Class which parses and transforms an ELF file into a ELF::Binary object.
Subclassed by LIEF::OAT::Parser
Public Functions
Public Static Functions
Parse an ELF file and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols
file – [in] Path to the ELF binary
conf – [in] Optional configuration for the parser
LIEF::ELF::Binary as a unique_ptr
Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
data – [in] Raw ELF as a std::vector of uint8_t
conf – [in] Optional configuration for the parser
Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
stream – [in] The stream which wraps the ELF binary
conf – [in] Optional configuration for the parser
Public Static Attributes
Friends
This structure is used to tweak the ELF Parser (ELF::Parser)
Public Types
Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols
Values:
Automatic detection
Count based on sections (not very reliable)
Count based on hash table (reliable)
Count based on PLT/GOT relocations (very reliable but not accurate)
Public Members
Whether relocations (including plt-like relocations) should be parsed.
Whether dynamic symbols (those from .dynsym) should be parsed.
Whether debug symbols (those from .symtab) should be parsed.
Whether versioning symbols should be parsed.
Whether ELF notes information should be parsed.
Whether the overlay data should be parsed.
The method used to count the number of dynamic symbols
Public Static Functions
This returns a ParserConfig object configured to process all the ELF elements.
Class which represents an ELF binary.
Subclassed by LIEF::OAT::Binary
Public Types
This enum describes the different ways to relocate the segments table.
Values:
Defer the choice of the layout to LIEF.
The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.
The new segments table is relocated right after the first bss-like segment.
The new segments table is relocated at the end of the binary.
The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.
Iterator which outputs Note& object.
Iterator which outputs const Note& object.
Internal container for storing SymbolVersionRequirement.
Iterator which outputs SymbolVersionRequirement& object.
Iterator which outputs const SymbolVersionRequirement& object.
Internal container for storing SymbolVersionDefinition.
Iterator which outputs SymbolVersionDefinition& object.
Iterator which outputs const SymbolVersionDefinition& object.
Internal container for storing ELF’s Segment.
Iterator which outputs Segment& object.
Iterator which outputs const Segment& object.
Internal container for storing ELF’s DynamicEntry.
Iterator which outputs DynamicEntry& object.
Iterator which outputs const DynamicEntry& object.
Internal container for storing ELF’s SymbolVersion.
Iterator which outputs SymbolVersion& object.
Iterator which outputs const SymbolVersion& object.
Internal container for storing ELF’s Relocation.
Iterator which outputs plt/got Relocation& object.
Iterator which outputs plt/got const Relocation& object.
Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs Relocation& object found in object files (.o)
Iterator which outputs const Relocation& object found in object files (.o)
Iterator which outputs Relocation& object.
Iterator which outputs const Relocation& object.
Iterator which outputs the Dynamic Symbol& object.
Iterator which outputs the Dynamic const Symbol& object.
Iterator which outputs the static/debug Symbol& object.
Iterator which outputs the static/debug const Symbol& object.
Iterator which outputs static and dynamic Symbol& object.
Iterator which outputs static and dynamic const Symbol& object.
Iterator which outputs exported Symbol& object.
Iterator which outputs exported const Symbol& object.
Iterator which outputs imported Symbol& object.
Iterator which outputs imported const Symbol& object.
Internal container for storing ELF’s Section.
Iterator which outputs Section& object.
Iterator which outputs const Section& object.
Public Functions
Return Elf header .
Return the last offset used in binary according to sections table.
Return the last offset used in binary according to segments table.
Return the next virtual address available.
Return an iterator over the binary’s sections.
Return the binary’s entrypoint.
Return binary’s segments.
Return binary’s dynamic entries.
Add the given dynamic entry and return the new entry.
Remove the given dynamic entry.
Remove all dynamic entries with the given tag.
Remove the given section. The clear parameter can be used to zeroize the original content beforehand.
section – [in] The section to remove
clear – [in] Whether zeroize the original content
Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.
Return symbols which are exported by the binary.
Return symbols which are imported by the binary.
Return the debug symbols from the .symtab section.
Return the symbol versions.
Return symbols version definition.
Return Symbol version requirement.
Return dynamic relocations.
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related
See: add_pltgot_relocation
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
See also: add_dynamic_relocation
Add relocation for object file (.o)
The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.
If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.
Return plt.got relocations.
Return relocations used in an object file (*.o)
Return all relocations present in the binary.
Return relocation associated with the given address. It returns a nullptr if it is not found.
Return relocation associated with the given Symbol It returns a nullptr if it is not found.
Return relocation associated with the given Symbol name It returns a nullptr if it is not found.
true if GNU hash is used
See also
Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.
true if SYSV hash is used
See also
Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.
Check if a section with the given name exists in the binary.
Check if a section that handles the given offset exists.
