ELF

Parser

class Parser : public LIEF::Parser

Class which parse an ELF file and transform into a ELF::Binary.

Public Functions

Parser &operator=(const Parser &copy)
Parser(const Parser &copy)

Public Static Functions

std::unique_ptr<Binary> parse(const std::string &file, DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse an ELF file an return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters

std::unique_ptr<Binary> parse(const std::vector<uint8_t> &data, const std::string &name = "", DYNSYM_COUNT_METHODS count_mtd = DYNSYM_COUNT_METHODS::COUNT_AUTO)

Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.

For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols

Parameters

Public Static Attributes

constexpr uint32_t NB_MAX_SYMBOLS = 1000000
constexpr uint32_t DELTA_NB_SYMBOLS = 3000
constexpr uint32_t NB_MAX_BUCKETS = NB_MAX_SYMBOLS
constexpr uint32_t NB_MAX_CHAINS = 1000000
constexpr uint32_t NB_MAX_SECTION = 10000
constexpr uint32_t NB_MAX_SEGMENTS = 10000
constexpr uint32_t NB_MAX_RELOCATIONS = 3000000
constexpr uint32_t NB_MAX_DYNAMIC_ENTRIES = 1000
constexpr uint32_t NB_MAX_MASKWORD = 512
constexpr uint32_t LIEF::ELF::Parser::MAX_NOTE_DESCRIPTION = 1_MB
constexpr uint32_t LIEF::ELF::Parser::MAX_SECTION_SIZE = 100_MB
constexpr uint32_t MAX_SEGMENT_SIZE = MAX_SECTION_SIZE

Friends

friend LIEF::ELF::Parser::OAT::Parser

Binary

class Binary : public LIEF::Binary

Class which represent an ELF binary.

Subclassed by LIEF::OAT::Binary

Public Types

using string_list_t = std::vector<std::string>
using overlay_t = std::vector<uint8_t>

Public Functions

Binary(const std::string &name, ELF_CLASS type)
Binary &operator=(const Binary&)
Binary(const Binary &copy)
ELF_CLASS type(void) const

Return binary’s class (ELF32 or ELF64)

Header &header(void)

Return Elf header .

const Header &header(void) const
uint64_t last_offset_section(void) const

Return the last offset used in binary according to section headers.

uint64_t last_offset_segment(void) const

Return the last offset used in binary according to segment headers.

uint64_t next_virtual_address(void) const

Return the next virtual address available.

it_sections sections(void)

Return binary’s sections.

Warning

This method return a vector of references thus you can modify vector’s elements (section) but not add elements.

it_const_sections sections(void) const
uint64_t entrypoint(void) const

Return binary entrypoint.

it_segments segments(void)

Return binary’s segments.

it_const_segments segments(void) const
it_dynamic_entries dynamic_entries(void)

Return binary’s dynamic entries.

it_const_dynamic_entries dynamic_entries(void) const
DynamicEntry &add(const DynamicEntry &entry)

Add the given dynamic entry and return the entry added.

Note &add(const Note &note)

Add the given note and return the entry added.

void remove(const DynamicEntry &entry)

Remove the given dynamic entry.

void remove(DYNAMIC_TAGS tag)

Remove all dynamic entries with the given tag.

void remove(const Section &section, bool clear = false)

Remove the given section.

void remove(const Note &note)

Remove the given note.

void remove(NOTE_TYPES tag)

Remove all notes with the given type.

it_symbols dynamic_symbols(void)

Return binary’s dynamic symbols.

it_const_symbols dynamic_symbols(void) const
it_exported_symbols exported_symbols(void)

Return symbols which are exported by the binary.

it_const_exported_symbols exported_symbols(void) const
it_imported_symbols imported_symbols(void)

Return symbols which are imported by the binary.

it_const_imported_symbols imported_symbols(void) const
it_symbols static_symbols(void)

Return statics symbols.

it_const_symbols static_symbols(void) const
it_symbols_version symbols_version(void)

Return symbol versions.

it_const_symbols_version symbols_version(void) const
it_symbols_version_definition symbols_version_definition(void)

Return symbols version definition.

it_const_symbols_version_definition symbols_version_definition(void) const
it_symbols_version_requirement symbols_version_requirement(void)

Return Symbol version requirement.

it_const_symbols_version_requirement symbols_version_requirement(void) const
it_dynamic_relocations dynamic_relocations(void)

Return dynamic relocations.

it_const_dynamic_relocations dynamic_relocations(void) const
Relocation &add_dynamic_relocation(const Relocation &relocation)
Relocation &add_pltgot_relocation(const Relocation &relocation)
it_pltgot_relocations pltgot_relocations(void)

Return plt.got relocations.

it_const_pltgot_relocations pltgot_relocations(void) const
it_object_relocations object_relocations(void)

Return relocations used in an object file (*.o)

it_const_object_relocations object_relocations(void) const
it_relocations relocations(void)

Return all relocations present in the binary.

it_const_relocations relocations(void) const
const Relocation *get_relocation(uint64_t address) const

Return relocation associated with the given address. nullptr if not found

Relocation *get_relocation(uint64_t address)
const Relocation *get_relocation(const Symbol &symbol) const

Return relocation associated with the given Symbol.

Relocation *get_relocation(const Symbol &symbol)
const Relocation *get_relocation(const std::string &symbol_name) const

Return relocation associated with the given Symbol name.

Relocation *get_relocation(const std::string &symbol_name)
bool use_gnu_hash(void) const

true if GNU hash is used

See

gnu_hash and use_sysv_hash

const GnuHash &gnu_hash(void) const

Return the GnuHash object in readonly

bool use_sysv_hash(void) const

true if SYSV hash is used

See

sysv_hash and use_gnu_hash

const SysvHash &sysv_hash(void) const

Return the SysvHash object in readonly

bool has_section(const std::string &name) const

Check if a section with the given name exists in the binary.

bool has_section_with_offset(uint64_t offset) const

Check if a section that handle the given offset exists.

bool has_section_with_va(uint64_t va) const

Check if a section that handle the given virtual address exists.

Section &get_section(const std::string &name)

Return Section with the given name

const Section &get_section(const std::string &name) const
Section &text_section(void)

Return .text section.

Section &dynamic_section(void)

Return .dynamic section.

Section &hash_section(void)

Return hash section.

Section &static_symbols_section(void)

Return section which holds static symbols.

uint64_t imagebase(void) const

Return program image base. For instance 0x40000.

To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset

uint64_t virtual_size(void) const

Return the size of the mapped binary.

bool has_interpreter(void) const

Check if the binary uses a loader.

See

interpreter

const std::string &interpreter(void) const

Return ELF interprer if any. (e.g. /lib64/ld-linux-x86-64.so.2)

void interpreter(const std::string &interpreter)

Change the interpreter.

it_symbols symbols(void)

Return both static and dynamic symbols.

it_const_symbols symbols(void) const
Symbol &export_symbol(const Symbol &symbol)

Export the given symbol and create it if it doesn’t exist.

Symbol &export_symbol(const std::string &symbol_name, uint64_t value = 0)

Export the symbol with the given name and create it if it doesn’t exist.

bool has_dynamic_symbol(const std::string &name) const

Check if the symbol with the given name exists in the dynamic symbol table.

const Symbol &get_dynamic_symbol(const std::string &name) const

Get the dynamic symbol from the given name.

Symbol &get_dynamic_symbol(const std::string &name)
bool has_static_symbol(const std::string &name) const

Check if the symbol with the given name exists in the static symbol table.

const Symbol &get_static_symbol(const std::string &name) const

Get the static symbol from the given name.

Symbol &get_static_symbol(const std::string &name)
Binary::string_list_t strings(const size_t min_size = 5) const

Return list of strings used by the ELF binrary.

Basically we look for string in the .roadata

void remove_symbol(const std::string &name)

Remove symbols with the given name in boths.

void remove_static_symbol(const std::string &name)

Remove static symbols with the given name.

void remove_static_symbol(Symbol *symbol)
void remove_dynamic_symbol(const std::string &name)

Remove dynamic symbols with the given name.

void remove_dynamic_symbol(Symbol *symbol)

Remove the given symbol from the dynamic symbol table.

As a side effect, it will remove any ELF::Relocation that refer to this symbol and the SymbolVersion (if any) associated with this symbol

uint64_t get_function_address(const std::string &func_name) const

Return the address of the given function name.

uint64_t get_function_address(const std::string &func_name, bool demangled) const

Return the address of the given function name.

Parameters
  • func_name: The function’s name target

  • demangled: Use the demangled name

Section &add(const Section &section, bool loaded = true)

Add a new section in the binary

Return

The section added. The size and the virtual address may have changed.

Parameters
  • [in] section: The section object to insert

  • [in] loaded: Boolean value to indicate that sections’s data must be loaded

Section &extend(const Section &section, uint64_t size)
Symbol &add_static_symbol(const Symbol &symbol)

Add a static symbol.

Symbol &add_dynamic_symbol(const Symbol &symbol, const SymbolVersion &version = SymbolVersion::global())

Add a dynamic symbol with the associated SymbolVersion.

Symbol &add_exported_function(uint64_t address, const std::string &name = "")

Create a symbol for the function at the given address and export it.

DynamicEntryLibrary &add_library(const std::string &library_name)

Add a library as dependency.

void remove_library(const std::string &library_name)

Remove the given library.

DynamicEntryLibrary &get_library(const std::string &library_name)

Get the library object (DynamicEntryLibrary) from the given name.

const DynamicEntryLibrary &get_library(const std::string &library_name) const

Get the library object (DynamicEntryLibrary) from the given name.

bool has_library(const std::string &name) const

Check if the given library name exists in the current binary.

Segment &add(const Segment &segment, uint64_t base = 0)

Add a new segment in the binary.

The segment is inserted at the end

Warning

We assume that the binary is not position independent

Return

The segment added. Virtual address and File Offset may have changed

Segment &replace(const Segment &new_segment, const Segment &original_segment, uint64_t base = 0)
Segment &extend(const Segment &segment, uint64_t size)
void patch_address(uint64_t address, const std::vector<uint8_t> &patch_value, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO)

Patch the content at virtual address address with patch_value.

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

void patch_address(uint64_t address, uint64_t patch_value, size_t size = sizeof(uint64_t), LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO)

Patch the address with the given value.

Parameters
  • [in] address: Address to patch

  • [in] patch_value: Patch to apply

  • [in] size: Size of the value in bytes (1, 2, … 8)

void patch_pltgot(const Symbol &symbol, uint64_t address)

Patch the imported symbol with the address

Parameters
  • [in] symbol: Imported symbol to patch

  • [in] address: New address

void patch_pltgot(const std::string &symbol_name, uint64_t address)

Patch the imported symbol’s name with the address

Parameters
  • [in] symbol_name: Imported symbol’s name to patch

  • [in] address: New address

void strip(void)

Strip the binary by removing static symbols.

void remove_section(const std::string &name, bool clear = false)

Remove a binary’s section.

We clear data used by this section and it’s removed from section table

void write(const std::string &filename)

Reconstruct the binary object and write it in filename

Parameters
  • filename: Path to write the reconstructed binary

std::vector<uint8_t> raw(void)

Reconstruct the binary object and return his content as bytes.

uint64_t virtual_address_to_offset(uint64_t virtual_address) const

Convert a virtual address to an offset in the file.

bool is_pie(void) const

Check if the binary has been compiled with -fpie -pie flags.

To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)

bool has_nx(void) const

Check if the binary uses NX protection.

const Section &section_from_offset(uint64_t offset) const

Return the Section from the offset.

Section &section_from_offset(uint64_t offset)
const Section &section_from_virtual_address(uint64_t address) const

Return the Section from the address.

Section &section_from_virtual_address(uint64_t address)
const Segment &segment_from_virtual_address(uint64_t address) const

Return the Segment from the address.

Segment &segment_from_virtual_address(uint64_t address)
const Segment &segment_from_offset(uint64_t offset) const

Return the Segment from the offset.

Segment &segment_from_offset(uint64_t offset)
const DynamicEntry &get(DYNAMIC_TAGS tag) const

Return the first ELF::DynamicEntry associated with the given tag.

DynamicEntry &get(DYNAMIC_TAGS tag)
const Segment &get(SEGMENT_TYPES type) const

Return the first ELF::Segment associated with the given type.

Segment &get(SEGMENT_TYPES type)
const Note &get(NOTE_TYPES type) const

Return the first ELF::Note associated with the given type.

Note &get(NOTE_TYPES type)
const Section &get(ELF_SECTION_TYPES type) const

Return the first ELF::Section associated with the given type.

Section &get(ELF_SECTION_TYPES type)
bool has(DYNAMIC_TAGS tag) const

Check if an ELF::DynamicEntry associated with the given tag exists.

bool has(SEGMENT_TYPES type) const

Check if ELF::Segment associated with the given type exists.

bool has(NOTE_TYPES type) const

Check if a ELF::Note associated with the given type exists.

bool has(ELF_SECTION_TYPES type) const

Check if a ELF::Section associated with the given type exists.

std::vector<uint8_t> get_content_from_virtual_address(uint64_t virtual_address, uint64_t size, LIEF::Binary::VA_TYPES addr_type = LIEF::Binary::VA_TYPES::AUTO) const

Return the content located at virtual address.

void accept(LIEF::Visitor &visitor) const

Method so that the visitor can visit us.

void permute_dynamic_symbols(const std::vector<size_t> &permutation)

Apply the given permutation on the dynamic symbols table.

To avoid override by the ELF::Builder, one should set ELF::Builder::empties_gnuhash to true

LIEF::Binary::functions_t ctor_functions(void) const

Constructor functions that are called prior any other functions.

LIEF::Binary::functions_t dtor_functions(void) const
LIEF::Binary::functions_t functions(void) const
bool has_notes(void) const

true if the binary embed notes

it_const_notes notes(void) const

Return the Note object if any.

See

has_note

it_notes notes(void)
uint64_t eof_offset(void) const
bool has_overlay(void) const

True if data are present at the end of the binary.

const Binary::overlay_t &overlay(void) const

Overlay data (if any)

void overlay(overlay_t overlay)
size_t hash(const std::string &name)
~Binary(void)
std::ostream &print(std::ostream &os) const
bool operator==(const Binary &rhs) const
bool operator!=(const Binary &rhs) const
Binary &operator+=(const DynamicEntry &entry)
Binary &operator+=(const Section &section)
Binary &operator+=(const Segment &segment)
Binary &operator+=(const Note &note)
Binary &operator-=(const DynamicEntry &entry)
Binary &operator-=(DYNAMIC_TAGS tag)
Binary &operator-=(const Note &note)
Binary &operator-=(NOTE_TYPES type)
Segment &operator[](SEGMENT_TYPES type)
const Segment &operator[](SEGMENT_TYPES type) const
DynamicEntry &operator[](DYNAMIC_TAGS tag)
const DynamicEntry &operator[](DYNAMIC_TAGS tag) const
Note &operator[](NOTE_TYPES type)
const Note &operator[](NOTE_TYPES type) const
Section &operator[](ELF_SECTION_TYPES type)
const Section &operator[](ELF_SECTION_TYPES type) const


Section

class Section : public LIEF::Section

Class wich represent sections.

Public Functions

Section(uint8_t *data, ELF_CLASS type)
Section(const Elf64_Shdr *header)
Section(const Elf32_Shdr *header)
Section(const std::string &name, ELF_SECTION_TYPES type = ELF_SECTION_TYPES::SHT_PROGBITS)
Section(void)
~Section(void)
Section &operator=(Section other)
Section(const Section &other)
void swap(Section &other)
uint32_t name_idx(void) const
ELF_SECTION_TYPES type(void) const
std::vector<uint8_t> content(void) const

Section’s content.

void content(const std::vector<uint8_t> &data)

Set section content.

void content(std::vector<uint8_t> &&data)
uint64_t flags(void) const

Section flags LIEF::ELF::ELF_SECTION_FLAGS.

bool has(ELF_SECTION_FLAGS flag) const

True if the section has the given flag

Parameters
  • [in] flag: flag to test

bool has(const Segment &segment) const

True if the section is in the given segment

std::set<ELF_SECTION_FLAGS> flags_list(void) const

Return section flags as a std::set

uint64_t size(void) const

section’s size (size in the binary)

void size(uint64_t size)

section’s size (size in the binary)

void offset(uint64_t offset)
uint64_t offset(void) const

offset in the binary

uint64_t file_offset(void) const

See

offset

uint64_t original_size(void) const
uint64_t alignment(void) const
uint64_t information(void) const
uint64_t entry_size(void) const
uint32_t link(void) const
Section &clear(uint8_t value = 0)

Clear the content of the section with the given value

void add(ELF_SECTION_FLAGS flag)
void remove(ELF_SECTION_FLAGS flag)
void type(ELF_SECTION_TYPES type)
void flags(uint64_t flags)
void clear_flags(void)
void file_offset(uint64_t offset)
void link(uint32_t link)
void information(uint32_t info)
void alignment(uint64_t alignment)
void entry_size(uint64_t entry_size)
it_segments segments(void)
it_const_segments segments(void) const
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

Section &operator+=(ELF_SECTION_FLAGS c)
Section &operator-=(ELF_SECTION_FLAGS c)
bool operator==(const Section &rhs) const
bool operator!=(const Section &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Section &section)

Segment

class Segment : public LIEF::Object

Class which represent segments.

Public Functions

Segment(void)
Segment(const std::vector<uint8_t> &header, ELF_CLASS type)
Segment(const std::vector<uint8_t> &header)
Segment(const Elf64_Phdr *header)
Segment(const Elf32_Phdr *header)
~Segment(void)
Segment &operator=(Segment other)
Segment(const Segment &other)
void swap(Segment &other)
SEGMENT_TYPES type(void) const
ELF_SEGMENT_FLAGS flags(void) const
uint64_t file_offset(void) const
uint64_t virtual_address(void) const
uint64_t physical_address(void) const
uint64_t physical_size(void) const
uint64_t virtual_size(void) const
uint64_t alignment(void) const
std::vector<uint8_t> content(void) const
bool has(ELF_SEGMENT_FLAGS flag) const
bool has(const Section &section) const
bool has(const std::string &section_name) const
void add(ELF_SEGMENT_FLAGS c)
void remove(ELF_SEGMENT_FLAGS c)
void type(SEGMENT_TYPES type)
void flags(ELF_SEGMENT_FLAGS flags)
void clear_flags(void)
void file_offset(uint64_t fileOffset)
void virtual_address(uint64_t virtualAddress)
void physical_address(uint64_t physicalAddress)
void physical_size(uint64_t physicalSize)
void virtual_size(uint64_t virtualSize)
void alignment(uint64_t alignment)
void content(const std::vector<uint8_t> &content)
void content(std::vector<uint8_t> &&content)
it_sections sections(void)
it_const_sections sections(void) const
void accept(Visitor &visitor) const
Segment &operator+=(ELF_SEGMENT_FLAGS c)
Segment &operator-=(ELF_SEGMENT_FLAGS c)
bool operator==(const Segment &rhs) const
bool operator!=(const Segment &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Segment &segment)

Dynamic Entry

class DynamicEntry : public LIEF::Object

Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject

Public Functions

DynamicEntry(const Elf64_Dyn *header)
DynamicEntry(const Elf32_Dyn *header)
DynamicEntry(void)
DynamicEntry(DYNAMIC_TAGS tag, uint64_t value)
DynamicEntry &operator=(const DynamicEntry&)
DynamicEntry(const DynamicEntry&)
~DynamicEntry(void)
DYNAMIC_TAGS tag(void) const
uint64_t value(void) const
void tag(DYNAMIC_TAGS tag)
void value(uint64_t value)
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const
bool operator==(const DynamicEntry &rhs) const
bool operator!=(const DynamicEntry &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const DynamicEntry &entry)

Dynamic Entry Library

class DynamicEntryLibrary : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryLibrary(void)
DynamicEntryLibrary(const std::string &name)
DynamicEntryLibrary &operator=(const DynamicEntryLibrary&)
DynamicEntryLibrary(const DynamicEntryLibrary&)
const std::string &name(void) const
void name(const std::string &name)
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Dynamic Shared Object

class DynamicSharedObject : public LIEF::ELF::DynamicEntry

Public Functions

DynamicSharedObject(void)
DynamicSharedObject(const std::string &name)
DynamicSharedObject &operator=(const DynamicSharedObject&)
DynamicSharedObject(const DynamicSharedObject&)
const std::string &name(void) const
void name(const std::string &name)
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Dynamic Entry Run Path

class DynamicEntryRunPath : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryRunPath(void)
DynamicEntryRunPath(const std::string &name)

Constructor from (run)path.

DynamicEntryRunPath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRunPath &operator=(const DynamicEntryRunPath&)
DynamicEntryRunPath(const DynamicEntryRunPath&)
const std::string &name(void) const

Runpath raw value.

void name(const std::string &name)
const std::string &runpath(void) const

Runpath raw value.

void runpath(const std::string &runpath)
std::vector<std::string> paths(void) const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRunPath &insert(size_t pos, const std::string path)

Insert a path at the given position

DynamicEntryRunPath &append(const std::string &path)

Append the given path

DynamicEntryRunPath &remove(const std::string &path)

Remove the given path

DynamicEntryRunPath &operator+=(const std::string &path)
DynamicEntryRunPath &operator-=(const std::string &path)
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Public Static Attributes

constexpr char delimiter = ':'

Dynamic Entry RPath

class DynamicEntryRpath : public LIEF::ELF::DynamicEntry

Public Functions

DynamicEntryRpath(void)
DynamicEntryRpath(const std::string &name)
DynamicEntryRpath(const std::vector<std::string> &paths)

Constructor from a list of paths.

DynamicEntryRpath &operator=(const DynamicEntryRpath&)
DynamicEntryRpath(const DynamicEntryRpath&)
const std::string &name(void) const
void name(const std::string &name)
const std::string &rpath(void) const
void rpath(const std::string &name)
std::vector<std::string> paths(void) const

Paths as a list.

void paths(const std::vector<std::string> &paths)
DynamicEntryRpath &insert(size_t pos, const std::string path)

Insert a path at the given position

DynamicEntryRpath &append(const std::string &path)

Append the given path

DynamicEntryRpath &remove(const std::string &path)

Remove the given path

DynamicEntryRpath &operator+=(const std::string &path)
DynamicEntryRpath &operator-=(const std::string &path)
void accept(Visitor &visitor) const
std::ostream &print(std::ostream &os) const

Public Static Attributes

constexpr char delimiter = ':'

Dynamic Entry Array

class DynamicEntryArray : public LIEF::ELF::DynamicEntry

Public Types

using array_t = std::vector<uint64_t>

Public Functions

DynamicEntryArray(void)
DynamicEntryArray(DYNAMIC_TAGS tag, const array_t &array)
DynamicEntryArray &operator=(const DynamicEntryArray&)
DynamicEntryArray(const DynamicEntryArray&)
DynamicEntryArray::array_t &array(void)
const DynamicEntryArray::array_t &array(void) const
void array(const array_t &array)
DynamicEntryArray &insert(size_t pos, uint64_t callback)

Insert the given callback at pos

DynamicEntryArray &append(uint64_t callback)

Append the given callback.

DynamicEntryArray &remove(uint64_t callback)

Remove the given callback.

size_t size(void) const

Number of callback registred.

DynamicEntryArray &operator+=(uint64_t value)
DynamicEntryArray &operator-=(uint64_t value)
const uint64_t &operator[](size_t idx) const
uint64_t &operator[](size_t idx)
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const
~DynamicEntryArray(void)

Dynamic Entry Flags

class DynamicEntryFlags : public LIEF::ELF::DynamicEntry

Public Types

using flags_list_t = std::set<uint32_t>

Public Functions

DynamicEntryFlags(void)
DynamicEntryFlags &operator=(const DynamicEntryFlags&)
DynamicEntryFlags(const DynamicEntryFlags&)
bool has(DYNAMIC_FLAGS f) const

If the current entry has the given DYNAMIC_FLAGS.

bool has(DYNAMIC_FLAGS_1 f) const

If the current entry has the given DYNAMIC_FLAGS_1.

DynamicEntryFlags::flags_list_t flags(void) const

Return flags as a list of integers.

void add(DYNAMIC_FLAGS f)

Add the given DYNAMIC_FLAGS.

void add(DYNAMIC_FLAGS_1 f)

Add the given DYNAMIC_FLAGS_1.

void remove(DYNAMIC_FLAGS f)

Remove the given DYNAMIC_FLAGS.

void remove(DYNAMIC_FLAGS_1 f)

Remove the given DYNAMIC_FLAGS_1.

DynamicEntryFlags &operator+=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator+=(DYNAMIC_FLAGS_1 f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS f)
DynamicEntryFlags &operator-=(DYNAMIC_FLAGS_1 f)
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

std::ostream &print(std::ostream &os) const

Relocations

class Relocation : public LIEF::Relocation

Public Functions

Relocation(const Elf32_Rel *header)
Relocation(const Elf32_Rela *header)
Relocation(const Elf64_Rel *header)
Relocation(const Elf64_Rela *header)
Relocation(uint64_t address, uint32_t type = 0, int64_t addend = 0, bool isRela = false)
template<class T, typename = typename std::enable_if<std::is_enum<T>::value>::type>
Relocation(uint64_t address, T type, int64_t addend = 0, bool isRela = false)
Relocation(void)
~Relocation(void)
Relocation &operator=(Relocation other)
Relocation(const Relocation &other)
void swap(Relocation &other)
int64_t addend(void) const
uint32_t type(void) const
bool is_rela(void) const
bool is_rel(void) const
uint32_t info(void) const
ARCH architecture(void) const
RELOCATION_PURPOSES purpose(void) const
size_t size(void) const

Return the bit size of the value to patch.

Return -1 if it fails

bool has_symbol(void) const
Symbol &symbol(void)
const Symbol &symbol(void) const
bool has_section(void) const

True if the relocation has a section associated.

Section &section(void)

Section associated with this relocation.

const Section &section(void) const
void addend(int64_t addend)
void type(uint32_t type)
void purpose(RELOCATION_PURPOSES purpose)
void info(uint32_t v)
void symbol(Symbol *symbol)
void accept(Visitor &visitor) const

Method so that the visitor can visit us.

bool operator==(const Relocation &rhs) const
bool operator!=(const Relocation &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Relocation &entry)

Symbol

class Symbol : public LIEF::Symbol

Public Functions

Symbol(const Elf32_Sym *header)
Symbol(const Elf64_Sym *header)
Symbol(std::string name, ELF_SYMBOL_TYPES type = ELF_SYMBOL_TYPES::STT_NOTYPE, SYMBOL_BINDINGS binding = SYMBOL_BINDINGS::STB_WEAK, uint8_t other = 0, uint16_t shndx = 0, uint64_t value = 0, uint64_t size = 0)
Symbol(void)
~Symbol(void)
Symbol &operator=(Symbol other)
Symbol(const Symbol &other)
void swap(Symbol &other)
ELF_SYMBOL_TYPES type(void) const

A symbol’s type provides a general classification for the associated entity.

SYMBOL_BINDINGS binding(void) const

A symbol’s binding determines the linkage visibility and behavior.

uint8_t information(void) const

This member specifies the symbol’s type and binding attributes.

uint8_t other(void) const

This member currently holds 0 and has no defined meaning.

uint16_t section_idx(void) const

section index associated with the symbol

ELF_SYMBOL_VISIBILITY visibility(void) const
Section &section(void)
uint16_t shndx(void) const

Symbol size.

This member have slightly different interpretations:

  • In relocatable files, value holds alignment constraints for a symbol whose section index is SHN_COMMON

  • In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.

  • In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.

    See

    Symbol::section_idx

bool has_version(void) const

Check if this symbols has a symbol version .

SymbolVersion &symbol_version(void)

Return the symbol version associated with this symbol.

const SymbolVersion &symbol_version(void) const
std::string demangled_name(void) const

Symbol’s unmangled name.

void type(ELF_SYMBOL_TYPES type)
void binding(SYMBOL_BINDINGS binding)
void other(uint8_t other)
void visibility(ELF_SYMBOL_VISIBILITY visibility)
void information(uint8_t info)
void shndx(uint16_t idx)
void shndx(SYMBOL_SECTION_INDEX idx)
bool is_exported(void) const

Check if the current symbol is exported.

void set_exported(bool flag = true)

Set whether or not the symbol is exported.

bool is_imported(void) const

Check if the current symbol is imported.

void set_imported(bool flag = true)

Set whether or not the symbol is imported.

bool is_static(void) const

True if the symbol is a static one.

bool is_function(void) const

True if the symbol represent a function.

bool is_variable(void) const

True if the symbol represent a variable.

void accept(Visitor &visitor) const

Method so that the visitor can visit us.

bool operator==(const Symbol &rhs) const
bool operator!=(const Symbol &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const Symbol &entry)

Symbol Version

class SymbolVersion : public LIEF::Object

Class which modelization of an entry defined in DT_VERSYM

Public Functions

SymbolVersion(uint16_t value)
SymbolVersion(void)
~SymbolVersion(void)
SymbolVersion &operator=(const SymbolVersion&)
SymbolVersion(const SymbolVersion&)
uint16_t value(void) const

Value associated with the symbol

If the given SymbolVersion hasn’t Auxiliary version:

  • 0 means Local

  • 1 means Global

bool has_auxiliary_version(void) const

Whether or not the current SymbolVersion has an auxiliary one.

SymbolVersionAux &symbol_version_auxiliary(void)

SymbolVersionAux associated with the current Version (if any)

const SymbolVersionAux &symbol_version_auxiliary(void) const
void value(uint16_t v)
void accept(Visitor &visitor) const
bool operator==(const SymbolVersion &rhs) const
bool operator!=(const SymbolVersion &rhs) const

Public Static Functions

SymbolVersion local(void)

Generate a local SymbolVersion.

SymbolVersion global(void)

Generate a global SymbolVersion.

Friends

std::ostream &operator<<(std::ostream &os, const SymbolVersion &symv)

Symbol Version Auxiliary

class SymbolVersionAux : public LIEF::Object

Class which modelize an Auxiliary Symbol version.

Subclassed by LIEF::ELF::SymbolVersionAuxRequirement

Public Functions

SymbolVersionAux(const std::string &name)
SymbolVersionAux(void)
~SymbolVersionAux(void)
SymbolVersionAux &operator=(const SymbolVersionAux&)
SymbolVersionAux(const SymbolVersionAux&)
const std::string &name(void) const

Smybol’s aux name (e.g. GLIBC_2.2.5)

void name(const std::string &name)
void accept(Visitor &visitor) const
bool operator==(const SymbolVersionAux &rhs) const
bool operator!=(const SymbolVersionAux &rhs) const

Friends

std::ostream &operator<<(std::ostream &os, const SymbolVersionAux &symAux)

GNU Hash table

class GnuHash : public LIEF::Object

Public Functions

GnuHash(void)
GnuHash(uint32_t symbol_idx, uint32_t shift2, const std::vector<uint64_t> &bloom_filters, const std::vector<uint32_t> &buckets, const std::vector<uint32_t> &hash_values = {})
GnuHash &operator=(const GnuHash &copy)
GnuHash(const GnuHash &copy)
~GnuHash(void)
uint32_t nb_buckets(void) const

Return the number of buckets.

See

GnuHash::buckets

uint32_t symbol_index(void) const

Index of the first symbol in the dynamic symbols table which accessible with the hash table.

uint32_t shift2(void) const

Shift count used in the bloom filter.

uint32_t maskwords(void) const

Number of bloom filters used. It must be a power of 2.

const std::vector<uint64_t> &bloom_filters(void) const

Bloom filters.

const std::vector<uint32_t> &buckets(void) const

Hash buckets.

const std::vector<uint32_t> &hash_values(void) const

Hash values.

bool check_bloom_filter(uint32_t hash) const

Check if the given hash pass the bloom filter.

bool check_bucket(uint32_t hash) const

Check if the given hash pass the bucket filter.

bool check(const std::string &symbol_name) const

Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exists. If true you can’t do any assumption.

bool check(uint32_t hash) const

Check if the symbol associated with the given probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.

bool operator==(const GnuHash &rhs) const
bool operator!=(const GnuHash &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const GnuHash &gnuhash)

SYSV Hash table

class SysvHash : public LIEF::Object

Public Functions

SysvHash(void)
SysvHash &operator=(const SysvHash &copy)
SysvHash(const SysvHash &copy)
~SysvHash(void)
uint32_t nbucket(void) const

Return the number of buckets used.

uint32_t nchain(void) const

Return the number of chain used.

const std::vector<uint32_t> &buckets(void) const

Buckets values.

const std::vector<uint32_t> &chains(void) const

Chains values.

bool operator==(const SysvHash &rhs) const
bool operator!=(const SysvHash &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const SysvHash &sysvhash)

Note

class Note : public LIEF::Object

Public Types

using description_t = std::vector<uint8_t>

Container used to handle the description data.

Public Functions

Note()
Note(const std::string &name, uint32_t type, const description_t &description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES type, const description_t &description, Binary *binary = nullptr)
Note(const std::string &name, NOTE_TYPES_CORE type, const description_t &description, Binary *binary = nullptr)
Note &operator=(Note copy)
Note(const Note &copy)
~Note(void)
const std::string &name(void) const

Return the name of the note.

NOTE_TYPES type(void) const

Return the type of the note. It could be one of the NOTE_TYPES values.

NOTE_TYPES_CORE type_core(void) const

Return the type of the note for core ELF (ET_CORE). It could be one of the NOTE_TYPES_CORE values.

const Note::description_t &description(void) const

Return the description associated with the note.

Note::description_t &description(void)
bool is_core(void) const

True if the current note is associated with a core dump.

bool is_android(void) const

True if the current note is specific to Android.

If true, details() returns a reference the LIEF::ELF::AndroidNote object

const NoteDetails &details(void) const
NoteDetails &details(void)
void name(const std::string &name)
void type(NOTE_TYPES type)
void type_core(NOTE_TYPES_CORE type)
void description(const description_t &description)
uint64_t size(void) const

Sizeof the raw note.

void dump(std::ostream &os) const
bool operator==(const Note &rhs) const
bool operator!=(const Note &rhs) const
void swap(Note &other)
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const Note &note)

Note Details

class NoteDetails : public LIEF::Object

Subclassed by LIEF::ELF::AndroidNote, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi

Public Functions

NoteDetails()
~NoteDetails(void)
NoteDetails *clone(void) const
const Note::description_t &description(void) const
void dump(std::ostream &os) const
bool operator==(const NoteDetails &rhs) const
bool operator!=(const NoteDetails &rhs) const
void accept(Visitor &visitor) const

Friends

std::ostream &operator<<(std::ostream &os, const NoteDetails &note)

Core PrPsInfo

class CorePrPsInfo : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Functions

CorePrPsInfo *clone(void) const
std::string file_name(void) const

Process file name.

uint64_t flags(void) const

Process flag.

uint32_t uid(void) const

Process user id.

uint32_t gid(void) const

Process group id.

int32_t pid(void) const

Process ID.

int32_t ppid(void) const

Process parent ID.

int32_t pgrp(void) const

Process session group ID.

int32_t sid(void) const

Process session ID.

void file_name(const std::string &file_name)
void flags(uint64_t flags)
void uid(uint32_t uid)
void gid(uint32_t gid)
void pid(int32_t pid)
void ppid(int32_t ppid)
void pgrp(int32_t pgrp)
void sid(int32_t sid)
bool operator==(const CorePrPsInfo &rhs) const
bool operator!=(const CorePrPsInfo &rhs) const
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~CorePrPsInfo(void)

Public Static Functions

CorePrPsInfo make(Note &note)

Friends

std::ostream &operator<<(std::ostream &os, const CorePrPsInfo &note)

Core File

class CoreFile : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

using files_t = std::vector<CoreFileEntry>
using iterator = files_t::iterator
using const_iterator = files_t::const_iterator

Public Functions

CoreFile *clone(void) const
uint64_t count(void) const

Number of coredump file entries.

const CoreFile::files_t &files(void) const

Coredump file entries.

CoreFile::iterator begin(void)
CoreFile::iterator end(void)
CoreFile::const_iterator begin(void) const
CoreFile::const_iterator end(void) const
void files(const files_t &files)
bool operator==(const CoreFile &rhs) const
bool operator!=(const CoreFile &rhs) const
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~CoreFile(void)

Public Static Functions

CoreFile make(Note &note)

Friends

std::ostream &operator<<(std::ostream &os, const CoreFile &note)

Core File Entry

Warning

doxygenclass: Cannot find class “LIEF::ELF::CoreFileEntry” in doxygen xml output for project “lief” from directory: /tmp/LIEF/LIEF/build/doc/doxygen/xml


Core PrStatus

class CorePrStatus : public LIEF::ELF::NoteDetails

Class representing core PrPsInfo object.

Public Types

enum REGISTERS

Values:

UNKNOWN
X86_START
X86_EBX
X86_ECX
X86_EDX
X86_ESI
X86_EDI
X86_EBP
X86_EAX
X86_DS
X86_ES
X86_FS
X86_GS
X86__
X86_EIP
X86_CS
X86_EFLAGS
X86_ESP
X86_SS
X86_END
X86_64_START
X86_64_R15
X86_64_R14
X86_64_R13
X86_64_R12
X86_64_RBP
X86_64_RBX
X86_64_R11
X86_64_R10
X86_64_R9
X86_64_R8
X86_64_RAX
X86_64_RCX
X86_64_RDX
X86_64_RSI
X86_64_RDI
X86_64__
X86_64_RIP
X86_64_CS
X86_64_EFLAGS
X86_64_RSP
X86_64_SS
X86_64_END
ARM_START
ARM_R0
ARM_R1
ARM_R2
ARM_R3
ARM_R4
ARM_R5
ARM_R6
ARM_R7
ARM_R8
ARM_R9
ARM_R10
ARM_R11
ARM_R12
ARM_R13
ARM_R14
ARM_R15
ARM_CPSR
ARM_END
AARCH64_START
AARCH64_X0
AARCH64_X1
AARCH64_X2
AARCH64_X3
AARCH64_X4
AARCH64_X5
AARCH64_X6
AARCH64_X7
AARCH64_X8
AARCH64_X9
AARCH64_X10
AARCH64_X11
AARCH64_X12
AARCH64_X13
AARCH64_X14
AARCH64_X15
AARCH64_X16
AARCH64_X17
AARCH64_X18
AARCH64_X19
AARCH64_X20
AARCH64_X21
AARCH64_X22
AARCH64_X23
AARCH64_X24
AARCH64_X25
AARCH64_X26
AARCH64_X27
AARCH64_X28
AARCH64_X29
AARCH64_X30
AARCH64_X31
AARCH64_PC
AARCH64__
AARCH64_END
using reg_context_t = std::map<REGISTERS, uint64_t>

Public Functions

CorePrStatus *clone(void) const
const Elf_siginfo &siginfo(void) const

Info associated with the signal.

uint16_t current_sig(void) const

Current Signal.

uint64_t sigpend(void) const

Set of pending signals.

uint64_t sighold(void) const

Set of held signals.

int32_t pid(void) const

Process ID.

int32_t ppid(void) const

Process parent ID.

int32_t pgrp(void) const

Process group ID.

int32_t sid(void) const

Process session ID.

Elf64_timeval utime(void) const

User time.

Elf64_timeval stime(void) const

System time.

Elf64_timeval cutime(void) const

Cumulative user time.

Elf64_timeval cstime(void) const

Cumulative system time.

const CorePrStatus::reg_context_t &reg_context(void) const

GP registers state.

uint64_t pc(void) const

Return the program counter.

uint64_t sp(void) const

Return the stack pointer.

uint64_t get(REGISTERS reg, bool *error = nullptr) const

Get register value. If error is set, this function and the register exists, the function set the boolean value to false Otherwise it set the value to true

bool has(REGISTERS reg) const

Check if the given register is present in the info.

void siginfo(const Elf_siginfo &siginfo)
void current_sig(uint16_t current_sig)
void sigpend(uint64_t sigpend)
void sighold(uint64_t sighold)
void pid(int32_t pid)
void ppid(int32_t ppid)
void pgrp(int32_t pgrp)
void sid(int32_t sid)
void utime(Elf64_timeval utime)
void stime(Elf64_timeval stime)
void cutime(Elf64_timeval cutime)
void cstime(Elf64_timeval cstime)
void reg_context(const reg_context_t &ctx)
bool set(REGISTERS reg, uint64_t value)
bool operator==(const CorePrStatus &rhs) const
bool operator!=(const CorePrStatus &rhs) const
uint64_t &operator[](REGISTERS reg)
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~CorePrStatus(void)

Public Static Functions

CorePrStatus make(Note &note)
std::ostream &dump(std::ostream &os, const Elf64_timeval &time)
std::ostream &dump(std::ostream &os, const Elf_siginfo &siginfo)
std::ostream &dump(std::ostream &os, const reg_context_t &ctx)

Friends

std::ostream &operator<<(std::ostream &os, const CorePrStatus &note)

Core Siginfo

class CoreSigInfo : public LIEF::ELF::NoteDetails

Class representing core siginfo object.

Public Functions

CoreSigInfo *clone(void) const
int32_t signo(void) const

Signal number.

int32_t sigcode(void) const

Signal code.

int32_t sigerrno(void) const

If non-zero, an errno value associated with this signal.

void signo(int32_t signo)
void sigcode(int32_t sigcode)
void sigerrno(int32_t sigerrno)
bool operator==(const CoreSigInfo &rhs) const
bool operator!=(const CoreSigInfo &rhs) const
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~CoreSigInfo(void)

Public Static Functions

CoreSigInfo make(Note &note)

Friends

std::ostream &operator<<(std::ostream &os, const CoreSigInfo &note)

Core Auxiliary Vector

class CoreAuxv : public LIEF::ELF::NoteDetails

Class representing core Auxv object.

Public Types

using val_context_t = std::map<AUX_TYPE, uint64_t>

Public Functions

CoreAuxv *clone(void) const
const CoreAuxv::val_context_t &values(void) const

Auxiliary values.

uint64_t get(AUX_TYPE atype, bool *error = nullptr) const

Get an auxiliary value. If error is set, this function and the value exists, the function set the boolean value to false Otherwise it set the value to true

bool has(AUX_TYPE reg) const

Check if the given register is present in the info.

void values(const val_context_t &ctx)
bool set(AUX_TYPE atype, uint64_t value)
bool operator==(const CoreAuxv &rhs) const
bool operator!=(const CoreAuxv &rhs) const
uint64_t &operator[](AUX_TYPE atype)
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~CoreAuxv(void)

Public Static Functions

CoreAuxv make(Note &note)

Friends

std::ostream &operator<<(std::ostream &os, const CoreAuxv &note)

Android Note

class AndroidNote : public LIEF::ELF::NoteDetails

Class representing the “.note.android.ident” section

: https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39

Public Types

using description_t = typename Note::description_t

Public Functions

AndroidNote *clone(void) const
uint32_t sdk_version(void) const

Target SDK version.

std::string ndk_version(void) const

NDK version used.

std::string ndk_build_number(void) const

NDK build number.

void sdk_version(uint32_t version)
void ndk_version(const std::string &ndk_version)
void ndk_build_number(const std::string &ndk_build_number)
bool operator==(const AndroidNote &rhs) const
bool operator!=(const AndroidNote &rhs) const
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~AndroidNote(void)

Public Static Functions

AndroidNote make(Note &note)

Public Static Attributes

constexpr const char NAME = "Android"
constexpr size_t sdk_version_offset = 0
constexpr size_t sdk_version_size = sizeof(uint32_t)
constexpr size_t ndk_version_offset = sdk_version_offset + sdk_version_size
constexpr size_t ndk_version_size = 64 * sizeof(char)
constexpr size_t ndk_build_number_offset = ndk_version_offset + ndk_version_size
constexpr size_t ndk_build_number_size = 64 * sizeof(char)

Friends

std::ostream &operator<<(std::ostream &os, const AndroidNote &note)

Note ABI

class NoteAbi : public LIEF::ELF::NoteDetails

Class representing the “.note.android.ident” section

: https://android.googlesource.com/platform/ndk/+/ndk-release-r16/sources/crt/crtbrand.S#39

Public Types

using version_t = std::array<uint32_t, 3>

Version type: (Major, Minor, Patch)

using description_t = typename Note::description_t

Public Functions

NoteAbi *clone(void) const
NoteAbi::version_t version(void) const

Return the target version as <Major, Minor, Patch>.

NOTE_ABIS abi(void) const

Return the target ABI. Require a NT_GNU_ABI_TAG type.

bool operator==(const NoteAbi &rhs) const
bool operator!=(const NoteAbi &rhs) const
void dump(std::ostream &os) const
void accept(Visitor &visitor) const
~NoteAbi(void)

Public Static Functions

NoteAbi make(Note &note)

Public Static Attributes

constexpr size_t abi_offset = 0
constexpr size_t abi_size = sizeof(uint32_t)
constexpr size_t version_offset = abi_offset + abi_size
constexpr size_t version_size = 3 * sizeof(uint32_t)

Friends

std::ostream &operator<<(std::ostream &os, const NoteAbi &note)

Utilities

bool LIEF::ELF::is_elf(const std::string &file)

Check if the given file is an ELF one.

bool LIEF::ELF::is_elf(const std::vector<uint8_t> &raw)

check if the raw data is a ELF file


Enums

Architectures

enum LIEF::ELF::ARCH

Machine architectures See current registered ELF machine architectures at: http://www.uxsglobal.com/developers/gabi/latest/ch4.eheader.html.

Values:

EM_NONE = 0

No machine

EM_M32 = 1

AT&T WE 32100

EM_SPARC = 2

SPARC

EM_386 = 3

Intel 386

EM_68K = 4

Motorola 68000

EM_88K = 5

Motorola 88000

EM_IAMCU = 6

Intel MCU

EM_860 = 7

Intel 80860

EM_MIPS = 8

MIPS R3000

EM_S370 = 9

IBM System/370

EM_MIPS_RS3_LE = 10

MIPS RS3000 Little-endian

EM_PARISC = 15

Hewlett-Packard PA-RISC

EM_VPP500 = 17

Fujitsu VPP500

EM_SPARC32PLUS = 18

Enhanced instruction set SPARC

EM_960 = 19

Intel 80960

EM_PPC = 20

PowerPC

EM_PPC64 = 21

PowerPC64

EM_S390 = 22

IBM System/390

EM_SPU = 23

IBM SPU/SPC

EM_V800 = 36

NEC V800

EM_FR20 = 37

Fujitsu FR20

EM_RH32 = 38

TRW RH-32

EM_RCE = 39

Motorola RCE

EM_ARM = 40

ARM

EM_ALPHA = 41

DEC Alpha

EM_SH = 42

Hitachi SH

EM_SPARCV9 = 43

SPARC V9

EM_TRICORE = 44

Siemens TriCore

EM_ARC = 45

Argonaut RISC Core

EM_H8_300 = 46

Hitachi H8/300

EM_H8_300H = 47

Hitachi H8/300H

EM_H8S = 48

Hitachi H8S

EM_H8_500 = 49

Hitachi H8/500

EM_IA_64 = 50

Intel IA-64 processor architecture

EM_MIPS_X = 51

Stanford MIPS-X

EM_COLDFIRE = 52

Motorola ColdFire

EM_68HC12 = 53

Motorola M68HC12

EM_MMA = 54

Fujitsu MMA Multimedia Accelerator

EM_PCP = 55

Siemens PCP

EM_NCPU = 56

Sony nCPU embedded RISC processor

EM_NDR1 = 57

Denso NDR1 microprocessor

EM_STARCORE = 58

Motorola Star*Core processor

EM_ME16 = 59

Toyota ME16 processor

EM_ST100 = 60

STMicroelectronics ST100 processor

EM_TINYJ = 61

Advanced Logic Corp. TinyJ embedded processor family

EM_X86_64 = 62

AMD x86-64 architecture

EM_PDSP = 63

Sony DSP Processor

EM_PDP10 = 64

Digital Equipment Corp. PDP-10

EM_PDP11 = 65

Digital Equipment Corp. PDP-11

EM_FX66 = 66

Siemens FX66 microcontroller

EM_ST9PLUS = 67

STMicroelectronics ST9+ 8/16 bit microcontroller

EM_ST7 = 68

STMicroelectronics ST7 8-bit microcontroller

EM_68HC16 = 69

Motorola MC68HC16 Microcontroller

EM_68HC11 = 70

Motorola MC68HC11 Microcontroller

EM_68HC08 = 71

Motorola MC68HC08 Microcontroller

EM_68HC05 = 72

Motorola MC68HC05 Microcontroller

EM_SVX = 73

Silicon Graphics SVx

EM_ST19 = 74

STMicroelectronics ST19 8-bit microcontroller

EM_VAX = 75

Digital VAX

EM_CRIS = 76

Axis Communications 32-bit embedded processor

EM_JAVELIN = 77

Infineon Technologies 32-bit embedded processor

EM_FIREPATH = 78

Element 14 64-bit DSP Processor

EM_ZSP = 79

LSI Logic 16-bit DSP Processor

EM_MMIX = 80

Donald Knuth’s educational 64-bit processor

EM_HUANY = 81

Harvard University machine-independent object files

EM_PRISM = 82

SiTera Prism

EM_AVR = 83

Atmel AVR 8-bit microcontroller

EM_FR30 = 84

Fujitsu FR30

EM_D10V = 85

Mitsubishi D10V

EM_D30V = 86

Mitsubishi D30V

EM_V850 = 87

NEC v850

EM_M32R = 88

Mitsubishi M32R

EM_MN10300 = 89

Matsushita MN10300

EM_MN10200 = 90

Matsushita MN10200

EM_PJ = 91

picoJava

EM_OPENRISC = 92

OpenRISC 32-bit embedded processor

EM_ARC_COMPACT = 93

ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)

EM_XTENSA = 94

Tensilica Xtensa Architecture

EM_VIDEOCORE = 95

Alphamosaic VideoCore processor

EM_TMM_GPP = 96

Thompson Multimedia General Purpose Processor

EM_NS32K = 97

National Semiconductor 32000 series

EM_TPC = 98

Tenor Network TPC processor

EM_SNP1K = 99

Trebia SNP 1000 processor

EM_ST200 = 100

STMicroelectronics (www.st.com) ST200

EM_IP2K = 101

Ubicom IP2xxx microcontroller family

EM_MAX = 102

MAX Processor

EM_CR = 103

National Semiconductor CompactRISC microprocessor

EM_F2MC16 = 104

Fujitsu F2MC16

EM_MSP430 = 105

Texas Instruments embedded microcontroller msp430

EM_BLACKFIN = 106

Analog Devices Blackfin (DSP) processor

EM_SE_C33 = 107

S1C33 Family of Seiko Epson processors

EM_SEP = 108

Sharp embedded microprocessor

EM_ARCA = 109

Arca RISC Microprocessor

EM_UNICORE = 110

Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University

EM_EXCESS = 111

eXcess: 16/32/64-bit configurable embedded CPU

EM_DXP = 112

Icera Semiconductor Inc. Deep Execution Processor

EM_ALTERA_NIOS2 = 113

Altera Nios II soft-core processor

EM_CRX = 114

National Semiconductor CompactRISC CRX

EM_XGATE = 115

Motorola XGATE embedded processor

EM_C166 = 116

Infineon C16x/XC16x processor

EM_M16C = 117

Renesas M16C series microprocessors

EM_DSPIC30F = 118

Microchip Technology dsPIC30F Digital Signal

EM_CE = 119

Freescale Communication Engine RISC core

EM_M32C = 120

Renesas M32C series microprocessors

EM_TSK3000 = 131

Altium TSK3000 core

EM_RS08 = 132

Freescale RS08 embedded processor

EM_SHARC = 133

Analog Devices SHARC family of 32-bit DSP

EM_ECOG2 = 134

Cyan Technology eCOG2 microprocessor

EM_SCORE7 = 135

Sunplus S+core7 RISC processor

EM_DSP24 = 136

New Japan Radio (NJR) 24-bit DSP Processor

EM_VIDEOCORE3 = 137

Broadcom VideoCore III processor

EM_LATTICEMICO32 = 138

RISC processor for Lattice FPGA architecture

EM_SE_C17 = 139

Seiko Epson C17 family

EM_TI_C6000 = 140

The Texas Instruments TMS320C6000 DSP family

EM_TI_C2000 = 141

The Texas Instruments TMS320C2000 DSP family

EM_TI_C5500 = 142

The Texas Instruments TMS320C55x DSP family

EM_MMDSP_PLUS = 160

STMicroelectronics 64bit VLIW Data Signal Processor

EM_CYPRESS_M8C = 161

Cypress M8C microprocessor

EM_R32C = 162

Renesas R32C series microprocessors

EM_TRIMEDIA = 163

NXP Semiconductors TriMedia architecture family

EM_HEXAGON = 164

Qualcomm Hexagon processor

EM_8051 = 165

Intel 8051 and variants

EM_STXP7X = 166

STMicroelectronics STxP7x family of configurable

EM_NDS32 = 167
EM_ECOG1 = 168

Cyan Technology eCOG1X family

EM_ECOG1X = 168

Cyan Technology eCOG1X family

EM_MAXQ30 = 169

Dallas Semiconductor MAXQ30 Core Micro-controllers

EM_XIMO16 = 170

New Japan Radio (NJR) 16-bit DSP Processor

EM_MANIK = 171

M2000 Reconfigurable RISC Microprocessor

EM_CRAYNV2 = 172

Cray Inc. NV2 vector architecture

EM_RX = 173

Renesas RX family

EM_METAG = 174

Imagination Technologies META processor

EM_MCST_ELBRUS = 175

MCST Elbrus general purpose hardware architecture

EM_ECOG16 = 176

Cyan Technology eCOG16 family

EM_CR16 = 177

National Semiconductor CompactRISC CR16 16-bit

EM_ETPU = 178

Freescale Extended Time Processing Unit

EM_SLE9X = 179

Infineon Technologies SLE9X core

EM_L10M = 180

Intel L10M

EM_K10M = 181

Intel K10M

EM_AARCH64 = 183

ARM AArch64

EM_AVR32 = 185

Atmel Corporation 32-bit microprocessor family

EM_STM8 = 186

STMicroeletronics STM8 8-bit microcontroller

EM_TILE64 = 187

Tilera TILE64 multicore architecture family

EM_TILEPRO = 188

Tilera TILEPro multicore architecture family

EM_CUDA = 190

NVIDIA CUDA architecture

EM_TILEGX = 191

Tilera TILE-Gx multicore architecture family

EM_CLOUDSHIELD = 192

CloudShield architecture family

EM_COREA_1ST = 193

KIPO-KAIST Core-A 1st generation processor family

EM_COREA_2ND = 194

KIPO-KAIST Core-A 2nd generation processor family

EM_ARC_COMPACT2 = 195

Synopsys ARCompact V2

EM_OPEN8 = 196

Open8 8-bit RISC soft processor core

EM_RL78 = 197

Renesas RL78 family

EM_VIDEOCORE5 = 198

Broadcom VideoCore V processor

EM_78KOR = 199

Renesas 78KOR family

EM_56800EX = 200

Freescale 56800EX Digital Signal Controller (DSC)

EM_BA1 = 201

Beyond BA1 CPU architecture

EM_BA2 = 202

Beyond BA2 CPU architecture

EM_XCORE = 203

XMOS xCORE processor family

EM_MCHP_PIC = 204

Microchip 8-bit PIC(r) family

EM_INTEL205 = 205

Reserved by Intel

EM_INTEL206 = 206

Reserved by Intel

EM_INTEL207 = 207

Reserved by Intel

EM_INTEL208 = 208

Reserved by Intel

EM_INTEL209 = 209

Reserved by Intel

EM_KM32 = 210

KM211 KM32 32-bit processor

EM_KMX32 = 211

KM211 KMX32 32-bit processor

EM_KMX16 = 212

KM211 KMX16 16-bit processor

EM_KMX8 = 213

KM211 KMX8 8-bit processor

EM_KVARC = 214

KM211 KVARC processor

EM_CDP = 215

Paneve CDP architecture family

EM_COGE = 216

Cognitive Smart Memory Processor

EM_COOL = 217

iCelero CoolEngine

EM_NORC = 218

Nanoradio Optimized RISC

EM_CSR_KALIMBA = 219

CSR Kalimba architecture family

EM_AMDGPU = 224

AMD GPU architecture


Identity

enum LIEF::ELF::IDENTITY

e_ident size and indices.

Values:

EI_MAG0 = 0

File identification index.

EI_MAG1 = 1

File identification index.

EI_MAG2 = 2

File identification index.

EI_MAG3 = 3

File identification index.

EI_CLASS = 4

File class.

EI_DATA = 5

Data encoding.

EI_VERSION = 6

File version.

EI_OSABI = 7

OS/ABI identification.

EI_ABIVERSION = 8

ABI version.

EI_PAD = 9

Start of padding bytes.

EI_NIDENT = 16

Number of bytes in e_ident.


Binary types

enum LIEF::ELF::E_TYPE

Enum associated with e_type

Values:

ET_NONE = 0

No file type

ET_REL = 1

Relocatable file

ET_EXEC = 2

Executable file

ET_DYN = 3

Shared object file

ET_CORE = 4

Core file

ET_LOPROC = 0xff00

Beginning of processor-specific codes

ET_HIPROC = 0xffff

Processor-specific


Version

enum LIEF::ELF::VERSION

Versioning

Values:

EV_NONE = 0
EV_CURRENT = 1

Default value


ELF Class

enum LIEF::ELF::ELF_CLASS

Object file classes.

Values:

ELFCLASSNONE = 0

Unknown

ELFCLASS32 = 1

32-bit object file

ELFCLASS64 = 2

64-bit object file


ELF Data

enum LIEF::ELF::ELF_DATA

Object file byte orderings.

Values:

ELFDATANONE = 0

Invalid data encoding.

ELFDATA2LSB = 1

Little-endian object file

ELFDATA2MSB = 2

Big-endian object file


ELF OS/ABI

enum LIEF::ELF::OS_ABI

OS ABI identification.

Values:

ELFOSABI_SYSTEMV = 0

UNIX System V ABI

ELFOSABI_HPUX = 1

HP-UX operating system

ELFOSABI_NETBSD = 2

NetBSD

ELFOSABI_GNU = 3

GNU/Linux

ELFOSABI_LINUX = 3

Historical alias for ELFOSABI_GNU.

ELFOSABI_HURD = 4

GNU/Hurd

ELFOSABI_SOLARIS = 6

Solaris

ELFOSABI_AIX = 7

AIX

ELFOSABI_IRIX = 8

IRIX

ELFOSABI_FREEBSD = 9

FreeBSD

ELFOSABI_TRU64 = 10

TRU64 UNIX

ELFOSABI_MODESTO = 11

Novell Modesto

ELFOSABI_OPENBSD = 12

OpenBSD

ELFOSABI_OPENVMS = 13

OpenVMS

ELFOSABI_NSK = 14

Hewlett-Packard Non-Stop Kernel

ELFOSABI_AROS = 15

AROS

ELFOSABI_FENIXOS = 16

FenixOS

ELFOSABI_CLOUDABI = 17

Nuxi CloudABI

ELFOSABI_C6000_ELFABI = 64

Bare-metal TMS320C6000

ELFOSABI_AMDGPU_HSA = 64

AMD HSA runtime

ELFOSABI_C6000_LINUX = 65

Linux TMS320C6000

ELFOSABI_ARM = 97

ARM

ELFOSABI_STANDALONE = 255

Standalone (embedded) application


Symbol section index

enum LIEF::ELF::SYMBOL_SECTION_INDEX

Special section indices.

Values:

SHN_UNDEF = 0

Undefined, missing, irrelevant, or meaningless

SHN_LORESERVE = 0xff00

Lowest reserved index

SHN_LOPROC = 0xff00

Lowest processor-specific index

SHN_HIPROC = 0xff1f

Highest processor-specific index

SHN_LOOS = 0xff20

Lowest operating system-specific index

SHN_HIOS = 0xff3f

Highest operating system-specific index

SHN_ABS = 0xfff1

Symbol has absolute value; does not need relocation

SHN_COMMON = 0xfff2

FORTRAN COMMON or C external global variables

SHN_XINDEX = 0xffff

Mark that the index is >= SHN_LORESERVE

SHN_HIRESERVE = 0xffff

Highest reserved index


Section types

enum LIEF::ELF::ELF_SECTION_TYPES

Section types.

Values:

SHT_NULL = 0

No associated section (inactive entry).

SHT_PROGBITS = 1

Program-defined contents.

SHT_SYMTAB = 2

Symbol table.

SHT_STRTAB = 3

String table.

SHT_RELA = 4

Relocation entries; explicit addends.

SHT_HASH = 5

Symbol hash table.

SHT_DYNAMIC = 6

Information for dynamic linking.

SHT_NOTE = 7

Information about the file.

SHT_NOBITS = 8

Data occupies no space in the file.

SHT_REL = 9

Relocation entries; no explicit addends.

SHT_SHLIB = 10

Reserved.

SHT_DYNSYM = 11

Symbol table.

SHT_INIT_ARRAY = 14

Pointers to initialization functions.

SHT_FINI_ARRAY = 15

Pointers to termination functions.

SHT_PREINIT_ARRAY = 16

Pointers to pre-init functions.

SHT_GROUP = 17

Section group.

SHT_SYMTAB_SHNDX = 18

Indices for SHN_XINDEX entries.

SHT_LOOS = 0x60000000

Lowest operating system-specific type.

SHT_GNU_ATTRIBUTES = 0x6ffffff5

Object attributes.

SHT_GNU_HASH = 0x6ffffff6

GNU-style hash table.

SHT_GNU_verdef = 0x6ffffffd

GNU version definitions.

SHT_GNU_verneed = 0x6ffffffe

GNU version references.

SHT_GNU_versym = 0x6fffffff

GNU symbol versions table.

SHT_HIOS = 0x6fffffff

Highest operating system-specific type.

SHT_LOPROC = 0x70000000

Lowest processor arch-specific type.

SHT_ARM_EXIDX = 0x70000001U

Exception Index table

SHT_ARM_PREEMPTMAP = 0x70000002U

BPABI DLL dynamic linking pre-emption map

SHT_ARM_ATTRIBUTES = 0x70000003U

Object file compatibility attributes

SHT_ARM_DEBUGOVERLAY = 0x70000004U
SHT_ARM_OVERLAYSECTION = 0x70000005U
SHT_HEX_ORDERED = 0x70000000

Link editor is to sort the entries in

SHT_X86_64_UNWIND = 0x70000001

Unwind information

SHT_MIPS_REGINFO = 0x70000006

Register usage information

SHT_MIPS_OPTIONS = 0x7000000d

General options

SHT_MIPS_ABIFLAGS = 0x7000002a

ABI information.

SHT_HIPROC = 0x7fffffff

Highest processor arch-specific type.

SHT_LOUSER = 0x80000000

Lowest type reserved for applications.

SHT_HIUSER = 0xffffffff

Highest type reserved for applications.


Section flags

enum LIEF::ELF::ELF_SECTION_FLAGS

Section flags.

Values:

SHF_NONE = 0x0
SHF_WRITE = 0x1

Section data should be writable during execution.

SHF_ALLOC = 0x2

Section occupies memory during program execution.

SHF_EXECINSTR = 0x4

Section contains executable machine instructions.

SHF_MERGE = 0x10

The data in this section may be merged.

SHF_STRINGS = 0x20

The data in this section is null-terminated strings.

SHF_INFO_LINK = 0x40U

A field in this section holds a section header table index.

Adds special ordering requirements for link editors.

SHF_OS_NONCONFORMING = 0x100U

This section requires special OS-specific processing to avoid incorrect behavior

SHF_GROUP = 0x200U

This section is a member of a section group.

SHF_TLS = 0x400U

This section holds Thread-Local Storage.

SHF_EXCLUDE = 0x80000000U

This section is excluded from the final executable or shared library.

XCORE_SHF_CP_SECTION = 0x800U
XCORE_SHF_DP_SECTION = 0x1000U
SHF_MASKOS = 0x0ff00000
SHF_MASKPROC = 0xf0000000

Bits indicating processor-specific flags.

SHF_X86_64_LARGE = 0x10000000
SHF_HEX_GPREL = 0x10000000
SHF_MIPS_NODUPES = 0x01000000
SHF_MIPS_NAMES = 0x02000000

Linker must generate implicit hidden weak names.

SHF_MIPS_LOCAL = 0x04000000

Section data local to process.

SHF_MIPS_NOSTRIP = 0x08000000

Do not strip this section.

SHF_MIPS_GPREL = 0x10000000

Section must be part of global data area.

SHF_MIPS_MERGE = 0x20000000

This section should be merged.

SHF_MIPS_ADDR = 0x40000000

Address size to be inferred from section entry size.

SHF_MIPS_STRING = 0x80000000

Section data is string data by default.


Symbol bindings

enum LIEF::ELF::SYMBOL_BINDINGS

Symbol bindings.

Values:

STB_LOCAL = 0

Local symbol, not visible outside obj file containing def

STB_GLOBAL = 1

Global symbol, visible to all object files being combined

STB_WEAK = 2

Weak symbol, like global but lower-precedence

STB_GNU_UNIQUE = 10
STB_LOOS = 10

Lowest operating system-specific binding type

STB_HIOS = 12

Highest operating system-specific binding type

STB_LOPROC = 13

Lowest processor-specific binding type

STB_HIPROC = 15

Highest processor-specific binding type


Symbol visibility

enum LIEF::ELF::ELF_SYMBOL_VISIBILITY

Values:

STV_DEFAULT = 0
STV_INTERNAL = 1
STV_HIDDEN = 2
STV_PROTECTED = 3

Symbol types

enum LIEF::ELF::ELF_SYMBOL_TYPES

Values:

STT_NOTYPE = 0
STT_OBJECT = 1
STT_FUNC = 2
STT_SECTION = 3
STT_FILE = 4
STT_COMMON = 5
STT_TLS = 6
STT_GNU_IFUNC = 10
STT_LOOS = 10
STT_HIOS = 12
STT_LOPROC = 13
STT_HIPROC = 15

Segment types

enum LIEF::ELF::SEGMENT_TYPES

Segment types.

Values:

PT_NULL = 0

Unused segment.

PT_LOAD = 1

Loadable segment.

PT_DYNAMIC = 2

Dynamic linking information.

PT_INTERP = 3

Interpreter pathname.

PT_NOTE = 4

Auxiliary information.

PT_SHLIB = 5

Reserved.

PT_PHDR = 6

The program header table itself.

PT_TLS = 7

The thread-local storage template.

PT_LOOS = 0x60000000

Lowest operating system-specific pt entry type.

PT_HIOS = 0x6fffffff

Highest operating system-specific pt entry type.

PT_LOPROC = 0x70000000

Lowest processor-specific program hdr entry type.

PT_HIPROC = 0x7fffffff

Highest processor-specific program hdr entry type.

PT_GNU_EH_FRAME = 0x6474e550
PT_SUNW_EH_FRAME = 0x6474e550
PT_SUNW_UNWIND = 0x6464e550
PT_GNU_STACK = 0x6474e551

Indicates stack executability.

PT_GNU_RELRO = 0x6474e552

Read-only after relocation.

PT_ARM_ARCHEXT = 0x70000000

Platform architecture compatibility info

PT_ARM_EXIDX = 0x70000001
PT_ARM_UNWIND = 0x70000001
PT_MIPS_REGINFO = 0x70000000

Register usage information.

PT_MIPS_RTPROC = 0x70000001

Runtime procedure table.

PT_MIPS_OPTIONS = 0x70000002

Options segment.

PT_MIPS_ABIFLAGS = 0x70000003

Abiflags segment.


Segment flags

enum LIEF::ELF::ELF_SEGMENT_FLAGS

Segment flags.

Values:

PF_NONE = 0
PF_X = 1

Execute

PF_W = 2

Write

PF_R = 4

Read

PF_MASKOS = 0x0ff00000

Bits for operating system-specific semantics.

PF_MASKPROC = 0xf0000000

Bits for processor-specific semantics.


Dynamic tags

enum LIEF::ELF::DYNAMIC_TAGS

Dynamic table entry tags.

Values:

DT_NULL = 0

Marks end of dynamic array.

DT_NEEDED = 1

String table offset of needed library.

DT_PLTRELSZ = 2

Size of relocation entries in PLT.

DT_PLTGOT = 3

Address associated with linkage table.

DT_HASH = 4

Address of symbolic hash table.

DT_STRTAB = 5

Address of dynamic string table.

DT_SYMTAB = 6

Address of dynamic symbol table.

DT_RELA = 7

Address of relocation table (Rela entries).

DT_RELASZ = 8

Size of Rela relocation table.

DT_RELAENT = 9

Size of a Rela relocation entry.

DT_STRSZ = 10

Total size of the string table.

DT_SYMENT = 11

Size of a symbol table entry.

DT_INIT = 12

Address of initialization function.

DT_FINI = 13

Address of termination function.

DT_SONAME = 14

String table offset of a shared objects name.

DT_RPATH = 15

String table offset of library search path.

DT_SYMBOLIC = 16

Changes symbol resolution algorithm.

DT_REL = 17

Address of relocation table (Rel entries).

DT_RELSZ = 18

Size of Rel relocation table.

DT_RELENT = 19

Size of a Rel relocation entry.

DT_PLTREL = 20

Type of relocation entry used for linking.

DT_DEBUG = 21

Reserved for debugger.

DT_TEXTREL = 22

Relocations exist for non-writable segments.

DT_JMPREL = 23

Address of relocations associated with PLT.

DT_BIND_NOW = 24

Process all relocations before execution.

DT_INIT_ARRAY = 25

Pointer to array of initialization functions.

DT_FINI_ARRAY = 26

Pointer to array of termination functions.

DT_INIT_ARRAYSZ = 27

Size of DT_INIT_ARRAY.

DT_FINI_ARRAYSZ = 28

Size of DT_FINI_ARRAY.

DT_RUNPATH = 29

String table offset of lib search path.

DT_FLAGS = 30

Flags.

DT_ENCODING = 32

Values from here to DT_LOOS follow the rules for the interpretation of the d_un union.

DT_PREINIT_ARRAY = 32

Pointer to array of preinit functions.

DT_PREINIT_ARRAYSZ = 33

Size of the DT_PREINIT_ARRAY array.

DT_LOOS = 0x60000000

Start of environment specific tags.

DT_HIOS = 0x6FFFFFFF

End of environment specific tags.

DT_LOPROC = 0x70000000

Start of processor specific tags.

DT_HIPROC = 0x7FFFFFFF

End of processor specific tags.

DT_GNU_HASH = 0x6FFFFEF5

Reference to the GNU hash table.

DT_RELACOUNT = 0x6FFFFFF9

ELF32_Rela count.

DT_RELCOUNT = 0x6FFFFFFA

ELF32_Rel count.

DT_FLAGS_1 = 0x6FFFFFFB

Flags_1.

DT_VERSYM = 0x6FFFFFF0

The address of .gnu.version section.

DT_VERDEF = 0x6FFFFFFC

The address of the version definition table.

DT_VERDEFNUM = 0x6FFFFFFD

The number of entries in DT_VERDEF.

DT_VERNEED = 0x6FFFFFFE

The address of the version Dependency table.

DT_VERNEEDNUM = 0x6FFFFFFF

The number of entries in DT_VERNEED.

DT_MIPS_RLD_VERSION = 0x70000001

32 bit version number for runtime linker interface.

DT_MIPS_TIME_STAMP = 0x70000002

Time stamp.

DT_MIPS_ICHECKSUM = 0x70000003

Checksum of external strings and common sizes.

DT_MIPS_IVERSION = 0x70000004

Index of version string in string table.

DT_MIPS_FLAGS = 0x70000005

32 bits of flags.

DT_MIPS_BASE_ADDRESS = 0x70000006

Base address of the segment.

DT_MIPS_MSYM = 0x70000007

Address of .msym section.

DT_MIPS_CONFLICT = 0x70000008

Address of .conflict section.

DT_MIPS_LIBLIST = 0x70000009

Address of .liblist section.

DT_MIPS_LOCAL_GOTNO = 0x7000000a

Number of local global offset table entries.

DT_MIPS_CONFLICTNO = 0x7000000b

Number of entries in the .conflict section.

DT_MIPS_LIBLISTNO = 0x70000010

Number of entries in the .liblist section.

DT_MIPS_SYMTABNO = 0x70000011

Number of entries in the .dynsym section.

DT_MIPS_UNREFEXTNO = 0x70000012

Index of first external dynamic symbol not referenced locally.

DT_MIPS_GOTSYM = 0x70000013

Index of first dynamic symbol in global offset table.

DT_MIPS_HIPAGENO = 0x70000014

Number of page table entries in global offset table.

DT_MIPS_RLD_MAP = 0x70000016

Address of run time loader map, used for debugging.

DT_MIPS_DELTA_CLASS = 0x70000017

Delta C++ class definition.

DT_MIPS_DELTA_CLASS_NO = 0x70000018

Number of entries in DT_MIPS_DELTA_CLASS.

DT_MIPS_DELTA_INSTANCE = 0x70000019

Delta C++ class instances.

DT_MIPS_DELTA_INSTANCE_NO = 0x7000001A

Number of entries in DT_MIPS_DELTA_INSTANCE.

DT_MIPS_DELTA_RELOC = 0x7000001B

Delta relocations.

DT_MIPS_DELTA_RELOC_NO = 0x7000001C

Number of entries in DT_MIPS_DELTA_RELOC.

DT_MIPS_DELTA_SYM = 0x7000001D

Delta symbols that Delta relocations refer to.

DT_MIPS_DELTA_SYM_NO = 0x7000001E

Number of entries in DT_MIPS_DELTA_SYM.

DT_MIPS_DELTA_CLASSSYM = 0x70000020

Delta symbols that hold class declarations.

DT_MIPS_DELTA_CLASSSYM_NO = 0x70000021

Number of entries in DT_MIPS_DELTA_CLASSSYM.

DT_MIPS_CXX_FLAGS = 0x70000022

Flags indicating information about C++ flavor.

DT_MIPS_PIXIE_INIT = 0x70000023

Pixie information.

DT_MIPS_SYMBOL_LIB = 0x70000024

Address of .MIPS.symlib

DT_MIPS_LOCALPAGE_GOTIDX = 0x70000025

The GOT index of the first PTE for a segment

DT_MIPS_LOCAL_GOTIDX = 0x70000026

The GOT index of the first PTE for a local symbol

DT_MIPS_HIDDEN_GOTIDX = 0x70000027

The GOT index of the first PTE for a hidden symbol

DT_MIPS_PROTECTED_GOTIDX = 0x70000028

The GOT index of the first PTE for a protected symbol

DT_MIPS_OPTIONS = 0x70000029

Address of `.MIPS.options’.

DT_MIPS_INTERFACE = 0x7000002A

Address of `.interface’.

DT_MIPS_DYNSTR_ALIGN = 0x7000002B

Unknown.

DT_MIPS_INTERFACE_SIZE = 0x7000002C

Size of the .interface section.

DT_MIPS_RLD_TEXT_RESOLVE_ADDR = 0x7000002D

Size of rld_text_resolve function stored in the GOT.

DT_MIPS_PERF_SUFFIX = 0x7000002E

Default suffix of DSO to be added by rld on dlopen() calls.

DT_MIPS_COMPACT_SIZE = 0x7000002F

Size of compact relocation section (O32).

DT_MIPS_GP_VALUE = 0x70000030

GP value for auxiliary GOTs.

DT_MIPS_AUX_DYNAMIC = 0x70000031

Address of auxiliary .dynamic.

DT_MIPS_PLTGOT = 0x70000032

Address of the base of the PLTGOT.

DT_MIPS_RWPLT = 0x70000034

Points to the base of a writable PLT.


Dynamic flags

enum LIEF::ELF::DYNAMIC_FLAGS

DT_FLAGS and DT_FLAGS_1 values.

Values:

DF_ORIGIN = 0x00000001

The object may reference $ORIGIN.

DF_SYMBOLIC = 0x00000002

Search the shared lib before searching the exe.

DF_TEXTREL = 0x00000004

Relocations may modify a non-writable segment.

DF_BIND_NOW = 0x00000008

Process all relocations on load.

DF_STATIC_TLS = 0x00000010

Reject attempts to load dynamically.


Dynamic flags 1

enum LIEF::ELF::DYNAMIC_FLAGS_1

Values:

DF_1_NOW = 0x00000001

Set RTLD_NOW for this object.

DF_1_GLOBAL = 0x00000002

Set RTLD_GLOBAL for this object.

DF_1_GROUP = 0x00000004

Set RTLD_GROUP for this object.

DF_1_NODELETE = 0x00000008

Set RTLD_NODELETE for this object.

DF_1_LOADFLTR = 0x00000010

Trigger filtee loading at runtime.

DF_1_INITFIRST = 0x00000020

Set RTLD_INITFIRST for this object.

DF_1_NOOPEN = 0x00000040

Set RTLD_NOOPEN for this object.

DF_1_ORIGIN = 0x00000080

$ORIGIN must be handled.

DF_1_DIRECT = 0x00000100

Direct binding enabled.

DF_1_TRANS = 0x00000200
DF_1_INTERPOSE = 0x00000400

Object is used to interpose.

DF_1_NODEFLIB = 0x00000800

Ignore default lib search path.

DF_1_NODUMP = 0x00001000

Object can’t be dldump’ed.

DF_1_CONFALT = 0x00002000

Configuration alternative created.

DF_1_ENDFILTEE = 0x00004000

Filtee terminates filters search.

DF_1_DISPRELDNE = 0x00008000

Disp reloc applied at build time.

DF_1_DISPRELPND = 0x00010000

Disp reloc applied at run-time.

DF_1_NODIRECT = 0x00020000

Object has no-direct binding.

DF_1_IGNMULDEF = 0x00040000
DF_1_NOKSYMS = 0x00080000
DF_1_NOHDR = 0x00100000
DF_1_EDITED = 0x00200000

Object is modified after built.

DF_1_NORELOC = 0x00400000
DF_1_SYMINTPOSE = 0x00800000

Object has individual interposers.

DF_1_GLOBAUDIT = 0x01000000

Global auditing required.

DF_1_SINGLETON = 0x02000000

Singleton symbols are used.


Dynamic symbols counting

enum LIEF::ELF::DYNSYM_COUNT_METHODS

Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols

Values:

COUNT_AUTO = 0

Automatic detection

COUNT_SECTION = 1

Count based on sections (not very reliable)

COUNT_HASH = 2

Count based on hash table (reliable)

COUNT_RELOCATIONS = 3

Count based on PLT/GOT relocations (very reliable but not accurate)


Note types

enum LIEF::ELF::NOTE_TYPES

Values:

NT_UNKNOWN = 0
NT_GNU_ABI_TAG = 1
NT_GNU_HWCAP = 2
NT_GNU_BUILD_ID = 3
NT_GNU_GOLD_VERSION = 4

Note Core types

enum LIEF::ELF::NOTE_TYPES_CORE

Values:

NT_CORE_UNKNOWN = 0
NT_PRSTATUS = 1
NT_PRFPREG = 2
NT_PRPSINFO = 3
NT_TASKSTRUCT = 4
NT_AUXV = 6
NT_SIGINFO = 0x53494749
NT_FILE = 0x46494c45
NT_PRXFPREG = 0x46e62b7f
NT_ARM_VFP = 0x400
NT_ARM_TLS = 0x401
NT_ARM_HW_BREAK = 0x402
NT_ARM_HW_WATCH = 0x403
NT_ARM_SYSTEM_CALL = 0x404
NT_ARM_SVE = 0x405
NT_386_TLS = 0x200
NT_386_IOPERM = 0x201
NT_386_XSTATE = 0x202

Note ABIs

enum LIEF::ELF::NOTE_ABIS

Values:

ELF_NOTE_UNKNOWN = -1u
ELF_NOTE_OS_LINUX = 0
ELF_NOTE_OS_GNU = 1
ELF_NOTE_OS_SOLARIS2 = 2
ELF_NOTE_OS_FREEBSD = 3
ELF_NOTE_OS_NETBSD = 4
ELF_NOTE_OS_SYLLABLE = 5

Relocation purpose

enum LIEF::ELF::RELOCATION_PURPOSES

Values:

RELOC_PURPOSE_NONE = 0
RELOC_PURPOSE_PLTGOT = 1
RELOC_PURPOSE_DYNAMIC = 2
RELOC_PURPOSE_OBJECT = 3

Relocations x86-64

enum LIEF::ELF::RELOC_x86_64

x86_64 relocations.

Values:

R_X86_64_NONE = 0
R_X86_64_64 = 1
R_X86_64_PC32 = 2
R_X86_64_GOT32 = 3
R_X86_64_PLT32 = 4
R_X86_64_COPY = 5
R_X86_64_GLOB_DAT = 6
R_X86_64_JUMP_SLOT = 7
R_X86_64_RELATIVE = 8
R_X86_64_GOTPCREL = 9
R_X86_64_32 = 10
R_X86_64_32S = 11
R_X86_64_16 = 12
R_X86_64_PC16 = 13
R_X86_64_8 = 14
R_X86_64_PC8 = 15
R_X86_64_DTPMOD64 = 16
R_X86_64_DTPOFF64 = 17
R_X86_64_TPOFF64 = 18
R_X86_64_TLSGD = 19
R_X86_64_TLSLD = 20
R_X86_64_DTPOFF32 = 21
R_X86_64_GOTTPOFF = 22
R_X86_64_TPOFF32 = 23
R_X86_64_PC64 = 24
R_X86_64_GOTOFF64 = 25
R_X86_64_GOTPC32 = 26
R_X86_64_GOT64 = 27
R_X86_64_GOTPCREL64 = 28
R_X86_64_GOTPC64 = 29
R_X86_64_GOTPLT64 = 30
R_X86_64_PLTOFF64 = 31
R_X86_64_SIZE32 = 32
R_X86_64_SIZE64 = 33
R_X86_64_GOTPC32_TLSDESC = 34
R_X86_64_TLSDESC_CALL = 35
R_X86_64_TLSDESC = 36
R_X86_64_IRELATIVE = 37
R_X86_64_RELATIVE64 = 38
R_X86_64_PC32_BND = 39
R_X86_64_PLT32_BND = 40
R_X86_64_GOTPCRELX = 41
R_X86_64_REX_GOTPCRELX = 42

Relocations x86 (i386)

enum LIEF::ELF::RELOC_i386

i386 relocations.

Values:

R_386_NONE = 0
R_386_32 = 1
R_386_PC32 = 2
R_386_GOT32 = 3
R_386_PLT32 = 4
R_386_COPY = 5
R_386_GLOB_DAT = 6
R_386_JUMP_SLOT = 7
R_386_RELATIVE = 8
R_386_GOTOFF = 9
R_386_GOTPC = 10
R_386_32PLT = 11
R_386_TLS_TPOFF = 14
R_386_TLS_IE = 15
R_386_TLS_GOTIE = 16
R_386_TLS_LE = 17
R_386_TLS_GD = 18
R_386_TLS_LDM = 19
R_386_16 = 20
R_386_PC16 = 21
R_386_8 = 22
R_386_PC8 = 23
R_386_TLS_GD_32 = 24
R_386_TLS_GD_PUSH = 25
R_386_TLS_GD_CALL = 26
R_386_TLS_GD_POP = 27
R_386_TLS_LDM_32 = 28
R_386_TLS_LDM_PUSH = 29
R_386_TLS_LDM_CALL = 30
R_386_TLS_LDM_POP = 31
R_386_TLS_LDO_32 = 32
R_386_TLS_IE_32 = 33
R_386_TLS_LE_32 = 34
R_386_TLS_DTPMOD32 = 35
R_386_TLS_DTPOFF32 = 36
R_386_TLS_TPOFF32 = 37
R_386_TLS_GOTDESC = 39
R_386_TLS_DESC_CALL = 40
R_386_TLS_DESC = 41
R_386_IRELATIVE = 42
R_386_NUM = 43

Relocations ARM

enum LIEF::ELF::RELOC_ARM

Values:

R_ARM_NONE = 0x00
R_ARM_PC24 = 0x01
R_ARM_ABS32 = 0x02
R_ARM_REL32 = 0x03
R_ARM_LDR_PC_G0 = 0x04
R_ARM_ABS16 = 0x05
R_ARM_ABS12 = 0x06
R_ARM_THM_ABS5 = 0x07
R_ARM_ABS8 = 0x08
R_ARM_SBREL32 = 0x09
R_ARM_THM_CALL = 0x0a
R_ARM_THM_PC8 = 0x0b
R_ARM_BREL_ADJ = 0x0c
R_ARM_TLS_DESC = 0x0d
R_ARM_THM_SWI8 = 0x0e
R_ARM_XPC25 = 0x0f
R_ARM_THM_XPC22 = 0x10
R_ARM_TLS_DTPMOD32 = 0x11
R_ARM_TLS_DTPOFF32 = 0x12
R_ARM_TLS_TPOFF32 = 0x13
R_ARM_COPY = 0x14
R_ARM_GLOB_DAT = 0x15
R_ARM_JUMP_SLOT = 0x16
R_ARM_RELATIVE = 0x17
R_ARM_GOTOFF32 = 0x18
R_ARM_BASE_PREL = 0x19
R_ARM_GOT_BREL = 0x1a
R_ARM_PLT32 = 0x1b
R_ARM_CALL = 0x1c
R_ARM_JUMP24 = 0x1d
R_ARM_THM_JUMP24 = 0x1e
R_ARM_BASE_ABS = 0x1f
R_ARM_ALU_PCREL_7_0 = 0x20
R_ARM_ALU_PCREL_15_8 = 0x21
R_ARM_ALU_PCREL_23_15 = 0x22
R_ARM_LDR_SBREL_11_0_NC = 0x23
R_ARM_ALU_SBREL_19_12_NC = 0x24