Module: ElfUtils

Defined in:

lib/elf_utils.rb,
lib/elf_utils/symbol.rb,
lib/elf_utils/section.rb,
lib/elf_utils/segment.rb,
lib/elf_utils/version.rb,
lib/elf_utils/elf_file.rb,
lib/elf_utils/types/dwarf.rb,
lib/elf_utils/section/base.rb,
lib/elf_utils/segment/base.rb,
lib/elf_utils/string_pread.rb,
lib/elf_utils/types/dwarf32.rb,
lib/elf_utils/types/dwarf64.rb,
lib/elf_utils/section/dynsym.rb,
lib/elf_utils/section/strtab.rb,
lib/elf_utils/section/symtab.rb,
lib/elf_utils/section/debug_addr.rb,
lib/elf_utils/section/debug_info.rb,
lib/elf_utils/section/debug_line.rb,
lib/elf_utils/section/debug_abbrev.rb,
lib/elf_utils/section/debug_arange.rb,
lib/elf_utils/section/debug_ranges.rb,
lib/elf_utils/section/debug_info/die.rb,
lib/elf_utils/types/dwarf/expression.rb,
lib/elf_utils/section/debug_info/header.rb,
lib/elf_utils/section/debug_str_offsets.rb,
lib/elf_utils/section/debug_info/die_ref.rb,
lib/elf_utils/section/debug_info/die/base.rb,
lib/elf_utils/section/debug_info/debug_str_ref.rb,
lib/elf_utils/section/debug_abbrev/abbreviation.rb,
lib/elf_utils/section/debug_info/compilation_unit.rb,
lib/elf_utils/section/debug_info/debug_str_offsets_ref.rb,
lib/elf_utils/section/debug_line/line_number_program/header.rb,
ext/elf_utils/elf_utils.c

Overview

ElfUtils for working with ELF & DWARF files

ElfUtils provides a user-friendly wrapper around core ELF & DWARF types to make it easier to extract common information from ELF files. The ElfFile and Symbol classes are the primary interface into ELF file contents. For complex tasks not currently provided there, you can directly access the ELF and DWARF structures from ElfFile#sections, ElfFile#segments, and ElfFile#debug_info.

ElfUtils supports 32-bit & 64-bit ELF formats, both little and big endian. ElfUtils supports DWARF v2, v3, v4, and v5, but not exhaustively.

Here are some quick examples of ElfUtils functionality.

Examples:

Get the source of a function from a binary with DWARF debug info

ElfUtils.open("spec/data/complex_64be-dwarf64-v5") do |elf_file|
  elf_file.symbol("main").source_location
end  # => {:file=>"spec/data/test.c", :line=>25 (0x19), :column=>0}

Get the address of a variable in memory

ElfUtils.open("spec/data/complex_64be-dwarf64-v5") do |elf_file|
  symbol = elf_file.symbol("global_buf")  # => #<ElfUtils::Symbol ... >
  symbol.addr                             # => 0x000206d0

  # adjust the load segment location for ASLR
  symbol.section.load_segment.relocate(0x10000000)
  symbol.addr                             # => 0x10000090
end

Extract the initial value for a variable from an elf file

# open the elf file
elf_file = ElfUtils.open("spec/data/complex_64be-dwarf64-v5")

# lookup the symbol for a global variable, and get its type
symbol = elf_file.symbol("struct_with_bitfield")  # => #<ElfUtils::Symbol>
ctype = symbol.ctype                              # => #<CTypes::Type ...>

# read the bytes for the symbol from the elf file
buf = symbol.section.bytes[symbol.section_offset, symbol.size]
                                                  # => "\xE0\x80\x00\x00"

# unpack the bytes into a human-readable structure
value = ctype.unpack(buf)                         # => { a: 1, b: -1, c: 1}

See Also:

• ElfFile
• Symbol

Defined Under Namespace

Modules: Section, Segment, StringPread, Types Classes: ElfFile, Error, InvalidFormat, Symbol

Constant Summary

VERSION =

"0.3.3"

Class Method Summary

• .open(path, &block) ⇒ Object

  open a file path, and return an ElfFile instance.

Class Method Details

.open(path) ⇒ ElfFile .open(path) {|ElfFile| ... } ⇒ Object

open a file path, and return an ElfFile instance

Examples:

Open an ELF file and print all symbols

elf_file = ElfUtils.open("spec/data/complex_64be-dwarf64-v5")
pp(elf_file.symbols)
elf_file.close

print all symbols using a block invocation

ElfUtils.open("spec/data/complex_64be-dwarf64-v5") do |elf_file|
  pp(elf_file.symbols)
end

Overloads:

• .open(path) ⇒ ElfFile

  Parameters:

  • path (String) —

    file path

  Returns:

  • (ElfFile)
• .open(path) {|ElfFile| ... } ⇒ Object

  Parameters:

  • path (String) —

    file path

  Yields:

  • (ElfFile) —

    invokes block with opened file, will close when block returns

# File 'lib/elf_utils.rb', line 76

def self.open(path, &block)
  ElfFile.open(path, &block)
end