Check if a section that handles the given virtual address exists.
Return Section with the given name. If the section can’t be found, it returns a nullptr.
Return the .text section. If the section can’t be found, it returns a nullptr.
Return the .dynamic section. If the section can’t be found, it returns a nullptr.
Return the hash section. If the section can’t be found, it returns a nullptr.
Return section which holds the symtab symbols. If the section can’t be found, it returns a nullptr.
Return program image base. For instance 0x40000
To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset
Return the size of the mapped binary.
Check if the binary uses a loader (also named linker or interpreter)
See also
Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.
See also
Change the interpreter.
Return an iterator on both static and dynamic symbols.
Export the given symbol and create it if it doesn’t exist.
Export the symbol with the given name and create it if it doesn’t exist.
Check if the symbol with the given name exists in the dynamic symbols table.
Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.
Check if the symbol with the given name exists in the symtab symbol table.
Get the symtab symbol from the given name Return a nullptr if it can’t be found.
Return list of the strings used by the ELF binary.
Basically, this function looks for string in the .roadata section
Remove symbols with the given name in both:
dynamic symbols
symtab symbols
Remove symtabl symbols with the given name.
Remove dynamic symbols with the given name.
Remove the given symbol from the dynamic symbols table.
As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol
Return the address of the given function name.
Return the address of the given function name.
func_name – [in] The function’s name target
demangled – [in] Use the demangled name
Add a new section in the binary.
This function requires a well-formed ELF binary
section – [in] The section object to insert
loaded – [in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment
The section added. The size and the virtual address might change.
Add a dynamic symbol with the associated SymbolVersion.
Create a symbol for the function at the given address and export it.
Add a library as dependency.
Remove the given library from the dependencies.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Check if the given library name exists in the current binary.
Add a new segment in the binary.
The segment is inserted at the end
This function requires a well-formed ELF binary
The segment added. Virtual address and File Offset might change.
Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.
Warning
The original_segment is no longer valid after this function
Patch the content at virtual address address with patch_value.
address – [in] Address to patch
patch_value – [in] Patch to apply
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the address with the given value.
address – [in] Address to patch
patch_value – [in] Patch to apply
size – [in] Size of the value in bytes (1, 2, … 8)
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the imported symbol with the address
symbol – [in] Imported symbol to patch
address – [in] New address
Patch the imported symbol’s name with the address
symbol_name – [in] Imported symbol’s name to patch
address – [in] New address
Strip the binary by removing symtab symbols.
Remove a binary’s section.
name – [in] The name of the section to remove
clear – [in] Whether zeroize the original content
Reconstruct the binary object and write it in filename
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
filename – Path for the written ELF binary
Reconstruct the binary object with the given config and write it in filename
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
filename – Path for the written ELF binary
config – Builder configuration
Reconstruct the binary object and write it in os stream.
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
os – Output stream for the written ELF binary
Reconstruct the binary object with the given config and write it in os stream.
os – Output stream for the written ELF binary
config – Builder configuration
Reconstruct the binary object and return its content as a byte vector.
Convert a virtual address to a file offset.
Convert the given offset into a virtual address.
offset – [in] The offset to convert.
slide – [in] If not 0, it will replace the default base address (if any)
Check if the binary has been compiled with -fpie -pie flags.
To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)
Check if the binary uses the NX protection (Non executable stack)
Symbol index in the dynamic symbol table or -1 if the symbol does not exist.
Symbol index from the .symtab section or -1 if the symbol is not present.
Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.
Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.
Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.
Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.
Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.
Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.
Check if an ELF::DynamicEntry associated with the given tag exists.
Check if ELF::Segment associated with the given type exists.
Check if a ELF::Section associated with the given type exists.
Return the content located at virtual address.
Method associated with the visitor pattern.
Apply the given permutation on the dynamic symbols table.
List of binary constructors (typically, the functions located in the .init_array)
List of the binary destructors (typically, the functions located in the .fini_array)
List of the functions found the in the binary.
true if the binary embeds notes
Return an iterator over the ELF’s LIEF::ELF::Note.
See also
has_note
Return the last offset used by the ELF binary according to both: the sections table and the segments table.
True if data are present at the end of the binary.
Overlay data (if any)
Force relocating the segments table in a specific way.
This function can be used to enforce a specific relocation of the segments table.
type – [in] The relocation type to apply
The offset of the new segments table or 0 if it fails with the given method.
Return the array defined by the given tag (e.g. DynamicEntry::TAG::INIT_ARRAY) with relocations applied (if any)
True if the current ELF is targeting Android.
Find the index of the section given in the first parameter.
Find the index of the section with the name given in the first parameter.
Class which represents the ELF’s header. This class mirrors the raw ELF Elfxx_Ehdr structure.
Public Types
e_ident size and indices.
