當前位置：首頁 > 编程资源 > 编程问答 >内容正文

编程问答

ELF格式解析库之提取信息

發布時間：2024/4/14 编程问答 31 豆豆

生活随笔收集整理的這篇文章主要介紹了 ELF格式解析库之提取信息小編覺得挺不錯的,現在分享給大家,幫大家做個參考.

看，寶藏就在那兒

在上一篇文章中，我們提到用按圖索驥比喻庫的初始化過程，那么現在有了地圖，接下來的事情就是去尋找我們感興趣的寶藏了。這個寶藏可能是一個ELF文件的程序文本段，也有可能是程序的某個不知名的代碼段，這些都取決于你想要什么信息。我建議你去閱讀ELF 的官方標準，那里邊講的比較清楚。

我這里只是實現了幾個提取諸如：程序的大小端，能執行的CPU位數，程序的入口點，以及獲得程序的所有節的編號和根據節的編號獲取該節的詳細信息。

提取信息：程序的大小端

1: long ELF_GetELFEnddian(SEF_ELFHEADER* pHandle) 2: { 3: long ret = 0; 4: SEF_ELFHEADER *handle = (SEF_ELFHEADER*)pHandle; 5: big_endding or litte_endding 6: ? 7: if(pHandle == NULL) 8: { 9: ret = -1; 10: } 11: else if(pHandle->nFlag_Data == 1) 12: { 13: ret = ELFDATA2LSB; 14: } 15: else if(pHandle->nFlag_Data == 2) 16: { 17: ret = ELFDATA2MSB; 18: } 19: else 20: { 21: ret = ELFDATANONE; 22: } 23: return ret; 24: }

可以看到輸入之前初始化的elfheader二級數據管理句柄，返回這個elf文件的大小端信息。

提取信息：目標文件能執行的CPU位數

1: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine) 2: { 3: long ret=0; 4: *nMachine = 0; 5: //判斷 CPU 6: if(pELF64Header == NULL) 7: { 8: ret = -1; 9: } 10: if(3 == pELF64Header->e_machine) 11: { 12: *nMachine = 1; 13: //printf("virtual program address: %p\n",pELF64Header->e_entry); 14: } 15: else if(62 == pELF64Header->e_machine) 16: { 17: *nMachine = 2; 18: } 19: else 20: { 21: *nMachine = 3; 22: } 23: return ret; 24: } 25: ? 26: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine) 27: { 28: long ret=0; 29: *nMachine = 0; 30: if(pELF32Header == NULL) 31: { 32: ret = -1; 33: } 34: //判斷 CPU 35: if(3 == pELF32Header->e_machine) 36: { 37: *nMachine = 1; 38: //printf("virtual program address: %p\n",pELF32Header->e_entry); 39: } 40: else if(62 == pELF32Header->e_machine) 41: { 42: *nMachine = 2; 43: } 44: else 45: { 46: *nMachine = 3; 47: } 48: return ret; 49: }

