mirror of https://github.com/Nonannet/pelfy.git
initial commit
This commit is contained in:
commit
9d5dba8864
|
@ -0,0 +1,47 @@
|
|||
# Byte-compiled / optimized / DLL files
|
||||
__pycache__/
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
wheels/
|
||||
share/python-wheels/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
MANIFEST
|
||||
|
||||
# Jupyter Notebook
|
||||
.ipynb_checkpoints
|
||||
|
||||
# IPython
|
||||
profile_default/
|
||||
ipython_config.py
|
||||
|
||||
# Environments
|
||||
.env
|
||||
.venv
|
||||
env/
|
||||
venv/
|
||||
ENV/
|
||||
.venv/
|
||||
env.bak/
|
||||
venv.bak/
|
||||
|
||||
# mypy
|
||||
.mypy_cache/
|
||||
.dmypy.json
|
||||
dmypy.json
|
||||
|
||||
# pytype static type analyzer
|
||||
.pytype/
|
|
@ -0,0 +1,21 @@
|
|||
MIT License
|
||||
|
||||
Copyright (c) 2024 Nicolas Kruse
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
|
@ -0,0 +1,31 @@
|
|||
[project]
|
||||
name = "pelfy"
|
||||
version = "1.0.0"
|
||||
authors = [
|
||||
{ name="Nicolas Kruse", email="nicolas.kruse@nonan.net" },
|
||||
]
|
||||
description = "Parser for ELF files written in python"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.9"
|
||||
classifiers = [
|
||||
"Programming Language :: Python :: 3",
|
||||
"License :: OSI Approved :: MIT License",
|
||||
"Operating System :: OS Independent",
|
||||
]
|
||||
|
||||
[project.urls]
|
||||
Homepage = "https://github.com/Nonannet/pelfy"
|
||||
Issues = "https://github.com/Nonannet/pelfy/issues"
|
||||
|
||||
[build-system]
|
||||
requires = ["setuptools>=61.0"]
|
||||
build-backend = "setuptools.build_meta"
|
||||
|
||||
[tool.setuptools.packages.find]
|
||||
where = ["src"]
|
||||
|
||||
[tool.pytest.ini_options]
|
||||
minversion = "6.0"
|
||||
addopts = "-ra -q"
|
||||
testpaths = ["tests"]
|
||||
pythonpath = ["src"]
|
|
@ -0,0 +1,200 @@
|
|||
_elf_header_field = {
|
||||
"e_ident[EI_MAG]": {
|
||||
"32": "0x00", "64": "0x00", "size32": "4", "size64": "4", "field_name": "e_ident[EI_MAG]",
|
||||
"description": "0x7F followed by ELF(45 4c 46) in ASCII; these four bytes constitute the magic number"
|
||||
},
|
||||
"e_ident[EI_CLASS]": {
|
||||
"32": "0x04", "64": "0x04", "size32": "1", "size64": "1", "field_name": "e_ident[EI_CLASS]",
|
||||
"description": "This byte is set to either 1 or 2 to signify 32- or 64-bit format, respectively"
|
||||
},
|
||||
"e_ident[EI_DATA]": {
|
||||
"32": "0x05", "64": "0x05", "size32": "1", "size64": "1", "field_name": "e_ident[EI_DATA]",
|
||||
"description": "This byte is set to either 1 or 2 to signify little or big endianness, respectively This affects interpretation of multi-byte fields starting with offset 0x10"
|
||||
},
|
||||
"e_ident[EI_VERSION]": {
|
||||
"32": "0x06", "64": "0x06", "size32": "1", "size64": "1", "field_name": "e_ident[EI_VERSION]",
|
||||
"description": "Set to 1 for the original and current version of ELF"
|
||||
},
|
||||
"e_ident[EI_OSABI]": {
|
||||
"32": "0x07", "64": "0x07", "size32": "1", "size64": "1", "field_name": "e_ident[EI_OSABI]",
|
||||
"description": "Identifies the target operating system ABI"
|
||||
},
|
||||
"e_ident[EI_ABIVERSION]": {
|
||||
"32": "0x08", "64": "0x08", "size32": "1", "size64": "1", "field_name": "e_ident[EI_ABIVERSION]",
|
||||
"description": "Further specifies the ABI version"
|
||||
},
|
||||
"e_ident[EI_PAD]": {
|
||||
"32": "0x09", "64": "0x09", "size32": "7", "size64": "7", "field_name": "e_ident[EI_PAD]",
|
||||
"description": "Reserved padding bytes Currently unused Should be filled with zeros and ignored when read"
|
||||
},
|
||||
"e_type": {
|
||||
"32": "0x10", "64": "0x10", "size32": "2", "size64": "2", "field_name": "e_type",
|
||||
"description": "Identifies object file type"
|
||||
},
|
||||
"e_machine": {
|
||||
"32": "0x12", "64": "0x12", "size32": "2", "size64": "2", "field_name": "e_machine",
|
||||
"description": "Specifies target instruction set architecture"
|
||||
},
|
||||
"e_version": {
|
||||
"32": "0x14", "64": "0x14", "size32": "4", "size64": "4", "field_name": "e_version",
|
||||
"description": "Set to 1 for the original version of ELF"
|
||||
},
|
||||
"e_entry": {
|
||||
"32": "0x18", "64": "0x18", "size32": "4", "size64": "8", "field_name": "e_entry",
|
||||
"description": "This is the memory address of the entry point from where the process starts executing This field is either 32 or 64 bits long, depending on the format defined earlier (byte 0x04) If the file doesn't have an associated entry point, then this holds zero"
|
||||
},
|
||||
"e_phoff": {
|
||||
"32": "0x1C", "64": "0x20", "size32": "4", "size64": "8", "field_name": "e_phoff",
|
||||
"description": "Points to the start of the program header table It usually follows the file header immediately following this one, making the offset 0x34 or 0x40 for 32- and 64-bit ELF executables, respectively"
|
||||
},
|
||||
"e_shoff": {
|
||||
"32": "0x20", "64": "0x28", "size32": "4", "size64": "8", "field_name": "e_shoff",
|
||||
"description": "Points to the start of the section header table"
|
||||
},
|
||||
"e_flags": {
|
||||
"32": "0x24", "64": "0x30", "size32": "4", "size64": "4", "field_name": "e_flags",
|
||||
"description": "Interpretation of this field depends on the target architecture"
|
||||
},
|
||||
"e_ehsize": {
|
||||
"32": "0x28", "64": "0x34", "size32": "2", "size64": "2", "field_name": "e_ehsize",
|
||||
"description": "Contains the size of this header, normally 64 Bytes for 64-bit and 52 Bytes for 32-bit format"
|
||||
},
|
||||
"e_phentsize": {
|
||||
"32": "0x2A", "64": "0x36", "size32": "2", "size64": "2", "field_name": "e_phentsize",
|
||||
"description": "Contains the size of a program header table entry As explained below, this will typically be 0x20 (32 bit) or 0x38 (64 bit)"
|
||||
},
|
||||
"e_phnum": {
|
||||
"32": "0x2C", "64": "0x38", "size32": "2", "size64": "2", "field_name": "e_phnum",
|
||||
"description": "Contains the number of entries in the program header table"
|
||||
},
|
||||
"e_shentsize": {
|
||||
"32": "0x2E", "64": "0x3A", "size32": "2", "size64": "2", "field_name": "e_shentsize",
|
||||
"description": "Contains the size of a section header table entry As explained below, this will typically be 0x28 (32 bit) or 0x40 (64 bit)"
|
||||
},
|
||||
"e_shnum": {
|
||||
"32": "0x30", "64": "0x3C", "size32": "2", "size64": "2", "field_name": "e_shnum",
|
||||
"description": "Contains the number of entries in the section header table"
|
||||
},
|
||||
"e_shstrndx": {
|
||||
"32": "0x32", "64": "0x3E", "size32": "2", "size64": "2", "field_name": "e_shstrndx",
|
||||
"description": "Contains index of the section header table entry that contains the section names"
|
||||
}
|
||||
}
|
||||
|
||||
_section_header = {
|
||||
"sh_name": {
|
||||
"32": "0x00", "64": "0x00", "size32": "4", "size64": "4", "field_name": "sh_name",
|
||||
"description": "An offset to a string in the .shstrtab section that represents the name of this section."
|
||||
},
|
||||
"sh_type": {
|
||||
"32": "0x04", "64": "0x04", "size32": "4", "size64": "4", "field_name": "sh_type",
|
||||
"description": "Identifies the type of this header."
|
||||
},
|
||||
"sh_flags": {
|
||||
"32": "0x08", "64": "0x08", "size32": "4", "size64": "8", "field_name": "sh_flags",
|
||||
"description": "Identifies the attributes of the section."
|
||||
},
|
||||
"sh_addr": {
|
||||
"32": "0x0C", "64": "0x10", "size32": "4", "size64": "8", "field_name": "sh_addr",
|
||||
"description": "Virtual address of the section in memory, for sections that are loaded."
|
||||
},
|
||||
"sh_offset": {
|
||||
"32": "0x10", "64": "0x18", "size32": "4", "size64": "8", "field_name": "sh_offset",
|
||||
"description": "Offset of the section in the file image."
|
||||
},
|
||||
"sh_size": {
|
||||
"32": "0x14", "64": "0x20", "size32": "4", "size64": "8", "field_name": "sh_size",
|
||||
"description": "Size in bytes of the section in the file image. May be 0."
|
||||
},
|
||||
"sh_link": {
|
||||
"32": "0x18", "64": "0x28", "size32": "4", "size64": "4", "field_name": "sh_link",
|
||||
"description": "Contains the section index of an associated section. This field is used for several purposes, depending on the type of section."
|
||||
},
|
||||
"sh_info": {
|
||||
"32": "0x1C", "64": "0x2C", "size32": "4", "size64": "4", "field_name": "sh_info",
|
||||
"description": "Contains extra information about the section. This field is used for several purposes, depending on the type of section."
|
||||
},
|
||||
"sh_addralign": {
|
||||
"32": "0x20", "64": "0x30", "size32": "4", "size64": "8", "field_name": "sh_addralign",
|
||||
"description": "Contains the required alignment of the section. This field must be a power of two."
|
||||
},
|
||||
"sh_entsize": {
|
||||
"32": "0x24", "64": "0x38", "size32": "4", "size64": "8", "field_name": "sh_entsize",
|
||||
"description": "Contains the size, in bytes, of each entry, for sections that contain fixed-size entries. Otherwise, this field contains zero."
|
||||
}
|
||||
}
|
||||
|
||||
_section_header_types = {
|
||||
0: {"value": "0x0", "name": "SHT_NULL", "description": "Section header table entry unused"},
|
||||
1: {"value": "0x1", "name": "SHT_PROGBITS", "description": "Program data"},
|
||||
2: {"value": "0x2", "name": "SHT_SYMTAB", "description": "Symbol table"},
|
||||
3: {"value": "0x3", "name": "SHT_STRTAB", "description": "String table"},
|
||||
4: {"value": "0x4", "name": "SHT_RELA", "description": "Relocation entries with addends"},
|
||||
5: {"value": "0x5", "name": "SHT_HASH", "description": "Symbol hash table"},
|
||||
6: {"value": "0x6", "name": "SHT_DYNAMIC", "description": "Dynamic linking information"},
|
||||
7: {"value": "0x7", "name": "SHT_NOTE", "description": "Notes"},
|
||||
8: {"value": "0x8", "name": "SHT_NOBITS", "description": "Program space with no data (bss)"},
|
||||
9: {"value": "0x9", "name": "SHT_REL", "description": "Relocation entries, no addends"},
|
||||
10: {"value": "0x0A", "name": "SHT_SHLIB", "description": "Reserved"},
|
||||
11: {"value": "0x0B", "name": "SHT_DYNSYM", "description": "Dynamic linker symbol table"},
|
||||