Values:
File identification index.
File identification index.
File identification index.
File identification index.
File class.
Data encoding.
File version.
OS/ABI identification.
ABI version.
Start of padding bytes.
Number of bytes in e_ident.
The type of the underlying ELF file. This enum matches the semantic of ET_NONE, ET_REL, …
Values:
Can’t be determined.
Relocatable file (or object file)
non-pie executable
Shared library or a pie-executable.
Core dump file.
Match the result of Elfxx_Ehdr.e_version
Values:
Invalid ELF version.
Current version (default)
Match the result of Elfxx_Ehdr.e_ident[EI_CLASS]
Values:
Invalid class.
32-bit objects
Match the result Elfxx_Ehdr.e_ident[EI_OSABI]
Values:
UNIX System V ABI.
HP-UX operating system.
NetBSD.
GNU/Linux.
Historical alias for ELFOSABI_GNU.
GNU/Hurd.
Solaris.
AIX.
IRIX.
FreeBSD.
TRU64 UNIX.
Novell Modesto.
OpenBSD.
OpenVMS.
Hewlett-Packard Non-Stop Kernel.
AROS.
FenixOS.
Nuxi CloudABI.
Bare-metal TMS320C6000.
AMD HSA runtime.
Linux TMS320C6000.
ARM.
Match the result Elfxx_Ehdr.e_ident[EI_DATA]
Values:
Invalid data encoding.
2’s complement, little endian
Public Functions
Executable entrypoint.
Offset of the programs table (also known as segments table)
Offset of the sections table.
Processor-specific flags.
Size of the current header (i.e. sizeof(Elfxx_Ehdr)) This size should be 64 for an ELF64 binary and 52 for an ELF32.
Return the size of a program header (i.e. sizeof(Elfxx_Phdr)) This size should be 56 for an ELF64 binary and 32 for an ELF32.
Return the number of segments.
Return the size of a section header (i.e. sizeof(Elfxx_Shdr)) This size should be 64 for a ELF64 binary and 40 for an ELF32.
Return the number of sections.
Warning
This value could differ from the real number of sections present in the binary. It must be taken as an indication
Return the section’s index which contains sections’ names.
Return the ELF identity as an std::array
Identifies the version of the ABI for which the object is prepared.
ABI Version.
Class wich represents an ELF Section.
Public Types
Values:
No associated section (inactive entry).
Program-defined contents.
String table.
Relocation entries; explicit addends.
Information for dynamic linking.
Information about the file.
Data occupies no space in the file.
Relocation entries; no explicit addends.
Reserved.
Pointers to initialization functions.
Pointers to termination functions.
Pointers to pre-init functions.
Indices for SHN_XINDEX entries.
Relocation entries; only offsets.
Packed relocations (Android specific).
Packed relocations (Android specific).
This section is used to mark symbols as address-significant.
New relr relocations (Android specific).
Object attributes.
GNU-style hash table.
GNU version definitions.
GNU version references.
GNU symbol versions table.
Exception Index table
BPABI DLL dynamic linking pre-emption map
Object file compatibility attributes
Link editor is to sort the entries in this section based on their sizes
Unwind information
Register usage information
General options
ABI information.
Values:
The data in this section may be merged.
The data in this section is null-terminated strings.
A field in this section holds a section header table index.
Adds special ordering requirements for link editors.
This section requires special OS-specific processing to avoid incorrect behavior
This section is a member of a section group.
This section holds Thread-Local Storage.
Public Functions
Set section content.
section’s size (size in the binary, not the virtual size)
Change the section size.
Offset in the binary.
Original size of the section’s data.
This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data
Section information. The meaning of this value depends on the section’s type.
This function returns the size of an element in the case of a section that contains an array.
For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeoe(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.
Index to another section.
Return a stream over the content of this section.
Public Static Functions
Public Static Attributes
Class which represents the ELF segments.
Public Types
Values:
Unused segment.
Loadable segment.
Dynamic linking information.
Interpreter pathname.
Auxiliary information.
Reserved.
The program header table itself.
The thread-local storage template.
Indicates stack executability.
GNU property
Read-only after relocation.
Public Functions
The file offset of the data associated with this segment.
The virtual address of the segment.
The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.
Usually this value matches virtual_address
The file size of the data associated with this segment.
The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.
The offset alignment of the segment.
The raw data associated with this segment.
Check if the current segment wraps the given ELF::Section.
Check if the current segment wraps the given section’s name.
Iterator over the sections wrapped by this segment.
Public Static Functions
Public Static Attributes
Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.
Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject
Public Types
Values:
Marks end of dynamic array.
String table offset of needed library.
Size of relocation entries in PLT.
Address associated with linkage table.
Address of symbolic hash table.
Address of dynamic string table.
