64-bit Elf Header and Data Handler¶
[1]:
from rich import print
from rich.console import Console
from rich.table import Table
from byteclasses.handlers.executables.elf import Elf64, ElfHdr64
from byteclasses.print import byteclass_info, byteclass_inspect, collection_table
[2]:
with open("../../../tests/data/hello_world.elf", "rb") as file:
data = file.read()
elf64_hdr = ElfHdr64()
elf64_hdr.attach(memoryview(data))
[3]:
byteclass_info(elf64_hdr)
Byteclass Info ┏━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Property ┃ Value ┃ ┡━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩ │ type() │ ElfHdr64 │ │ is_byteclass() │ True │ │ is_collection_instance() │ True │ │ is_primitive_instance() │ False │ │ mro │ ElfHdr64 -> object │ │ len() │ 64 │ │ str() │ ElfHdr64(e_ident=String(16, value='\x7fELF\x02\x01\x01'), e_type=<ElfType.DYN: 0x3>, │ │ │ e_machine=<ElfMachine.AARCH64: 0xb7>, e_version=<ElfVersion.CURRENT: 0x1>, │ │ │ e_entry=Ptr64(0x640), e_phoff=Ptr64(0x40), e_shoff=Ptr64(0x1ba8), │ │ │ e_flags=BitField32(data=b'\x00\x00\x00\x00'), e_ehsize=UInt16(64), │ │ │ e_phentsize=UInt16(56), e_phnum=UInt16(9), e_shentsize=UInt16(64), │ │ │ e_shnum=UInt16(28), e_shstrndx=UInt16(27)) │ │ repr() │ ElfHdr64(byte_order=b'@',data=bytearray(b'\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x… │ │ .data │ bytearray(b'\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\xb7\x00… │ └──────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────┘
[4]:
byteclass_inspect(elf64_hdr)
╭────────────────── Byteclass Inspect ──────────────────╮ │ 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f │ │ ----------------------------------------------------- │ │ 0x0 |7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 │ │ 0x10 |03 00|b7 00|01 00 00 00|40 06 00 00 00 00 00 00 │ │ 0x20 |40 00 00 00 00 00 00 00|a8 1b 00 00 00 00 00 00 │ │ 0x30 |00 00 00 00|40 00|38 00|09 00|40 00|1c 00|1b 00 │ │ 0x40 │ ╰───────────────────────────────────────────────────────╯
Legend ┏━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Member ┃ Value ┃ ┡━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩ │ e_ident │ ELF │ │ e_type │ DYN │ │ e_machine │ AARCH64 │ │ e_version │ CURRENT │ │ e_entry │ 0x0000000000000640 │ │ e_phoff │ 0x0000000000000040 │ │ e_shoff │ 0x0000000000001ba8 │ │ e_flags │ BitField32(00000000000000000000000000000000, flags={}) │ │ e_ehsize │ 64 │ │ e_phentsize │ 56 │ │ e_phnum │ 9 │ │ e_shentsize │ 64 │ │ e_shnum │ 28 │ │ e_shstrndx │ 27 │ └─────────────┴────────────────────────────────────────────────────────┘
[5]:
collection_table(elf64_hdr)
ElfHdr64 ┏━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Member ┃ Value ┃ Data ┃ ┡━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩ │ e_ident │ ELF │ b'\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\… │ │ e_type │ DYN │ b'\x03\x00' │ │ e_machine │ AARCH64 │ b'\xb7\x00' │ │ e_version │ CURRENT │ b'\x01\x00\x00\x00' │ │ e_entry │ 0x0000000000000640 │ b'@\x06\x00\x00\x00\x00\x00\x00' │ │ e_phoff │ 0x0000000000000040 │ b'@\x00\x00\x00\x00\x00\x00\x00' │ │ e_shoff │ 0x0000000000001ba8 │ b'\xa8\x1b\x00\x00\x00\x00\x00\x00' │ │ e_flags │ BitField32(00000000000000000000000000000000, │ b'\x00\x00\x00\x00' │ │ │ flags={}) │ │ │ e_ehsize │ 64 │ b'@\x00' │ │ e_phentsize │ 56 │ b'8\x00' │ │ e_phnum │ 9 │ b'\t\x00' │ │ e_shentsize │ 64 │ b'@\x00' │ │ e_shnum │ 28 │ b'\x1c\x00' │ │ e_shstrndx │ 27 │ b'\x1b\x00' │ └─────────────┴─────────────────────────────────────────────────┴─────────────────────────────────────────────────┘
[6]:
elf64 = Elf64(data)
[7]:
table = Table(title="Elf64 Handler")
table.add_column("Name")
table.add_column("Value")
table.add_row("len(elf64)", str(len(elf64)))
table.add_row("str(elf64)", str(elf64))
table.add_row("repr(elf64)", repr(elf64))
table.add_row("elf64.data", str(elf64.data))
table.add_row("elf64.hdr", str(elf64.hdr))
table.add_row("elf64.type", str(elf64.type))
table.add_row("elf64.machine", str(elf64.machine))