這里展示的兩個函數分別對應著：32位和64位。

提取信息：目標程序的入口點

1: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA) 2: { 3: long ret=0; 4: uint64_t ProNum=0; 5: long nFlag = -1; 6: uint64_t i = 0; 7: uint64_t offset = 0; 8: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL) 9: { 10: ret = -1; 11: goto ELF_ENTRY32; 12: } 13: /*deal 32bits elf file*/ 14: SEF_ELFHEADER_32 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_32); 15: ProNum = pElfHeader->e_phnum; 16: *RVA = pElfHeader->e_entry; 17: SEF_PROHEADER_32 *pSegTabFind=NULL; 18: SEF_PROHEADER_32 *pSegTabUse=NULL; 19: uint64_t nItemNum = *RVA; 20: /*find the first load segment*/ 21: for (i=0; i<ProNum; i++) 22: { 23: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_32[i]); 24: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz))) 25: { 26: nFlag = i; 27: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_32[nFlag]); 28: break; 29: } 30: } 31: if (pSegTabUse != NULL) 32: { 33: offset = nItemNum - pSegTabUse->p_vaddr; 34: *RAW = pSegTabUse->p_offset + offset; 35: } 36: else 37: { 38: ret = -2; 39: goto ELF_ENTRY32; 40: } 41: ELF_ENTRY32: 42: return ret; 43: } 44: ? 45: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA) 46: { 47: long ret=0; 48: uint64_t ProNum=0; 49: long nFlag = -1; 50: uint64_t i = 0; 51: uint64_t offset = 0; 52: /*deal 32bits elf file*/ 53: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL) 54: { 55: ret = -1; 56: goto ELF_ENTRY64; 57: } 58: SEF_ELFHEADER_64 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_64); 59: ProNum = pElfHeader->e_phnum; 60: *RVA = pElfHeader->e_entry; 61: 62: SEF_PROHEADER_64 *pSegTabFind=NULL; 63: SEF_PROHEADER_64 *pSegTabUse=NULL; 64: uint64_t nItemNum = *RVA; 65: /*find the first load segment*/ 66: for (i=0; i<ProNum; i++) 67: { 68: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_64[i]); 69: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz))) 70: { 71: nFlag = i; 72: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_64[nFlag]); 73: break; 74: } 75: } 76: if (pSegTabUse != NULL) 77: { 78: offset = nItemNum - pSegTabUse->p_vaddr; 79: *RAW = pSegTabUse->p_offset + offset; 80: // printf("RAW is %d\n",*RAW); 81: } 82: else 83: { 84: ret = -2; 85: goto ELF_ENTRY64; 86: } 87: ELF_ENTRY64: 88: return ret; 89: }

展示的函數依然是分別對應著：32位和64位。

提取信息：獲得目標程序所有節的編號

1: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo) 2: { 3: long ret = 0; 4: uint16_t SecNum = 0; 5: uint8_t i=0; //as temp circle num 6: SEF_HEADSET* handle = (SEF_HEADSET*)phandle; 7: if(phandle->pS_SecHeader == NULL) 8: { 9: ret = -1; 10: goto getsecinfo_finish; 11: } 12: SEF_ELFHEADER_32 *pElfHeader32=&(handle->pS_ElfHeader->S_ElfHeader_32); 13: SEF_SECHEADER_32 *pSecHead32=NULL; 14: 15: SecNum = pElfHeader32->e_shnum; 16: ? 17: if(nIndex < 0 || nIndex > SecNum) 18: { 19: printf("Your input number is illegal!!\n"); 20: ret = -2; 21: goto getsecinfo_finish; 22: } 23: ? 24: pSecHead32 = &(handle->pS_SecHeader->pS_SecHeader_32[nIndex]); 25: ? 26: ELF_GetSecName(handle,nIndex,pSecInfo); 27: ? 28: pSecInfo->nType = pSecHead32->sh_type; 29: pSecInfo->nAddr = pSecHead32->sh_addr; 30: pSecInfo->nflags = pSecHead32->sh_flags; 31: pSecInfo->nOffset = pSecHead32->sh_offset; 32: pSecInfo->nSize = pSecHead32->sh_size; 33: pSecInfo->nLink = pSecHead32->sh_link; 34: pSecInfo->nInfo = pSecHead32->sh_info; 35: pSecInfo->nAddralign = pSecHead32->sh_addralign; 36: pSecInfo->nEntsize = pSecHead32->sh_entsize; 37: 38: //printf("nFlags is =====%p\n",pSecInfo->nflags); 39: //ELF_GetSecftInfo(pSecInfo); 40: getsecinfo_finish: 41: return ret; 42: } 43: ? 44: long ELF_GetSecInfo64(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo) 45: { 46: long ret = 0; 47: uint16_t SecNum = 0; 48: uint8_t i=0; //as temp circle num 49: SEF_HEADSET* handle = (SEF_HEADSET*)phandle; 50: if(phandle->pS_SecHeader == NULL) 51: { 52: ret = -1; 53: goto getsecinfo_finish; 54: } 55: SEF_ELFHEADER_64 *pElfHeader64=&(handle->pS_ElfHeader->S_ElfHeader_64); 56: SEF_SECHEADER_64 *pSecHead64=NULL; 57: ? 58: SecNum = pElfHeader64->e_shnum; 59: ? 60: if(nIndex < 0 || nIndex > SecNum) 61: { 62: printf("Your input number is illegal!!\n"); 63: ret = -2; 64: goto getsecinfo_finish; 65: } 66: printf("--------------------------------"); 67: pSecHead64 = &(handle->pS_SecHeader->pS_SecHeader_64[nIndex]); 68: 69: ELF_GetSecName(handle,nIndex,pSecInfo); 70: ? 71: pSecInfo->nType = pSecHead64->sh_type; 72: pSecInfo->nAddr = pSecHead64->sh_addr; 73: pSecInfo->nflags = pSecHead64->sh_flags; 74: pSecInfo->nOffset = pSecHead64->sh_offset; 75: pSecInfo->nSize = pSecHead64->sh_size; 76: pSecInfo->nLink = pSecHead64->sh_link; 77: pSecInfo->nInfo = pSecHead64->sh_info; 78: pSecInfo->nAddralign = pSecHead64->sh_addralign; 79: pSecInfo->nEntsize = pSecHead64->sh_entsize; 80: ? 81: //ELF_GetSecftInfo(pSecInfo); 82: getsecinfo_finish: 83: return ret; 84: }

