ELF

Parser

class LIEF::ELF::Parser : public LIEF::Parser

Class which parse an ELF file and transform into a ELF::Binary.

Public Functions

Parser &operator=(const Parser &copy) = delete
Parser(const Parser &copy) = delete

Public Static Functions

std::unique_ptr<Binary> parse(const std::string &file, DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse an ELF file an return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters

std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const std::string &name = "", DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters

Public Static Attributes

constexpr uint32_t NB_MAX_SYMBOLS = 1000000
constexpr uint32_t DELTA_NB_SYMBOLS = 3000
constexpr uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
constexpr uint32_t NB_MAX_CHAINS = 1000000
constexpr uint32_t NB_MAX_SECTION = 10000
constexpr uint32_t NB_MAX_SEGMENTS = 10000
constexpr uint32_t NB_MAX_RELOCATIONS = 3000000
constexpr uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
constexpr uint32_t NB_MAX_MASKWORD = 512
constexpr uint32_t MAX_NOTE_DESCRIPTION = 1_MB
constexpr uint32_t MAX_SECTION_SIZE = 100_MB
constexpr uint32_t MAX_SEGMENT_SIZE = MAX_SECTION_SIZE

Friends

friend class OAT::Parser

Binary

class LIEF::ELF::Binary : public LIEF::Binary

Class which represent an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

using string_list_t = std::vector<std::string>
using overlay_t = std::vector<uint8_t>

Public Functions

Binary(const std::string &name, ELF_CLASS type)
Binary &operator=(const Binary&) = delete
Binary(const Binary &copy) = delete
ELF_CLASS type(void) const

Return binary’s class (ELF32 or ELF64)

Header &header(void)

Return Elf header .

const Header &header(void) const
uint64_t last_offset_section(void) const

Return the last offset used in binary according to section headers.

uint64_t last_offset_segment(void) const

Return the last offset used in binary according to segment headers.

uint64_t next_virtual_address(void) const

Return the next virtual address available.

it_sections sections(void)

Return binary’s sections.

Warning

This method return a vector of references thus you can modify vector’s elements (section) but not add elements.

it_const_sections sections(void) const
uint64_t entrypoint(void) const override

Return binary entrypoint.

it_segments segments(void)

Return binary’s segments.

it_const_segments segments(void) const
it_dynamic_entries dynamic_entries(void)

Return binary’s dynamic entries.

it_const_dynamic_entries dynamic_entries(void) const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the entry added.

Note &add(const Note &note)

Add the given note and return the entry added.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DYNAMIC_TAGS tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section.

void remove(const Note &note)

Remove the given note.

void remove(NOTE_TYPES tag)

Remove all notes with the given type.

it_symbols dynamic_symbols(void)

Return binary’s dynamic symbols.

it_const_symbols dynamic_symbols(void) const
it_exported_symbols exported_symbols(void)

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols(void) const
it_imported_symbols imported_symbols(void)

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols(void) const
it_symbols static_symbols(void)

Return statics symbols.

it_const_symbols static_symbols(void) const
it_symbols_version symbols_version(void)

Return symbol versions.

it_const_symbols_version symbols_version(void) const
it_symbols_version_definition symbols_version_definition(void)

Return symbols version definition.

it_const_symbols_version_definition symbols_version_definition(void) const
it_symbols_version_requirement symbols_version_requirement(void)

Return Symbol version requirement.

it_const_symbols_version_requirement symbols_version_requirement(void) const
it_dynamic_relocations dynamic_relocations(void)

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations(void) const
Relocation &add_dynamic_relocation(const Relocation &relocation)
Relocation &add_pltgot_relocation(const Relocation &relocation)
it_pltgot_relocations pltgot_relocations(void)

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations(void) const
it_object_relocations object_relocations(void)

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations(void) const
it_relocations relocations(void)

Return all relocations present in the binary.

it_const_relocations relocations(void) const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. nullptrif not found

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name.

Relocation *get_relocation(const std::string &symbol_name)
bool use_gnu_hash(void) const

true if GNU hash is used

See

gnu_hash and use_sysv_hash

const GnuHash &gnu_hash(void) const

Return the GnuHash object in readonly

bool use_sysv_hash(void) const

true if SYSV hash is used

See

sysv_hash and use_gnu_hash

const SysvHash &sysv_hash(void) const

Return the SysvHash object in readonly

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handle the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handle the given virtual address exists.

Section &get_section(const std::string &name)

Return Section with the given name

const Section &get_section(const std::string &name) const
Section &text_section(void)

Return .text section.

Section &dynamic_section(void)

Return .dynamic section.

Section &hash_section(void)

Return hash section.

Section &static_symbols_section(void)

Return section which holds static symbols.

uint64_t imagebase(void) const

Return program image base. For instance 0x40000.

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size(void) const

Return the size of the mapped binary.

bool has_interpreter(void) const

Check if the binary uses a loader.

See

interpreter

const std::string &interpreter(void) const

Return ELF interprer if any. (e.g. /lib64/ld-linux-x86-64.so.2)

void interpreter(const std::string &interpreter)

Change the interpreter.

it_symbols symbols(void)

Return both static and dynamic symbols.

it_const_symbols symbols(void) const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbol table.

const Symbol &get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name.

Symbol &get_dynamic_symbol(const std::string &name)
bool has_static_symbol(const std::string &name) const

Check if the symbol with the given name exists in the static symbol table.

const Symbol &get_static_symbol(const std::string &name) const

Get the static symbol from the given name.

Symbol &get_static_symbol(const std::string &name)
string_list_t strings(const size_t min_size = 5) const

Return list of strings used by the ELF binrary.

Basically we look for string in the .roadata

void remove_symbol(const std::string &name)

Remove symbols with the given name in boths.

void remove_static_symbol(const std::string &name)

Remove static symbols with the given name.

void remove_static_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbol table.

As a side effect, it will remove any ELF::Relocation that refer to this symbol and the SymbolVersion (if any) associated with this symbol

uint64_t get_function_address(const std::string &func_name) const override

Return the address of the given function name.

uint64_t get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters
  • func_name: The function’s name target

  • demangled: Use the demangled name

Section &add(const Section &section, bool loaded = true)

Add a new section in the binary

Return

The section added. The size and the virtual address may have changed.

Parameters
  • [in] section: The section object to insert

  • [in] loaded: Boolean value to indicate that sections’s data must be loaded

Section &extend(const Section &section, uint64_t size)
Symbol &add_static_symbol(const Symbol &symbol)

Add a static symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion &version = SymbolVersion::global())

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library.

DynamicEntryLibrary &get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name.

const DynamicEntryLibrary &get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment &add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

Warning

We assume that the binary is not position independent

Return

The segment added. Virtual address and File Offsetmay have changed

Segment &replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)
Segment &extend(const Segment &segment, uint64_t size)
void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the content at virtual address address with patch_value.

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) override

Patch the address with the given value.

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

  • [in] size: Size of the value in bytes (1, 2, … 8)

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters
  • [in] symbol: Imported symbol to patch

  • [in] address: New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters
  • [in] symbol_name: Imported symbol’s name to patch

  • [in] address: New address

void strip(void)

Strip the binary by removing static symbols.

void remove_section(const std::string &name, bool clear = false) override

Remove a binary’s section.

We clear data used by this section and it’s removed from section table

void write(const std::string &filename) override

Reconstruct the binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the binary object and return his content as bytes.

uint64_t virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to an offset in the file.

bool is_pie(void) const override

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

bool has_nx(void) const override

Check if the binary uses NX protection.

const Section &section_from_offset(uint64_t offset) const

Return the Section from the offset.

Section &section_from_offset(uint64_t offset)
const Section &section_from_virtual_address(uint64_t address) const

Return the Section from the address.

Section &section_from_virtual_address(uint64_t address)
const Segment &segment_from_virtual_address(uint64_t address) const

Return the Segment from the address.

Segment &segment_from_virtual_address(uint64_t address)
const Segment &segment_from_offset(uint64_t offset) const

Return the Segment from the offset.

Segment &segment_from_offset(uint64_t offset)
const DynamicEntry &get(DYNAMIC_TAGS tag) const

Return the first ELF::DynamicEntry associated with the given tag.

DynamicEntry &get(DYNAMIC_TAGS tag)
const Segment &get(SEGMENT_TYPES type) const

Return the first ELF::Segment associated with the given type.

Segment &get(SEGMENT_TYPES type)
const Note &get(NOTE_TYPES type) const

Return the first ELF::Note associated with the given type.

Note &get(NOTE_TYPES type)
const Section &get(ELF_SECTION_TYPES type) const

Return the first ELF::Section associated with the given type.

Section &get(ELF_SECTION_TYPES type)
bool has(DYNAMIC_TAGS tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

bool has(SEGMENT_TYPES type) const

Check if ELF::Segment associated with the given type exists.

bool has(NOTE_TYPES type) const

Check if a ELF::Note associated with the given type exists.

bool has(ELF_SECTION_TYPES type) const

Check if a ELF::Section associated with the given type exists.

std::vector<uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) const override

Return the content located at virtual address.

void accept(LIEF::Visitor &visitor) const override

Method so that the visitor can visit us.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

To avoid override by the ELF::Builder, one should set ELF::Builder::empties_gnuhash to true

LIEF::Binary::functions_t ctor_functions(void) const override

Constructor functions that are called prior any other functions.

LIEF::Binary::functions_t dtor_functions(void) const
LIEF::Binary::functions_t functions(void) const
bool has_notes(void) const

trueif the binary embed notes

it_const_notes notes(void) const

Return the Note object if any.

