Skip to content

Elf

This file declares types and methods useful for enumerating all of the address spaces and permissions of an ELF file in memory.

This is necessary for when access to /proc is restricted, or when working on a BSD system which simply does not have /proc.

Ehdr = Union[pwndbg.lib.elftypes.Elf32_Ehdr, pwndbg.lib.elftypes.Elf64_Ehdr] module-attribute

Phdr = Union[pwndbg.lib.elftypes.Elf32_Phdr, pwndbg.lib.elftypes.Elf64_Phdr] module-attribute

T = TypeVar('T', Union[pwndbg.lib.elftypes.Elf32_Ehdr, pwndbg.lib.elftypes.Elf64_Ehdr], Union[pwndbg.lib.elftypes.Elf32_Phdr, pwndbg.lib.elftypes.Elf64_Phdr]) module-attribute

ehdr_type_loaded = 0 module-attribute

module = sys.modules[__name__] module-attribute

ELFInfo

Bases: NamedTuple

ELF metadata and structures.

header: Dict[str, int | str] instance-attribute

is_pic: bool property

is_pie: bool property

sections: List[Dict[str, int | str]] instance-attribute

segments: List[Dict[str, int | str]] instance-attribute

dump_relocations_by_section_name(filepath, section_name, try_local_path=False)

Dump the relocation entries of a section from an ELF file, return a generator of Relocation objects.

dump_section_by_name(filepath, section_name, try_local_path=False)

Dump the content of a section from an ELF file, return the start address, size and content.

entry()

Return the address of the entry point for the main executable.

exe()

Return a loaded ELF header object pointing to the Ehdr of the main executable.

get_containing_sections(elf_filepath, elf_loadaddr, vaddr)

get_containing_segments(elf_filepath, elf_loadaddr, vaddr)

get_ehdr(pointer)

Returns an ehdr object for the ELF pointer points into.

We expect the pointer to be an address from the binary.

get_elf_info(filepath)

Parse and return ELFInfo.

Adds various calculated properties to the ELF header, segments and sections. Such added properties are those with prefix 'x_' in the returned dicts.

get_elf_info_rebased(filepath, vaddr)

Parse and return ELFInfo with all virtual addresses rebased to vaddr

get_phdrs(pointer)

Returns a tuple containing (phnum, phentsize, gdb.Value), where the gdb.Value object is an ELF Program Header with the architecture-appropriate structure type.

iter_phdrs(ehdr)

load(pointer)

map(pointer, objfile='')

Given a pointer into an ELF module, return a list of all loaded sections in the ELF.

Returns:

Type Description
Tuple[Page, ...]

A sorted list of pwndbg.lib.memory.Page objects

Example:

Text Only
1
2
3
4
5
6
7
8
9
>>> pwndbg.gdblib.elf.load(pwndbg.gdblib.regs.pc)
[Page('400000-4ef000 r-xp 0'),
 Page('6ef000-6f0000 r--p ef000'),
 Page('6f0000-6ff000 rw-p f0000')]
>>> pwndbg.gdblib.elf.load(0x7ffff77a2000)
[Page('7ffff75e7000-7ffff77a2000 r-xp 0x1bb000 0'),
 Page('7ffff77a2000-7ffff79a2000 ---p 0x200000 1bb000'),
 Page('7ffff79a2000-7ffff79a6000 r--p 0x4000 1bb000'),
 Page('7ffff79a6000-7ffff79ad000 rw-p 0x7000 1bf000')]

map_inner(ei_class, ehdr, objfile)

read(typ, address, blob=None)

reset_ehdr_type_loaded()

update()