Address of dynamic symbol table.
Address of relocation table (Rela entries).
Size of Rela relocation table.
Size of a Rela relocation entry.
Total size of the string table.
Size of a symbol table entry.
Address of initialization function.
Address of termination function.
String table offset of a shared objects name.
String table offset of library search path.
Changes symbol resolution algorithm.
Address of relocation table (Rel entries).
Size of Rel relocation table.
Size of a Rel relocation entry.
Type of relocation entry used for linking.
Reserved for debugger.
Relocations exist for non-writable segments.
Address of relocations associated with PLT.
Process all relocations before execution.
Pointer to array of initialization functions.
Pointer to array of termination functions.
Size of DT_INIT_ARRAY.
Size of DT_FINI_ARRAY.
String table offset of lib search path.
Flags.
Pointer to array of preinit functions.
Size of the DT_PREINIT_ARRAY array.
Address of SYMTAB_SHNDX section
Total size of RELR relative relocations
Address of RELR relative relocations
Size of one RELR relative relocaction
Reference to the GNU hash table.
ELF32_Rela count.
ELF32_Rel count.
Flags_1.
The address of .gnu.version section.
The address of the version definition table.
The number of entries in DT_VERDEF.
The address of the version Dependency table.
The number of entries in DT_VERNEED.
The offset of packed relocation data (older version < M) (Android specific).
The size of packed relocation data in bytes (older version < M) (Android specific).
The offset of packed relocation data (Android specific).
The size of packed relocation data in bytes (Android specific).
The offset of packed relocation data (Android specific).
The size of packed relocation data in bytes (Android specific).
The offset of new relr relocation data (Android specific).
The size of nre relr relocation data in bytes (Android specific).
The size of a new relr relocation entry (Android specific).
Specifies the relative count of new relr relocation entries (Android specific).
32 bit version number for runtime linker interface.
Index of first external dynamic symbol not referenced locally.
Index of first dynamic symbol in global offset table.
Number of page table entries in global offset table.
Address of run time loader map, used for debugging.
Number of entries in DT_MIPS_DELTA_INSTANCE.
Number of entries in DT_MIPS_DELTA_CLASSSYM.
The GOT index of the first PTE for a segment
The GOT index of the first PTE for a local symbol
The GOT index of the first PTE for a hidden symbol
The GOT index of the first PTE for a protected symbol
Address of .MIPS.options. */ MIPS_INTERFACE = MIPS_DISC + 0x7000002A, /**< Address of .interface.
Size of rld_text_resolve function stored in the GOT.
Default suffix of DSO to be added by rld on dlopen() calls.
Public Functions
Return the entry’s value.
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Public Static Functions
Public Static Attributes
Friends
Class which represents a DT_NEEDED entry in the dynamic table.
This kind of entry is usually used to create library dependency.
Public Functions
Return the library associated with this entry (e.g. libc.so.6)
Public Static Functions
Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).
Public Functions
Constructor from (run)path.
Constructor from a list of paths.
Runpath raw value.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)
Public Functions
Constructor from a list of paths.
The actual rpath as a string.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class that represent an Array in the dynamic table. This entry is associated with constructors:
DT_PREINIT_ARRAY
DT_INIT_ARRAY
DT_FINI_ARRAY
The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.
Public Types
Public Functions
Insert the given function at pos
Append the given function.
Remove the given function.
Number of function registred in this array.
Public Static Functions
Public Types
Values:
The object may reference $ORIGIN.
Search the shared lib before searching the exe.
Relocations may modify a non-writable segment.
Process all relocations on load.
Reject attempts to load dynamically.
Public Functions
Return flags as a list of integers.
Public Static Functions
Public Static Attributes
Class that represents an ELF relocation.
Public Types
The purpose of a relocation defines how this relocation is used by the loader.
Values:
The relocation is associated with the PLT/GOT resolution.
The relocation is used for regulard data/code relocation.
The relocation is used in an object file.
Values:
The relocation is using the regular Elf_Rel structure.
The relocation is using the regular Elf_Rela structure.
The relocation is using the relative relocation format.
The relocation is using the packed Android-SLEB128 format.
Public Functions
Copy constructor.
Warning
When this constructor is invoked, referenced sections or symbols are discarded. This means that on the copied Relocation, Relocation::section, Relocation::symbol and Relocation::symbol_table are set to a nullptr.
Copy assignment operator.
Please read the notice of the copy constructor
Additional value that can be involved in the relocation processing.
Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)
Check if the relocation uses the implicit addend (i.e. not present in the ELF structure)
True if the relocation is using the relative encoding.
True if the relocation is using the Android packed relocation format.
Relocation info which contains, for instance, the symbol index.
