Class which parses and transforms an ELF file into a ELF::Binary object.
Subclassed by LIEF::OAT::Parser
Public Static Functions
Parse an ELF file and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method to use for counting dynamic symbols
file – [in] Path to the ELF binary
conf – [in] Optional configuration for the parser
LIEF::ELF::Binary as a unique_ptr
Parse the given raw data as an ELF binary and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
data – [in] Raw ELF as a std::vector of uint8_t
conf – [in] Optional configuration for the parser
Parse the ELF binary from the given stream and return a LIEF::ELF::Binary object.
For weird binaries (e.g. sectionless) you can choose which method use to count dynamic symbols
stream – [in] The stream which wraps the ELF binary
conf – [in] Optional configuration for the parser
Public Static Attributes
Friends
This structure is used to tweak the ELF Parser (ELF::Parser)
Public Members
Whether relocations (including plt-like relocations) should be parsed.
Whether dynamic symbols (those from .dynsym) should be parsed.
Whether debug symbols (those from .symtab) should be parsed.
Whether versioning symbols should be parsed.
Whether ELF notes information should be parsed.
Whether the overlay data should be parsed.
The method used to count the number of dynamic symbols
Public Static Functions
This returns a ParserConfig object configured to process all the ELF elements.
Class which represents an ELF binary.
Subclassed by LIEF::OAT::Binary
Public Types
This enum describes the different ways to relocate the segments table.
Values:
Defer the choice of the layout to LIEF.
The content of the binary right after the segments table is shifted and the relocations are updated accordingly. This kind of shift only works with PIE binaries.
The new segments table is relocated right after the first bss-like segment.
The new segments table is relocated at the end of the binary.
The new segments table is relocated between two LOAD segments. This kind of relocation is only doable when there is an alignment enforcement.
Iterator which outputs Note& object.
Iterator which outputs const Note& object.
Internal container for storing SymbolVersionRequirement.
Iterator which outputs SymbolVersionRequirement& object.
Iterator which outputs const SymbolVersionRequirement& object.
Internal container for storing SymbolVersionDefinition.
Iterator which outputs SymbolVersionDefinition& object.
Iterator which outputs const SymbolVersionDefinition& object.
Internal container for storing ELF’s Segment.
Iterator which outputs Segment& object.
Iterator which outputs const Segment& object.
Internal container for storing ELF’s DynamicEntry.
Iterator which outputs DynamicEntry& object.
Iterator which outputs const DynamicEntry& object.
Internal container for storing ELF’s SymbolVersion.
Iterator which outputs SymbolVersion& object.
Iterator which outputs const SymbolVersion& object.
Internal container for storing ELF’s Relocation.
Iterator which outputs plt/got Relocation& object.
Iterator which outputs plt/got const Relocation& object.
Iterator which outputs dynamic Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs dynamic const Relocation& object (not related to the PLT/GOT mechanism)
Iterator which outputs Relocation& object found in object files (.o)
Iterator which outputs const Relocation& object found in object files (.o)
Iterator which outputs Relocation& object.
Iterator which outputs const Relocation& object.
Iterator which outputs the Dynamic Symbol& object.
Iterator which outputs the Dynamic const Symbol& object.
Iterator which outputs the static/debug Symbol& object.
Iterator which outputs the static/debug const Symbol& object.
Iterator which outputs static and dynamic Symbol& object.
Iterator which outputs static and dynamic const Symbol& object.
Iterator which outputs exported Symbol& object.
Iterator which outputs exported const Symbol& object.
Iterator which outputs imported Symbol& object.
Iterator which outputs imported const Symbol& object.
Internal container for storing ELF’s Section.
Iterator which outputs Section& object.
Iterator which outputs const Section& object.
Public Functions
Return Elf header .
Return the last offset used in binary according to sections table.
Return the last offset used in binary according to segments table.
Return the next virtual address available.
Return an iterator over the binary’s sections.
Return the binary’s entrypoint.
Return binary’s segments.
Return binary’s dynamic entries.
Add the given dynamic entry and return the new entry.
Remove the given dynamic entry.
Remove all dynamic entries with the given tag.
Remove the given section. The clear parameter can be used to zeroize the original content beforehand.
section – [in] The section to remove
clear – [in] Whether zeroize the original content
Return an iterator over the binary’s dynamic symbols The dynamic symbols are those located in the .dynsym section.
Return symbols which are exported by the binary.
Return symbols which are imported by the binary.
Return statics symbols.
Return the symbol versions.
Return symbols version definition.
Return Symbol version requirement.
Return dynamic relocations.
Add a new dynamic relocation.
We consider a dynamic relocation as a relocation which is not plt-related
See: add_pltgot_relocation
Add a .plt.got relocation. This kind of relocation is usually associated with a PLT stub that aims at resolving the underlying symbol.
See also: add_dynamic_relocation
Add relocation for object file (.o)
The first parameter is the section to add while the second parameter is the LIEF::ELF::Section associated with the relocation.
If there is an error, this function returns a nullptr. Otherwise, it returns the relocation added.
Return plt.got relocations.
Return relocations used in an object file (*.o)
Return all relocations present in the binary.
Return relocation associated with the given address. It returns a nullptr if it is not found.
Return relocation associated with the given Symbol It returns a nullptr if it is not found.
