELF::NoteGnuProperty::Property¶
This class represents the
GNU_PROPERTY_1_NEEDEDnote property.This property provides information about additional features that the object file needs at runtime (e.g. indirect external access).
Public Types
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static std::unique_ptr<Needed> create(BinaryStream &stream)¶
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
No Copy on Protected¶
- class NoteNoCopyOnProtected : public LIEF::ELF::NoteGnuProperty::Property¶
This class provides an interface over the
GNU_PROPERTY_NO_COPY_ON_PROTECTEDproperty. This property indicates that the linker shouldn’t copy relocations against protected symbols.Public Functions
- ~NoteNoCopyOnProtected() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static inline std::unique_ptr<NoteNoCopyOnProtected> create()¶
- ~NoteNoCopyOnProtected() override = default¶
Stack Size¶
- class StackSize : public LIEF::ELF::NoteGnuProperty::Property¶
This class provides an interface over the
GNU_PROPERTY_STACK_SIZEproperty.This property can be used by the loader to raise the stack limit.
Public Functions
- inline uint64_t stack_size() const¶
The indicated stack size.
- virtual void dump(std::ostream &os) const override¶
- ~StackSize() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- inline uint64_t stack_size() const¶
X86 Feature¶
- class X86Features : public LIEF::ELF::NoteGnuProperty::Property¶
This class interfaces the different
GNU_PROPERTY_X86_FEATURE_*properties which includes:GNU_PROPERTY_X86_FEATURE_1_ANDGNU_PROPERTY_X86_FEATURE_2_USEDGNU_PROPERTY_X86_FEATURE_2_NEEDED
Public Types
- enum class FLAG¶
Flag according to the
_AND,_USEDor_NEEDEDsuffixes.Values:
- enumerator NONE = 0¶
For the original
GNU_PROPERTY_X86_FEATURE_1_ANDproperty.
- enumerator USED¶
For the original
GNU_PROPERTY_X86_FEATURE_2_USEDproperty.
- enumerator NEEDED¶
For the original
GNU_PROPERTY_X86_FEATURE_2_NEEDEDproperty.
- enumerator NONE = 0¶
- enum class FEATURE¶
Features provided by these different properties.
Values:
- enumerator UNKNOWN = 0¶
- enumerator IBT¶
- enumerator SHSTK¶
- enumerator LAM_U48¶
- enumerator LAM_U57¶
- enumerator X86¶
- enumerator X87¶
- enumerator MMX¶
- enumerator XMM¶
- enumerator YMM¶
- enumerator ZMM¶
- enumerator FXSR¶
- enumerator XSAVE¶
- enumerator XSAVEOPT¶
- enumerator XSAVEC¶
- enumerator TMM¶
- enumerator MASK¶
- enumerator UNKNOWN = 0¶
- using features_t = std::vector<std::pair<FLAG, FEATURE>>¶
List of the features as a pair of FLAG, FEATURE.
For instance, if the raw property is
GNU_PROPERTY_X86_FEATURE_2_USEDwith a bitmask set toGNU_PROPERTY_X86_FEATURE_2_XSAVE, it generates the pair: FLAG::USED, FEATURE::XSAVE
Public Functions
- inline const features_t &features() const¶
List of the features.