table.add_row("elf64.version", str(elf64.version))
table.add_row("elf64.entry", str(elf64.entry))
table.add_row("elf64.prog_hdr_offset", str(elf64.prog_hdr_offset))
table.add_row("elf64.section_hdr_offset", str(elf64.section_hdr_offset))
table.add_row("elf64.flags", str(elf64.flags))
console = Console()
console.print(table)
Elf64 Handler ┏━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓ ┃ Name ┃ Value ┃ ┡━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩ │ len(elf64) │ 8872 │ │ str(elf64) │ Elf64(type=DYN, machine=AARCH64, version=CURRENT) │ │ repr(elf64) │ Elf64(data=<memory at 0x7fabf253d600>) │ │ elf64.data │ <memory at 0x7fabf253d600> │ │ elf64.hdr │ ElfHdr64(e_ident=String(16, value='\x7fELF\x02\x01\x01'), e_type=<ElfType.DYN: 0x3>, │ │ │ e_machine=<ElfMachine.AARCH64: 0xb7>, e_version=<ElfVersion.CURRENT: 0x1>, │ │ │ e_entry=Ptr64(0x640), e_phoff=Ptr64(0x40), e_shoff=Ptr64(0x1ba8), │ │ │ e_flags=BitField32(data=b'\x00\x00\x00\x00'), e_ehsize=UInt16(64), │ │ │ e_phentsize=UInt16(56), e_phnum=UInt16(9), e_shentsize=UInt16(64), │ │ │ e_shnum=UInt16(28), e_shstrndx=UInt16(27)) │ │ elf64.type │ DYN │ │ elf64.machine │ AARCH64 │ │ elf64.version │ CURRENT │ │ elf64.entry │ 0x0000000000000640 │ │ elf64.prog_hdr_offset │ 0x0000000000000040 │ │ elf64.section_hdr_offset │ 0x0000000000001ba8 │ │ elf64.flags │ {} │ └──────────────────────────┴──────────────────────────────────────────────────────────────────────────────────────┘
[8]:
print(elf64.program_table)
[ PEntry64(type=PHDR, offset=0x0000000000000040, vaddr=0x0000000000000040, paddr=0x0000000000000040, file_size=504, flags={'execute': False, 'write': False, 'read': True}), PEntry64(type=INTERP, offset=0x0000000000000238, vaddr=0x0000000000000238, paddr=0x0000000000000238, file_size=27, flags={'execute': False, 'write': False, 'read': True}), PEntry64(type=LOAD, offset=0x0000000000000000, vaddr=0x0000000000000000, paddr=0x0000000000000000, file_size=2196, flags={'execute': True, 'write': False, 'read': True}), PEntry64(type=LOAD, offset=0x0000000000000d90, vaddr=0x0000000000010d90, paddr=0x0000000000010d90, file_size=640, flags={'execute': False, 'write': True, 'read': True}), PEntry64(type=DYNAMIC, offset=0x0000000000000da0, vaddr=0x0000000000010da0, paddr=0x0000000000010da0, file_size=496, flags={'execute': False, 'write': True, 'read': True}), PEntry64(type=NOTE, offset=0x0000000000000254, vaddr=0x0000000000000254, paddr=0x0000000000000254, file_size=68, flags={'execute': False, 'write': False, 'read': True}), PEntry64(type=GNU_EH_FRAME, offset=0x00000000000007a8, vaddr=0x00000000000007a8, paddr=0x00000000000007a8, file_size=60, flags={'execute': False, 'write': False, 'read': True}), PEntry64(type=GNU_STACK, offset=0x0000000000000000, vaddr=0x0000000000000000, paddr=0x0000000000000000, file_size=0, flags={'execute': False, 'write': True, 'read': True}), PEntry64(type=GNU_RELRO, offset=0x0000000000000d90, vaddr=0x0000000000010d90, paddr=0x0000000000010d90, file_size=624, flags={'execute': False, 'write': False, 'read': True}) ]
[9]:
print(elf64.section_table)
[ SEntry64(name=0, type=NULL, flags=SBitField64(0000000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000000, offset=0, size=0, link=0, info=0, addr_align=0, entry_size=0), SEntry64(name=27, type=PROGBITS, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000238, offset=568, size=27, link=0, info=0, addr_align=1, entry_size=0), SEntry64(name=35, type=NOTE, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000254, offset=596, size=36, link=0, info=0, addr_align=4, entry_size=0), SEntry64(name=54, type=NOTE, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000278, offset=632, size=32, link=0, info=0, addr_align=4, entry_size=0), SEntry64(name=68, type=UNKNOWN, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000298, offset=664, size=28, link=5, info=0, addr_align=8, entry_size=0), SEntry64(name=78, type=DYNSYM, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000002b8, offset