elf ¤

This file declares types and methods useful for enumerating all of the address spaces and permissions of an ELF file in memory.

This is necessary for when access to /proc is restricted, or when working on a BSD system which simply does not have /proc.

Classes:

• ELFInfo –

  ELF metadata and structures.

Functions:

• update –
• read –
• get_elf_info –

  Parse and return ELFInfo.

• get_elf_info_rebased –

  Parse and return ELFInfo with all virtual addresses rebased to vaddr

• get_containing_segments –
• get_containing_sections –
• dump_section_by_name –

  Dump the content of a section from an ELF file, return the start address, size and content.

• dump_relocations_by_section_name –

  Dump the relocation entries of a section from an ELF file, return a generator of Relocation objects.

• exe –

  Return a loaded ELF header object pointing to the Ehdr of the

• entry –

  Return the address of the entry point for the main executable.

• load –
• reset_ehdr_type_loaded –
• get_ehdr –

  Returns an ehdr object for the ELF pointer points into.

• get_phdrs –

  Returns a tuple containing (phnum, phentsize, gdb.Value),

• iter_phdrs –
• map –

  Given a pointer into an ELF module, return a list of all loaded

• map_inner –

Attributes:

• module –
• Ehdr –
• Phdr –
• T –
• ehdr_type_loaded –

module = modules[__name__]

Ehdr = Union[Elf32_Ehdr, Elf64_Ehdr]

Phdr = Union[Elf32_Phdr, Elf64_Phdr]

T = TypeVar('T', Union[Elf32_Ehdr, Elf64_Ehdr], Union[Elf32_Phdr, Elf64_Phdr])

ehdr_type_loaded = 0

header: dict[str, int | str]

sections: list[dict[str, int | str]]

segments: list[dict[str, int | str]]

is_pic: bool

is_pie: bool

update() -> None

read(typ: T, address: int, blob: bytearray | None = None) -> T

get_elf_info(filepath: str) -> ELFInfo

get_elf_info_rebased(filepath: str, vaddr: int) -> ELFInfo

get_containing_segments(elf_filepath: str, elf_loadaddr: int, vaddr: int)

get_containing_sections(elf_filepath: str, elf_loadaddr: int, vaddr: int)

dump_section_by_name(
    filepath: str, section_name: str, try_local_path: bool = False
) -> tuple[int, int, bytes] | None

dump_relocations_by_section_name(
    filepath: str, section_name: str, try_local_path: bool = False
) -> tuple[Relocation, ...] | None

exe() -> Ehdr | None

entry() -> int

load(pointer: int) -> Ehdr | None

reset_ehdr_type_loaded() -> None

get_ehdr(pointer: int) -> tuple[int | None, Ehdr | None]

get_phdrs(pointer: int)

iter_phdrs(ehdr: Ehdr)

map(pointer: int, objfile: str = '') -> tuple[Page, ...]

>>> pwndbg.aglib.elf.load(pwndbg.aglib.regs.pc)
[Page('400000-4ef000 r-xp 0'),
 Page('6ef000-6f0000 r--p ef000'),
 Page('6f0000-6ff000 rw-p f0000')]
>>> pwndbg.aglib.elf.load(0x7ffff77a2000)
[Page('7ffff75e7000-7ffff77a2000 r-xp 0x1bb000 0'),
 Page('7ffff77a2000-7ffff79a2000 ---p 0x200000 1bb000'),
 Page('7ffff79a2000-7ffff79a6000 r--p 0x4000 1bb000'),
 Page('7ffff79a6000-7ffff79ad000 rw-p 0x7000 1bf000')]

map_inner(ei_class: int, ehdr: Ehdr, objfile: str) -> tuple[Page, ...]