(re)Compute the raw r_info attribute based on the given ELF class
Return the size (in bits) of the value associated with this relocation Return -1 if the size can’t be determined.
True if the current relocation is associated with a symbol.
True if the relocation has an associated section.
Try to resolve the value of the relocation such as *address() = resolve()
Public Static Functions
Public Static Attributes
Friends
Class which represents an ELF symbol.
Public Types
Values:
Local symbol.
Global symbol.
Weak symbol.
Unique symbol.
Type of the symbol. This enum matches the STT_xxx values of the ELF specs.
Values:
Local, absolute symbol that refers to a file.
An uninitialized common block.
Thread local data object.
GNU indirect function.
Visibility of the symbol. This enum matches the STV_xxx values of the official ELF specs.
Values:
Visibility is specified by binding type.
Defined by processor supplements.
Not visible to other components.
Visible in other components but not preemptable.
Public Functions
The symbol’s type provides a general classification for the associated entity.
This member specifies the symbol’s type and binding attributes.
Alias for visibility()
ELF::Section index associated with the symbol.
Symbol visibility.
This member has slightly different interpretations:
In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON
In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.
In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.
Symbol size.
Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.
See also
Check if this symbols has a symbol version .
Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.
Symbol’s unmangled name. If not available, it returns an empty string.
Check if the current symbol is exported.
Set whether or not the symbol is exported.
Check if the current symbol is imported.
Set whether or not the symbol is imported.
True if the symbol is a static one.
True if the symbol represent a function.
True if the symbol represent a variable.
Public Static Functions
Class which represents an entry defined in the DT_VERSYM dynamic entry.
Public Functions
Value associated with the symbol.
If the given SymbolVersion hasn’t Auxiliary version:
0 means Local
1 means Global
Whether the current SymbolVersion has an auxiliary one.
SymbolVersionAux associated with the current Version if any, or a nullptr.
Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.
On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement
Public Static Functions
Generate a local SymbolVersion.
Generate a global SymbolVersion.
Friends
Class which represents an Auxiliary Symbol version.
Subclassed by LIEF::ELF::SymbolVersionAuxRequirement
Public Functions
Friends
Class which represents an entry defined in DT_VERDEF or .gnu.version_d
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Version information.
Version index.
Numeric value used as an index in the LIEF::ELF::SymbolVersion table
Hash value of the symbol’s name (using ELF hash function)
SymbolVersionAux entries.
Friends
Class which represents an entry in the DT_VERNEED or .gnu.version_r table.
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Number of auxiliary entries.
Auxiliary entries as an iterator over SymbolVersionAuxRequirement.
Return the library name associated with this requirement (e.g. libc.so.6)
Add a version auxiliary requirement to the existing list.
Friends
Public Functions
Hash value of the dependency name (use ELF hashing function)
Bitmask of flags.
It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.
Friends
Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.
Public Functions
Return the number of buckets.
See also
Index of the first symbol in the dynamic symbols table which accessible with the hash table.
Shift count used in the bloom filter.
Number of bloom filters used. It must be a power of 2.
Bloom filters.
Hash buckets.
Hash values.
Check if the given hash passes the bloom filter.
Check if the given hash passes the bucket filter.
Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.
Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.
Class which represents the SYSV hash for the symbols resolution.
References:
http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/
https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
Public Functions
Return the number of buckets used.
Return the number of chain used.
Buckets values.
Chains values.
Class which represents an ELF note. This class can be instantiated using the static Note::create functions.
Subclassed by LIEF::ELF::AndroidIdent, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi, LIEF::ELF::NoteGnuProperty, LIEF::ELF::QNXStack
Public Types
LIEF representation of the ELF NT_ values.
Values:
Match NT_HWCAP: Synthetic hardware capabilities information.
Match NT_GNU_BUILD_ID: Unique build ID as generated by the GNU ld.
Match NT_GNU_GOLD_VERSION: The version of gold used to link.
Match NT_GNU_PROPERTY_TYPE_0: Program property note, as described in “Linux Extensions to the gABI”.
Crashpad note used by the Chromium project.
Coredump that wraps the elf_prstatus structure.
Coredump that wraps the elf_prpsinfo structure.
See: CorePrPsInfo
Coredump that contains a copy of all the auxiliary vectors (auxv)
See: CoreAuxv
Coredump that wraps the fpregset structure.
Coredump that wraps the psinfo structure.
Note that is specific to Android and that describes information such as the NDK version or the SDK build number.
See AndroidIdent
Container used to handle the description data.
Public Functions
Clone the current note and keep its polymorphic type.
Return the name of the note (also known as ‘owner’ )
Return the section name in which the note is or should be stored.
Return the type of the note. This type does not match the NT_ type value. For accessing the original NT_ value, check original_type()
The original NT_xxx integer value. The meaning of this value likely depends on the owner of the note.
Return the description associated with the note.
Change the description of the note.
Size of the raw note which includes padding.
Public Static Functions
Convert the raw integer note type into a TYPE according to the owner.
Try to determine the ELF section name associated with the TYPE provided in parameter.
Try to determine the owner’s name of the TYPE provided in parameter.
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process.
Public Functions
Clone the current note and keep its polymorphic type.
Friends
Public Functions
Initial part of the arguments.
Return the filename without the ending \x00
Return the args without the ending \x00
Public Members
Numeric process state.
printable character representing state
Whether the process is a zombie.
Nice value.
Process flag.
Process user ID.
Process group ID.
Process ID.
Process parent ID.
Process group.
Process session id.
Filename of the executable.
Class representing a core NT_FILE which describes the mapped files of the process.
Public Types
Public Functions
Clone the current note and keep its polymorphic type.
Number of coredump file entries.
Class representing core PrPsInfo object.
Public Functions
Clone the current note and keep its polymorphic type.
Return the pr_status_t structure.
The value of the register that holds the return value according to the calling convention.
Get the value for the given X86 register or return an error.
Get the value for the given X86_64 register or return an error.
Get the value for the given ARM register or return an error.
Get the value for the given AARCH64 register or return an error.
A list of the register values. This list is guarantee to be as long as the Registers::ARM::_COUNT or empty if it can’t be resolved. Thus, one can access a specific register with:
if (architecture() == ARCH::AARCH64) {
auto reg_vals = register_values()
if (!reg_vals.empty()) {
auto x20 = reg_vals[static_cast<size_t>(Register::AARCH64::X20)]
}
}
Friends
Public Types
Register for the x86 architecture (ARCH::I386).
Values:
Register for the x86-64 architecture (ARCH::X86_64).
Values:
Register for the ARM architecture (ARCH::ARM).
Values:
Register for the AARCH64 architecture (ARCH::AARCH64).
Values:
Class representing a core siginfo object.
Public Functions
Clone the current note and keep its polymorphic type.
Friends
Class representing core auxv object.
Public Types
Values:
End of vector
Entry should be ignored
File descriptor of program
Program headers for program
Size of program header entry
Number of program headers
System page size
Base address of interpreter
Flags
Entry point of program
Program is not ELF
Real uid
Effective uid
Real gid
Effective gid
String identifying platform.
Machine dependent hints about processor capabilities.
Frequency of times()
Used FPU control word.
Data cache block size.
Instruction cache block size.
Instruction cache block size.
Entry should be ignored.
Boolean, was exec setuid-like?.
String identifying real platform
Address of 16 random bytes
Extension of AT_HWCAP
Filename of executable
Filename of executable
Pointer to ELF header of system-supplied DSO.
Public Functions
Clone the current note and keep its polymorphic type.
A map of CoreAuxv::TYPE and the value.
Return the value associated with the provided TYPE or a lief_errors::not_found if the type is not present.
Class representing the “.note.android.ident” section.
Public Functions
Clone the current note and keep its polymorphic type.
Target SDK version (or 0 if it can’t be resolved)
NDK version used (or an empty string if it can’t be parsed)
NDK build number (or an empty string if it can’t be parsed)
Public Static Functions
Public Static Attributes
Friends
Class representing the QNX QNT_STACK note.
Public Functions
Clone the current note and keep its polymorphic type.
Size of the stack.
Size of the stack pre-allocated (upfront)
Whether the stack is executable.
Class that wraps the NT_GNU_ABI_TAG note.
Public Types
ABI recognized by this note.
Values:
Version type: (Major, Minor, Patch)
Public Functions
Clone the current note and keep its polymorphic type.
Public Static Functions
Class that wraps the NT_GNU_PROPERTY_TYPE_0 note.
Public Types
Public Functions
Clone the current note and keep its polymorphic type.
Find the property with the given type or return a nullptr
Return the properties as a list of Property.
Friends
This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note.
Subclassed by LIEF::ELF::AArch64Feature, LIEF::ELF::AArch64PAuth, LIEF::ELF::Generic, LIEF::ELF::Needed, LIEF::ELF::NoteNoCopyOnProtected, LIEF::ELF::StackSize, LIEF::ELF::X86Features, LIEF::ELF::X86ISA
Public Types
LIEF’s mirror types of the original GNU_PROPERTY_ values.
Values:
Mirror of GNU_PROPERTY_AARCH64_FEATURE_1_AND
Mirror of GNU_PROPERTY_AARCH64_FEATURE_PAUTH
Mirror of GNU_PROPERTY_STACK_SIZE
Mirror of GNU_PROPERTY_NO_COPY_ON_PROTECTED
Mirror of GNU_PROPERTY_X86_ISA_1_* and GNU_PROPERTY_X86_COMPAT_*
Mirror of GNU_PROPERTY_X86_FEATURE_*
This class represents a property which doesn’t have a concrete LIEF implementation.