See

has_note

it_notes notes(void)
uint64_t eof_offset(void) const
bool has_overlay(void) const

True if data are present at the end of the binary.

const overlay_t &overlay(void) const

Overlay data (if any)

void overlay(overlay_t overlay)
size_t hash(const std::string &name)
~Binary(void)
std::ostream &print(std::ostream &os) const override
bool operator==(const Binary &rhs) const
bool operator!=(const Binary &rhs) const
Binary &operator+=(const DynamicEntry &entry)
Binary &operator+=(const Section &section)
Binary &operator+=(const Segment &segment)
Binary &operator+=(const Note &note)
Binary &operator-=(const DynamicEntry &entry)
Binary &operator-=(DYNAMIC_TAGS tag)
Binary &operator-=(const Note &note)
Binary &operator-=(NOTE_TYPES type)
Segment &operator[](SEGMENT_TYPES type)
const Segment &operator[](SEGMENT_TYPES type) const
DynamicEntry &operator[](DYNAMIC_TAGS tag)
const DynamicEntry &operator[](DYNAMIC_TAGS tag) const
Note &operator[](NOTE_TYPES type)
const Note &operator[](NOTE_TYPES type) const
Section &operator[](ELF_SECTION_TYPES type)
const Section &operator[](ELF_SECTION_TYPES type) const


Section

class LIEF::ELF::Section : public LIEF::Section

Class wich represent sections.

Public Functions

Section(uint8_t *data, ELF_CLASS type)
Section(const Elf64_Shdr *header)
Section(const Elf32_Shdr *header)
Section(const std::string &name, ELF_SECTION_TYPES type = ELF_SECTION_TYPES::SHT_PROGBITS)
Section(void)
~Section(void)
Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other)
uint32_t name_idx(void) const
ELF_SECTION_TYPES type(void) const
std::vector<uint8_t> content(void) const override

Section’s content.

void content(const std::vector<uint8_t> &data) override

Set section content.

void content(std::vector<uint8_t> &&data)
uint64_t flags(void) const

Section flags LIEF::ELF::ELF_SECTION_FLAGS.

bool has(ELF_SECTION_FLAGS flag) const

True if the section has the given flag

Parameters
  • [in] flag: flag to test

bool has(const Segment &segment) const

True if the section is in the given segment

std::set<ELF_SECTION_FLAGS> flags_list(void) const

Return section flags as a std::set

uint64_t size(void) const override

section’s size (size in the binary)

void size(uint64_t size) override

section’s size (size in the binary)

void offset(uint64_t offset) override
uint64_t offset(void) const override

offset in the binary

uint64_t file_offset(void) const

See

offset

uint64_t original_size(void) const
uint64_t alignment(void) const
uint64_t information(void) const
uint64_t entry_size(void) const
uint32_t link(void) const
Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(ELF_SECTION_FLAGS flag)
void remove(ELF_SECTION_FLAGS flag)
void type(ELF_SECTION_TYPES type)
void flags(uint64_t flags)
void clear_flags(void)
void file_offset(uint64_t offset)
void link(uint32_t link)
void information(uint32_t info)
void alignment(uint64_t alignment)
void entry_size(uint64_t entry_size)
it_segments segments(void)
it_const_segments segments(void) const
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

Section &operator+=(ELF_SECTION_FLAGS c)
Section &operator-=(ELF_SECTION_FLAGS c)
bool operator==(const Section &rhs) const
bool operator!=(const Section &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class LIEF::ELF::Segment : public LIEF::Object

Class which represent segments.

Public Functions

Segment(void)
Segment(const std::vector<uint8_t> &header, ELF_CLASS type)
Segment(const std::vector<uint8_t> &header)
Segment(const Elf64_Phdr *header)
Segment(const Elf32_Phdr *header)
~Segment(void)
Segment &operator=(Segment other)
Segment(const Segment &other)
void swap(Segment &other)
SEGMENT_TYPES type(void) const
ELF_SEGMENT_FLAGS flags(void) const
uint64_t file_offset(void) const
uint64_t virtual_address(void) const
uint64_t physical_address(void) const
uint64_t physical_size(void) const
uint64_t virtual_size(void) const
uint64_t alignment(void) const
std::vector<uint8_t> content(void) const
bool has(ELF_SEGMENT_FLAGS flag) const
bool has(const Section &section) const
bool has(const std::string &section_name) const
void add(ELF_SEGMENT_FLAGS c)
void remove(ELF_SEGMENT_FLAGS c)
void type(SEGMENT_TYPES type)
void flags(ELF_SEGMENT_FLAGS flags)
void clear_flags(void)
void file_offset(uint64_t fileOffset)
void virtual_address(uint64_t virtualAddress)
void physical_address(uint64_t physicalAddress)
void physical_size(uint64_t physicalSize)
void virtual_size(uint64_t virtualSize)
void alignment(uint64_t alignment)
void content(const std::vector<uint8_t> &content)
void content(std::vector<uint8_t> &&content)
template<typename T>
T get_content_value(size_t offset) const
template<typename T>
void set_content_value(size_t offset, T value)
size_t get_content_size() const
it_sections sections(void)
it_const_sections sections(void) const
void accept(Visitor &visitor) const override
Segment &operator+=(ELF_SEGMENT_FLAGS c)
Segment &operator-=(ELF_SEGMENT_FLAGS c)
bool operator==(const Segment &rhs) const
bool operator!=(const Segment &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class LIEF::ELF::DynamicEntry : public LIEF::Object

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Functions

DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&)
DynamicEntry(const DynamicEntry&)
~DynamicEntry(void)
DYNAMIC_TAGS tag(void) const
uint64_t value(void) const
void tag(DYNAMIC_TAGS tag)
void value(uint64_t value)
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const
bool operator==(const DynamicEntry &rhs) const
bool operator!=(const DynamicEntry &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class LIEF::ELF::DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryLibrary(void)
DynamicEntryLibrary(const std::string &name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&)
DynamicEntryLibrary(const DynamicEntryLibrary&)
const std::string &name(void) const
void name(const std::string &name)
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Dynamic Shared Object

class LIEF::ELF::DynamicSharedObject : public LIEF::ELF::DynamicEntry

Public Functions

DynamicSharedObject(void)
DynamicSharedObject(const std::string &name)
DynamicSharedObject &operator=(const DynamicSharedObject&)
DynamicSharedObject(const DynamicSharedObject&)
const std::string &name(void) const
void name(const std::string &name)
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Dynamic Entry Run Path

class LIEF::ELF::DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryRunPath(void)
DynamicEntryRunPath(const std::string &name)

Constructor from (run)path.

DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&)
DynamicEntryRunPath(const DynamicEntryRunPath&)
const std::string &name(void) const

Runpath raw value.

void name(const std::string &name)
const std::string &runpath(void) const

Runpath raw value.

void runpath(const std::string &runpath)
std::vector<std::string> paths(void) const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

DynamicEntryRunPath &operator+=(const std::string &path)
DynamicEntryRunPath &operator-=(const std::string &path)
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Attributes

constexpr char delimiter = ':'

Dynamic Entry RPath

class LIEF::ELF::DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryRpath(void)
DynamicEntryRpath(const std::string &name)
DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&)
DynamicEntryRpath(const DynamicEntryRpath&)
const std::string &name(void) const
void name(const std::string &name)
const std::string &rpath(void) const
void rpath(const std::string &name)
std::vector<std::string> paths(void) const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

DynamicEntryRpath &operator+=(const std::string &path)
DynamicEntryRpath &operator-=(const std::string &path)
void accept(Visitor &visitor) const override
std::ostream &print(std::ostream &os) const override
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Public Static Attributes

constexpr char delimiter = ':'

Dynamic Entry Array

class LIEF::ELF::DynamicEntryArray : public LIEF::ELF::DynamicEntry

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray(void)
DynamicEntryArray(DYNAMIC_TAGS tag, const array_t &array)
DynamicEntryArray &operator=(const DynamicEntryArray&)
DynamicEntryArray(const DynamicEntryArray&)
array_t &array(void)
const array_t &array(void) const
void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t callback)

Insert the given callback at pos

DynamicEntryArray &append(uint64_t callback)

Append the given callback.

DynamicEntryArray &remove(uint64_t callback)

Remove the given callback.

size_t size(void) const

Number of callback registred.

DynamicEntryArray &operator+=(uint64_t value)
DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const override
~DynamicEntryArray(void)
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Dynamic Entry Flags

class LIEF::ELF::DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

using flags_list_t = std::set<uint32_t>

Public Functions

DynamicEntryFlags(void)
DynamicEntryFlags &operator=(const DynamicEntryFlags&)
DynamicEntryFlags(const DynamicEntryFlags&)
bool has(DYNAMIC_FLAGS f) const

If the current entry has the given DYNAMIC_FLAGS.

bool has(DYNAMIC_FLAGS_1 f) const

If the current entry has the given DYNAMIC_FLAGS_1.

flags_list_t flags(void) const

Return flags as a list of integers.

void add(DYNAMIC_FLAGS f)

Add the given DYNAMIC_FLAGS.

void add(DYNAMIC_FLAGS_1 f)

Add the given DYNAMIC_FLAGS_1.

void remove(DYNAMIC_FLAGS f)

Remove the given DYNAMIC_FLAGS.

void remove(DYNAMIC_FLAGS_1 f)

Remove the given DYNAMIC_FLAGS_1.

DynamicEntryFlags &operator+=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator+=(DYNAMIC_FLAGS_1 f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS_1 f)
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const override
DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry(const DynamicEntry&)

Relocations

class LIEF::ELF::Relocation : public LIEF::Relocation

Public Functions

Relocation(const Elf32_Rel *header)
Relocation(const Elf32_Rela *header)
Relocation(const Elf64_Rel *header)
Relocation(const Elf64_Rela *header)
Relocation(uint64_t address, uint32_t type = 0, int64_t addend = 0, bool isRela = false)
template<class T, typename = typename std::enable_if<std::is_enum<T>::value>::type>
Relocation(uint64_t address, T type, int64_t addend = 0, bool isRela = false)
Relocation(void)
~Relocation(void)
Relocation &operator=(Relocation other)
Relocation(const Relocation &other)
void swap(Relocation &other)
int64_t addend(void) const
uint32_t type(void) const
bool is_rela(void) const
bool is_rel(void) const
uint32_t info(void) const
ARCH architecture(void) const
RELOCATION_PURPOSES purpose(void) const
size_t size(void) const override

Return the bit size of the value to patch.

