elfviz is a command line interface tool to interact with ELF binary files.
click
and pyelftools
are required installations.
pip install click
pip install pyelftools
pip install ipython
Options for the CLI can be seen by running python3 elfviz.py --help
.
(venv) elfviz % python3 elfviz.py --help
Usage: elfviz.py [OPTIONS] FILE COMMAND [ARGS]...
Options:
--debug
--help Show this message and exit.
Commands:
all-sections
section-header
symbol-offset
A path to the file that should be examined is a required argument for the main program.
elfviz can be run with debugging when the --debug
flag is passed as an OPTION.
Supported functionality can be seen under Commands
.
Furthermore, each sub-command has their own unique set of arguments and options.
These can be seen by running the command along with the --help
tag.
(venv) elfviz % python3 elfviz.py examples/hello section-header --help
Usage: elfviz.py FILE section-header [OPTIONS] SECTION
Options:
--help Show this message and exit.
An interactive mode has been added to facilitate running multiple
commands on the ELF binary in one session. The main object to operate on
is called elf
.
(venv) elfviz % python3 elfviz.py examples/hello interactive
In [1]: help(elf)
In [2]: elf.show_elf_header()
e_ident: Container({'EI_MAG': [127, 69, 76, 70], 'EI_CLASS': 'ELFCLASS64', 'EI_DATA': 'ELFDATA2LSB', 'EI_VERSION': 'EV_CURRENT', 'EI_OSABI': 'ELFOSABI_LINUX', 'EI_ABIVERSION': 0})
e_type: ET_EXEC
e_machine: EM_X86_64
e_version: EV_CURRENT
e_entry: 4196944
e_phoff: 64
e_shoff: 845136
e_flags: 0
e_ehsize: 64
e_phentsize: 56
e_phnum: 6
e_shentsize: 64
e_shnum: 38
e_shstrndx: 37
To see a full list of available methods use dir(elf)
or help(elf)
.
Below, the .got
section header details are obtained with the section-header
command.
(venv) elfviz % python3 elfviz.py examples/hello section-header .got
sh_name: 231
sh_type: SHT_PROGBITS
sh_flags: 3
sh_addr: 7048952
sh_offset: 757496
sh_size: 248
sh_link: 0
sh_info: 0
sh_addralign: 8
sh_entsize: 0
Getting a symbol offset in the file with a debugging level set:
(venv) elfviz % python elfviz.py --debug examples/hello symbol-offset open
DEBUG:root:[!] symbol address: 0x448ae0
DEBUG:root:[!] symbol at section index 6
DEBUG:root:[!] symbol [ open ] in section: .plt
DEBUG:root:[!] section address: 0x400418
[+] offset: 297696