Package ghidra.app.util.bin.format.elf
Class ElfHeader
java.lang.Object
ghidra.app.util.bin.format.elf.ElfHeader
- All Implemented Interfaces:
StructConverter
A class to represent the Executable and Linking Format (ELF)
header and specification.
-
Field Summary
-
Constructor Summary
ConstructorDescriptionElfHeader
(ByteProvider provider, Consumer<String> errorConsumer) ConstructElfHeader
from byte provider -
Method Summary
Modifier and TypeMethodDescriptionlong
adjustAddressForPrelink
(long address) Adjust address offset for certain pre-linked binaries which do not adjust certain header fields (e.g., dynamic table address entries).short
e_ehsize()
This member holds the ELF header's size in bytes.long
e_entry()
This member gives the virtual address to which the system first transfers control, thus starting the process.int
e_flags()
This member holds processor-specific flags associated with the file.byte
This member identifies the target ABI version.byte
This member identifies the target operating system and ABI.short
This member's value specifies the required architecture for an individual file.short
This member holds the size in bytes of one entry in the file's program header table; all entries are the same size.long
e_phoff()
This member holds the program header table's file offset in bytes.short
This member holds the section header's size in bytes.long
e_shoff()
This member holds the section header table's file offset in bytes.int
This member holds the section header table index of the entry associated with the section name string table.short
e_type()
This member identifies the object file type; executable, shared object, etc.int
This member identifies the object file version, where "EV_NONE == Invalid Version" and "EV_CURRENT == Current Version" The value 1 signifies the original file format; extensions will create new versions with higher numbers.long
Inspect the Elf image and determine the default image base prior to any parse method being invoked (i.e., only the main Elf header structure has been parsed during initialization.Returns the byte providerString[]
Returns array of dynamic library names defined by DT_NEEDEDReturns the dynamic string table as defined in this ELF file.Returns the dynamic symbol table as defined in this ELF file.Returns the dynamic table defined by program header of type PT_DYNAMIC or the .dynamic program section.getDynamicType
(int type) protected HashMap
<Integer, ElfDynamicType> int
Get the Elf header structure component ordinal corresponding to the e_entry elementgetFlags()
Returns a string representation of the numeric flags field.long
Returns the image base of this ELF.Get the installed extension provider.Returns a string name of the processor specified in this ELF header.int
Get the Elf header structure component ordinal corresponding to the e_phoff elementgetProgramHeaderAt
(long virtualAddr) Returns the program header at the specified address, or null if no program header exists at that address.int
This member holds the number of entries in the program header table.Returns the program header with type of PT_PHDR.Returns the program headers as defined in this ELF file.getProgramHeaders
(int type) Returns the program headers with the specified type.getProgramHeaderType
(int type) protected HashMap
<Integer, ElfProgramHeaderType> getProgramLoadHeaderContaining
(long virtualAddr) Returns the PT_LOAD program header which loads a range containing the specified address, or null if not found.getProgramLoadHeaderContainingFileOffset
(long offset) Returns the PT_LOAD program header which loads a range containing the specified file offset, or null if not found.Returns the unconstrained binary reader (i.e., reads beyond EOF will return 0-bytes).getRelocationTable
(ElfSectionHeader relocSection) Returns the relocation table associated to the specified section header, or null if one does not exist.getRelocationTableAtOffset
(long fileOffset) Returns the relocation table located at the specified fileOffset, or null if one does not exist.Returns the relocation tables as defined in this ELF file.getSection
(String name) Returns the section header with the specified name, or null if no section exists with that name.getSectionAt
(long address) Returns the section header at the specified address, or null if no section exists at that address.getSectionHeaderContainingFileRange
(long fileOffset, long fileRangeLength) Returns the section header which fully contains the specified file offset range.int
This member holds the number of entries in the section header table.getSectionHeaderType
(int type) protected HashMap
<Integer, ElfSectionHeaderType> int
getSectionIndex
(ElfSectionHeader section) Returns the index of the specified section.getSectionLoadHeaderContaining
(long address) Returns the section header that loads/contains the specified address, or null if no section contains the address.Returns the section headers as defined in this ELF file.getSections
(int type) Returns the section headers with the specified type.int
Get the Elf header structure component ordinal corresponding to the e_shoff elementgetStringTable
(ElfSectionHeader section) Returns the string table associated to the specified section header.Returns the string tables as defined in this ELF file.getSymbolTable
(ElfSectionHeader symbolTableSection) Returns the symbol table associated to the specified section header.Returns the symbol tables as defined in this ELF file.boolean
is32Bit()
Returns true if this ELF was created for a 32-bit processor.boolean
is64Bit()
Returns true if this ELF was created for a 64-bit processor.boolean
Returns true if this ELF was created for a big endian processor.boolean
Returns true if this is an executable file.boolean
Returns true if this ELF was created for a little endian processor.boolean
Determine if the image has been pre-linked.boolean
Returns true if this is a relocatable file.boolean
isSectionLoaded
(ElfSectionHeader section) boolean
Returns true if this is a shared object file.void
parse()
Perform parse of all supported headers.protected void
Returns a structure datatype representing the contents of the implementor of this interface.long
unadjustAddressForPrelink
(long address) Unadjust address offset for certain pre-linked binaries which do not adjust certain header fields (e.g., dynamic table address entries).