Return -1 if it fails

bool has_symbol(void) const
Symbol &symbol(void)
const Symbol &symbol(void) const
bool has_section(void) const

True if the relocation has a section associated.

Section &section(void)

Section associated with this relocation.

const Section &section(void) const
void addend(int64_t addend)
void type(uint32_t type)
void purpose(RELOCATION_PURPOSES purpose)
void info(uint32_t v)
void symbol(Symbol *symbol)
void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Relocation &rhs) const
bool operator!=(const Relocation &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Relocation &entry)

Symbol

class LIEF::ELF::Symbol : public LIEF::Symbol

Public Functions

Symbol(const Elf32_Sym *header)
Symbol(const Elf64_Sym *header)
Symbol(std::string name, ELF_SYMBOL_TYPES type = ELF_SYMBOL_TYPES::STT_NOTYPE, SYMBOL_BINDINGS binding = SYMBOL_BINDINGS::STB_WEAK, uint8_t other = 0, uint16_t shndx = 0, uint64_t value = 0, uint64_t size = 0)
Symbol(void)
~Symbol(void)
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
ELF_SYMBOL_TYPES type(void) const

A symbol’s type provides a general classification for the associated entity.

SYMBOL_BINDINGS binding(void) const

A symbol’s binding determines the linkage visibility and behavior.

uint8_t information(void) const

This member specifies the symbol’s type and binding attributes.

uint8_t other(void) const

This member currently holds 0 and has no defined meaning.

uint16_t section_idx(void) const

section index associated with the symbol

ELF_SYMBOL_VISIBILITY visibility(void) const
Section &section(void)
uint16_t shndx(void) const

Symbol size.

This member have slightly different interpretations:

  • In relocatable files, value holds alignment constraints for a symbol whose section index is SHN_COMMON

  • In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.

  • In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant. Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.

See

Symbol::section_idx

bool has_version(void) const

Check if this symbols has a symbol version .

SymbolVersion &symbol_version(void)

Return the symbol version associated with this symbol.

const SymbolVersion &symbol_version(void) const
std::string demangled_name(void) const

Symbol’s unmangled name.

void type(ELF_SYMBOL_TYPES type)
void binding(SYMBOL_BINDINGS binding)
void other(uint8_t other)
void visibility(ELF_SYMBOL_VISIBILITY visibility)
void information(uint8_t info)
void shndx(uint16_t idx)
void shndx(SYMBOL_SECTION_INDEX idx)
bool is_exported(void) const

Check if the current symbol is exported.

void set_exported(bool flag = true)

Set whether or not the symbol is exported.

bool is_imported(void) const

Check if the current symbol is imported.

void set_imported(bool flag = true)

Set whether or not the symbol is imported.

bool is_static(void) const

True if the symbol is a static one.

bool is_function(void) const

True if the symbol represent a function.

bool is_variable(void) const

True if the symbol represent a variable.

void accept(Visitor &visitor) const override

Method so that the visitor can visit us.

bool operator==(const Symbol &rhs) const
bool operator!=(const Symbol &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const Symbol &entry)

Symbol Version

class LIEF::ELF::SymbolVersion : public LIEF::Object

Class which modelization of an entry defined in DT_VERSYM

Public Functions

SymbolVersion(uint16_t value)
SymbolVersion(void)
~SymbolVersion(void)
SymbolVersion &operator=(const SymbolVersion&)
SymbolVersion(const SymbolVersion&)
uint16_t value(void) const

Value associated with the symbol

If the given SymbolVersion hasn’t Auxiliary version:

  • 0 means Local

  • 1 means Global

bool has_auxiliary_version(void) const

Whether or not the current SymbolVersion has an auxiliary one.

SymbolVersionAux &symbol_version_auxiliary(void)

SymbolVersionAux associated with the current Version (if any)

const SymbolVersionAux &symbol_version_auxiliary(void) const
void value(uint16_t v)
void accept(Visitor &visitor) const override
bool operator==(const SymbolVersion &rhs) const
bool operator!=(const SymbolVersion &rhs) const

Public Static Functions

SymbolVersion local(void)

Generate a local SymbolVersion.

SymbolVersion global(void)

Generate a global SymbolVersion.

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)

Symbol Version Auxiliary

class LIEF::ELF::SymbolVersionAux : public LIEF::Object

Class which modelize an Auxiliary Symbol version.

Subclassed by LIEF::ELF::SymbolVersionAuxRequirement

Public Functions

SymbolVersionAux(const std::string &name)
SymbolVersionAux(void)
~SymbolVersionAux(void)
SymbolVersionAux &operator=(const SymbolVersionAux&)
SymbolVersionAux(const SymbolVersionAux&)
const std::string &name(void) const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)
void accept(Visitor &visitor) const override
bool operator==(const SymbolVersionAux &rhs) const
bool operator!=(const SymbolVersionAux &rhs) const

Friends

friend std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &symAux)

GNU Hash table

class LIEF::ELF::GnuHash : public LIEF::Object

Public Functions

GnuHash(void)
GnuHash(uint32_t symbol_idx, uint32_t shift2, const std::vector<uint64_t> &bloom_filters, const std::vector<uint32_t> &buckets, const std::vector<uint32_t> &hash_values = {})
GnuHash &operator=(const GnuHash &copy)
GnuHash(const GnuHash &copy)
~GnuHash(void)
uint32_t nb_buckets(void) const

Return the number of buckets.

See

GnuHash::buckets

uint32_t symbol_index(void) const

Index of the first symbol in the dynamic symbols table which accessible with the hash table.

uint32_t shift2(void) const

Shift count used in the bloom filter.

uint32_t maskwords(void) const

Number of bloom filters used. It must be a power of 2.

const std::vector<uint64_t> &bloom_filters(void) const

Bloom filters.

const std::vector<uint32_t> &buckets(void) const

Hash buckets.

const std::vector<uint32_t> &hash_values(void) const

Hash values.

bool check_bloom_filter(uint32_t hash) const

Check if the given hash pass the bloom filter.

bool check_bucket(uint32_t hash) const

Check if the given hash pass the bucket filter.

bool check(const std::string &symbol_name) const

Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exists. If true you can’t do any assumption.

bool check(uint32_t hash) const

Check if the symbol associated with the given probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.

bool operator==(const GnuHash &rhs) const
bool operator!=(const GnuHash &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash)

SYSV Hash table

class LIEF::ELF::SysvHash : public LIEF::Object

Public Functions

SysvHash(void)
SysvHash &operator=(const SysvHash &copy)
SysvHash(const SysvHash &copy)
~SysvHash(void)
uint32_t nbucket(void) const

Return the number of buckets used.

uint32_t nchain(void) const

Return the number of chain used.

const std::vector<uint32_t> &buckets(void) const

Buckets values.

const std::vector<uint32_t> &chains(void) const

Chains values.

bool operator==(const SysvHash &rhs) const
bool operator!=(const SysvHash &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash)

Note

class LIEF::ELF::Note : public LIEF::Object

Public Types

using description_t = std::vector<uint8_t>

Container used to handle the description data.

Public Functions

Note()
Note(const std::string &name, uint32_t type, const description_t &description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES type, const description_t &description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES_CORE type, const description_t &description, Binary *binary = nullptr)
Note &operator=(Note copy)
Note(const Note &copy)
~Note(void)
const std::string &name(void) const

Return the name of the note.

NOTE_TYPES type(void) const

Return the type of the note. It could be one of the NOTE_TYPES values.

NOTE_TYPES_CORE type_core(void) const

Return the type of the note for core ELF (ET_CORE). It could be one of the NOTE_TYPES_CORE values.

const description_t &description(void) const

Return the description associated with the note.

description_t &description(void)
bool is_core(void) const

True if the current note is associated with a core dump.

bool is_android(void) const

True if the current note is specific to Android.

If true, details() returns a reference the LIEF::ELF::AndroidNote object

const NoteDetails &details(void) const
NoteDetails &details(void)
void name(const std::string &name)
void type(NOTE_TYPES type)
void type_core(NOTE_TYPES_CORE type)
void description(const description_t &description)
uint64_t size(void) const

Sizeof the raw note.

void dump(std::ostream &os) const
bool operator==(const Note &rhs) const
bool operator!=(const Note &rhs) const
void swap(Note &other)
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const Note &note)

Note Details

class LIEF::ELF::NoteDetails : public LIEF::Object

Subclassed by LIEF::ELF::AndroidNote, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi

Public Functions

NoteDetails()
~NoteDetails(void)
NoteDetails *clone(void) const
const Note::description_t &description(void) const
void dump(std::ostream &os) const
bool operator==(const NoteDetails &rhs) const
bool operator!=(const NoteDetails &rhs) const
void accept(Visitor &visitor) const override

Friends

friend std::ostream &operator<<(std::ostream &os, const NoteDetails &note)

Core PrPsInfo

class LIEF::ELF::CorePrPsInfo : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Functions

CorePrPsInfo *clone(void) const override
std::string file_name(void) const

Process file name.

uint64_t flags(void) const

Process flag.

uint32_t uid(void) const

Process user id.

uint32_t gid(void) const

Process group id.

int32_t pid(void) const

Process ID.

int32_t ppid(void) const

Process parent ID.

int32_t pgrp(void) const

Process session group ID.

int32_t sid(void) const

Process session ID.

void file_name(const std::string &file_name)
void flags(uint64_t)
void uid(uint32_t)
void gid(uint32_t)
void pid(int32_t)
void ppid(int32_t)
void pgrp(int32_t)
void sid(int32_t)
bool operator==(const CorePrPsInfo &rhs) const
bool operator!=(const CorePrPsInfo &rhs) const
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~CorePrPsInfo(void)
NoteDetails()

Public Static Functions

CorePrPsInfo make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CorePrPsInfo &note)

Core File

class LIEF::ELF::CoreFile : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

using files_t = std::vector<CoreFileEntry>
using iterator = files_t::iterator
using const_iterator = files_t::const_iterator

Public Functions

CoreFile *clone(void) const override
uint64_t count(void) const

Number of coredump file entries.

const files_t &files(void) const

Coredump file entries.

iterator begin(void)
iterator end(void)
const_iterator begin(void) const
const_iterator end(void) const
void files(const files_t&)
bool operator==(const CoreFile &rhs) const
bool operator!=(const CoreFile &rhs) const
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~CoreFile(void)
NoteDetails()

Public Static Functions

CoreFile make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CoreFile &note)

Core File Entry

Warning

doxygenclass: Cannot find class “LIEF::ELF::CoreFileEntry” in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml


Core PrStatus

class LIEF::ELF::CorePrStatus : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

enum REGISTERS

Values:

enumerator UNKNOWN
enumerator X86_START
enumerator X86_EBX
enumerator X86_ECX
enumerator X86_EDX
enumerator X86_ESI
enumerator X86_EDI
enumerator X86_EBP
enumerator X86_EAX
enumerator X86_DS
enumerator X86_ES
enumerator X86_FS
enumerator X86_GS
enumerator X86__
enumerator X86_EIP
enumerator X86_CS
enumerator X86_EFLAGS
enumerator X86_ESP
enumerator X86_SS
enumerator X86_END
enumerator X86_64_START
enumerator X86_64_R15
enumerator X86_64_R14
enumerator X86_64_R13
enumerator X86_64_R12
enumerator X86_64_RBP
enumerator X86_64_RBX
enumerator X86_64_R11
enumerator X86_64_R10
enumerator X86_64_R9
enumerator X86_64_R8
enumerator X86_64_RAX
enumerator X86_64_RCX
enumerator X86_64_RDX
enumerator X86_64_RSI
enumerator X86_64_RDI
enumerator X86_64__
enumerator X86_64_RIP
enumerator X86_64_CS
enumerator X86_64_EFLAGS
enumerator X86_64_RSP
enumerator X86_64_SS
enumerator X86_64_END
enumerator ARM_START
enumerator ARM_R0
enumerator ARM_R1
enumerator ARM_R2
enumerator ARM_R3
enumerator ARM_R4
enumerator ARM_R5
enumerator ARM_R6
enumerator ARM_R7
enumerator ARM_R8
enumerator ARM_R9
enumerator ARM_R10
enumerator ARM_R11
enumerator ARM_R12
enumerator ARM_R13
enumerator ARM_R14
enumerator ARM_R15
enumerator ARM_CPSR
enumerator ARM_END
enumerator AARCH64_START
enumerator AARCH64_X0
enumerator AARCH64_X1
enumerator AARCH64_X2
enumerator AARCH64_X3
enumerator AARCH64_X4
enumerator AARCH64_X5
enumerator AARCH64_X6
enumerator AARCH64_X7
enumerator AARCH64_X8
enumerator AARCH64_X9
enumerator AARCH64_X10
enumerator AARCH64_X11
enumerator AARCH64_X12
enumerator AARCH64_X13
enumerator AARCH64_X14
enumerator AARCH64_X15
enumerator AARCH64_X16
enumerator AARCH64_X17
enumerator AARCH64_X18
enumerator AARCH64_X19
enumerator AARCH64_X20
enumerator AARCH64_X21
enumerator AARCH64_X22
enumerator AARCH64_X23
enumerator AARCH64_X24
enumerator AARCH64_X25
enumerator AARCH64_X26
enumerator AARCH64_X27
enumerator AARCH64_X28
enumerator AARCH64_X29
enumerator AARCH64_X30
enumerator AARCH64_X31
enumerator AARCH64_PC
enumerator AARCH64__
enumerator AARCH64_END
using reg_context_t = std::map<REGISTERS, uint64_t>

Public Functions

CorePrStatus *clone(void) const override
const Elf_siginfo &siginfo(void) const

Info associated with the signal.

uint16_t current_sig(void) const

Current Signal.

uint64_t sigpend(void) const

Set of pending signals.

uint64_t sighold(void) const

Set of held signals.

int32_t pid(void) const

Process ID.

int32_t ppid(void) const

Process parent ID.

int32_t pgrp(void) const

Process group ID.

int32_t sid(void) const

Process session ID.

Elf64_timeval utime(void) const

User time.

Elf64_timeval stime(void) const

System time.

Elf64_timeval cutime(void) const

Cumulative user time.

Elf64_timeval cstime(void) const

Cumulative system time.

const reg_context_t &reg_context(void) const

GP registers state.

uint64_t pc(void) const

Return the program counter.

uint64_t sp(void) const

Return the stack pointer.

uint64_t get(REGISTERS reg, bool *error = nullptr) const

Get register value. If error is set, this function and the register exists, the function set the boolean value to false Otherwise it set the value to true

bool has(REGISTERS reg) const

Check if the given register is present in the info.

void siginfo(const Elf_siginfo &siginfo)
void current_sig(uint16_t current_sig)
void sigpend(uint64_t sigpend)
void sighold(uint64_t sighold)
void pid(int32_t pid)
void ppid(int32_t ppid)
void pgrp(int32_t pgrp)
void sid(int32_t sid)
void utime(Elf64_timeval utime)
void stime(Elf64_timeval stime)
void cutime(Elf64_timeval cutime)
void cstime(Elf64_timeval cstime)
void reg_context(const reg_context_t &ctx)
bool set(REGISTERS reg, uint64_t value)
bool operator==(const CorePrStatus &rhs) const
bool operator!=(const CorePrStatus &rhs) const
uint64_t &operator[](REGISTERS reg)
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~CorePrStatus(void)
NoteDetails()

Public Static Functions

CorePrStatus make(Note &note)
std::ostream &dump(std::ostream &os, const Elf64_timeval &time)
std::ostream &dump(std::ostream &os, const Elf_siginfo &siginfo)
std::ostream &dump(std::ostream &os, const reg_context_t &ctx)

Friends

friend std::ostream &operator<<(std::ostream &os, const CorePrStatus &note)

Core Siginfo

class LIEF::ELF::CoreSigInfo : public LIEF::ELF::NoteDetails

Class representing core siginfo object.

Public Functions

CoreSigInfo *clone(void) const override
int32_t signo(void) const

Signal number.

int32_t sigcode(void) const

Signal code.

int32_t sigerrno(void) const

If non-zero, an errno value associated with this signal.

void signo(int32_t signo)
void sigcode(int32_t sigcode)
void sigerrno(int32_t sigerrno)
bool operator==(const CoreSigInfo &rhs) const
bool operator!=(const CoreSigInfo &rhs) const
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~CoreSigInfo(void)
NoteDetails()

Public Static Functions

CoreSigInfo make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CoreSigInfo &note)

Core Auxiliary Vector

class LIEF::ELF::CoreAuxv : public LIEF::ELF::NoteDetails

Class representing core Auxv object.

Public Types

using val_context_t = std::map<AUX_TYPE, uint64_t>

Public Functions

CoreAuxv *clone(void) const override
const val_context_t &values(void) const

Auxiliary values.

uint64_t get(AUX_TYPE atype, bool *error = nullptr) const

Get an auxiliary value. If error is set, this function and the value exists, the function set the boolean value to false Otherwise it set the value to true

bool has(AUX_TYPE reg) const

Check if the given register is present in the info.

void values(const val_context_t &ctx)
bool set(AUX_TYPE atype, uint64_t value)
bool operator==(const CoreAuxv &rhs) const
bool operator!=(const CoreAuxv &rhs) const
uint64_t &operator[](AUX_TYPE atype)
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~CoreAuxv(void)
NoteDetails()

Public Static Functions

CoreAuxv make(Note &note)

Friends

friend std::ostream &operator<<(std::ostream &os, const CoreAuxv &note)

Android Note

class LIEF::ELF::AndroidNote : public LIEF::ELF::NoteDetails

Class representing the “.note.android.ident” section

@See: https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39

Public Types

using description_t = typename Note::description_t

Public Functions

AndroidNote *clone(void) const override
uint32_t sdk_version(void) const

Target SDK version.

std::string ndk_version(void) const

NDK version used.

std::string ndk_build_number(void) const

NDK build number.

void sdk_version(uint32_t version)
void ndk_version(const std::string &ndk_version)
void ndk_build_number(const std::string &ndk_build_number)
bool operator==(const AndroidNote &rhs) const
bool operator!=(const AndroidNote &rhs) const
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~AndroidNote(void)
NoteDetails()

Public Static Functions

AndroidNote make(Note &note)

Public Static Attributes

constexpr const char NAME[] = "Android"
constexpr size_t sdk_version_offset = 0
constexpr size_t sdk_version_size = sizeof(uint32_t)
constexpr size_t ndk_version_offset = sdk_version_offset + sdk_version_size
constexpr size_t ndk_version_size = 64 * sizeof(char)
constexpr size_t ndk_build_number_offset = ndk_version_offset + ndk_version_size
constexpr size_t ndk_build_number_size = 64 * sizeof(char)

Friends

friend std::ostream &operator<<(std::ostream &os, const AndroidNote &note)

Note ABI

class LIEF::ELF::NoteAbi : public LIEF::ELF::NoteDetails

Class representing the “.note.android.ident” section

@See: https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39

Public Types

using version_t = std::array<uint32_t, 3>

Version type: (Major, Minor, Patch)

using description_t = typename Note::description_t

Public Functions

NoteAbi *clone(void) const override
version_t version(void) const

Return the target version as <Major, Minor, Patch>.

NOTE_ABIS abi(void) const

Return the target ABI. Require a NT_GNU_ABI_TAG type.

bool operator==(const NoteAbi &rhs) const
bool operator!=(const NoteAbi &rhs) const
void dump(std::ostream &os) const override
void accept(Visitor &visitor) const override
~NoteAbi(void)
NoteDetails()

Public Static Functions

NoteAbi make(Note &note)

Public Static Attributes

constexpr size_t abi_offset = 0
constexpr size_t abi_size = sizeof(uint32_t)
constexpr size_t version_offset = abi_offset + abi_size
constexpr size_t version_size = 3 * sizeof(uint32_t)

Friends

friend std::ostream &operator<<(std::ostream &os, const NoteAbi &note)

Utilities

Warning

doxygenfunction: Unable to resolve multiple matches for function “LIEF::ELF::is_elf” with arguments (const std::string&) in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml. Potential matches:

- bool is_elf(const std::string &file)
- bool is_elf(const std::vector<uint8_t> &raw)

Warning

doxygenfunction: Unable to resolve multiple matches for function “LIEF::ELF::is_elf” with arguments (const std::vector<uint8_t>&) in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml. Potential matches:

- bool is_elf(const std::string &file)
- bool is_elf(const std::vector<uint8_t> &raw)

Enums

Architectures

enum ELF::LIEF::ARCH

Machine architectures See current registered ELF machine architectures at: http://www.uxsglobal.com/developers/gabi/latest/ch4.eheader.html.

Values:

enumerator EM_NONE = 0

No machine

enumerator EM_M32 = 1

AT&T WE 32100

enumerator EM_SPARC = 2

SPARC

enumerator EM_386 = 3

Intel 386

enumerator EM_68K = 4

Motorola 68000

enumerator EM_88K = 5

Motorola 88000

enumerator EM_IAMCU = 6

Intel MCU

enumerator EM_860 = 7

Intel 80860

enumerator EM_MIPS = 8

MIPS R3000

enumerator EM_S370 = 9

IBM System/370

enumerator EM_MIPS_RS3_LE = 10

MIPS RS3000 Little-endian

enumerator EM_PARISC = 15

Hewlett-Packard PA-RISC

enumerator EM_VPP500 = 17

Fujitsu VPP500

enumerator EM_SPARC32PLUS = 18

Enhanced instruction set SPARC

enumerator EM_960 = 19

Intel 80960

enumerator EM_PPC = 20

PowerPC

enumerator EM_PPC64 = 21

PowerPC64

enumerator EM_S390 = 22

IBM System/390

enumerator EM_SPU = 23

IBM SPU/SPC

enumerator EM_V800 = 36

NEC V800

enumerator EM_FR20 = 37

Fujitsu FR20

enumerator EM_RH32 = 38

TRW RH-32

enumerator EM_RCE = 39

Motorola RCE

enumerator EM_ARM = 40

ARM

enumerator EM_ALPHA = 41

DEC Alpha

enumerator EM_SH = 42

Hitachi SH

enumerator EM_SPARCV9 = 43

SPARC V9

enumerator EM_TRICORE = 44

Siemens TriCore

enumerator EM_ARC = 45

Argonaut RISC Core

enumerator EM_H8_300 = 46

Hitachi H8/300

enumerator EM_H8_300H = 47

Hitachi H8/300H

enumerator EM_H8S = 48

Hitachi H8S

enumerator EM_H8_500 = 49

Hitachi H8/500

enumerator EM_IA_64 = 50

Intel IA-64 processor architecture

enumerator EM_MIPS_X = 51

Stanford MIPS-X

enumerator EM_COLDFIRE = 52

Motorola ColdFire

enumerator EM_68HC12 = 53

Motorola M68HC12

enumerator EM_MMA = 54

Fujitsu MMA Multimedia Accelerator

enumerator EM_PCP = 55

Siemens PCP

enumerator EM_NCPU = 56

Sony nCPU embedded RISC processor

enumerator EM_NDR1 = 57

Denso NDR1 microprocessor

enumerator EM_STARCORE = 58

Motorola Star*Core processor

enumerator EM_ME16 = 59

Toyota ME16 processor

enumerator EM_ST100 = 60

STMicroelectronics ST100 processor

enumerator EM_TINYJ = 61

Advanced Logic Corp. TinyJ embedded processor family

enumerator EM_X86_64 = 62

AMD x86-64 architecture

enumerator EM_PDSP = 63

Sony DSP Processor

enumerator EM_PDP10 = 64

Digital Equipment Corp. PDP-10

enumerator EM_PDP11 = 65

Digital Equipment Corp. PDP-11

enumerator EM_FX66 = 66

Siemens FX66 microcontroller

enumerator EM_ST9PLUS = 67

STMicroelectronics ST9+ 8/16 bit microcontroller

enumerator EM_ST7 = 68

STMicroelectronics ST7 8-bit microcontroller

enumerator EM_68HC16 = 69

Motorola MC68HC16 Microcontroller

enumerator EM_68HC11 = 70

Motorola MC68HC11 Microcontroller

enumerator EM_68HC08 = 71

Motorola MC68HC08 Microcontroller

enumerator EM_68HC05 = 72

Motorola MC68HC05 Microcontroller

enumerator EM_SVX = 73

Silicon Graphics SVx

enumerator EM_ST19 = 74

STMicroelectronics ST19 8-bit microcontroller

enumerator EM_VAX = 75

Digital VAX

enumerator EM_CRIS = 76

Axis Communications 32-bit embedded processor

enumerator EM_JAVELIN = 77

Infineon Technologies 32-bit embedded processor

enumerator EM_FIREPATH = 78

Element 14 64-bit DSP Processor

enumerator EM_ZSP = 79

LSI Logic 16-bit DSP Processor

enumerator EM_MMIX = 80

Donald Knuth’s educational 64-bit processor

enumerator EM_HUANY = 81

Harvard University machine-independent object files

enumerator EM_PRISM = 82

SiTera Prism

enumerator EM_AVR = 83

Atmel AVR 8-bit microcontroller

enumerator EM_FR30 = 84

Fujitsu FR30

enumerator EM_D10V = 85

Mitsubishi D10V

enumerator EM_D30V = 86

Mitsubishi D30V

enumerator EM_V850 = 87

NEC v850

enumerator EM_M32R = 88

Mitsubishi M32R

enumerator EM_MN10300 = 89

Matsushita MN10300

enumerator EM_MN10200 = 90

Matsushita MN10200

enumerator EM_PJ = 91

picoJava

enumerator EM_OPENRISC = 92

OpenRISC 32-bit embedded processor

enumerator EM_ARC_COMPACT = 93

ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)

enumerator EM_XTENSA = 94

Tensilica Xtensa Architecture

enumerator EM_VIDEOCORE = 95

Alphamosaic VideoCore processor

enumerator EM_TMM_GPP = 96

Thompson Multimedia General Purpose Processor

enumerator EM_NS32K = 97

National Semiconductor 32000 series

enumerator EM_TPC = 98

Tenor Network TPC processor

enumerator EM_SNP1K = 99

Trebia SNP 1000 processor

enumerator EM_ST200 = 100

STMicroelectronics (www.st.com) ST200

enumerator EM_IP2K = 101

Ubicom IP2xxx microcontroller family

enumerator EM_MAX = 102

MAX Processor

enumerator EM_CR = 103

National Semiconductor CompactRISC microprocessor

enumerator EM_F2MC16 = 104

Fujitsu F2MC16

enumerator EM_MSP430 = 105

Texas Instruments embedded microcontroller msp430

enumerator EM_BLACKFIN = 106

Analog Devices Blackfin (DSP) processor

enumerator EM_SE_C33 = 107

S1C33 Family of Seiko Epson processors

enumerator EM_SEP = 108

Sharp embedded microprocessor

enumerator EM_ARCA = 109

Arca RISC Microprocessor

enumerator EM_UNICORE = 110

Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University

enumerator EM_EXCESS = 111

eXcess: 16/32/64-bit configurable embedded CPU

enumerator EM_DXP = 112

Icera Semiconductor Inc. Deep Execution Processor

enumerator EM_ALTERA_NIOS2 = 113

Altera Nios II soft-core processor

enumerator EM_CRX = 114

National Semiconductor CompactRISC CRX

enumerator EM_XGATE = 115

Motorola XGATE embedded processor

enumerator EM_C166 = 116

Infineon C16x/XC16x processor

enumerator EM_M16C = 117

Renesas M16C series microprocessors

enumerator EM_DSPIC30F = 118

Microchip Technology dsPIC30F Digital Signal

enumerator EM_CE = 119

Freescale Communication Engine RISC core

enumerator EM_M32C = 120

Renesas M32C series microprocessors

enumerator EM_TSK3000 = 131

Altium TSK3000 core

enumerator EM_RS08 = 132

Freescale RS08 embedded processor

enumerator EM_SHARC = 133

Analog Devices SHARC family of 32-bit DSP

enumerator EM_ECOG2 = 134

Cyan Technology eCOG2 microprocessor

enumerator EM_SCORE7 = 135

Sunplus S+core7 RISC processor

enumerator EM_DSP24 = 136

New Japan Radio (NJR) 24-bit DSP Processor

enumerator EM_VIDEOCORE3 = 137

Broadcom VideoCore III processor

enumerator EM_LATTICEMICO32 = 138

RISC processor for Lattice FPGA architecture

enumerator EM_SE_C17 = 139

Seiko Epson C17 family

enumerator EM_TI_C6000 = 140

The Texas Instruments TMS320C6000 DSP family

enumerator EM_TI_C2000 = 141

The Texas Instruments TMS320C2000 DSP family

enumerator EM_TI_C5500 = 142

The Texas Instruments TMS320C55x DSP family

enumerator EM_MMDSP_PLUS = 160

STMicroelectronics 64bit VLIW Data Signal Processor

enumerator EM_CYPRESS_M8C = 161

Cypress M8C microprocessor

enumerator EM_R32C = 162

Renesas R32C series microprocessors

enumerator EM_TRIMEDIA = 163

NXP Semiconductors TriMedia architecture family

enumerator EM_HEXAGON = 164

Qualcomm Hexagon processor

enumerator EM_8051 = 165

Intel 8051 and variants

enumerator EM_STXP7X = 166

STMicroelectronics STxP7x family of configurable

enumerator EM_NDS32 = 167
enumerator EM_ECOG1 = 168

Cyan Technology eCOG1X family

enumerator EM_ECOG1X = 168

Cyan Technology eCOG1X family

enumerator EM_MAXQ30 = 169

Dallas Semiconductor MAXQ30 Core Micro-controllers

enumerator EM_XIMO16 = 170

New Japan Radio (NJR) 16-bit DSP Processor

enumerator EM_MANIK = 171

M2000 Reconfigurable RISC Microprocessor

enumerator EM_CRAYNV2 = 172

Cray Inc. NV2 vector architecture

enumerator EM_RX = 173

Renesas RX family

enumerator EM_METAG = 174

Imagination Technologies META processor

enumerator EM_MCST_ELBRUS = 175

MCST Elbrus general purpose hardware architecture

enumerator EM_ECOG16 = 176

Cyan Technology eCOG16 family

enumerator EM_CR16 = 177

National Semiconductor CompactRISC CR16 16-bit

enumerator EM_ETPU = 178

Freescale Extended Time Processing Unit

enumerator EM_SLE9X = 179

Infineon Technologies SLE9X core

enumerator EM_L10M = 180

Intel L10M

enumerator EM_K10M = 181

Intel K10M

enumerator EM_AARCH64 = 183

ARM AArch64

enumerator EM_AVR32 = 185

Atmel Corporation 32-bit microprocessor family

enumerator EM_STM8 = 186

STMicroeletronics STM8 8-bit microcontroller

enumerator EM_TILE64 = 187

Tilera TILE64 multicore architecture family

enumerator EM_TILEPRO = 188

Tilera TILEPro multicore architecture family

enumerator EM_CUDA = 190

NVIDIA CUDA architecture

enumerator EM_TILEGX = 191

Tilera TILE-Gx multicore architecture family

enumerator EM_CLOUDSHIELD = 192

CloudShield architecture family

enumerator EM_COREA_1ST = 193

KIPO-KAIST Core-A 1st generation processor family

enumerator EM_COREA_2ND = 194

KIPO-KAIST Core-A 2nd generation processor family

enumerator EM_ARC_COMPACT2 = 195

Synopsys ARCompact V2

enumerator EM_OPEN8 = 196

Open8 8-bit RISC soft processor core

enumerator EM_RL78 = 197

Renesas RL78 family

enumerator EM_VIDEOCORE5 = 198

Broadcom VideoCore V processor

enumerator EM_78KOR = 199

Renesas 78KOR family

enumerator EM_56800EX = 200

Freescale 56800EX Digital Signal Controller (DSC)

enumerator EM_BA1 = 201

Beyond BA1 CPU architecture

enumerator EM_BA2 = 202

Beyond BA2 CPU architecture

enumerator EM_XCORE = 203

XMOS xCORE processor family

enumerator EM_MCHP_PIC = 204

Microchip 8-bit PIC(r) family

enumerator EM_INTEL205 = 205

Reserved by Intel

enumerator EM_INTEL206 = 206

Reserved by Intel

enumerator EM_INTEL207 = 207

Reserved by Intel

enumerator EM_INTEL208 = 208

Reserved by Intel

enumerator EM_INTEL209 = 209

Reserved by Intel

enumerator EM_KM32 = 210

KM211 KM32 32-bit processor

enumerator EM_KMX32 = 211

KM211 KMX32 32-bit processor

enumerator EM_KMX16 = 212

KM211 KMX16 16-bit processor

enumerator EM_KMX8 = 213

KM211 KMX8 8-bit processor

enumerator EM_KVARC = 214

KM211 KVARC processor

enumerator EM_CDP = 215

Paneve CDP architecture family

enumerator EM_COGE = 216

Cognitive Smart Memory Processor

enumerator EM_COOL = 217

iCelero CoolEngine

enumerator EM_NORC = 218

Nanoradio Optimized RISC

enumerator EM_CSR_KALIMBA = 219

CSR Kalimba architecture family

enumerator EM_AMDGPU = 224

AMD GPU architecture


Identity

enum ELF::LIEF::IDENTITY

e_ident size and indices.

Values:

enumerator EI_MAG0 = 0

File identification index.

enumerator EI_MAG1 = 1

File identification index.

enumerator EI_MAG2 = 2

File identification index.

enumerator EI_MAG3 = 3

File identification index.

enumerator EI_CLASS = 4

File class.

enumerator EI_DATA = 5

Data encoding.

enumerator EI_VERSION = 6

File version.

enumerator EI_OSABI = 7

OS/ABI identification.

enumerator EI_ABIVERSION = 8

ABI version.

enumerator EI_PAD = 9

Start of padding bytes.

enumerator EI_NIDENT = 16

Number of bytes in e_ident.


Binary types

enum ELF::LIEF::E_TYPE

Enum associated with e_type

Values:

enumerator ET_NONE = 0

No file type

enumerator ET_REL = 1

Relocatable file

enumerator ET_EXEC = 2

Executable file

enumerator ET_DYN = 3

Shared object file

enumerator ET_CORE = 4

Core file

enumerator ET_LOPROC = 0xff00

Beginning of processor-specific codes

enumerator ET_HIPROC = 0xffff

Processor-specific


Version

enum ELF::LIEF::VERSION

Versioning

Values:

enumerator EV_NONE = 0
enumerator EV_CURRENT = 1

Default value


ELF Class

enum ELF::LIEF::ELF_CLASS

Object file classes.

Values:

enumerator ELFCLASSNONE = 0

Unknown

enumerator ELFCLASS32 = 1

32-bit object file

enumerator ELFCLASS64 = 2

64-bit object file


ELF Data

enum ELF::LIEF::ELF_DATA

Object file byte orderings.

Values:

enumerator ELFDATANONE = 0

Invalid data encoding.

enumerator ELFDATA2LSB = 1

Little-endian object file

enumerator ELFDATA2MSB = 2

Big-endian object file


ELF OS/ABI

enum ELF::LIEF::OS_ABI

OS ABI identification.

Values:

enumerator ELFOSABI_SYSTEMV = 0

UNIX System V ABI

enumerator ELFOSABI_HPUX = 1

HP-UX operating system

enumerator ELFOSABI_NETBSD = 2

NetBSD

enumerator ELFOSABI_GNU = 3

GNU/Linux

enumerator ELFOSABI_LINUX = 3

Historical alias for ELFOSABI_GNU.

enumerator ELFOSABI_HURD = 4

GNU/Hurd

enumerator ELFOSABI_SOLARIS = 6

Solaris

enumerator ELFOSABI_AIX = 7

AIX

enumerator ELFOSABI_IRIX = 8

IRIX

enumerator ELFOSABI_FREEBSD = 9

FreeBSD

enumerator ELFOSABI_TRU64 = 10

TRU64 UNIX

enumerator ELFOSABI_MODESTO = 11

Novell Modesto

enumerator ELFOSABI_OPENBSD = 12

OpenBSD

enumerator ELFOSABI_OPENVMS = 13

OpenVMS

enumerator ELFOSABI_NSK = 14

Hewlett-Packard Non-Stop Kernel

enumerator ELFOSABI_AROS = 15

AROS

enumerator ELFOSABI_FENIXOS = 16

FenixOS

enumerator ELFOSABI_CLOUDABI = 17

Nuxi CloudABI

enumerator ELFOSABI_C6000_ELFABI = 64

Bare-metal TMS320C6000

enumerator ELFOSABI_AMDGPU_HSA = 64

AMD HSA runtime

enumerator ELFOSABI_C6000_LINUX = 65

Linux TMS320C6000

enumerator ELFOSABI_ARM = 97

ARM

enumerator ELFOSABI_STANDALONE = 255

Standalone (embedded) application


Symbol section index

enum ELF::LIEF::SYMBOL_SECTION_INDEX

Special section indices.

Values:

enumerator SHN_UNDEF = 0

Undefined, missing, irrelevant, or meaningless

enumerator SHN_LORESERVE = 0xff00

Lowest reserved index

enumerator SHN_LOPROC = 0xff00

Lowest processor-specific index

enumerator SHN_HIPROC = 0xff1f

Highest processor-specific index

enumerator SHN_LOOS = 0xff20

Lowest operating system-specific index

enumerator SHN_HIOS = 0xff3f

Highest operating system-specific index

enumerator SHN_ABS = 0xfff1

Symbol has absolute value; does not need relocation

enumerator SHN_COMMON = 0xfff2

FORTRAN COMMON or C external global variables

enumerator SHN_XINDEX = 0xffff

Mark that the index is >= SHN_LORESERVE

enumerator SHN_HIRESERVE = 0xffff

Highest reserved index


Section types

enum ELF::LIEF::ELF_SECTION_TYPES

Section types.