- virtual void dump(std::ostream &os) const override¶
- ~X86Features() override = default¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static std::unique_ptr<X86Features> create(uint32_t type, BinaryStream &stream)¶
X86 ISA¶
- class X86ISA : public LIEF::ELF::NoteGnuProperty::Property¶
This class interfaces the different
GNU_PROPERTY_X86_ISA_*properties which includes:GNU_PROPERTY_X86_ISA_1_USEDGNU_PROPERTY_X86_ISA_1_NEEDEDGNU_PROPERTY_X86_COMPAT_ISA_1_USEDGNU_PROPERTY_X86_COMPAT_ISA_1_NEEDEDGNU_PROPERTY_X86_COMPAT_2_ISA_1_USEDGNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED
Public Types
- enum class ISA¶
Values:
- enumerator UNKNOWN = 0¶
- enumerator BASELINE¶
- enumerator V2¶
- enumerator V3¶
- enumerator V4¶
- enumerator CMOV¶
- enumerator FMA¶
- enumerator I486¶
- enumerator I586¶
- enumerator I686¶
- enumerator SSE¶
- enumerator SSE2¶
- enumerator SSE3¶
- enumerator SSSE3¶
- enumerator SSE4_1¶
- enumerator SSE4_2¶
- enumerator AVX¶
- enumerator AVX2¶
- enumerator AVX512F¶
- enumerator AVX512CD¶
- enumerator AVX512ER¶
- enumerator AVX512PF¶
- enumerator AVX512VL¶
- enumerator AVX512DQ¶
- enumerator AVX512BW¶
- enumerator AVX512_4FMAPS¶
- enumerator AVX512_4VNNIW¶
- enumerator AVX512_BITALG¶
- enumerator AVX512_IFMA¶
- enumerator AVX512_VBMI¶
- enumerator AVX512_VBMI2¶
- enumerator AVX512_VNNI¶
- enumerator AVX512_BF16¶
- enumerator UNKNOWN = 0¶
Public Static Functions
- static inline bool classof(const NoteGnuProperty::Property *prop)¶
- static std::unique_ptr<X86ISA> create(uint32_t type, BinaryStream &stream)¶
Builder¶
- class Builder¶
Class which takes an ELF::Binary object and reconstructs a valid binary.
This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run).
Public Functions
- Builder() = delete¶
- ~Builder()¶
- void build()¶
Perform the build of the provided ELF binary.
- const std::vector<uint8_t> &get_build()¶
Return the built ELF binary as a byte vector.
- void write(const std::string &filename) const¶
Write the built ELF binary in the
filenamegiven in parameter.
- void write(std::ostream &os) const¶
Write the built ELF binary in the stream
osgiven in parameter.
- struct config_t¶
Configuration options to tweak the building process.
Public Members
- bool dt_hash = true¶
Rebuild DT_HASH.
- bool dyn_str = true¶
Rebuild DT_STRTAB.
- bool dynamic_section = true¶
Rebuild PT_DYNAMIC segment.
- bool fini_array = true¶
Rebuild DT_FINI_ARRAY.
- bool gnu_hash = true¶
Rebuild DT_GNU_HASH.
- bool init_array = true¶
Rebuild DT_INIT_ARRAY.
- bool interpreter = true¶
Rebuild PT_INTERPRETER.
- bool jmprel = true¶
Rebuild DT_JMPREL.
- bool notes = false¶
Disable note building since it can break the default layout.
- bool preinit_array = true¶
Rebuild DT_PREINIT_ARRAY.
- bool relr = true¶
Rebuild DT_RELR.
- bool android_rela = true¶
Rebuild DT_ANDROID_REL[A].
- bool rela = true¶
Rebuild DT_REL[A].
- bool sym_verdef = true¶
Rebuild DT_VERDEF.
- bool sym_verneed = true¶
Rebuild DT_VERNEED.
- bool sym_versym = true¶
Rebuild DT_VERSYM.
- bool symtab = true¶
Rebuild DT_SYMTAB.
- bool coredump_notes = true¶
Rebuild the Coredump notes.
- bool force_relocate = false¶
Force to relocating all the ELF structures that are supported by LIEF (mostly for testing).
- bool skip_dynamic = false¶
Skip relocating the PT_DYNAMIC segment (only relevant if force_relocate is set.
- bool keep_empty_version_requirement = false¶
Remove entries in
.gnu.version_rif they are not associated with at least one version.
- bool dt_hash = true¶
- Builder() = delete¶
Utilities¶
- bool LIEF::ELF::check_layout(const Binary &bin, std::string *error_info = nullptr)¶
Check that the layout of the given Binary is correct.
- bool LIEF::ELF::is_elf(const std::string &file)¶
Check if the given file is an ELF one.
- bool LIEF::ELF::is_elf(const std::vector<uint8_t> &raw)¶
Check if the raw data is an ELF file.
Enums¶
Architectures¶
- enum class LIEF::ELF::ARCH¶
Machine architectures See current registered ELF machine architectures at: http://www.sco.com/developers/gabi/latest/ch4.eheader.html
Values:
- enumerator NONE = 0¶
No machine
- enumerator M32 = 1¶
AT&T WE 32100
- enumerator SPARC = 2¶
SPARC
- enumerator I386 = 3¶
Intel 386
- enumerator M68K = 4¶
Motorola 68000
- enumerator M88K = 5¶
Motorola 88000
- enumerator IAMCU = 6¶
Intel MCU
- enumerator I860 = 7¶
Intel 80860
- enumerator MIPS = 8¶
MIPS R3000
- enumerator S370 = 9¶
IBM System/370
- enumerator MIPS_RS3_LE = 10¶
MIPS RS3000 Little-endian
- enumerator PARISC = 15¶
Hewlett-Packard PA-RISC
- enumerator VPP500 = 17¶
Fujitsu VPP500
- enumerator SPARC32PLUS = 18¶
Enhanced instruction set SPARC
- enumerator I60 = 19¶
Intel 80960
- enumerator PPC = 20¶
PowerPC
- enumerator PPC64 = 21¶
PowerPC64
- enumerator S390 = 22¶
IBM System/390
- enumerator SPU = 23¶
IBM SPU/SPC
- enumerator V800 = 36¶
NEC V800
- enumerator FR20 = 37¶
Fujitsu FR20
- enumerator RH32 = 38¶
TRW RH-32
- enumerator RCE = 39¶
Motorola RCE
- enumerator ARM = 40¶
ARM
- enumerator ALPHA = 41¶
DEC Alpha
- enumerator SH = 42¶
Hitachi SH
- enumerator SPARCV9 = 43¶
SPARC V9
- enumerator TRICORE = 44¶
Siemens TriCore
- enumerator ARC = 45¶
Argonaut RISC Core
- enumerator H8_300 = 46¶
Hitachi H8/300
- enumerator H8_300H = 47¶
Hitachi H8/300H
- enumerator H8S = 48¶
Hitachi H8S
- enumerator H8_500 = 49¶
Hitachi H8/500
- enumerator IA_64 = 50¶
Intel IA-64 processor architecture
- enumerator MIPS_X = 51¶
Stanford MIPS-X
- enumerator COLDFIRE = 52¶
Motorola ColdFire
- enumerator M68HC12 = 53¶
Motorola M68HC12
- enumerator MMA = 54¶
Fujitsu MMA Multimedia Accelerator
- enumerator PCP = 55¶
Siemens PCP
- enumerator NCPU = 56¶
Sony nCPU embedded RISC processor
- enumerator NDR1 = 57¶
Denso NDR1 microprocessor
- enumerator STARCORE = 58¶
Motorola Star*Core processor
- enumerator ME16 = 59¶
Toyota ME16 processor
- enumerator ST100 = 60¶
STMicroelectronics ST100 processor
- enumerator TINYJ = 61¶
Advanced Logic Corp. TinyJ embedded processor family
- enumerator X86_64 = 62¶
AMD x86-64 architecture
- enumerator PDSP = 63¶
Sony DSP Processor
- enumerator PDP10 = 64¶
Digital Equipment Corp. PDP-10
- enumerator PDP11 = 65¶
Digital Equipment Corp. PDP-11
- enumerator FX66 = 66¶
Siemens FX66 microcontroller
- enumerator ST9PLUS = 67¶
STMicroelectronics ST9+ 8/16 bit microcontroller
- enumerator ST7 = 68¶
STMicroelectronics ST7 8-bit microcontroller
- enumerator M68HC16 = 69¶
Motorola MC68HC16 Microcontroller
- enumerator M68HC11 = 70¶
Motorola MC68HC11 Microcontroller
- enumerator M68HC08 = 71¶
Motorola MC68HC08 Microcontroller
- enumerator M68HC05 = 72¶
Motorola MC68HC05 Microcontroller
- enumerator SVX = 73¶
Silicon Graphics SVx
- enumerator ST19 = 74¶
STMicroelectronics ST19 8-bit microcontroller
- enumerator VAX = 75¶
Digital VAX
- enumerator CRIS = 76¶
Axis Communications 32-bit embedded processor
- enumerator JAVELIN = 77¶
Infineon Technologies 32-bit embedded processor
- enumerator FIREPATH = 78¶
Element 14 64-bit DSP Processor
- enumerator ZSP = 79¶
LSI Logic 16-bit DSP Processor
- enumerator MMIX = 80¶
Donald Knuth’s educational 64-bit processor
- enumerator HUANY = 81¶
Harvard University machine-independent object files
- enumerator PRISM = 82¶
SiTera Prism
- enumerator AVR = 83¶
Atmel AVR 8-bit microcontroller
- enumerator FR30 = 84¶
Fujitsu FR30
- enumerator D10V = 85¶
Mitsubishi D10V
- enumerator D30V = 86¶
Mitsubishi D30V
- enumerator V850 = 87¶
NEC v850
- enumerator M32R = 88¶
Mitsubishi M32R
- enumerator MN10300 = 89¶
Matsushita MN10300
- enumerator MN10200 = 90¶
Matsushita MN10200
- enumerator PJ = 91¶
picoJava
- enumerator OPENRISC = 92¶
OpenRISC 32-bit embedded processor
- enumerator ARC_COMPACT = 93¶
ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)
- enumerator XTENSA = 94¶
Tensilica Xtensa Architecture
- enumerator VIDEOCORE = 95¶
Alphamosaic VideoCore processor
- enumerator TMM_GPP = 96¶
Thompson Multimedia General Purpose Processor
- enumerator NS32K = 97¶
National Semiconductor 32000 series
- enumerator TPC = 98¶
Tenor Network TPC processor
- enumerator SNP1K = 99¶
Trebia SNP 1000 processor
- enumerator ST200 = 100¶
STMicroelectronics (www.st.com) ST200
- enumerator IP2K = 101¶
Ubicom IP2xxx microcontroller family
- enumerator MAX = 102¶
MAX Processor
- enumerator CR = 103¶
National Semiconductor CompactRISC microprocessor
- enumerator F2MC16 = 104¶
Fujitsu F2MC16
- enumerator MSP430 = 105¶
Texas Instruments embedded microcontroller msp430
- enumerator BLACKFIN = 106¶
Analog Devices Blackfin (DSP) processor
- enumerator SE_C33 = 107¶
S1C33 Family of Seiko Epson processors
- enumerator SEP = 108¶
Sharp embedded microprocessor
- enumerator ARCA = 109¶
Arca RISC Microprocessor
- enumerator UNICORE = 110¶
Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University
- enumerator EXCESS = 111¶
eXcess: 16/32/64-bit configurable embedded CPU
- enumerator DXP = 112¶
Icera Semiconductor Inc. Deep Execution Processor
- enumerator ALTERA_NIOS2 = 113¶
Altera Nios II soft-core processor
- enumerator CRX = 114¶
National Semiconductor CompactRISC CRX
- enumerator XGATE = 115¶
Motorola XGATE embedded processor
- enumerator C166 = 116¶
Infineon C16x/XC16x processor
- enumerator M16C = 117¶
Renesas M16C series microprocessors
- enumerator DSPIC30F = 118¶
Microchip Technology dsPIC30F Digital Signal
- enumerator CE = 119¶
Freescale Communication Engine RISC core
- enumerator M32C = 120¶
Renesas M32C series microprocessors
- enumerator TSK3000 = 131¶
Altium TSK3000 core
- enumerator RS08 = 132¶
Freescale RS08 embedded processor
- enumerator SHARC = 133¶
Analog Devices SHARC family of 32-bit DSP
- enumerator ECOG2 = 134¶
Cyan Technology eCOG2 microprocessor
- enumerator SCORE7 = 135¶
Sunplus S+core7 RISC processor
- enumerator DSP24 = 136¶
New Japan Radio (NJR) 24-bit DSP Processor
- enumerator VIDEOCORE3 = 137¶
Broadcom VideoCore III processor
- enumerator LATTICEMICO32 = 138¶
RISC processor for Lattice FPGA architecture
- enumerator SE_C17 = 139¶
Seiko Epson C17 family
- enumerator TI_C6000 = 140¶
The Texas Instruments TMS320C6000 DSP family
- enumerator TI_C2000 = 141¶
The Texas Instruments TMS320C2000 DSP family
- enumerator TI_C5500 = 142¶
The Texas Instruments TMS320C55x DSP family
- enumerator MMDSP_PLUS = 160¶
STMicroelectronics 64bit VLIW Data Signal Processor
- enumerator CYPRESS_M8C = 161¶
Cypress M8C microprocessor
- enumerator R32C = 162¶
Renesas R32C series microprocessors
- enumerator TRIMEDIA = 163¶
NXP Semiconductors TriMedia architecture family
- enumerator HEXAGON = 164¶
Qualcomm Hexagon processor
- enumerator M8051 = 165¶
Intel 8051 and variants
- enumerator STXP7X = 166¶
STMicroelectronics STxP7x family of configurable
- enumerator NDS32 = 167¶
- enumerator ECOG1 = 168¶
Cyan Technology eCOG1X family
- enumerator ECOG1X = 168¶
Cyan Technology eCOG1X family
- enumerator MAXQ30 = 169¶
Dallas Semiconductor MAXQ30 Core Micro-controllers
- enumerator XIMO16 = 170¶
New Japan Radio (NJR) 16-bit DSP Processor
- enumerator MANIK = 171¶
M2000 Reconfigurable RISC Microprocessor
- enumerator CRAYNV2 = 172¶
Cray Inc. NV2 vector architecture
- enumerator RX = 173¶
Renesas RX family
- enumerator METAG = 174¶
Imagination Technologies META processor
- enumerator MCST_ELBRUS = 175¶
MCST Elbrus general purpose hardware architecture
- enumerator ECOG16 = 176¶
Cyan Technology eCOG16 family
- enumerator CR16 = 177¶
National Semiconductor CompactRISC CR16 16-bit
- enumerator ETPU = 178¶
Freescale Extended Time Processing Unit