=696, size=240, link=6, info=3, addr_align=8, entry_size=24), SEntry64(name=86, type=STRTAB, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000003a8, offset=936, size=146, link=0, info=0, addr_align=1, entry_size=0), SEntry64(name=94, type=UNKNOWN, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x000000000000043a, offset=1082, size=20, link=5, info=0, addr_align=2, entry_size=2), SEntry64(name=107, type=UNKNOWN, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000450, offset=1104, size=48, link=6, info=1, addr_align=8, entry_size=0), SEntry64(name=122, type=RELA, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000480, offset=1152, size=192, link=5, info=0, addr_align=8, entry_size=24), SEntry64(name=132, type=RELA, flags=SBitField64(0100001000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000540, offset=1344, size=120, link=5, info=21, addr_align=8, entry_size=24), SEntry64(name=142, type=PROGBITS, flags=SBitField64(0110000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000005b8, offset=1464, size=24, link=0, info=0, addr_align=4, entry_size=0), SEntry64(name=137, type=PROGBITS, flags=SBitField64(0110000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000005d0, offset=1488, size=112, link=0, info=0, addr_align=16, entry_size=0), SEntry64(name=148, type=PROGBITS, flags=SBitField64(0110000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000640, offset=1600, size=316, link=0, info=0, addr_align=64, entry_size=0), SEntry64(name=154, type=PROGBITS, flags=SBitField64(0110000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x000000000000077c, offset=1916, size=20, link=0, info=0, addr_align=4, entry_size=0), SEntry64(name=160, type=PROGBITS, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000790, offset=1936, size=21, link=0, info=0, addr_align=8, entry_size=0), SEntry64(name=168, type=PROGBITS, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000007a8, offset=1960, size=60, link=0, info=0, addr_align=4, entry_size=0), SEntry64(name=182, type=PROGBITS, flags=SBitField64(0100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x00000000000007e8, offset=2024, size=172, link=0, info=0, addr_align=8, entry_size=0), SEntry64(name=192, type=UNKNOWN, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000010d90, offset=3472, size=8, link=0, info=0, addr_align=8, entry_size=8), SEntry64(name=204, type=UNKNOWN, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000010d98, offset=3480, size=8, link=0, info=0, addr_align=8, entry_size=8), SEntry64(name=216, type=DYNAMIC, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000010da0, offset=3488, size=496, link=6, info=0, addr_align=8, entry_size=16), SEntry64(name=225, type=PROGBITS, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000010f90, offset=3984, size=112, link=0, info=0, addr_align=8, entry_size=8), SEntry64(name=230, type=PROGBITS, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000011000, offset=4096, size=16, link=0, info=0, addr_align=8, entry_size=0), SEntry64(name=236, type=NOBITS, flags=SBitField64(1100000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000011010, offset=4112, size=8, link=0, info=0, addr_align=1, entry_size=0), SEntry64(name=241, type=PROGBITS, flags=SBitField64(0000110000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000000, offset=4112, size=43, link=0, info=0, addr_align=1, entry_size=1), SEntry64(name=1, type=SYMTAB, flags=SBitField64(0000000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000000, offset=4160, size=2112, link=26, info=65, addr_align=8, entry_size=24), SEntry64(name=9, type=STRTAB, flags=SBitField64(0000000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000000, offset=6272, size=557, link=0, info=0, addr_align=1, entry_size=0), SEntry64(name=17, type=STRTAB, flags=SBitField64(0000000000000000000000000000000000000000000000000000000000000000, flags={}), addr=0x0000000000000000, offset=6829, size=250, link=0, info=0, addr_align=1, entry_size=0) ]