14: {"value": "0x0E", "name": "SHT_INIT_ARRAY", "description": "Array of constructors"},
|
||||
15: {"value": "0x0F", "name": "SHT_FINI_ARRAY", "description": "Array of destructors"},
|
||||
16: {"value": "0x10", "name": "SHT_PREINIT_ARRAY", "description": "Array of pre-constructors"},
|
||||
17: {"value": "0x11", "name": "SHT_GROUP", "description": "Section group"},
|
||||
18: {"value": "0x12", "name": "SHT_SYMTAB_SHNDX", "description": "Extended section indices"},
|
||||
19: {"value": "0x13", "name": "SHT_NUM", "description": "Number of defined types."},
|
||||
1610612736: {"value": "0x60000000", "name": "SHT_LOOS", "description": "Start OS-specific."},
|
||||
1879048182: {"value": "0x6ffffff6", "name": "SHT_GNU_HASH", "description": "GNU-style hash table."}
|
||||
}
|
||||
|
||||
_st_info_values = {
|
||||
0: {"name": "STT_NOTYPE", "description": "Type is unspecified"},
|
||||
1: {"name": "STT_OBJECT", "description": "Data object (variable, array, etc.)"},
|
||||
2: {"name": "STT_FUNC", "description": "Function or executable code"},
|
||||
3: {"name": "STT_SECTION", "description": "Associated with a section"},
|
||||
4: {"name": "STT_FILE", "description": "Represents a file name"},
|
||||
5: {"name": "STT_COMMON", "description": "Common data object (uninit. storage)"},
|
||||
6: {"name": "STT_TLS", "description": "Thread-local storage (TLS)"},
|
||||
7: {"name": "STT_NUM", "description": "Number of defined types"},
|
||||
10: {"name": "STT_GNU_IFUNC", "description": "Indirect function (GNU extension)"},
|
||||
12: {"name": "STT_HIPROC", "description": "Processor-specific symbol type"},
|
||||
}
|
||||
|
||||
_stb_values = {
|
||||
0: {"name": "STB_LOCAL", "description": "Local, not visible outside the object file"},
|
||||
1: {"name": "STB_GLOBAL", "description": "Global, visible to all object files"},
|
||||
2: {"name": "STB_WEAK", "description": "Weak, like global but with lower precedence"},
|
||||
10: {"name": "STB_GNU_UNIQUE", "description": "Unique in the entire process (GNU extension)"},
|
||||
12: {"name": "STB_HIPROC", "description": "Processor-specific binding type"},
|
||||
}
|
||||
|
||||
_relocation_table_types = {
|
||||
0: {"name": "R_X86_64_NONE", "description": "No relocation"},
|
||||
1: {"name": "R_X86_64_64", "description": "Direct 64-bit relocation"},
|
||||
2: {"name": "R_X86_64_PC32", "description": "32-bit PC-relative relocation"},
|
||||
3: {"name": "R_X86_64_GOT32", "description": "32-bit Global Offset Table (GOT) entry"},
|
||||
4: {"name": "R_X86_64_PLT32", "description": "32-bit Procedure Linkage Table (PLT) entry"},
|
||||
5: {"name": "R_X86_64_COPY", "description": "Copy data from shared object"},
|
||||
6: {"name": "R_X86_64_GLOB_DAT", "description": "Set GOT entry to the address of a symbol"},
|
||||
7: {"name": "R_X86_64_JUMP_SLOT", "description": "Set GOT entry to the address of a function (dynamic linking)"},
|
||||
8: {"name": "R_X86_64_RELATIVE", "description": "Adjust relative to the load address"},
|
||||
9: {"name": "R_X86_64_GOTPCREL", "description": "PC-relative address for GOT entry"},
|
||||
10: {"name": "R_X86_64_32", "description": "32-bit absolute relocation"},
|
||||
11: {"name": "R_X86_64_32S", "description": "32-bit signed absolute relocation"},
|
||||
12: {"name": "R_X86_64_16", "description": "16-bit absolute relocation"},
|
||||
13: {"name": "R_X86_64_8", "description": "8-bit absolute relocation"}
|
||||
}
|
||||
|
||||
_e_machine_dict = {
|
||||
0x0001: {"name": "EM_386", "description": "Intel 80386 (x86)"},
|
||||
0x0002: {"name": "EM_MIPS", "description": "MIPS (32-bit)"},
|
||||
0x0003: {"name": "EM_SPARC", "description": "SPARC (32-bit)"},
|
||||
0x0008: {"name": "EM_MIPS_RS3_LE", "description": "MIPS (Big Endian)"},
|
||||
0x0014: {"name": "EM_ARM", "description": "ARM (32-bit)"},
|
||||
0x0028: {"name": "EM_PPC", "description": "PowerPC (32-bit)"},
|
||||
0x0032: {"name": "EM_S390", "description": "IBM S/390"},
|
||||
0x003E: {"name": "EM_X86_64", "description": "x86-64 (64-bit)"},
|
||||
0x00F3: {"name": "EM_AARCH64", "description": "ARM64 (64-bit)"},
|
||||
0x0103: {"name": "EM_RISCV", "description": "RISC-V (32/64-bit)"},
|
||||
0xF3: {"name": "EM_BPF", "description": "BPF (Berkeley Packet Filter)"}
|
||||
}
|
|
@ -0,0 +1,264 @@
|
|||
import elf_fields as elff
|
||||
|
||||
class elf_list(list):
|
||||
def __getitem__(self, key: int | str | slice):
|
||||
if isinstance(key, (int | slice)):
|
||||
return super().__getitem__(key)
|
||||
else:
|
||||
elements = [el for el in self if el.name == key]
|
||||
assert elements, f'Unknown section name: {key}'
|
||||
return elements[0]
|
||||
|
||||
class section_list(elf_list):
|
||||
def __repr__(self):
|
||||
return '\n'.join(['Sections:'] + [s._short_repr() for s in self] + [' '])
|
||||
|
||||
class symbol_list(elf_list):
|
||||
def __repr__(self):
|
||||
return '\n'.join(['Symbols:'] + [s._short_repr() for s in self] + [' '])
|
||||
|
||||
class relocation_list(list):
|
||||
def __repr__(self):
|
||||
return '\n'.join(['Relocations:'] + [f'{i:4} ' + s._short_repr() for i, s in enumerate(self)] + [' '])
|
||||
|
||||
class elf_symbol():
|
||||
def __init__(self, file: 'elf_file', fields: dict[str, int], index: int):
|
||||
self.fields = fields
|
||||
self.file = file
|
||||
self.name = file._read_string(file.string_table['sh_offset'] + fields['st_name'])
|
||||
self.index = index
|
||||
|
||||
st_info = elff._st_info_values[fields['st_info'] & 0x0F]
|
||||
stb = elff._stb_values[fields['st_info'] >> 4]
|
||||
|
||||
self.stb = stb['name']
|
||||
self.description = st_info['description']
|
||||
self.info = st_info['name']
|
||||
|
||||
def read_data(self) -> bytes:
|
||||
start = self.file.sections[self['st_shndx']]['sh_offset'] + self['st_value']
|
||||
end = start + self['st_size']
|
||||
return self.file._data[start:end]
|
||||
|
||||
def read_data_hex(self):
|
||||
return ' '.join(f'{d:02X}' for d in self.read_data())
|
||||
|
||||
def get_relocations(self) -> relocation_list:
|
||||
ret = relocation_list()
|
||||
section = self.file.sections[self['st_shndx']]
|
||||
assert section.type == 'SHT_PROGBITS'
|
||||
for reloc in self.file.get_relocations():
|
||||
if reloc.target_section == section:
|
||||
offset = reloc['r_offset'] - self['st_value']
|
||||
if 0 <= offset < self['st_size']:
|
||||
ret.append(reloc)
|
||||
return ret
|
||||
|
||||
def __getitem__(self, key: str):
|
||||
assert key in self.fields, f'Unknown field name: {key}'
|
||||
return self.fields[key]
|
||||
|
||||
def __repr__(self):
|
||||
stb = elff._stb_values[self.fields['st_info'] >> 4]
|
||||
return f'index {self.index}\n' +\
|
||||
f'name {self.name}\n' +\
|
||||
f'stb {self.stb} ({stb["description"]})\n' +\
|
||||
f'info {self.info} ({self.description})\n' +\
|
||||
'\n'.join(f'{k:18} {v:4}' for k, v in self.fields.items()) + '\n'
|
||||
|
||||
def _short_repr(self):
|
||||
return f"{self.index:3} {self.name:18} {self.info:18} {self.fields['st_size']:8} {self.stb:18} {self.description}"
|
||||
|
||||
class elf_section():
|
||||
def __init__(self, file: 'elf_file', fields: dict[str, int], section_names: dict[str, int], index: int):
|
||||
self.fields = fields
|
||||
self.file = file
|
||||
self.index = index
|
||||
if fields['sh_name']:
|
||||
self.name = file._read_string(section_names['sh_offset']+fields['sh_name'])
|
||||
else:
|
||||
self.name = ''
|
||||
assert fields['sh_type'] in elff._section_header_types, f"Unknown section type: {hex(fields['sh_type'])}"
|
||||
self.description = elff._section_header_types[fields['sh_type']]['description']
|
||||
self.type = elff._section_header_types[fields['sh_type']]['name']
|
||||
|
||||
def read_data(self):
|
||||
start = self['sh_offset']
|
||||
end = start + self['sh_size']
|
||||
return self.file._data[start:end]
|
||||
|
||||
def read_data_hex(self):
|
||||
return ' '.join(f'{d:02X}' for d in self.read_data())
|
||||
|
||||
def __getitem__(self, key: str):
|
||||
assert key in self.fields, f'Unknown field name: {key}'
|
||||
return self.fields[key]
|
||||
|
||||
def __repr__(self):
|
||||
return f'index {self.index}\n' +\
|
||||
f'name {self.name}\n' +\
|
||||
f'type {self.type} ({self.description})\n' +\
|
||||
'\n'.join(f"{k:18} {v:4} {elff._section_header[k]['description']}" for k, v in self.fields.items()) + '\n'
|
||||
|
||||
def _short_repr(self):
|
||||
return f"{self.index:3} {self.name:18} {self.type:18} {self.description}"
|
||||
|
||||
|
||||
class elf_relocation():
|
||||
def __init__(self, file: 'elf_file', fields: dict[str, int], symbol_index: int, relocation_type: int, sh_info: int):
|
||||
self.fields = fields
|
||||
self.file = file
|
||||
self.symbol = file.symbols[symbol_index]
|
||||
self.description = elff._relocation_table_types[relocation_type]['description']
|
||||
self.type = elff._relocation_table_types[relocation_type]['name']
|
||||
self.target_section = file.sections[sh_info]
|
||||
|
||||
def __getitem__(self, key: str):
|
||||
assert key in self.fields, f'Unknown field name: {key}'
|
||||
return self.fields[key]
|
||||
|
||||
def __repr__(self):
|
||||
return f'symbol {self.symbol.name}\n' +\
|
||||
f'relocation type {self.type} ({self.description})\n' +\
|
||||
'\n'.join(f'{k:18} {v:4}' for k, v in self.fields.items()) + '\n'
|
||||
|
||||
def _short_repr(self):
|
||||
return f'{self.symbol.name:18} {self.type:18} {self.description}'
|
||||
|
||||
|
||||
class elf_file:
|
||||
def __init__(self, file_path: str):
|
||||
with open(file_path, mode='rb') as f:
|
||||
self._data = f.read()
|
||||
|
||||
#Defaults required for function _read_int_from_elf_field
|
||||
self.bit_width = 32
|
||||
self.byteorder = 'little'
|
||||
|
||||
assert self._read_bytes_from_elf_field('e_ident[EI_MAG]') == bytes([0x7F, 0x45, 0x4c, 0x46]), 'Not an ELF file'
|
||||
|
||||
self.bit_width = {1: 32, 2: 64}[self._read_int_from_elf_field('e_ident[EI_CLASS]')]
|
||||
self.byteorder = {1: 'little', 2: 'big'}[self._read_int_from_elf_field('e_ident[EI_DATA]')]
|
||||
|
||||
self.fields = {fn: self._read_int_from_elf_field(fn) for fn in elff._elf_header_field.keys()}
|
||||
|
||||
arch_entr = elff._e_machine_dict.get(self.fields['e_machine'])
|
||||
self.architecture = arch_entr['name'] + ' - ' + arch_entr['description'] if arch_entr else 'Unknown'
|
||||
|
||||
section_data = list(self._list_sections())
|
||||
section_names = section_data[self.fields['e_shstrndx']] if section_data else []
|
||||
self.sections = section_list(elf_section(self, d, section_names, i) for i, d in enumerate(section_data))
|
||||
|
||||
ret_sections = [sh for sh in self.sections if sh.type == 'SHT_SYMTAB']
|
||||
self.symbol_table = ret_sections[0] if ret_sections else None
|
||||
|
||||
print(self.sections)
|
||||
ret_sections = [sh for sh in self.sections if sh.name == '.strtab']
|
||||
self.string_table = ret_sections[0] if ret_sections else None
|
||||
|
||||
self.symbols = symbol_list(self._list_symbols())
|
||||
|
||||
self.functions = symbol_list(s for s in self.symbols if s.info == 'STT_FUNC')
|
||||
self.objects = symbol_list(s for s in self.symbols if s.info == 'STT_OBJECT')
|
||||
|
||||
self.code_relocations = self.get_relocations('.rela.text')
|
||||
|
||||
def _list_sections(self):
|
||||
for i in range(self.fields['e_shnum']):
|
||||
offs = self.fields['e_shoff'] + i * self.fields['e_shentsize']
|
||||
yield {fn: self._read_from_sh_field(offs, fn) for fn in elff._section_header.keys()}
|
||||
|
||||
def _list_symbols(self):
|
||||
if self.symbol_table:
|
||||
offs = self.symbol_table['sh_offset']
|
||||
|
||||
for j, i in enumerate(range(offs, self.symbol_table['sh_size']+offs, self.symbol_table['sh_entsize'])):
|
||||
ret = {'st_name': self._read_int(i, 4)}
|
||||
|
||||
if self.bit_width == 32:
|
||||
ret['st_value'] = self._read_int(i+4, 4)
|
||||
ret['st_size'] = self._read_int(i+8, 4)
|
||||
ret['st_info'] = self._read_int(i+12, 1)
|
||||
ret['st_other'] = self._read_int(i+13, 1)
|
||||
ret['st_shndx'] = self._read_int(i+14, 2)
|
||||
elif self.bit_width == 64:
|
||||
ret['st_info'] = self._read_int(i+4, 1)
|
||||
ret['st_other'] = self._read_int(i+5, 1)
|
||||
ret['st_shndx'] = self._read_int(i+6, 2)
|
||||
ret['st_value'] = self._read_int(i+8, 8)
|
||||
ret['st_size'] = self._read_int(i+16, 8)
|
||||
|
||||
yield elf_symbol(self, ret, j)
|
||||
|
||||
def get_relocations(self, reloc_section: elf_section | str | None = None) -> relocation_list:
|
||||
if isinstance(reloc_section, elf_section):
|
||||
assert elf_section.type == 'SHT_RELA', f'{elf_section.name} is not a relocation section'
|
||||
return self.relocation_list(self._list_relocations(sh))
|
||||
else:
|
||||
relocs = relocation_list()
|
||||
for sh in self.sections:
|
||||
if sh.type == 'SHT_RELA':
|
||||
if sh.name == reloc_section or not isinstance(reloc_section, str):
|
||||
relocs += relocation_list(self._list_relocations(sh))
|
||||
|
||||
return relocs
|
||||
|
||||
def _list_relocations(self, sh: elf_section) -> dict[str, int]:
|
||||
assert sh.type == 'SHT_RELA', \
|
||||
'Section must be a relocation section (currently only SHT_RELA is supported)'
|
||||
|
||||
offs = sh['sh_offset']
|
||||
for i in range(offs, sh['sh_size']+offs, sh['sh_entsize']):
|
||||
ret = dict()
|
||||
|
||||
if self.bit_width == 32:
|
||||
ret['r_offset'] = self._read_int(i, 4)
|
||||
r_info = self._read_int(i+4, 4)
|
||||
ret['r_info'] = r_info
|
||||
ret['r_addend'] = self._read_int(i+8, 4, True)
|
||||
yield elf_relocation(self, ret, r_info >> 8, r_info & 0xFF, sh['sh_info'])
|
||||
elif self.bit_width == 64:
|
||||
ret['r_offset'] = self._read_int(i, 8)
|
||||
r_info = self._read_int(i+8, 8)
|
||||
ret['r_info'] = r_info
|
||||
ret['r_addend'] = self._read_int(i+16, 8, True)
|
||||
yield elf_relocation(self, ret, r_info >> 32, r_info & 0xFFFFFFFF, sh['sh_info'])
|
||||
|
||||
def _read_bytes(self, offset: int, num_bytes: int):
|
||||
return self._data[offset:offset+num_bytes]
|
||||
|
||||
def _read_int(self, offset: int, num_bytes: int, signed: bool = False) -> int:
|
||||
return int.from_bytes(self._data[offset:offset+num_bytes], self.byteorder, signed=signed)
|
||||
|
||||
def int_to_bytes(self, value: int, num_bytes: int = 4, signed: bool = False) -> int:
|
||||
return value.to_bytes(length=num_bytes, byteorder=self.byteorder, signed=signed)
|
||||
|
||||
def _read_string(self, offset: int) -> str:
|
||||
str_end = self._data.find(b'\x00', offset)
|
||||
return self._data[offset:str_end].decode()
|
||||
|
||||
def _read_int_from_elf_field(self, field_name: str) -> int:
|
||||
field = elff._elf_header_field[field_name]
|
||||
offs = int(field[str(self.bit_width)], base=16)
|
||||
byte_len = int(field['size'+str(self.bit_width)])
|
||||
return self._read_int(offs, byte_len)
|
||||
|
||||
def _read_bytes_from_elf_field(self, field_name: str) -> int:
|
||||
field = elff._elf_header_field[field_name]
|
||||
offs = int(field[str(self.bit_width)], base=16)
|
||||
byte_len = int(field['size'+str(self.bit_width)])
|
||||
return self._read_bytes(offs, byte_len)
|
||||
|
||||
def _read_from_sh_field(self, offset: int, field_name: str) -> int:
|
||||
field = elff._section_header[field_name]
|
||||
offs = int(field[str(self.bit_width)], base=16) + offset
|
||||
byte_len = int(field['size'+str(self.bit_width)])
|
||||
return self._read_int(offs, byte_len)
|
||||
|
||||
def __repr__(self):
|
||||
hf_list = ((hf, self.fields[hf['field_name']]) for hf in elff._elf_header_field.values())
|
||||
return '\n'.join(f"{hf['field_name']:24} {v:4} {hf['description']}" for hf, v in hf_list) + '\n'
|
||||
|
||||
def __getitem__(self, key: str):
|
||||
assert key in self.fields, f'Unknown field name: {key}'
|
||||
return self.fields[key]
|
|
@ -0,0 +1,3 @@
|
|||
import pelfy
|
||||
|
||||
elf = pelfy.elf_file('tests/testbin/test_O3.o')
|
Loading…
Reference in New Issue