- enumerator SLE9X = 179¶
Infineon Technologies SLE9X core
- enumerator L10M = 180¶
Intel L10M
- enumerator K10M = 181¶
Intel K10M
- enumerator AARCH64 = 183¶
ARM AArch64
- enumerator AVR32 = 185¶
Atmel Corporation 32-bit microprocessor family
- enumerator STM8 = 186¶
STMicroeletronics STM8 8-bit microcontroller
- enumerator TILE64 = 187¶
Tilera TILE64 multicore architecture family
- enumerator TILEPRO = 188¶
Tilera TILEPro multicore architecture family
- enumerator CUDA = 190¶
NVIDIA CUDA architecture
- enumerator TILEGX = 191¶
Tilera TILE-Gx multicore architecture family
- enumerator CLOUDSHIELD = 192¶
CloudShield architecture family
- enumerator COREA_1ST = 193¶
KIPO-KAIST Core-A 1st generation processor family
- enumerator COREA_2ND = 194¶
KIPO-KAIST Core-A 2nd generation processor family
- enumerator ARC_COMPACT2 = 195¶
Synopsys ARCompact V2
- enumerator OPEN8 = 196¶
Open8 8-bit RISC soft processor core
- enumerator RL78 = 197¶
Renesas RL78 family
- enumerator VIDEOCORE5 = 198¶
Broadcom VideoCore V processor
- enumerator M78KOR = 199¶
Renesas 78KOR family
- enumerator M56800EX = 200¶
Freescale 56800EX Digital Signal Controller (DSC)
- enumerator BA1 = 201¶
Beyond BA1 CPU architecture
- enumerator BA2 = 202¶
Beyond BA2 CPU architecture
- enumerator XCORE = 203¶
XMOS xCORE processor family
- enumerator MCHP_PIC = 204¶
Microchip 8-bit PIC(r) family
- enumerator INTEL205 = 205¶
Reserved by Intel
- enumerator INTEL206 = 206¶
Reserved by Intel
- enumerator INTEL207 = 207¶
Reserved by Intel
- enumerator INTEL208 = 208¶
Reserved by Intel
- enumerator INTEL209 = 209¶
Reserved by Intel
- enumerator KM32 = 210¶
KM211 KM32 32-bit processor
- enumerator KMX32 = 211¶
KM211 KMX32 32-bit processor
- enumerator KMX16 = 212¶
KM211 KMX16 16-bit processor
- enumerator KMX8 = 213¶
KM211 KMX8 8-bit processor
- enumerator KVARC = 214¶
KM211 KVARC processor
- enumerator CDP = 215¶
Paneve CDP architecture family
- enumerator COGE = 216¶
Cognitive Smart Memory Processor
- enumerator COOL = 217¶
iCelero CoolEngine
- enumerator NORC = 218¶
Nanoradio Optimized RISC
- enumerator CSR_KALIMBA = 219¶
CSR Kalimba architecture family
- enumerator AMDGPU = 224¶
AMD GPU architecture
- enumerator RISCV = 243¶
RISC-V
- enumerator BPF = 247¶
eBPF Filter
- enumerator CSKY = 252¶
C-SKY
- enumerator LOONGARCH = 258¶
LoongArch
- enumerator ALPHA_ALT = 0x9026¶
- enumerator NONE = 0¶
Processor Flags¶
- enum class LIEF::ELF::PROCESSOR_FLAGS : uint64_t¶
Values:
- enumerator ARM_EABI_UNKNOWN = 0x00000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_SOFT_FLOAT = 0x00000200 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_VFP_FLOAT = 0x00000400 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_VER1 = 0x01000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_VER2 = 0x02000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_VER3 = 0x03000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_VER4 = 0x04000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_VER5 = 0x05000000 | (PF_ARM_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_MACH_V2 = 0x00000001 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_MACH_V3 = 0x00000002 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_MACH_V4 = 0x00000003 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_MACH_V5 = 0x00000004 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_ISA_V2 = 0x00000010 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_ISA_V3 = 0x00000020 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_ISA_V4 = 0x00000030 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator HEXAGON_ISA_V5 = 0x00000040 | (PF_HEX_ID << PFLAGS_BIT)¶
- enumerator LOONGARCH_ABI_SOFT_FLOAT = 0x1 | (PF_LOONGARCH_ID << PFLAGS_BIT)¶
- enumerator LOONGARCH_ABI_SINGLE_FLOAT = 0x2 | (PF_LOONGARCH_ID << PFLAGS_BIT)¶
- enumerator LOONGARCH_ABI_DOUBLE_FLOAT = 0x3 | (PF_LOONGARCH_ID << PFLAGS_BIT)¶
- enumerator MIPS_NOREORDER = 0x00000001 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_PIC = 0x00000002 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_CPIC = 0x00000004 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ABI2 = 0x00000020 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_32BITMODE = 0x00000100 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_FP64 = 0x00000200 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_NAN2008 = 0x00000400 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ABI_O32 = 0x00001000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ABI_O64 = 0x00002000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ABI_EABI32 = 0x00003000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ABI_EABI64 = 0x00004000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_3900 = 0x00810000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_4010 = 0x00820000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_4100 = 0x00830000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_4650 = 0x00850000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_4120 = 0x00870000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_4111 = 0x00880000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_SB1 = 0x008a0000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_OCTEON = 0x008b0000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_XLR = 0x008c0000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_OCTEON2 = 0x008d0000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_OCTEON3 = 0x008e0000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_5400 = 0x00910000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_5900 = 0x00920000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_5500 = 0x00980000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_9000 = 0x00990000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_LS2E = 0x00a00000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_LS2F = 0x00a10000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MACH_LS3A = 0x00a20000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_MICROMIPS = 0x02000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_ASE_M16 = 0x04000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_ASE_MDMX = 0x08000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_1 = 0x00000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_2 = 0x10000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_3 = 0x20000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_4 = 0x30000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_5 = 0x40000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_32 = 0x50000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_64 = 0x60000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_32R2 = 0x70000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_64R2 = 0x80000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_32R6 = 0x90000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator MIPS_ARCH_64R6 = 0xa0000000 | (PF_MIPS_ID << PFLAGS_BIT)¶
- enumerator RISCV_RVC = 0x00000001 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_SOFT = 0x00000000 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_SINGLE = 0x00000002 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_DOUBLE = 0x00000004 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_QUAD = 0x00000006 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_RVE = 0x00000008 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator RISCV_FLOAT_ABI_TSO = 0x00000010 | (PF_RISCV_ID << PFLAGS_BIT)¶
- enumerator ARM_EABI_UNKNOWN = 0x00000000 | (PF_ARM_ID << PFLAGS_BIT)¶