實際上設計兩個函數式為了保持目標文件的兼容性。

提取信息：根據節的編號獲取該節的詳細信息

1: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pElfInfo) 2: { 3: SEF_HEADSET * phandle = (SEF_HEADSET *)handle; 4: int ret = 0; 5: if((phandle==NULL) || (phandle->pS_ElfHeader == NULL) || (phandle->pS_SecHeader==NULL)) 6: { 7: ret = -1; 8: goto GetOut; 9: } 10: 11: SEF_ELFHEADER * pElfHeaderTemp = phandle->pS_ElfHeader; 12: SEF_SECHEADER * pSecHeaderTemp = phandle->pS_SecHeader; 13: int Index = 0; 14: 15: //deal 32bits elf file 16: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS32) 17: { 18: Index = pElfHeaderTemp->S_ElfHeader_32.e_shstrndx; 19: 20: //shstrname is the start address of the section name string section 21: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_32[Index].sh_offset; 22: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_32[num].sh_name; 23: ? 24: 25: } 26: //deal 64bits elf file 27: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS64) 28: { 29: Index = pElfHeaderTemp->S_ElfHeader_64.e_shstrndx; 30: 31: //shstrname is the start address of the section name string section 32: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_64[Index].sh_offset; 33: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_64[num].sh_name; 34: } 35: GetOut: 36: return ret; 37: }

把整個源碼文件也貼出來：

1: #include<stdio.h> 2: #include<string.h> 3: #include<stdlib.h> 4: #include"elf_GetElfInfo.h" 5: #include"elf_interface.h" 6: #include"../../include/adt.h" 7: ? 8: long ELF_GetELFEnddian(SEF_ELFHEADER* pHandle) 9: { 10: long ret = 0; 11: SEF_ELFHEADER *handle = (SEF_ELFHEADER*)pHandle; 12: big_endding or litte_endding 13: ? 14: if(pHandle == NULL) 15: { 16: ret = -1; 17: } 18: else if(pHandle->nFlag_Data == 1) 19: { 20: ret = ELFDATA2LSB; 21: } 22: else if(pHandle->nFlag_Data == 2) 23: { 24: ret = ELFDATA2MSB; 25: } 26: else 27: { 28: ret = ELFDATANONE; 29: } 30: return ret; 31: } 32: ? 33: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine) 34: { 35: long ret=0; 36: *nMachine = 0; 37: //判斷 CPU 38: if(pELF64Header == NULL) 39: { 40: ret = -1; 41: } 42: if(3 == pELF64Header->e_machine) 43: { 44: *nMachine = 1; 45: //printf("virtual program address: %p\n",pELF64Header->e_entry); 46: } 47: else if(62 == pELF64Header->e_machine) 48: { 49: *nMachine = 2; 50: } 51: else 52: { 53: *nMachine = 3; 54: } 55: return ret; 56: } 57: ? 58: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine) 59: { 60: long ret=0; 61: *nMachine = 0; 62: if(pELF32Header == NULL) 63: { 64: ret = -1; 65: } 66: //判斷 CPU 67: if(3 == pELF32Header->e_machine) 68: { 69: *nMachine = 1; 70: //printf("virtual program address: %p\n",pELF32Header->e_entry); 71: } 72: else if(62 == pELF32Header->e_machine) 73: { 74: *nMachine = 2; 75: } 76: else 77: { 78: *nMachine = 3; 79: } 80: return ret; 81: } 82: ? 83: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA) 84: { 85: long ret=0; 86: uint64_t ProNum=0; 87: long nFlag = -1; 88: uint64_t i = 0; 89: uint64_t offset = 0; 90: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL) 91: { 92: ret = -1; 93: goto ELF_ENTRY32; 94: } 95: /*deal 32bits elf file*/ 96: SEF_ELFHEADER_32 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_32); 97: ProNum = pElfHeader->e_phnum; 98: *RVA = pElfHeader->e_entry; 99: SEF_PROHEADER_32 *pSegTabFind=NULL; 100: SEF_PROHEADER_32 *pSegTabUse=NULL; 101: uint64_t nItemNum = *RVA; 102: /*find the first load segment*/ 103: for (i=0; i<ProNum; i++) 104: { 105: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_32[i]); 106: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz))) 107: { 108: nFlag = i; 109: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_32[nFlag]); 110: break; 111: } 112: } 113: if (pSegTabUse != NULL) 114: { 115: offset = nItemNum - pSegTabUse->p_vaddr; 116: *RAW = pSegTabUse->p_offset + offset; 117: } 118: else 119: { 120: ret = -2; 121: goto ELF_ENTRY32; 122: } 123: ELF_ENTRY32: 124: return ret; 125: } 126: ? 127: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA) 128: { 129: long ret=0; 130: uint64_t ProNum=0; 131: long nFlag = -1; 132: uint64_t i = 0; 133: uint64_t offset = 0; 134: /*deal 32bits elf file*/ 135: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL) 136: { 137: ret = -1; 138: goto ELF_ENTRY64; 139: } 140: SEF_ELFHEADER_64 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_64); 141: ProNum = pElfHeader->e_phnum; 142: *RVA = pElfHeader->e_entry; 143: 144: SEF_PROHEADER_64 *pSegTabFind=NULL; 145: SEF_PROHEADER_64 *pSegTabUse=NULL; 146: uint64_t nItemNum = *RVA; 147: /*find the first load segment*/ 148: for (i=0; i<ProNum; i++) 149: { 150: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_64[i]); 151: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz))) 152: { 153: nFlag = i; 154: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_64[nFlag]); 155: break; 156: } 157: } 158: if (pSegTabUse != NULL) 159: { 160: offset = nItemNum - pSegTabUse->p_vaddr; 161: *RAW = pSegTabUse->p_offset + offset; 162: // printf("RAW is %d\n",*RAW); 163: } 164: else 165: { 166: ret = -2; 167: goto ELF_ENTRY64; 168: } 169: ELF_ENTRY64: 170: return ret; 171: } 172: ? 