Public Functions
The original raw type as an integer. This value might depends on the architecture and/or the file type.
Public Static Functions
This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND property.
Public Types
Public Functions
Public Static Functions
This class represents the GNU_PROPERTY_AARCH64_FEATURE_PAUTH property.
Note
If both: AArch64PAuth::platform and AArch64PAuth::version are set to 0, this means that the binary is incompatible with PAuth ABI extension.
Public Functions
64-bit value that specifies the platform vendor.
A 0 value is associated with an invalid platform while the value 1 is associated with a baremetal platform.
64-bit value that identifies the signing schema used by the ELF file.
Public Static Functions
This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols.
Public Functions
Public Static Functions
This class provides an interface over the GNU_PROPERTY_STACK_SIZE property.
This property can be used by the loader to raise the stack limit.
Public Functions
The indicated stack size.
Public Static Functions
This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes:
GNU_PROPERTY_X86_FEATURE_1_AND
GNU_PROPERTY_X86_FEATURE_2_USED
GNU_PROPERTY_X86_FEATURE_2_NEEDED
Public Types
Flag according to the _AND, _USED or _NEEDED suffixes.
Values:
For the original GNU_PROPERTY_X86_FEATURE_1_AND property.
For the original GNU_PROPERTY_X86_FEATURE_2_USED property.
For the original GNU_PROPERTY_X86_FEATURE_2_NEEDED property.
Features provided by these different properties.
Values:
List of the features as a pair of FLAG, FEATURE.
For instance, if the raw property is GNU_PROPERTY_X86_FEATURE_2_USED with a bitmask set to GNU_PROPERTY_X86_FEATURE_2_XSAVE, it generates the pair: FLAG::USED, FEATURE::XSAVE
Public Functions
List of the features.
Public Static Functions
This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes:
GNU_PROPERTY_X86_ISA_1_USED
GNU_PROPERTY_X86_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED
Public Types
Values:
Public Static Functions
Class which takes an ELF::Binary object and reconstructs a valid binary.
This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run).
Public Functions
Perform the build of the provided ELF binary.
Return the built ELF binary as a byte vector.
Write the built ELF binary in the filename given in parameter.
Write the built ELF binary in the stream os given in parameter.
Configuration options to tweak the building process.
Public Members
Rebuild DT_HASH.
Rebuild DT_STRTAB.
Rebuild PT_DYNAMIC segment.
Rebuild DT_FINI_ARRAY.
Rebuild DT_GNU_HASH.
Rebuild DT_INIT_ARRAY.
Rebuild PT_INTERPRETER.
Rebuild DT_JMPREL.
Disable note building since it can break the default layout.
Rebuild DT_PREINIT_ARRAY.
Rebuild DT_RELR.
Rebuild DT_ANDROID_REL[A].
Rebuild DT_REL[A].
Rebuild .symtab
Rebuild DT_VERDEF.
Rebuild DT_VERNEED.
Rebuild DT_VERSYM.
Rebuild DT_SYMTAB.
Rebuild the Coredump notes.
Check if the given file is an ELF one.
check if the raw data is a ELF file
Machine architectures See current registered ELF machine architectures at: http://www.sco.com/developers/gabi/latest/ch4.eheader.html
Values:
No machine
AT&T WE 32100
SPARC
Intel 386
Motorola 68000
Motorola 88000
Intel MCU
Intel 80860
MIPS R3000
IBM System/370
MIPS RS3000 Little-endian
Hewlett-Packard PA-RISC
Fujitsu VPP500
Enhanced instruction set SPARC
Intel 80960
PowerPC
PowerPC64
IBM System/390
IBM SPU/SPC
NEC V800
Fujitsu FR20
TRW RH-32
Motorola RCE
ARM
DEC Alpha
Hitachi SH
SPARC V9
Siemens TriCore
Argonaut RISC Core
Hitachi H8/300
Hitachi H8/300H
Hitachi H8S
Hitachi H8/500
Intel IA-64 processor architecture
Stanford MIPS-X
Motorola ColdFire
Motorola M68HC12
Fujitsu MMA Multimedia Accelerator
Siemens PCP
Sony nCPU embedded RISC processor
Denso NDR1 microprocessor
Motorola Star*Core processor
Toyota ME16 processor
STMicroelectronics ST100 processor
Advanced Logic Corp. TinyJ embedded processor family
AMD x86-64 architecture
Sony DSP Processor
Digital Equipment Corp. PDP-10
Digital Equipment Corp. PDP-11
Siemens FX66 microcontroller
STMicroelectronics ST9+ 8/16 bit microcontroller