-
Constructor Details
-
ElfHeader
ConstructElfHeader
from byte provider- Parameters:
provider
- byte providererrorConsumer
- error consumer- Throws:
ElfException
- if header parse failed
-
-
Method Details
-
getReader
Returns the unconstrained binary reader (i.e., reads beyond EOF will return 0-bytes).- Returns:
- the binary reader
-
getByteProvider
Returns the byte provider- Returns:
- the byte provider
-
parse
Perform parse of all supported headers.- Throws:
IOException
- if file IO error occurs
-
getLoadAdapter
Get the installed extension provider. If the parse method has not yet been invoked, the default adapter will be returned.- Returns:
- ELF load adapter
-
adjustAddressForPrelink
public long adjustAddressForPrelink(long address) Adjust address offset for certain pre-linked binaries which do not adjust certain header fields (e.g., dynamic table address entries). Standard GNU/Linux pre-linked shared libraries have adjusted header entries and this method should have no effect.- Parameters:
address
- unadjusted address offset- Returns:
- address with appropriate pre-link adjustment added
-
unadjustAddressForPrelink
public long unadjustAddressForPrelink(long address) Unadjust address offset for certain pre-linked binaries which do not adjust certain header fields (e.g., dynamic table address entries). This may be needed when updating a header address field which requires pre-link adjustment.- Parameters:
address
- prelink-adjusted address offset- Returns:
- address with appropriate pre-link adjustment subtracted
-
getProgramHeaderTypeMap
-
getSectionHeaderTypeMap
-
getProgramHeaderType
-
getSectionHeaderType
-
getDynamicTypeMap
-
getDynamicType
-
parseSectionHeaders
- Throws:
IOException
-
isBigEndian
public boolean isBigEndian()Returns true if this ELF was created for a big endian processor.- Returns:
- true if this ELF was created for a big endian processor
-
isLittleEndian
public boolean isLittleEndian()Returns true if this ELF was created for a little endian processor.- Returns:
- true if this ELF was created for a little endian processor
-
is32Bit
public boolean is32Bit()Returns true if this ELF was created for a 32-bit processor.- Returns:
- true if this ELF was created for a 32-bit processor
-
is64Bit
public boolean is64Bit()Returns true if this ELF was created for a 64-bit processor.- Returns:
- true if this ELF was created for a 64-bit processor
-
findImageBase
public long findImageBase()Inspect the Elf image and determine the default image base prior to any parse method being invoked (i.e., only the main Elf header structure has been parsed during initialization. The image base is the virtual address of the PT_LOAD program header with the smallest address or 0 if no program headers exist. By default, the image base address should be treated as a addressable unit offset.- Returns:
- preferred image base
-
getImageBase
public long getImageBase()Returns the image base of this ELF. The image base is the virtual address of the first PT_LOAD program header or 0 if no program headers. By default, the image base address should be treated as a addressable unit offset.s- Returns:
- the image base of this ELF
-
isPreLinked
public boolean isPreLinked()Determine if the image has been pre-linked. NOTE: Currently has very limited support. Certain pre-link cases can not be detected until after a full parse has been performed.- Returns:
- true if image has been pre-linked
-
isSectionLoaded
-
e_ehsize
public short e_ehsize()This member holds the ELF header's size in bytes.- Returns:
- the ELF header's size in bytes
-
e_entry
public long e_entry()This member gives the virtual address to which the system first transfers control, thus starting the process. If the file has no associated entry point, this member holds zero.- Returns:
- the virtual address to which the system first transfers control
-
e_flags
public int e_flags()This member holds processor-specific flags associated with the file. Flag names take the form EF_machine_flag.- Returns:
- the processor-specific flags associated with the file
- See Also:
-
e_machine
public short e_machine()This member's value specifies the required architecture for an individual file.- Returns:
- the required architecture for an individual file
- See Also:
-
e_ident_osabi
public byte e_ident_osabi()This member identifies the target operating system and ABI.- Returns:
- the target operating system and ABI
-
e_ident_abiversion
public byte e_ident_abiversion()This member identifies the target ABI version.- Returns:
- the target ABI version
-
e_phentsize