173: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo) 174: { 175: long ret = 0; 176: uint16_t SecNum = 0; 177: uint8_t i=0; //as temp circle num 178: SEF_HEADSET* handle = (SEF_HEADSET*)phandle; 179: if(phandle->pS_SecHeader == NULL) 180: { 181: ret = -1; 182: goto getsecinfo_finish; 183: } 184: SEF_ELFHEADER_32 *pElfHeader32=&(handle->pS_ElfHeader->S_ElfHeader_32); 185: SEF_SECHEADER_32 *pSecHead32=NULL; 186: 187: SecNum = pElfHeader32->e_shnum; 188: ? 189: if(nIndex < 0 || nIndex > SecNum) 190: { 191: printf("Your input number is illegal!!\n"); 192: ret = -2; 193: goto getsecinfo_finish; 194: } 195: ? 196: pSecHead32 = &(handle->pS_SecHeader->pS_SecHeader_32[nIndex]); 197: ? 198: ELF_GetSecName(handle,nIndex,pSecInfo); 199: ? 200: pSecInfo->nType = pSecHead32->sh_type; 201: pSecInfo->nAddr = pSecHead32->sh_addr; 202: pSecInfo->nflags = pSecHead32->sh_flags; 203: pSecInfo->nOffset = pSecHead32->sh_offset; 204: pSecInfo->nSize = pSecHead32->sh_size; 205: pSecInfo->nLink = pSecHead32->sh_link; 206: pSecInfo->nInfo = pSecHead32->sh_info; 207: pSecInfo->nAddralign = pSecHead32->sh_addralign; 208: pSecInfo->nEntsize = pSecHead32->sh_entsize; 209: 210: //printf("nFlags is =====%p\n",pSecInfo->nflags); 211: //ELF_GetSecftInfo(pSecInfo); 212: getsecinfo_finish: 213: return ret; 214: } 215: ? 216: long ELF_GetSecInfo64(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo) 217: { 218: long ret = 0; 219: uint16_t SecNum = 0; 220: uint8_t i=0; //as temp circle num 221: SEF_HEADSET* handle = (SEF_HEADSET*)phandle; 222: if(phandle->pS_SecHeader == NULL) 223: { 224: ret = -1; 225: goto getsecinfo_finish; 226: } 227: SEF_ELFHEADER_64 *pElfHeader64=&(handle->pS_ElfHeader->S_ElfHeader_64); 228: SEF_SECHEADER_64 *pSecHead64=NULL; 229: ? 230: SecNum = pElfHeader64->e_shnum; 231: ? 232: if(nIndex < 0 || nIndex > SecNum) 233: { 234: printf("Your input number is illegal!!\n"); 235: ret = -2; 236: goto getsecinfo_finish; 237: } 238: printf("--------------------------------"); 239: pSecHead64 = &(handle->pS_SecHeader->pS_SecHeader_64[nIndex]); 240: 241: ELF_GetSecName(handle,nIndex,pSecInfo); 242: ? 243: pSecInfo->nType = pSecHead64->sh_type; 244: pSecInfo->nAddr = pSecHead64->sh_addr; 245: pSecInfo->nflags = pSecHead64->sh_flags; 246: pSecInfo->nOffset = pSecHead64->sh_offset; 247: pSecInfo->nSize = pSecHead64->sh_size; 248: pSecInfo->nLink = pSecHead64->sh_link; 249: pSecInfo->nInfo = pSecHead64->sh_info; 250: pSecInfo->nAddralign = pSecHead64->sh_addralign; 251: pSecInfo->nEntsize = pSecHead64->sh_entsize; 252: ? 253: //ELF_GetSecftInfo(pSecInfo); 254: getsecinfo_finish: 255: return ret; 256: } 257: ? 258: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pElfInfo) 259: { 260: SEF_HEADSET * phandle = (SEF_HEADSET *)handle; 261: int ret = 0; 262: if((phandle==NULL) || (phandle->pS_ElfHeader == NULL) || (phandle->pS_SecHeader==NULL)) 263: { 264: ret = -1; 265: goto GetOut; 266: } 267: 268: SEF_ELFHEADER * pElfHeaderTemp = phandle->pS_ElfHeader; 269: SEF_SECHEADER * pSecHeaderTemp = phandle->pS_SecHeader; 270: int Index = 0; 271: 272: //deal 32bits elf file 273: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS32) 274: { 275: Index = pElfHeaderTemp->S_ElfHeader_32.e_shstrndx; 276: 277: //shstrname is the start address of the section name string section 278: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_32[Index].sh_offset; 279: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_32[num].sh_name; 280: ? 281: 282: } 283: //deal 64bits elf file 284: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS64) 285: { 286: Index = pElfHeaderTemp->S_ElfHeader_64.e_shstrndx; 287: 288: //shstrname is the start address of the section name string section 289: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_64[Index].sh_offset; 290: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_64[num].sh_name; 291: } 292: GetOut: 293: return ret; 294: } ? 最后給出.h頭文件： 1: #include"../../include/elf_type.h" 2: #include "elf_interface.h" 3: #include"../../include/adt.h" 4: ? 