Return relocation associated with the given Symbol name It returns a nullptr if it is not found.
true if GNU hash is used
See also
Return the GnuHash object in readonly If the ELF binary does not use the GNU hash table, return a nullptr.
true if SYSV hash is used
See also
Return the SysvHash object as a read-only object If the ELF binary does not use the legacy sysv hash table, return a nullptr.
Check if a section with the given name exists in the binary.
Check if a section that handles the given offset exists.
Check if a section that handles the given virtual address exists.
Return Section with the given name. If the section can’t be found, it returns a nullptr.
Return the .text section. If the section can’t be found, it returns a nullptr.
Return the .dynamic section. If the section can’t be found, it returns a nullptr.
Return the hash section. If the section can’t be found, it returns a nullptr.
Return section which holds static symbols. If the section can’t be found, it returns a nullptr.
Return program image base. For instance 0x40000
To compute the image base, we look for the PT_PHDR segment header (phdr), and we return phdr->p_vaddr - phdr->p_offset
Return the size of the mapped binary.
Check if the binary uses a loader (also named linker or interpreter)
See also
Return the ELF interpreter if any. (e.g. /lib64/ld-linux-x86-64.so.2) If the binary does not have an interpreter, it returns an empty string.
See also
Change the interpreter.
Return an iterator on both static and dynamic symbols.
Export the given symbol and create it if it doesn’t exist.
Export the symbol with the given name and create it if it doesn’t exist.
Check if the symbol with the given name exists in the dynamic symbols table.
Get the dynamic symbol from the given name. Return a nullptr if it can’t be found.
Check if the symbol with the given name exists in the static symbol table.
Get the static symbol from the given name Return a nullptr if it can’t be found.
Return list of the strings used by the ELF binary.
Basically, this function looks for string in the .roadata section
Remove symbols with the given name in both:
dynamic symbols
static symbols
Remove static symbols with the given name.
Remove dynamic symbols with the given name.
Remove the given symbol from the dynamic symbols table.
As a side effect, it will remove any ELF::Relocation that refers to this symbol and the SymbolVersion (if any) associated with this symbol
Return the address of the given function name.
Return the address of the given function name.
func_name – [in] The function’s name target
demangled – [in] Use the demangled name
Add a new section in the binary.
This function requires a well-formed ELF binary
section – [in] The section object to insert
loaded – [in] Boolean value to indicate that section’s data must be loaded by a PT_LOAD segment
The section added. The size and the virtual address might change.
Add a dynamic symbol with the associated SymbolVersion.
Create a symbol for the function at the given address and export it.
Add a library as dependency.
Remove the given library from the dependencies.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Get the library object (DynamicEntryLibrary) from the given name If the library can’t be found, it returns a nullptr.
Check if the given library name exists in the current binary.
Add a new segment in the binary.
The segment is inserted at the end
This function requires a well-formed ELF binary
The segment added. Virtual address and File Offset might change.
Replace the segment given in 2nd parameter with the segment given in the first one and return the updated segment.
Warning
The original_segment is no longer valid after this function
Patch the content at virtual address address with patch_value.
address – [in] Address to patch
patch_value – [in] Patch to apply
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the address with the given value.
address – [in] Address to patch
patch_value – [in] Patch to apply
size – [in] Size of the value in bytes (1, 2, … 8)
addr_type – [in] Specify if the address should be used as an absolute virtual address or an RVA
Patch the imported symbol with the address
symbol – [in] Imported symbol to patch
address – [in] New address
Patch the imported symbol’s name with the address
symbol_name – [in] Imported symbol’s name to patch
address – [in] New address
Strip the binary by removing static symbols.
Remove a binary’s section.
name – [in] The name of the section to remove
clear – [in] Whether zeroize the original content
Reconstruct the binary object and write it in filename
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
filename – Path for the written ELF binary
Reconstruct the binary object with the given config and write it in filename
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
filename – Path for the written ELF binary
config – Builder configuration
Reconstruct the binary object and write it in os stream.
This function assumes that the layout of the current ELF binary is correct (i.e. the binary can run).
os – Output stream for the written ELF binary
Reconstruct the binary object with the given config and write it in os stream.
os – Output stream for the written ELF binary
config – Builder configuration
Reconstruct the binary object and return its content as a byte vector.
Convert a virtual address to a file offset.
Convert the given offset into a virtual address.
offset – [in] The offset to convert.
slide – [in] If not 0, it will replace the default base address (if any)
Check if the binary has been compiled with -fpie -pie flags.
To do so we check if there is a PT_INTERP segment and if the binary type is ET_DYN (Shared object)
Check if the binary uses the NX protection (Non executable stack)
Return the ELF::Section from the given offset. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which the type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Section from the given address. Return a nullptr if a section can’t be found.
If skip_nobits is set (which is the case by default), this function won’t consider section for which type is SHT_NOBITS (like .bss, .tbss, ...)
Return the ELF::Segment from the given address. Return a nullptr if a segment can’t be found.
Return the ELF::Segment from the offset. Return a nullptr if a segment can’t be found.
Return the first ELF::DynamicEntry associated with the given tag If the tag can’t be found, it returns a nullptr.
Return the first ELF::Segment associated with the given type. If a segment can’t be found, it returns a nullptr.
Return the first ELF::Note associated with the given type If a note can’t be found, it returns a nullptr.
Return the first ELF::Section associated with the given type If a section can’t be found, it returns a nullptr.
Check if an ELF::DynamicEntry associated with the given tag exists.