Values:

enumerator SHT_NULL = 0

No associated section (inactive entry).

enumerator SHT_PROGBITS = 1

Program-defined contents.

enumerator SHT_SYMTAB = 2

Symbol table.

enumerator SHT_STRTAB = 3

String table.

enumerator SHT_RELA = 4

Relocation entries; explicit addends.

enumerator SHT_HASH = 5

Symbol hash table.

enumerator SHT_DYNAMIC = 6

Information for dynamic linking.

enumerator SHT_NOTE = 7

Information about the file.

enumerator SHT_NOBITS = 8

Data occupies no space in the file.

enumerator SHT_REL = 9

Relocation entries; no explicit addends.

enumerator SHT_SHLIB = 10

Reserved.

enumerator SHT_DYNSYM = 11

Symbol table.

enumerator SHT_INIT_ARRAY = 14

Pointers to initialization functions.

enumerator SHT_FINI_ARRAY = 15

Pointers to termination functions.

enumerator SHT_PREINIT_ARRAY = 16

Pointers to pre-init functions.

enumerator SHT_GROUP = 17

Section group.

enumerator SHT_SYMTAB_SHNDX = 18

Indices for SHN_XINDEX entries.

enumerator SHT_LOOS = 0x60000000

Lowest operating system-specific type.

enumerator SHT_GNU_ATTRIBUTES = 0x6ffffff5

Object attributes.

enumerator SHT_GNU_HASH = 0x6ffffff6

GNU-style hash table.

enumerator SHT_GNU_verdef = 0x6ffffffd

GNU version definitions.

enumerator SHT_GNU_verneed = 0x6ffffffe

GNU version references.

enumerator SHT_GNU_versym = 0x6fffffff

GNU symbol versions table.

enumerator SHT_HIOS = 0x6fffffff

Highest operating system-specific type.

enumerator SHT_LOPROC = 0x70000000

Lowest processor arch-specific type.

enumerator SHT_ARM_EXIDX = 0x70000001U

Exception Index table

enumerator SHT_ARM_PREEMPTMAP = 0x70000002U

BPABI DLL dynamic linking pre-emption map

enumerator SHT_ARM_ATTRIBUTES = 0x70000003U

Object file compatibility attributes

enumerator SHT_ARM_DEBUGOVERLAY = 0x70000004U
enumerator SHT_ARM_OVERLAYSECTION = 0x70000005U
enumerator SHT_HEX_ORDERED = 0x70000000

Link editor is to sort the entries in

enumerator SHT_X86_64_UNWIND = 0x70000001

Unwind information

enumerator SHT_MIPS_REGINFO = 0x70000006

Register usage information

enumerator SHT_MIPS_OPTIONS = 0x7000000d

General options

enumerator SHT_MIPS_ABIFLAGS = 0x7000002a

ABI information.

enumerator SHT_HIPROC = 0x7fffffff

Highest processor arch-specific type.

enumerator SHT_LOUSER = 0x80000000

Lowest type reserved for applications.

enumerator SHT_HIUSER = 0xffffffff

Highest type reserved for applications.


Section flags

enum ELF::LIEF::ELF_SECTION_FLAGS

Section flags.

Values:

enumerator SHF_NONE = 0x0
enumerator SHF_WRITE = 0x1

Section data should be writable during execution.

enumerator SHF_ALLOC = 0x2

Section occupies memory during program execution.

enumerator SHF_EXECINSTR = 0x4

Section contains executable machine instructions.

enumerator SHF_MERGE = 0x10

The data in this section may be merged.

enumerator SHF_STRINGS = 0x20

The data in this section is null-terminated strings.

enumerator SHF_INFO_LINK = 0x40U

A field in this section holds a section header table index.

Adds special ordering requirements for link editors.

enumerator SHF_OS_NONCONFORMING = 0x100U

This section requires special OS-specific processing to avoid incorrect behavior

enumerator SHF_GROUP = 0x200U

This section is a member of a section group.

enumerator SHF_TLS = 0x400U

This section holds Thread-Local Storage.

enumerator SHF_EXCLUDE = 0x80000000U

This section is excluded from the final executable or shared library.

enumerator XCORE_SHF_CP_SECTION = 0x800U
enumerator XCORE_SHF_DP_SECTION = 0x1000U
enumerator SHF_MASKOS = 0x0ff00000
enumerator SHF_MASKPROC = 0xf0000000

Bits indicating processor-specific flags.

enumerator SHF_X86_64_LARGE = 0x10000000
enumerator SHF_HEX_GPREL = 0x10000000
enumerator SHF_MIPS_NODUPES = 0x01000000
enumerator SHF_MIPS_NAMES = 0x02000000

Linker must generate implicit hidden weak names.

enumerator SHF_MIPS_LOCAL = 0x04000000

Section data local to process.

enumerator SHF_MIPS_NOSTRIP = 0x08000000

Do not strip this section.

enumerator SHF_MIPS_GPREL = 0x10000000

Section must be part of global data area.

enumerator SHF_MIPS_MERGE = 0x20000000

This section should be merged.

enumerator SHF_MIPS_ADDR = 0x40000000

Address size to be inferred from section entry size.

enumerator SHF_MIPS_STRING = 0x80000000

Section data is string data by default.


Symbol bindings

enum ELF::LIEF::SYMBOL_BINDINGS

Symbol bindings.

Values:

enumerator STB_LOCAL = 0

Local symbol, not visible outside obj file containing def

enumerator STB_GLOBAL = 1

Global symbol, visible to all object files being combined

enumerator STB_WEAK = 2

Weak symbol, like global but lower-precedence

enumerator STB_GNU_UNIQUE = 10
enumerator STB_LOOS = 10

Lowest operating system-specific binding type

enumerator STB_HIOS = 12

Highest operating system-specific binding type

enumerator STB_LOPROC = 13

Lowest processor-specific binding type

enumerator STB_HIPROC = 15

Highest processor-specific binding type


Symbol visibility

enum ELF::LIEF::ELF_SYMBOL_VISIBILITY

Values:

enumerator STV_DEFAULT = 0
enumerator STV_INTERNAL = 1
enumerator STV_HIDDEN = 2
enumerator STV_PROTECTED = 3

Symbol types

enum ELF::LIEF::ELF_SYMBOL_TYPES

Values:

enumerator STT_NOTYPE = 0
enumerator STT_OBJECT = 1
enumerator STT_FUNC = 2
enumerator STT_SECTION = 3
enumerator STT_FILE = 4
enumerator STT_COMMON = 5
enumerator STT_TLS = 6
enumerator STT_GNU_IFUNC = 10
enumerator STT_LOOS = 10
enumerator STT_HIOS = 12
enumerator STT_LOPROC = 13
enumerator STT_HIPROC = 15

Segment types

enum ELF::LIEF::SEGMENT_TYPES

Segment types.

Values:

enumerator PT_NULL = 0

Unused segment.

enumerator PT_LOAD = 1

Loadable segment.

enumerator PT_DYNAMIC = 2

Dynamic linking information.

enumerator PT_INTERP = 3

Interpreter pathname.

enumerator PT_NOTE = 4

Auxiliary information.

enumerator PT_SHLIB = 5

Reserved.

enumerator PT_PHDR = 6

The program header table itself.

enumerator PT_TLS = 7

The thread-local storage template.

enumerator PT_LOOS = 0x60000000

Lowest operating system-specific pt entry type.

enumerator PT_HIOS = 0x6fffffff

Highest operating system-specific pt entry type.

enumerator PT_LOPROC = 0x70000000

Lowest processor-specific program hdr entry type.

enumerator PT_HIPROC = 0x7fffffff

Highest processor-specific program hdr entry type.

enumerator PT_GNU_EH_FRAME = 0x6474e550
enumerator PT_SUNW_EH_FRAME = 0x6474e550
enumerator PT_SUNW_UNWIND = 0x6464e550
enumerator PT_GNU_STACK = 0x6474e551

Indicates stack executability.

enumerator PT_GNU_PROPERTY = 0x6474e553

GNU property

enumerator PT_GNU_RELRO = 0x6474e552

Read-only after relocation.

enumerator PT_ARM_ARCHEXT = 0x70000000

Platform architecture compatibility info

enumerator PT_ARM_EXIDX = 0x70000001
enumerator PT_ARM_UNWIND = 0x70000001
enumerator PT_MIPS_REGINFO = 0x70000000

Register usage information.

enumerator PT_MIPS_RTPROC = 0x70000001

Runtime procedure table.

enumerator PT_MIPS_OPTIONS = 0x70000002

Options segment.

enumerator PT_MIPS_ABIFLAGS = 0x70000003

Abiflags segment.


Segment flags

enum ELF::LIEF::ELF_SEGMENT_FLAGS

Segment flags.

Values:

enumerator PF_NONE = 0
enumerator PF_X = 1

Execute

enumerator PF_W = 2

Write

enumerator PF_R = 4

Read

enumerator PF_MASKOS = 0x0ff00000

Bits for operating system-specific semantics.

enumerator PF_MASKPROC = 0xf0000000

Bits for processor-specific semantics.


Dynamic tags

enum ELF::LIEF::DYNAMIC_TAGS

Dynamic table entry tags.

Values:

enumerator DT_NULL = 0

Marks end of dynamic array.

enumerator DT_NEEDED = 1

String table offset of needed library.

enumerator DT_PLTRELSZ = 2

Size of relocation entries in PLT.

enumerator DT_PLTGOT = 3

Address associated with linkage table.

enumerator DT_HASH = 4

Address of symbolic hash table.

enumerator DT_STRTAB = 5

Address of dynamic string table.

enumerator DT_SYMTAB = 6

Address of dynamic symbol table.

enumerator DT_RELA = 7

Address of relocation table (Rela entries).

enumerator DT_RELASZ = 8

Size of Rela relocation table.

enumerator DT_RELAENT = 9

Size of a Rela relocation entry.

enumerator DT_STRSZ = 10

Total size of the string table.

enumerator DT_SYMENT = 11

Size of a symbol table entry.

enumerator DT_INIT = 12

Address of initialization function.

enumerator DT_FINI = 13

Address of termination function.

enumerator DT_SONAME = 14

String table offset of a shared objects name.

enumerator DT_RPATH = 15

String table offset of library search path.

enumerator DT_SYMBOLIC = 16

Changes symbol resolution algorithm.

enumerator DT_REL = 17

Address of relocation table (Rel entries).

enumerator DT_RELSZ = 18

Size of Rel relocation table.

enumerator DT_RELENT = 19

Size of a Rel relocation entry.

enumerator DT_PLTREL = 20

Type of relocation entry used for linking.

enumerator DT_DEBUG = 21

Reserved for debugger.

enumerator DT_TEXTREL = 22

Relocations exist for non-writable segments.

enumerator DT_JMPREL = 23

Address of relocations associated with PLT.

enumerator DT_BIND_NOW = 24

Process all relocations before execution.

enumerator DT_INIT_ARRAY = 25

Pointer to array of initialization functions.