5: #define ELF_FLAG_WRITE 0X1 6: #define ELF_FLAG_ALLOC 0X2 7: #define ELF_FLAG_EXECINSTR 0X4 8: #define ELF_FLAG_MERGE 0X10 9: #define ELF_FLAG_STRINGS 0X20 10: #define ELF_FLAG_LINK 0X40 11: #define ELF_FLAG_ORDER 0X80 12: #define ELF_FLAG_NONCONFORMING 0X100 13: #define ELF_FLAG_CROUP 0X200 14: #define ELF_FLAG_MASKOS 0X0ff00000 15: #define ELF_FLAG_MASKPROC 0Xf0000000 16: ? 17: ? 18: ///Get ELF's Enddian /// 19: /* 20: function : get ELF's enddian 21: input : [in point] pHandle is Call InitElf will return handle 22: result : ret ; 23: -1 input point is NULL 24: 0 ELFDATANONE can't decide which enddian 25: 1 ELFDATA2LSB little enddian 26: 2 ELFDATA2MSB big enddian 27: */ 28: long ELF_GetELFEnddian(SEF_ELFHEADER *pHandle); 29: ? 30: ? 31: ? 32: ? 33: //Get ELF's Machine/ 34: /* 35: funtinon: decide ELF's Machine when class is 64_class 36: input: 37: result: 0 success 38: -5 can not decide which Machine it is 39: readme: nEndding: 1 liteld+ending ； 2 big-edding 40: nMachine: 1 Intel 0x386 CPU ,2 AMD 64 CPU 41: nELFType: 1 ET_REL ; 2 ET_EXEC ; 3 ET_DYN ; 0 it's not ELF type 42: */ 43: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine); 44: ? 45: /* 46: funtinon: decide ELF's Machine when class is 32_class 47: input: 48: result: 0 success 49: -5 can not decide which Machine it is 50: readme: nEndding: 1 little_endding ； 2 big_endding 51: nMachine: 1 Intel 0x386 CPU , 2 AMD 64 CPU 52: nELFType: 1 ET_REL ; 2 ET_EXEC ;3 ET_DYN ; 0 it's not ELF type 53: */ 54: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine); 55: ? 56: /Get ELF's Entry 57: /* 58: function: Get know Program exev begin point 's virtual Address --- RVA and Physics Offset---RAW 59: input: [int point] Common struct include pS_ElfHeader Struct and Program Struct 60: [int/out point] RAW 61: result: ret = 0; success 62: ret = -1; input point is NULL 63: ret = -2 can't find which program table has the first command 64: readme: 65: */ 66: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA); 67: ? 68: /* 69: function: Get know Program exev begin point 's virtual Address --- RVA and Physics Offset---RAW 70: input: [int point] Common struct include pS_ElfHeader Struct and Program Struct 71: [int/out point] RAW 72: result: ret = 0; success 73: ret = -1; input point is NULL 74: ret = -2 can't find which program table has the first command 75: readme: 76: */ 77: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA); 78: ? 79: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo); 80: ? 81: long ELF_GetSecInfo64(SEF_HEADSET*phandle,uint32_t nIndex,ELF_SECINFO *pElfSecInfo); 82: ? 83: ? 84: /* 85: *function : Get know Program exec begin point's virtual Address ---RVA and Physics Offset---RAW 86: *input ; [int point] pHandle is CAll InitELF will return handle ,pAddressHandle from InitAddressELF 87: [in/out point] RAW and RVA 88: *result ; ret==0; success 89: ret==-1; input point is illegal 90: ret==-2; can't find which Program table has the first command 91: `readme : 92: * 93: * */ 94: //long ELF_GetEntry(void *handle, uint64_t *RAW, uint64_t *RVA); 95: ? 96: //Get ELF's ALL Information 97: /* 98: funtinon: Get ELF bit, machine, bigendding 99: input: [in point] pHandle is Call InitELF will return handle 100: [in/out poing] ELFInfo struct point, recfrese Buf.h 101: result: 0 success 102: -1 input point is null 103: -2 length is too short or it's firt four bits don't fit ELF style so it's not ELF style 104: 105: readme: InitElF , handle Call InitELF() 106: output bIsElfStyle TURE elf文件；FALSE 非elf文件 107: nEndding: 1 little_endding ； 2 big_endding ;3 can't decide which enddian 108: nClass : 1 32_class ； 2 64_class ;3 can't decide which class 109: nMachine: 1 Intel 0x386 CPU ;2 AMD 64 CPU;3 can't decide which class 110: */ 111: //long ELF_GetElfHeaderInfo(void *pHandle,ELF_HEADERINFO *pElfInfo); 112: ? 113: ? 114： 115: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pSecInfo); 116: ?

轉載于:https://www.cnblogs.com/hellowolrd-dc/p/3917450.html

超強干貨來襲云風專訪：近40年碼齡，通宵達旦的技術人生

總結

以上是生活随笔為你收集整理的ELF格式解析库之提取信息的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。