public short e_phentsize()This member holds the size in bytes of one entry in the file's program header table; all entries are the same size.- Returns:
- the size in bytes of one program header table entry
-
getProgramHeaderCount
public int getProgramHeaderCount()This member holds the number of entries in the program header table. Thus the product of e_phentsize and unsigned e_phnum gives the table's size in bytes. If original e_phnum equals PNXNUM (0xffff) an attempt will be made to obtained the extended size from section[0].sh_info field. If a file has no program header table, e_phnum holds the value zero.- Returns:
- the number of entries in the program header table
-
e_phoff
public long e_phoff()This member holds the program header table's file offset in bytes. If the file has no program header table, this member holds zero.- Returns:
- the program header table's file offset in bytes
-
e_shentsize
public short e_shentsize()This member holds the section header's size in bytes. A section header is one entry in the section header table; all entries are the same size.- Returns:
- the section header's size in bytes
-
getSectionHeaderCount
public int getSectionHeaderCount()This member holds the number of entries in the section header table. Thus the product of e_shentsize and unsigned e_shnum gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value zero.- Returns:
- the number of entries in the section header table
-
e_shoff
public long e_shoff()This member holds the section header table's file offset in bytes. If the file has no section header table, this member holds zero.- Returns:
- the section header table's file offset in bytes
-
e_shstrndx
public int e_shstrndx()This member holds the section header table index of the entry associated with the section name string table. If the file has no section name string table, this member holds the value SHN_UNDEF.- Returns:
- the section header table index of the entry associated with the section name string table
-
e_type
public short e_type()This member identifies the object file type; executable, shared object, etc.- Returns:
- the object file type
-
isRelocatable
public boolean isRelocatable()Returns true if this is a relocatable file.
e_type == NewElfHeaderConstants.ET_REL- Returns:
- true if this is a relocatable file
-
isExecutable
public boolean isExecutable()Returns true if this is an executable file.
e_type == NewElfHeaderConstants.ET_EXEC- Returns:
- true if this is a executable file
-
e_version
public int e_version()This member identifies the object file version, where "EV_NONE == Invalid Version" and "EV_CURRENT == Current Version" The value 1 signifies the original file format; extensions will create new versions with higher numbers. The value of EV_CURRENT, though given as 1 above, will change as necessary to reflect the current version number.- Returns:
- the object file version
-
getSections
Returns the section headers as defined in this ELF file.- Returns:
- the section headers as defined in this ELF file
-
getSections
Returns the section headers with the specified type. The array could be zero-length, but will not be null.- Parameters:
type
- section type- Returns:
- the section headers with the specified type
- See Also:
-
getSection
Returns the section header with the specified name, or null if no section exists with that name.- Parameters:
name
- the name of the requested section- Returns:
- the section header with the specified name
-
getSectionAt
Returns the section header at the specified address, or null if no section exists at that address.- Parameters:
address
- the address of the requested section- Returns:
- the section header with the specified address
-
getSectionLoadHeaderContaining
Returns the section header that loads/contains the specified address, or null if no section contains the address.- Parameters:
address
- the address of the requested section- Returns:
- the section header that contains the address
-
getSectionHeaderContainingFileRange
Returns the section header which fully contains the specified file offset range.- Parameters:
fileOffset
- file offsetfileRangeLength
- length of file range in bytes- Returns:
- section or null if not found
-
getSectionIndex
Returns the index of the specified section. The index is the order in which the section was defined in the section header table.- Parameters:
section
- the section header- Returns:
- the index of the specified section header
-
getProgramHeaders
Returns the program headers as defined in this ELF file.- Returns:
- the program headers as defined in this ELF file
-
getProgramHeaders
