-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Rewrite ELF parsing from scratch w/o dependency of elf(3) and gelf(3)
In order to make it portable on other Unix operating systems, use ELF structure definitions and memory mapping to parse the ELF binary.
- Loading branch information
Showing
6 changed files
with
171 additions
and
59 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,43 @@ | ||
# elfdbg | ||
|
||
## About | ||
|
||
This project _elfdbg_ is a utility program to quickly identify if an ELF binary | ||
is built with [debug sections](https://en.wikipedia.org/wiki/Debug_symbol) | ||
|
||
Debug sections in ELF binary usually are generated using the `-g` flag with the | ||
compiler. The compiler adds the new `.debug_*` sections in the binary. | ||
|
||
The program is looking for the existence of sections with name starting with | ||
`.debug_` to determine if the binary has been built with debug information. | ||
|
||
The [ELF][ELF] format is a well-known standard. ELF TIS reference specification | ||
is available [here][spec] and as a FreeBSD [elf(5)][man] man page. | ||
|
||
## Build and install | ||
|
||
The Makefile use the standard BSDMakefile to build the program. | ||
|
||
``` | ||
make && sudo make install | ||
``` | ||
|
||
## Test | ||
|
||
The tests cases are implemented using the FreeBSD test suite framework with | ||
[kyua](https://github.com/jmmv/kyua) and [Kyuafile](./tests/Kyuafile). | ||
|
||
``` | ||
make test | ||
``` | ||
|
||
## History | ||
|
||
* _2015_ I wrote this using libelf elf(3) and gelf(3) API | ||
[f4b470b](https://github.com/sbz/elfdbg/commit/f4b470b) | ||
* _2020_ I rewrote this without relying on libelf API | ||
[96010ce](https://github.com/sbz/eldbg/commit/96010ce) | ||
|
||
[ELF]: https://en.wikipedia.org/wiki/Executable_and_Linkable_Format | ||
[spec]: http://refspecs.linuxbase.org/elf/elf.pdf | ||
[man]: https://www.freebsd.org/cgi/man.cgi?query=elf&sektion=5 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,83 @@ | ||
#include <fcntl.h> | ||
#include <stdio.h> | ||
#include <stdlib.h> | ||
#include <string.h> | ||
#include <sys/mman.h> | ||
#include <unistd.h> | ||
|
||
#include "elf.h" | ||
|
||
|
||
Elf_Obj * | ||
elf_init(const char *filename) | ||
{ | ||
int fd; | ||
struct stat sb; | ||
Elf_Obj *e; | ||
|
||
fd = open(filename, O_RDONLY); | ||
e = (Elf_Obj *)malloc(sizeof(Elf_Obj)); | ||
e->fd = fd; | ||
fstat(fd, &sb); | ||
e->sb = sb; | ||
|
||
e->mm = mmap(NULL, sb.st_size, PROT_READ, MAP_SHARED, fd, 0); | ||
e->ehdr = (Elf_Ehdr *) e->mm; | ||
e->ehdr_size = e->ehdr->e_ehsize; | ||
|
||
e->shdr = (Elf_Shdr *) (e->mm + e->ehdr->e_shoff); | ||
e->shdr_size = e->ehdr->e_shnum; | ||
|
||
e->strtab = NULL; | ||
e->strtab_size = 0; | ||
|
||
return e; | ||
} | ||
|
||
Elf_Shdr * | ||
elf_strtab(Elf_Obj *e) | ||
{ | ||
Elf_Shdr *ptr; | ||
|
||
ptr = &e->shdr[e->ehdr->e_shstrndx]; | ||
e->strtab = malloc(ptr->sh_size); | ||
e->strtab_size = ptr->sh_size; | ||
|
||
memcpy(e->strtab, (e->mm + ptr->sh_offset), ptr->sh_size); | ||
|
||
return ptr; | ||
} | ||
|
||
int | ||
elf_destroy(Elf_Obj *e) | ||
{ | ||
if (e == NULL) | ||
return 1; | ||
|
||
munmap(e->mm, e->sb.st_size); | ||
close(e->fd); | ||
if (e->strtab != NULL) | ||
free(e->strtab); | ||
free(e); | ||
|
||
return 0; | ||
} | ||
|
||
int | ||
elf_debug(Elf_Obj *e) | ||
{ | ||
int i, has_debug = 0; | ||
char *debug_prefix = ".debug_"; | ||
char *section_name = NULL; | ||
|
||
for (i=0; i < e->shdr_size; i++) { | ||
section_name = &e->strtab[e->shdr[i].sh_name]; | ||
if (strnstr(section_name, debug_prefix, strlen(debug_prefix))) { | ||
//printf("%s\n", section_name); | ||
has_debug++; | ||
} | ||
|
||
} | ||
|
||
return has_debug; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
#include <elf.h> | ||
#include <sys/stat.h> | ||
|
||
typedef struct Elf_Obj { | ||
int fd; | ||
struct stat sb; | ||
char *mm; | ||
char *strtab; | ||
size_t strtab_size; | ||
Elf_Ehdr *ehdr; | ||
size_t ehdr_size; | ||
Elf_Shdr *shdr; | ||
size_t shdr_size; | ||
} Elf_Obj; | ||
|
||
Elf_Obj *elf_init(const char *filename); | ||
int elf_destroy(Elf_Obj *); | ||
Elf_Shdr *elf_strtab(Elf_Obj *); | ||
int elf_debug(Elf_Obj *); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters