Wiki Navigation

[Kong API].ELF.ELF

ELF executable image parser

Synopsis:

int ELF_verify(Stream file);
template ELF_platform(uint PLATFORM);
class ELF_platform!(PLATFORM).image;

// PLATFORM: ELFCLASS32, ELFCLASS64

Description:

ELF_verify checks if the target is a valid ELF image, and returns its platform type.

ELF_platform is used to generate classes needed to parse images for a given platform. Valid platform are currently ELFCLASS32 and ELFCLASS64 for 32bit and 64bit variants.

The Stream file must be pointing to the start of the ELF header.
See [ELF types and aliases http://destroy.selfip.org/svn_view/index.cgi/root/view/kong/ELF/types.d]
Bug: non-native endian formats are unsupported.

template :

ELF_platform (uint platform)

class : ELF_platform.image

Type	Name	Description

Constructors:
(string path, FileMode mode = FileMode.In)	this
(void* base_address)	this
(Stream file)	this

Methods:
void (Object[] obj...);	analyze;	Analyze ELF file using provided data mining classes. Objects must derive mine!(Phdr) or mine!(Shdr).

Static Methods:
Off (Addr address, Phdr* segment);	RVA2file;	Virtual-address : file offset conversion
Addr (Off offset, Phdr* segment);	file2RVA;
Sym (string query, Sym[] table, uint32_t[] hash_buckets, uint32_t[] hash_chains, char[] strtab);	symbol_lookup;
T* (T)(T[] reloc_table, Sym* symbol, Sym[] symbols);	PLT_lookup;	Find PLT relocation entry that points to GOT slots.

Error handling:

Throws image_exception for various parse failures. StreamException and related for IO failures.

RVA2file and file2RVA throw image_exception if the conversion is invalid (offsets out of bounds).

Default mining classes:

ELF_platform.PT - Segment(Phdr) parser.
ELF_platform.ST - Section(Shdr) parser.
ELF_platform.DT - Segment.Dynamic(Dyn) parser.

Example:

elf_dump.d

image_interface, mine, ELF/types.d

kong