Returns the program headers with the specified type. The array could be zero-length, but will not be null.- Parameters:
type
- program header type- Returns:
- the program headers with the specified type
- See Also:
-
getDynamicTable
Returns the dynamic table defined by program header of type PT_DYNAMIC or the .dynamic program section. Or, null if one does not exist.- Returns:
- the dynamic table
-
getProgramHeaderProgramHeader
Returns the program header with type of PT_PHDR. Or, null if one does not exist.- Returns:
- the program header with type of PT_PHDR
-
getProgramHeaderAt
Returns the program header at the specified address, or null if no program header exists at that address.- Parameters:
virtualAddr
- the address of the requested program header- Returns:
- the program header with the specified address
-
getProgramLoadHeaderContaining
Returns the PT_LOAD program header which loads a range containing the specified address, or null if not found.- Parameters:
virtualAddr
- the address of the requested program header- Returns:
- the program header with the specified address
-
getProgramLoadHeaderContainingFileOffset
Returns the PT_LOAD program header which loads a range containing the specified file offset, or null if not found.- Parameters:
offset
- the file offset to be loaded- Returns:
- the program header with the specified file offset
-
getDynamicLibraryNames
Returns array of dynamic library names defined by DT_NEEDED- Returns:
- array of dynamic library names
-
getDynamicStringTable
Returns the dynamic string table as defined in this ELF file.- Returns:
- the dynamic string table as defined in this ELF file
-
getStringTables
Returns the string tables as defined in this ELF file.- Returns:
- the string tables as defined in this ELF file
-
getStringTable
Returns the string table associated to the specified section header. Or, null if one does not exist.- Parameters:
section
- section whose associated string table is requested- Returns:
- the string table associated to the specified section header
-
getDynamicSymbolTable
Returns the dynamic symbol table as defined in this ELF file.- Returns:
- the dynamic symbol table as defined in this ELF file
-
getSymbolTables
Returns the symbol tables as defined in this ELF file.- Returns:
- the symbol tables as defined in this ELF file
-
getSymbolTable
Returns the symbol table associated to the specified section header. Or, null if one does not exist.- Parameters:
symbolTableSection
- symbol table section header- Returns:
- the symbol table associated to the specified section header
-
getRelocationTables
Returns the relocation tables as defined in this ELF file.- Returns:
- the relocation tables as defined in this ELF file
-
getRelocationTable
Returns the relocation table associated to the specified section header, or null if one does not exist.- Parameters:
relocSection
- section header corresponding to relocation table- Returns:
- the relocation table associated to the specified section header
-
getRelocationTableAtOffset
Returns the relocation table located at the specified fileOffset, or null if one does not exist.- Parameters:
fileOffset
- file offset corresponding to start of relocation table- Returns:
- the relocation table located at the specified fileOffset or null
-
getMachineName
Returns a string name of the processor specified in this ELF header. For example, if "e_machine==EM_386", then it returns "80386".- Returns:
- a string name of the processor specified in this ELF header
-
getFlags
Returns a string representation of the numeric flags field.- Returns:
- elf flags field value
-
toDataType
Description copied from interface:StructConverter
Returns a structure datatype representing the contents of the implementor of this interface.For example, given:
class A { int foo; double bar; }
The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.
- Specified by:
toDataType
in interfaceStructConverter
- Returns:
- returns a structure datatype representing the implementor of this interface
- See Also:
-
getEntryComponentOrdinal
public int getEntryComponentOrdinal()Get the Elf header structure component ordinal corresponding to the e_entry element- Returns:
- e_entry component ordinal
-
getPhoffComponentOrdinal
public int getPhoffComponentOrdinal()Get the Elf header structure component ordinal corresponding to the e_phoff element- Returns:
- e_phoff component ordinal
-
getShoffComponentOrdinal
public int getShoffComponentOrdinal()Get the Elf header structure component ordinal corresponding to the e_shoff element- Returns:
- e_shoff component ordinal
-