STMicroelectronics ST7 8-bit microcontroller
Motorola MC68HC16 Microcontroller
Motorola MC68HC11 Microcontroller
Motorola MC68HC08 Microcontroller
Motorola MC68HC05 Microcontroller
Silicon Graphics SVx
STMicroelectronics ST19 8-bit microcontroller
Digital VAX
Axis Communications 32-bit embedded processor
Infineon Technologies 32-bit embedded processor
Element 14 64-bit DSP Processor
LSI Logic 16-bit DSP Processor
Donald Knuth’s educational 64-bit processor
Harvard University machine-independent object files
SiTera Prism
Atmel AVR 8-bit microcontroller
Fujitsu FR30
Mitsubishi D10V
Mitsubishi D30V
NEC v850
Mitsubishi M32R
Matsushita MN10300
Matsushita MN10200
picoJava
OpenRISC 32-bit embedded processor
ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)
Tensilica Xtensa Architecture
Alphamosaic VideoCore processor
Thompson Multimedia General Purpose Processor
National Semiconductor 32000 series
Tenor Network TPC processor
Trebia SNP 1000 processor
STMicroelectronics (www.st.com) ST200
Ubicom IP2xxx microcontroller family
MAX Processor
National Semiconductor CompactRISC microprocessor
Fujitsu F2MC16
Texas Instruments embedded microcontroller msp430
Analog Devices Blackfin (DSP) processor
S1C33 Family of Seiko Epson processors
Sharp embedded microprocessor
Arca RISC Microprocessor
Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University
eXcess: 16/32/64-bit configurable embedded CPU
Icera Semiconductor Inc. Deep Execution Processor
Altera Nios II soft-core processor
National Semiconductor CompactRISC CRX
Motorola XGATE embedded processor
Infineon C16x/XC16x processor
Renesas M16C series microprocessors
Microchip Technology dsPIC30F Digital Signal
Freescale Communication Engine RISC core
Renesas M32C series microprocessors
Altium TSK3000 core
Freescale RS08 embedded processor
Analog Devices SHARC family of 32-bit DSP
Cyan Technology eCOG2 microprocessor
Sunplus S+core7 RISC processor
New Japan Radio (NJR) 24-bit DSP Processor
Broadcom VideoCore III processor
RISC processor for Lattice FPGA architecture
Seiko Epson C17 family
The Texas Instruments TMS320C6000 DSP family
The Texas Instruments TMS320C2000 DSP family
The Texas Instruments TMS320C55x DSP family
STMicroelectronics 64bit VLIW Data Signal Processor
Cypress M8C microprocessor
Renesas R32C series microprocessors
NXP Semiconductors TriMedia architecture family
Qualcomm Hexagon processor
Intel 8051 and variants
STMicroelectronics STxP7x family of configurable
Cyan Technology eCOG1X family
Cyan Technology eCOG1X family
Dallas Semiconductor MAXQ30 Core Micro-controllers
New Japan Radio (NJR) 16-bit DSP Processor
M2000 Reconfigurable RISC Microprocessor
Cray Inc. NV2 vector architecture
Renesas RX family
Imagination Technologies META processor
MCST Elbrus general purpose hardware architecture
Cyan Technology eCOG16 family
National Semiconductor CompactRISC CR16 16-bit
Freescale Extended Time Processing Unit
Infineon Technologies SLE9X core
Intel L10M
Intel K10M
ARM AArch64
Atmel Corporation 32-bit microprocessor family
STMicroeletronics STM8 8-bit microcontroller
Tilera TILE64 multicore architecture family
Tilera TILEPro multicore architecture family
NVIDIA CUDA architecture
Tilera TILE-Gx multicore architecture family
CloudShield architecture family
KIPO-KAIST Core-A 1st generation processor family
KIPO-KAIST Core-A 2nd generation processor family
Synopsys ARCompact V2
Open8 8-bit RISC soft processor core
Renesas RL78 family
Broadcom VideoCore V processor
Renesas 78KOR family
Freescale 56800EX Digital Signal Controller (DSC)
Beyond BA1 CPU architecture
Beyond BA2 CPU architecture
XMOS xCORE processor family
Microchip 8-bit PIC(r) family
Reserved by Intel
Reserved by Intel
Reserved by Intel
Reserved by Intel
Reserved by Intel
KM211 KM32 32-bit processor
KM211 KMX32 32-bit processor
KM211 KMX16 16-bit processor
KM211 KMX8 8-bit processor
KM211 KVARC processor
Paneve CDP architecture family
Cognitive Smart Memory Processor
iCelero CoolEngine
Nanoradio Optimized RISC
CSR Kalimba architecture family
AMD GPU architecture
RISC-V
eBPF Filter
C-SKY
LoongArch
Values: