delf.h

D_ELF api

Linking by #include <delf.h>, compiling by adding delf.o in linker.

elf64_header_t

A structure that describes ELF64 file.

typedef struct {
    u8  e_ident[16];
    u16 e_type; // ELF Type
    u16 e_machine; // Architecture of ELF
    u32 e_version; // Version 
    u64 e_entry; // Code entry address
    u64 e_phoff; // Program Header Offset
    u64 e_shoff; // Section Header Offset 
    u32 e_flags; // Flags of ELF
    u16 e_ehsize; // Header Size
    u16 e_phentsize; // PH Entry size
    u16 e_phnum; // PH count of writer
    u16 e_shentsize; // SH Entry Size
    u16 e_shnum; // SH count of writes 
    u16 e_shstrndx; // SH String Table Index
} elf64_header_t;

elf64_phdr_t

Program Header descriptor

typedef struct {
    u32 p_type; // Type
    u32 p_flags; // Flags
    u64 p_offset; // Offset
    u64 p_vaddr; // Virtual Address 
    u64 p_paddr; // Physical Address 
    u64 p_filesz; // File Size 
    u64 p_memsz; // Memory size
    u64 p_align; // Align
} elf64_phdr_t;

elf64_shdr_t

Section Header descriptor

typedef struct {
    u32 sh_name;
    u32 sh_type;
    u64 sh_flags;
    u64 sh_addr;
    u64 sh_offset;
    u64 sh_size;
    u32 sh_link;
    u32 sh_info;
    u64 sh_addralign;
    u64 sh_entsize; // Entry Size
} elf64_shdr_t;

elf64_sym_t

Symbol table

typedef struct {
    u32 st_name;
    u8  st_info;
    u8  st_other;
    u16 st_shndx;
    u64 st_value;
    u64 st_size;
} elf64_sym_t;

elf64_rela_t

Relocation Table

typedef struct {
    u64 r_offset;
    u64 r_info;
    i64 r_addend;
} elf64_rela_t;

delf_check(const void *buf): int

Check loaded ELF64 if he is correct. In first arg you receive loaded in memory ELF64 file. Returns FALSE(see dtypes.h) if not, TRUE if ok.

*delf_header(void *buf): elf64_header_t

Returns pointer to elf64_header_t.

delf_image_span(void *buf, u64 size): u64

Returns size that ELF64 occupies in Virtual Memory. First arg is buffer with ELF64, second is size of buffer.

delf_load_at(void *buf, u64 size, u64 load_base): u64

Returns address of entry point in loaded to Virtual Memory ELF64, or 0 at error. First arg is ELF64, second is size, third is base address in memory (pointer), where load program segments.

Variables

#define ELF_SHT_NULL      0
#define ELF_SHT_PROGBITS  1 // Program Bits
#define ELF_SHT_SYMTAB    2 // Symbol Table 
#define ELF_SHT_STRTAB    3 // String Table
#define ELF_SHT_RELA      4 // Relocations
#define ELF_SHT_NOBITS    8
#define ELF_SHT_DYNSYM    11 // Dynamic Symbol
#define ELF_PT_LOAD    1
#define ELF_PT_DYNAMIC 2
#define R_X86_64_NONE        0
#define R_X86_64_64          1
#define R_X86_64_PC32        2
#define R_X86_64_PLT32       4
#define R_X86_64_GLOB_DAT    6
#define R_X86_64_JUMP_SLOT   7
#define R_X86_64_RELATIVE    8
#define R_X86_64_32          10
#define R_X86_64_32S         11