Check if ELF::Segment associated with the given type exists.
Check if a ELF::Section associated with the given type exists.
Return the content located at virtual address.
Method associated with the visitor pattern.
Apply the given permutation on the dynamic symbols table.
List of binary constructors (typically, the functions located in the .init_array)
List of the binary destructors (typically, the functions located in the .fini_array)
List of the functions found the in the binary.
true if the binary embeds notes
Return an iterator over the ELF’s LIEF::ELF::Note.
See also
has_note
Return the last offset used by the ELF binary according to both: the sections table and the segments table.
True if data are present at the end of the binary.
Overlay data (if any)
Force relocating the segments table in a specific way.
This function can be used to enforce a specific relocation of the segments table.
type – [in] The relocation type to apply
The offset of the new segments table or 0 if it fails with the given method.
Class which represents the ELF’s header. This is the ELF structure that starts an ELF file.
Public Types
Public Functions
LIEF abstract object type.
LIEF abstract architecture.
It returns Empty if it can’t be abstracted
LIEF abstract endianness.
Executable entrypoint.
Offset of program table (also known as segments table)
Offset of section table.
Processor-specific flags.
Check if the given flag is present in processor_flag()
Return a list of ARM_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of MIPS_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of PPC64_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of HEXAGON_EFLAGS present in processor_flag()
Check if the given flag is present in processor_flag()
Return a list of LOONGARCH_EFLAGS present in processor_flag()
Size of the current header.
This size should be 64 for an ELF64 binary and 52 for an ELF32.
Return the size of a Segment header
This size should be 56 for a ELF64 binary and 32 for an ELF32.
Return the the number of segments.
Return the size of a Section header
This size should be 64 for a ELF64 binary and 40 for an ELF32.
Return the number of sections.
Warning
This value could differ from the real number of sections present in the binary. It must be taken as an indication
Return the section’s index which contains sections’ names.
Return the ELF identity as an std::array
ABI Version.
Class wich represents an ELF Section.
Public Types
Public Functions
Set section content.
True if the section has the given flag
flag – [in] flag to test
Return section flags as a std::set
section’s size (size in the binary, not the virtual size)
Change the section size.
Offset in the binary.
See also
offset
Original size of the section’s data.
This value is used by the ELF::Builder to determines if it needs to be relocated to avoid an override of the data
Section information. This meaning of this value depends on the section’s type.
This function returns the size of an element in the case of a section that contains an array.
For instance, the .dynamic section contains an array of DynamicEntry. As the size of the raw C structure of this entry is 0x10 (sizeof(Elf64_Dyn)) in a ELF64, the entry_size is set to this value.
Index to another section.
Add the given ELF_SECTION_FLAGS.
Remove the given ELF_SECTION_FLAGS.
Class which represents the ELF segments.
Public Types
Public Functions
The segment’s type (LOAD, DYNAMIC, …)
The flag permissions associated with this segment.
The file offset of the data associated with this segment.
The virtual address of the segment.
The physical address of the segment. This value is not really relevant on systems like Linux or Android. On the other hand, Qualcomm trustlets might use this value.
Usually this value matches virtual_address
The file size of the data associated with this segment.
The in-memory size of this segment. Usually, if the .bss segment is wrapped by this segment then, virtual_size is larger than physical_size.
The offset alignment of the segment.
The raw data associated with this segment.
Check if the current segment has the given flag.
Check if the current segment wraps the given ELF::Section.
Check if the current segment wraps the given section’s name.
Append the given ELF_SEGMENT_FLAGS.
Remove the given ELF_SEGMENT_FLAGS.
Iterator over the sections wrapped by this segment.
Public Static Functions
Class which represents an entry in the dynamic table These entries are located in the .dynamic section or the PT_DYNAMIC segment.
Subclassed by LIEF::ELF::DynamicEntryArray, LIEF::ELF::DynamicEntryFlags, LIEF::ELF::DynamicEntryLibrary, LIEF::ELF::DynamicEntryRpath, LIEF::ELF::DynamicEntryRunPath, LIEF::ELF::DynamicSharedObject
Public Functions
Tag of the current entry. The most common tags are: DT_NEEDED, DT_INIT, …
Return the entry’s value.
The meaning of the value strongly depends on the tag. It can be an offset, an index, a flag, …
Friends
Class which represents a DT_NEEDED entry in the dynamic table.
This kind of entry is usually used to create library dependency.
Public Functions
Return the library associated with this entry (e.g. libc.so.6)
Public Static Functions
Class that represents a DT_RUNPATH wich is used by the loader to resolve libraries (DynamicEntryLibrary).
Public Functions
Constructor from (run)path.
Constructor from a list of paths.
Runpath raw value.
Runpath raw value.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class which represents a DT_RPATH entry. This attribute is deprecated (cf. man ld) in favour of DT_RUNPATH (See DynamicRunPath)
Public Functions
Constructor from a list of paths.
The actual rpath as a string.
The actual rpath as a string.
Paths as a list.
Insert a path at the given position
Append the given path
Remove the given path
Public Static Functions
Public Static Attributes
Class that represent an Array in the dynamic table. This entry is associated with constructors:
DT_PREINIT_ARRAY
DT_INIT_ARRAY
DT_FINI_ARRAY
The underlying values are 64-bits integers to cover both: ELF32 and ELF64 binaries.
Public Types
Public Functions
Insert the given function at pos
Append the given function.