enumerator DT_FINI_ARRAY = 26

Pointer to array of termination functions.

enumerator DT_INIT_ARRAYSZ = 27

Size of DT_INIT_ARRAY.

enumerator DT_FINI_ARRAYSZ = 28

Size of DT_FINI_ARRAY.

enumerator DT_RUNPATH = 29

String table offset of lib search path.

enumerator DT_FLAGS = 30

Flags.

enumerator DT_ENCODING = 32

Values from here to DT_LOOS follow the rules for the interpretation of the d_un union.

enumerator DT_PREINIT_ARRAY = 32

Pointer to array of preinit functions.

enumerator DT_PREINIT_ARRAYSZ = 33

Size of the DT_PREINIT_ARRAY array.

enumerator DT_LOOS = 0x60000000

Start of environment specific tags.

enumerator DT_HIOS = 0x6FFFFFFF

End of environment specific tags.

enumerator DT_LOPROC = 0x70000000

Start of processor specific tags.

enumerator DT_HIPROC = 0x7FFFFFFF

End of processor specific tags.

enumerator DT_GNU_HASH = 0x6FFFFEF5

Reference to the GNU hash table.

enumerator DT_RELACOUNT = 0x6FFFFFF9

ELF32_Rela count.

enumerator DT_RELCOUNT = 0x6FFFFFFA

ELF32_Rel count.

enumerator DT_FLAGS_1 = 0x6FFFFFFB

Flags_1.

enumerator DT_VERSYM = 0x6FFFFFF0

The address of .gnu.version section.

enumerator DT_VERDEF = 0x6FFFFFFC

The address of the version definition table.

enumerator DT_VERDEFNUM = 0x6FFFFFFD

The number of entries in DT_VERDEF.

enumerator DT_VERNEED = 0x6FFFFFFE

The address of the version Dependency table.

enumerator DT_VERNEEDNUM = 0x6FFFFFFF

The number of entries in DT_VERNEED.

enumerator DT_MIPS_RLD_VERSION = 0x70000001

32 bit version number for runtime linker interface.

enumerator DT_MIPS_TIME_STAMP = 0x70000002

Time stamp.

enumerator DT_MIPS_ICHECKSUM = 0x70000003

Checksum of external strings and common sizes.

enumerator DT_MIPS_IVERSION = 0x70000004

Index of version string in string table.

enumerator DT_MIPS_FLAGS = 0x70000005

32 bits of flags.

enumerator DT_MIPS_BASE_ADDRESS = 0x70000006

Base address of the segment.

enumerator DT_MIPS_MSYM = 0x70000007

Address of .msym section.

enumerator DT_MIPS_CONFLICT = 0x70000008

Address of .conflict section.

enumerator DT_MIPS_LIBLIST = 0x70000009

Address of .liblist section.

enumerator DT_MIPS_LOCAL_GOTNO = 0x7000000a

Number of local global offset table entries.

enumerator DT_MIPS_CONFLICTNO = 0x7000000b

Number of entries in the .conflict section.

enumerator DT_MIPS_LIBLISTNO = 0x70000010

Number of entries in the .liblist section.

enumerator DT_MIPS_SYMTABNO = 0x70000011

Number of entries in the .dynsym section.

enumerator DT_MIPS_UNREFEXTNO = 0x70000012

Index of first external dynamic symbol not referenced locally.

enumerator DT_MIPS_GOTSYM = 0x70000013

Index of first dynamic symbol in global offset table.

enumerator DT_MIPS_HIPAGENO = 0x70000014

Number of page table entries in global offset table.

enumerator DT_MIPS_RLD_MAP = 0x70000016

Address of run time loader map, used for debugging.

enumerator DT_MIPS_DELTA_CLASS = 0x70000017

Delta C++ class definition.

enumerator DT_MIPS_DELTA_CLASS_NO = 0x70000018

Number of entries in DT_MIPS_DELTA_CLASS.

enumerator DT_MIPS_DELTA_INSTANCE = 0x70000019

Delta C++ class instances.

enumerator DT_MIPS_DELTA_INSTANCE_NO = 0x7000001A

Number of entries in DT_MIPS_DELTA_INSTANCE.

enumerator DT_MIPS_DELTA_RELOC = 0x7000001B

Delta relocations.

enumerator DT_MIPS_DELTA_RELOC_NO = 0x7000001C

Number of entries in DT_MIPS_DELTA_RELOC.

enumerator DT_MIPS_DELTA_SYM = 0x7000001D

Delta symbols that Delta relocations refer to.

enumerator DT_MIPS_DELTA_SYM_NO = 0x7000001E

Number of entries in DT_MIPS_DELTA_SYM.

enumerator DT_MIPS_DELTA_CLASSSYM = 0x70000020

Delta symbols that hold class declarations.

enumerator DT_MIPS_DELTA_CLASSSYM_NO = 0x70000021

Number of entries in DT_MIPS_DELTA_CLASSSYM.

enumerator DT_MIPS_CXX_FLAGS = 0x70000022

Flags indicating information about C++ flavor.

enumerator DT_MIPS_PIXIE_INIT = 0x70000023

Pixie information.

enumerator DT_MIPS_SYMBOL_LIB = 0x70000024

Address of .MIPS.symlib

enumerator DT_MIPS_LOCALPAGE_GOTIDX = 0x70000025

The GOT index of the first PTE for a segment

enumerator DT_MIPS_LOCAL_GOTIDX = 0x70000026

The GOT index of the first PTE for a local symbol

enumerator DT_MIPS_HIDDEN_GOTIDX = 0x70000027

The GOT index of the first PTE for a hidden symbol

enumerator DT_MIPS_PROTECTED_GOTIDX = 0x70000028

The GOT index of the first PTE for a protected symbol

enumerator DT_MIPS_OPTIONS = 0x70000029

Address of .MIPS.options.

enumerator DT_MIPS_INTERFACE = 0x7000002A

Address of .interface.

enumerator DT_MIPS_DYNSTR_ALIGN = 0x7000002B

Unknown.

enumerator DT_MIPS_INTERFACE_SIZE = 0x7000002C

Size of the .interface section.

enumerator DT_MIPS_RLD_TEXT_RESOLVE_ADDR = 0x7000002D

Size of rld_text_resolve function stored in the GOT.

enumerator DT_MIPS_PERF_SUFFIX = 0x7000002E

Default suffix of DSO to be added by rld on dlopen() calls.

enumerator DT_MIPS_COMPACT_SIZE = 0x7000002F

Size of compact relocation section (O32).

enumerator DT_MIPS_GP_VALUE = 0x70000030

GP value for auxiliary GOTs.

enumerator DT_MIPS_AUX_DYNAMIC = 0x70000031

Address of auxiliary .dynamic.

enumerator DT_MIPS_PLTGOT = 0x70000032

Address of the base of the PLTGOT.

enumerator DT_MIPS_RWPLT = 0x70000034

Points to the base of a writable PLT.


Dynamic flags

enum ELF::LIEF::DYNAMIC_FLAGS

DT_FLAGS and DT_FLAGS_1 values.

Values:

enumerator DF_ORIGIN = 0x00000001

The object may reference $ORIGIN.

enumerator DF_SYMBOLIC = 0x00000002

Search the shared lib before searching the exe.

enumerator DF_TEXTREL = 0x00000004

Relocations may modify a non-writable segment.

enumerator DF_BIND_NOW = 0x00000008

Process all relocations on load.

enumerator DF_STATIC_TLS = 0x00000010

Reject attempts to load dynamically.


Dynamic flags 1

enum ELF::LIEF::DYNAMIC_FLAGS_1

Values:

enumerator DF_1_NOW = 0x00000001

Set RTLD_NOW for this object.

enumerator DF_1_GLOBAL = 0x00000002

Set RTLD_GLOBAL for this object.

enumerator DF_1_GROUP = 0x00000004

Set RTLD_GROUP for this object.

enumerator DF_1_NODELETE = 0x00000008

Set RTLD_NODELETE for this object.

enumerator DF_1_LOADFLTR = 0x00000010

Trigger filtee loading at runtime.

enumerator DF_1_INITFIRST = 0x00000020

Set RTLD_INITFIRST for this object.

enumerator DF_1_NOOPEN = 0x00000040

Set RTLD_NOOPEN for this object.

enumerator DF_1_ORIGIN = 0x00000080

$ORIGIN must be handled.

enumerator DF_1_DIRECT = 0x00000100

Direct binding enabled.

enumerator DF_1_TRANS = 0x00000200
enumerator DF_1_INTERPOSE = 0x00000400

Object is used to interpose.

enumerator DF_1_NODEFLIB = 0x00000800

Ignore default lib search path.

enumerator DF_1_NODUMP = 0x00001000

Object can’t be dldump’ed.

enumerator DF_1_CONFALT = 0x00002000

Configuration alternative created.

enumerator DF_1_ENDFILTEE = 0x00004000

Filtee terminates filters search.

enumerator DF_1_DISPRELDNE = 0x00008000

Disp reloc applied at build time.

enumerator DF_1_DISPRELPND = 0x00010000

Disp reloc applied at run-time.

enumerator DF_1_NODIRECT = 0x00020000

Object has no-direct binding.

enumerator DF_1_IGNMULDEF = 0x00040000
enumerator DF_1_NOKSYMS = 0x00080000
enumerator DF_1_NOHDR = 0x00100000
enumerator DF_1_EDITED = 0x00200000

Object is modified after built.

enumerator DF_1_NORELOC = 0x00400000
enumerator DF_1_SYMINTPOSE = 0x00800000

Object has individual interposers.

enumerator DF_1_GLOBAUDIT = 0x01000000

Global auditing required.

enumerator DF_1_SINGLETON = 0x02000000

Singleton symbols are used.


Dynamic symbols counting

enum ELF::LIEF::DYNSYM_COUNT_METHODS

Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols

Values:

enumerator COUNT_AUTO = 0

Automatic detection

enumerator COUNT_SECTION = 1

Count based on sections (not very reliable)