Remove the given function.
Number of function registred in this array.
Public Static Functions
Public Types
Public Functions
If the current entry has the given DYNAMIC_FLAGS.
If the current entry has the given DYNAMIC_FLAGS_1.
Return flags as a list of integers.
Add the given DYNAMIC_FLAGS.
Add the given DYNAMIC_FLAGS_1.
Remove the given DYNAMIC_FLAGS.
Remove the given DYNAMIC_FLAGS_1.
Method so that the visitor can visit us.
Public Static Functions
Class that represents an ELF relocation.
Public Functions
Additional value that can be involved in the relocation processing.
Type of the relocation This type depends on the underlying architecture which can be accessed with architecture().
Depending on the architecture, it can return:
RELOC_x86_64
RELOC_i386
RELOC_POWERPC32
RELOC_POWERPC64
RELOC_AARCH64
RELOC_ARM
RELOC_MIPS
RELOC_HEXAGON
RELOC_SYSTEMZ
RELOC_SPARC
RELOC_LOONGARCH
Check if the relocation uses the explicit addend() field (this is usually the case for 64 bits binaries)
Check if the relocation uses the implicit added (i.e. not present in the ELF structure)
Relocation info which contains for instance the symbol index.
Return the size (in bits) of the value associated with this relocation.
Return -1 if it fails
True if the current relocation is associated with a symbol.
Symbol associated with the relocation If no symbol is tied to this relocation, it returns a nullptr.
True if the relocation has an associated section.
The section to which the relocation applies. If no section to which the relocation applies is associtated to this relocation, it returns a nullptr.
The associated symbol table. If no symbol table section is associated with this relocation, it returns a nullptr.
Friends
Class which represents an ELF symbol.
Public Functions
The symbol’s type provides a general classification for the associated entity.
The symbol’s binding determines the linkage visibility and behavior.
This member specifies the symbol’s type and binding attributes.
Alias for visibility()
ELF::Section index associated with the symbol.
Symbol visibility.
This member has slightly different interpretations:
In relocatable files, value holds alignment constraints for a symbol for which section index is SHN_COMMON
In relocatable files, value holds a section offset for a defined symbol. That is, value is an offset from the beginning of the section associated with this symbol.
In executable and shared object files, value holds a virtual address. To make these files’s symbols more useful for the dynamic linker, the section offset (file interpretation) gives way to a virtual address (memory interpretation) for which the section number is irrelevant.
Symbol size.
Many symbols have associated sizes. For example, a data object’s size is the number of bytes contained in the object. This member holds 0 if the symbol has no size or an unknown size.
See also
Check if this symbols has a symbol version .
Return the SymbolVersion associated with this symbol. If there is no symbol version, return a nullptr.
Symbol’s unmangled name. If not available, it returns an empty string.
Check if the current symbol is exported.
Set whether or not the symbol is exported.
Check if the current symbol is imported.
Set whether or not the symbol is imported.
True if the symbol is a static one.
True if the symbol represent a function.
True if the symbol represent a variable.
Class which represents an entry defined in the DT_VERSYM dynamic entry.
Public Functions
Value associated with the symbol.
If the given SymbolVersion hasn’t Auxiliary version:
0 means Local
1 means Global
Whether the current SymbolVersion has an auxiliary one.
SymbolVersionAux associated with the current Version if any, or a nullptr.
Set the version’s auxiliary requirement The given SymbolVersionAuxRequirement must be an existing reference in the ELF::Binary.
On can add a new SymbolVersionAuxRequirement by using SymbolVersionRequirement::add_aux_requirement
Public Static Functions
Generate a local SymbolVersion.
Generate a global SymbolVersion.
Friends
Class which represents an Auxiliary Symbol version.
Subclassed by LIEF::ELF::SymbolVersionAuxRequirement
Public Functions
Smybol’s aux name (e.g. GLIBC_2.2.5)
Friends
Class which represents an entry defined in DT_VERDEF or .gnu.version_d
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Version information.
Version index.
Numeric value used as an index in the LIEF::ELF::SymbolVersion table
Hash value of the symbol’s name (using ELF hash function)
SymbolVersionAux entries.
Friends
Class which represents an entry in the DT_VERNEED or .gnu.version_r table.
Public Types
Public Functions
Version revision.
This field should always have the value 1. It will be changed if the versioning implementation has to be changed in an incompatible way.
Number of associated auxiliary entries.
Auxiliary entries as an iterator over SymbolVersionAuxRequirement.
Return the library name associated with this requirement (e.g. libc.so.6)
Add a version auxiliary requirement to the existing list.
Friends
Public Functions
Hash value of the dependency name (use ELF hashing function)
Bitmask of flags.
It returns the unique version index for the file which is used in the version symbol table. If the highest bit (bit 15) is set this is a hidden symbol which cannot be referenced from outside the object.
Smybol’s aux name (e.g. GLIBC_2.2.5)
Friends
Class which provides a view over the GNU Hash implementation. Most of the fields are read-only since the values are re-computed by the LIEF::ELF::Builder.
Public Functions
Return the number of buckets.
See also
Index of the first symbol in the dynamic symbols table which accessible with the hash table.
Shift count used in the bloom filter.
Number of bloom filters used. It must be a power of 2.
Bloom filters.
Hash buckets.
Hash values.
Check if the given hash passes the bloom filter.
Check if the given hash passes the bucket filter.
Check if the symbol probably exists. If the returned value is false you can assume at 100% that the symbol with the given name doesn’t exist. If true, you can’t do any assumption.
Check if the symbol associated with the given hash probably exists. If the returned value is false you can assume at 100% that the symbol doesn’t exists. If true you can’t do any assumption.
Class which represents the SYSV hash for the symbols resolution.
References:
http://www.linker-aliens.org/blogs/ali/entry/gnu_hash_elf_sections/
https://docs.oracle.com/cd/E23824_01/html/819-0690/chapter6-48031.html
Public Functions
Return the number of buckets used.
Return the number of chain used.
Buckets values.
Chains values.
Class which represents an ELF note. This class can be instantiated using the static Note::create functions.
Subclassed by LIEF::ELF::AndroidIdent, LIEF::ELF::CoreAuxv, LIEF::ELF::CoreFile, LIEF::ELF::CorePrPsInfo, LIEF::ELF::CorePrStatus, LIEF::ELF::CoreSigInfo, LIEF::ELF::NoteAbi, LIEF::ELF::NoteGnuProperty
Public Types
LIEF representation of the ELF NT_ values.
Values:
Match NT_HWCAP: Synthetic hardware capabilities information.
Match NT_GNU_BUILD_ID: Unique build ID as generated by the GNU ld.
Match NT_GNU_GOLD_VERSION: The version of gold used to link.
Match NT_GNU_PROPERTY_TYPE_0: Program property note, as described in “Linux Extensions to the gABI”.
Crashpad note used by the Chromium project.
Coredump that wraps the elf_prstatus structure.
Coredump that wraps the elf_prpsinfo structure.
See: CorePrPsInfo
Coredump that contains a copy of all the auxiliary vectors (auxv)
See: CoreAuxv
Coredump that wraps the fpregset structure.
Coredump that wraps the psinfo structure.
Note that is specific to Android and that describes information such as the NDK version or the SDK build number.
See AndroidIdent
Container used to handle the description data.
Public Functions
Clone the current note and keep its polymorphic type.
Return the name of the note (also known as ‘owner’ )
Return the type of the note. This type does not match the NT_ type value. For accessing the original NT_ value, check original_type()
The original NT_xxx integer value. The meaning of this value likely depends on the owner of the note.
Return the description associated with the note.
Change the description of the note.
Size of the raw note which includes padding.
Public Static Functions
Convert the raw integer note type into a TYPE according to the owner.
Try to determine the ELF section name associated with the TYPE provided in parameter.
Try to determine the owner’s name of the TYPE provided in parameter.
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Create a new note from the given parameters. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Create a new note from the given stream. Additional information such as the architecture or the ELF class could be required for creating notes like Coredump notes.
Class representing the NT_PRPSINFO core note. This kind of note represents general information about the process.
Public Functions
Clone the current note and keep its polymorphic type.
Friends
Public Functions
Initial part of the arguments.
Return the filename without the ending \x00
Return the args without the ending \x00
Public Members
Numeric process state.
printable character representing state
Whether the process is a zombie.
Nice value.
Process flag.
Process user ID.
Process group ID.
Process ID.
Process parent ID.
Process group.
Process session id.
Filename of the executable.
Class representing a core NT_FILE which describes the mapped files of the process.
Public Types
Public Functions
Clone the current note and keep its polymorphic type.
Number of coredump file entries.
Class representing core PrPsInfo object.
Public Functions
Clone the current note and keep its polymorphic type.
Return the pr_status_t structure.
The value of the register that holds the return value according to the calling convention.
Get the value for the given X86 register or return an error.
Get the value for the given X86_64 register or return an error.
Get the value for the given ARM register or return an error.
Get the value for the given AARCH64 register or return an error.
A list of the register values. This list is guarantee to be as long as the Registers::ARM::_COUNT or empty if it can’t be resolved. Thus, one can access a specific register with:
if (architecture() == ARCH::EM_AARCH64) {
auto reg_vals = register_values()
if (!reg_vals.empty()) {
auto x20 = reg_vals[static_cast<size_t>(Register::AARCH64::X20)]
}
}
Friends
Public Types
Register for the x86 architecture (ARCH::EM_386).
Values:
Register for the x86-64 architecture (ARCH::EM_X86_64).
Values:
Register for the ARM architecture (ARCH::EM_ARM).
Values:
Register for the AARCH64 architecture (ARCH::AARCH64).
Values:
Class representing a core siginfo object.
Public Functions
Clone the current note and keep its polymorphic type.
Friends
Class representing core auxv object.
Public Types
Values:
End of vector
Entry should be ignored
File descriptor of program
Program headers for program
Size of program header entry
Number of program headers
System page size
Base address of interpreter
Flags
Entry point of program
Program is not ELF
Real uid
Effective uid
Real gid
Effective gid
String identifying platform.
Machine dependent hints about processor capabilities.
Frequency of times()
Used FPU control word.
Data cache block size.
Instruction cache block size.
Instruction cache block size.
Entry should be ignored.
Boolean, was exec setuid-like?.
String identifying real platform
Address of 16 random bytes
Extension of AT_HWCAP
Filename of executable
Filename of executable
Pointer to ELF header of system-supplied DSO.
Public Functions
Clone the current note and keep its polymorphic type.
A map of CoreAuxv::TYPE and the value.
Return the value associated with the provided TYPE or a lief_errors::not_found if the type is not present.
Class representing the “.note.android.ident” section.
Public Functions
Clone the current note and keep its polymorphic type.
Target SDK version (or 0 if it can’t be resolved)
NDK version used (or an empty string if it can’t be parsed)
NDK build number (or an empty string if it can’t be parsed)
Public Static Functions
Public Static Attributes
Friends
Class that wraps the NT_GNU_ABI_TAG note.
Public Types
ABI recognized by this note.
Values:
Version type: (Major, Minor, Patch)
Public Functions
Clone the current note and keep its polymorphic type.
Public Static Functions
Class that wraps the NT_GNU_PROPERTY_TYPE_0 note.
Public Types
Public Functions
Clone the current note and keep its polymorphic type.
Find the property with the given type or return a nullptr
Return the properties as a list of Property.
Friends
This class wraps the different properties that can be used in a NT_GNU_PROPERTY_TYPE_0 note.
Subclassed by LIEF::ELF::AArch64Feature, LIEF::ELF::Generic, LIEF::ELF::Needed, LIEF::ELF::NoteNoCopyOnProtected, LIEF::ELF::StackSize, LIEF::ELF::X86Features, LIEF::ELF::X86ISA
Public Types
LIEF’s mirror types of the original GNU_PROPERTY_ values.
Values:
Mirror of GNU_PROPERTY_AARCH64_FEATURE_1_AND
Mirror of GNU_PROPERTY_STACK_SIZE
Mirror of GNU_PROPERTY_NO_COPY_ON_PROTECTED
Mirror of GNU_PROPERTY_X86_ISA_1_* and GNU_PROPERTY_X86_COMPAT_*
Mirror of GNU_PROPERTY_X86_FEATURE_*
This class represents a property which doesn’t have a concrete LIEF implementation.
Public Functions
The original raw type as an integer. This value might depends on the architecture and/or the file type.
Public Static Functions
This class represents the GNU_PROPERTY_AARCH64_FEATURE_1_AND property.
Public Types
Public Functions
Public Static Functions
This class provides an interface over the GNU_PROPERTY_NO_COPY_ON_PROTECTED property. This property indicates that the linker shouldn’t copy relocations against protected symbols.
Public Functions
Public Static Functions
This class provides an interface over the GNU_PROPERTY_STACK_SIZE property.
This property can be used by the loader to raise the stack limit.
Public Functions
The indicated stack size.
Public Static Functions
This class interfaces the different GNU_PROPERTY_X86_FEATURE_* properties which includes:
GNU_PROPERTY_X86_FEATURE_1_AND
GNU_PROPERTY_X86_FEATURE_2_USED
GNU_PROPERTY_X86_FEATURE_2_NEEDED
Public Types
Flag according to the _AND, _USED or _NEEDED suffixes.
Values:
For the original GNU_PROPERTY_X86_FEATURE_1_AND property.
For the original GNU_PROPERTY_X86_FEATURE_2_USED property.
For the original GNU_PROPERTY_X86_FEATURE_2_NEEDED property.
Features provided by these different properties.
Values:
List of the features as a pair of FLAG, FEATURE.
For instance, if the raw property is GNU_PROPERTY_X86_FEATURE_2_USED with a bitmask set to GNU_PROPERTY_X86_FEATURE_2_XSAVE, it generates the pair: FLAG::USED, FEATURE::XSAVE
Public Functions
List of the features.
Public Static Functions
This class interfaces the different GNU_PROPERTY_X86_ISA_* properties which includes:
GNU_PROPERTY_X86_ISA_1_USED
GNU_PROPERTY_X86_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_ISA_1_NEEDED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_USED
GNU_PROPERTY_X86_COMPAT_2_ISA_1_NEEDED
Public Types
Values:
Public Static Functions
Class which takes an ELF::Binary object and reconstructs a valid binary.
This interface assumes that the layout of input ELF binary is correct (i.e. the binary can run).
Public Functions
Perform the build of the provided ELF binary.
Return the built ELF binary as a byte vector.
Write the built ELF binary in the filename given in parameter.
Write the built ELF binary in the stream os given in parameter.
Configuration options to tweak the building process.
Public Members
Rebuild DT_HASH.
Rebuild DT_STRTAB.
Rebuild PT_DYNAMIC segment.
Rebuild DT_FINI_ARRAY.
Rebuild DT_GNU_HASH.
Rebuild DT_INIT_ARRAY.
Rebuild PT_INTERPRETER.
Rebuild DT_JMPREL.
Disable note building since it can break the default layout.
Rebuild DT_PREINIT_ARRAY.
Rebuild DT_REL[A].
Rebuild .symtab
Rebuild DT_VERDEF.
Rebuild DT_VERNEED.
Rebuild DT_VERSYM.
Rebuild DT_SYMTAB.
Check if the given file is an ELF one.
check if the raw data is a ELF file
Machine architectures See current registered ELF machine architectures at: http://www.sco.com/developers/gabi/latest/ch4.eheader.html.
Values:
No machine
AT&T WE 32100
SPARC
Intel 386
Motorola 68000
Motorola 88000
Intel MCU
Intel 80860
MIPS R3000
IBM System/370
MIPS RS3000 Little-endian
Hewlett-Packard PA-RISC
Fujitsu VPP500
Enhanced instruction set SPARC
Intel 80960
PowerPC
PowerPC64
IBM System/390
IBM SPU/SPC
NEC V800
Fujitsu FR20
TRW RH-32
Motorola RCE
ARM
DEC Alpha
Hitachi SH
SPARC V9
Siemens TriCore
Argonaut RISC Core
Hitachi H8/300
Hitachi H8/300H
Hitachi H8S
Hitachi H8/500
Intel IA-64 processor architecture
Stanford MIPS-X
Motorola ColdFire
Motorola M68HC12
Fujitsu MMA Multimedia Accelerator
Siemens PCP
Sony nCPU embedded RISC processor
Denso NDR1 microprocessor
Motorola Star*Core processor
Toyota ME16 processor
STMicroelectronics ST100 processor
Advanced Logic Corp. TinyJ embedded processor family
AMD x86-64 architecture
Sony DSP Processor
Digital Equipment Corp. PDP-10
Digital Equipment Corp. PDP-11
Siemens FX66 microcontroller
STMicroelectronics ST9+ 8/16 bit microcontroller
STMicroelectronics ST7 8-bit microcontroller
Motorola MC68HC16 Microcontroller
Motorola MC68HC11 Microcontroller
Motorola MC68HC08 Microcontroller
Motorola MC68HC05 Microcontroller
Silicon Graphics SVx
STMicroelectronics ST19 8-bit microcontroller
Digital VAX
Axis Communications 32-bit embedded processor
Infineon Technologies 32-bit embedded processor
Element 14 64-bit DSP Processor
LSI Logic 16-bit DSP Processor
Donald Knuth’s educational 64-bit processor
Harvard University machine-independent object files
SiTera Prism
Atmel AVR 8-bit microcontroller
Fujitsu FR30
Mitsubishi D10V
Mitsubishi D30V
NEC v850
Mitsubishi M32R
Matsushita MN10300
Matsushita MN10200
picoJava
OpenRISC 32-bit embedded processor
ARC International ARCompact processor (old spelling/synonym: EM_ARC_A5)
Tensilica Xtensa Architecture
Alphamosaic VideoCore processor
Thompson Multimedia General Purpose Processor
National Semiconductor 32000 series
Tenor Network TPC processor
Trebia SNP 1000 processor
STMicroelectronics (www.st.com) ST200
Ubicom IP2xxx microcontroller family
MAX Processor
National Semiconductor CompactRISC microprocessor
Fujitsu F2MC16
Texas Instruments embedded microcontroller msp430
Analog Devices Blackfin (DSP) processor
S1C33 Family of Seiko Epson processors
Sharp embedded microprocessor
Arca RISC Microprocessor
Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University
eXcess: 16/32/64-bit configurable embedded CPU
Icera Semiconductor Inc. Deep Execution Processor
Altera Nios II soft-core processor
National Semiconductor CompactRISC CRX
Motorola XGATE embedded processor
Infineon C16x/XC16x processor
Renesas M16C series microprocessors
Microchip Technology dsPIC30F Digital Signal
Freescale Communication Engine RISC core
Renesas M32C series microprocessors
Altium TSK3000 core
Freescale RS08 embedded processor
Analog Devices SHARC family of 32-bit DSP
Cyan Technology eCOG2 microprocessor
Sunplus S+core7 RISC processor
New Japan Radio (NJR) 24-bit DSP Processor
Broadcom VideoCore III processor
RISC processor for Lattice FPGA architecture
Seiko Epson C17 family
The Texas Instruments TMS320C6000 DSP family
The Texas Instruments TMS320C2000 DSP family
The Texas Instruments TMS320C55x DSP family
STMicroelectronics 64bit VLIW Data Signal Processor
Cypress M8C microprocessor
Renesas R32C series microprocessors
NXP Semiconductors TriMedia architecture family
Qualcomm Hexagon processor
Intel 8051 and variants
STMicroelectronics STxP7x family of configurable
Cyan Technology eCOG1X family
Cyan Technology eCOG1X family
Dallas Semiconductor MAXQ30 Core Micro-controllers
New Japan Radio (NJR) 16-bit DSP Processor
M2000 Reconfigurable RISC Microprocessor
Cray Inc. NV2 vector architecture
Renesas RX family
Imagination Technologies META processor
MCST Elbrus general purpose hardware architecture
Cyan Technology eCOG16 family
National Semiconductor CompactRISC CR16 16-bit
Freescale Extended Time Processing Unit
Infineon Technologies SLE9X core
Intel L10M
Intel K10M
ARM AArch64
Atmel Corporation 32-bit microprocessor family
STMicroeletronics STM8 8-bit microcontroller
Tilera TILE64 multicore architecture family
Tilera TILEPro multicore architecture family
NVIDIA CUDA architecture
Tilera TILE-Gx multicore architecture family
CloudShield architecture family
KIPO-KAIST Core-A 1st generation processor family
KIPO-KAIST Core-A 2nd generation processor family
Synopsys ARCompact V2
Open8 8-bit RISC soft processor core
Renesas RL78 family
Broadcom VideoCore V processor
Renesas 78KOR family
Freescale 56800EX Digital Signal Controller (DSC)
Beyond BA1 CPU architecture
Beyond BA2 CPU architecture
XMOS xCORE processor family
Microchip 8-bit PIC(r) family
Reserved by Intel
Reserved by Intel
Reserved by Intel
Reserved by Intel
Reserved by Intel
KM211 KM32 32-bit processor
KM211 KMX32 32-bit processor
KM211 KMX16 16-bit processor
KM211 KMX8 8-bit processor
KM211 KVARC processor
Paneve CDP architecture family
Cognitive Smart Memory Processor
iCelero CoolEngine
Nanoradio Optimized RISC
CSR Kalimba architecture family
AMD GPU architecture
RISC-V
eBPF Filter
LoongArch
e_ident size and indices.
Values:
File identification index.
File identification index.
File identification index.
File identification index.
File class.
Data encoding.
File version.
OS/ABI identification.
ABI version.
Start of padding bytes.
Number of bytes in e_ident.
Enum associated with e_type
Values:
No file type
Relocatable file
Executable file
Shared object file
Core file
Beginning of processor-specific codes
Processor-specific
OS ABI identification.
Values:
UNIX System V ABI
HP-UX operating system
NetBSD
GNU/Linux
Historical alias for ELFOSABI_GNU.
GNU/Hurd
Solaris
AIX
IRIX
FreeBSD
TRU64 UNIX
Novell Modesto
OpenBSD
OpenVMS
Hewlett-Packard Non-Stop Kernel
AROS
FenixOS
Nuxi CloudABI
Bare-metal TMS320C6000
AMD HSA runtime
Linux TMS320C6000
ARM
Standalone (embedded) application
Special section indices.
Values:
Undefined, missing, irrelevant, or meaningless
Lowest reserved index
Lowest processor-specific index
Highest processor-specific index
Lowest operating system-specific index
Highest operating system-specific index
FORTRAN COMMON or C external global variables
Mark that the index is >= SHN_LORESERVE
Highest reserved index
Section types.
Values:
No associated section (inactive entry).
Program-defined contents.
String table.
Relocation entries; explicit addends.
Information for dynamic linking.
Information about the file.
Data occupies no space in the file.
Relocation entries; no explicit addends.
Reserved.
Pointers to initialization functions.
Pointers to termination functions.
Pointers to pre-init functions.
Indices for SHN_XINDEX entries.
Lowest operating system-specific type.
Packed relocations (Android specific).
Packed relocations (Android specific).
This section is used to mark symbols as address-significant.
New relr relocations (Android specific).
Object attributes.
GNU-style hash table.
GNU version definitions.
GNU version references.
GNU symbol versions table.
Highest operating system-specific type.
Lowest processor arch-specific type.
Exception Index table
BPABI DLL dynamic linking pre-emption map
Object file compatibility attributes
Link editor is to sort the entries in
Unwind information
Register usage information
General options
ABI information.
Highest processor arch-specific type.
Lowest type reserved for applications.
Highest type reserved for applications.
Section flags.
Values:
The data in this section may be merged.
The data in this section is null-terminated strings.
A field in this section holds a section header table index.
Adds special ordering requirements for link editors.
This section requires special OS-specific processing to avoid incorrect behavior
This section is a member of a section group.
This section holds Thread-Local Storage.
This section is excluded from the final executable or shared library.
Bits indicating processor-specific flags.
Linker must generate implicit hidden weak names.
Do not strip this section.
This section should be merged.
Address size to be inferred from section entry size.
Symbol bindings.
Values:
Local symbol, not visible outside obj file containing def
Global symbol, visible to all object files being combined
Weak symbol, like global but lower-precedence
Lowest operating system-specific binding type
Highest operating system-specific binding type
Lowest processor-specific binding type
Highest processor-specific binding type
Values:
Segment types.
Values:
Unused segment.
Loadable segment.
Dynamic linking information.
Interpreter pathname.
Auxiliary information.
Reserved.
The program header table itself.
The thread-local storage template.
Lowest operating system-specific pt entry type.
Highest operating system-specific pt entry type.
Lowest processor-specific program hdr entry type.
Highest processor-specific program hdr entry type.
Indicates stack executability.
GNU property
Read-only after relocation.
Platform architecture compatibility info
Register usage information.
Runtime procedure table.
Options segment.
Abiflags segment.
Segment flags.
Values:
Execute
Write
Read
Bits for operating system-specific semantics.
Bits for processor-specific semantics.
DT_FLAGS and DT_FLAGS_1 values.
Values:
The object may reference $ORIGIN.
Search the shared lib before searching the exe.
Relocations may modify a non-writable segment.
Process all relocations on load.
Reject attempts to load dynamically.
Values:
Set RTLD_NOW for this object.
Set RTLD_GLOBAL for this object.
Set RTLD_GROUP for this object.
Set RTLD_NODELETE for this object.
Trigger filtee loading at runtime.
Set RTLD_INITFIRST for this object.
Set RTLD_NOOPEN for this object.
$ORIGIN must be handled.
Direct binding enabled.
Object is used to interpose.
Ignore default lib search path.
Object can’t be dldump’ed.
Configuration alternative created.
Filtee terminates filters search.
Disp reloc applied at build time.
Disp reloc applied at run-time.
Object has no-direct binding.
Object is modified after built.
Object has individual interposers.
Global auditing required.
Singleton symbols are used.
Singleton symbols are used.
Methods that can be used by the LIEF::ELF::Parser to count the number of dynamic symbols
Values:
Automatic detection
Count based on sections (not very reliable)
Count based on hash table (reliable)
Count based on PLT/GOT relocations (very reliable but not accurate)
x86_64 relocations.
Values:
i386 relocations.
Values:
Values:
Values:
Values:
Values:
Values: