konrad-kruczynski / elfsharp Goto Github PK
View Code? Open in Web Editor NEWPure managed C# library for reading ELF, UImage, Mach-O binaries.
Home Page: https://elfsharp.it
License: Other
Pure managed C# library for reading ELF, UImage, Mach-O binaries.
Home Page: https://elfsharp.it
License: Other
Hi everyone,
I am trying to figure out how to get the file offset of a segment in an ELF. I observe that the field offset
in Segment
has private
attribute, so the only way to get offset
is to parse again the header of this segment? Is there some reason to make offset
as private
?
Many thanks.
It is not available for the .NET Standard 2.0 and ELFSharp only uses some pieces out of the whole library, so it would be nice to actually implement the necessary functionality directly.
If the FileSize
of a segment is smaller than its Size
, the part of the data that is not in the ELF should be filled up with zeroes, I think.
Steps to reproduce:
FileSize
smaller than Size
.GetFileContents()
and GetMemoryContents()
on this segment.Expected result:
Let's assume the FileSize is 4 and the Size is 8. Then GetFileContents()
should return something like
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ }
where 0xZZ
is any number
and GetMemoryContents()
should return something like
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ, 0x00, 0x00, 0x00, 0x00 }
Actual result:
GetFileContents()
returns
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ }
GetMemoryContents()
returns
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ, 0xGG, 0xGG, 0xGG, 0xGG }
where 0xGG are random numbers
Version I used: 2.1.0
Trying out a simple example, using VS Express 2015 and targeting .NET 4.5:
using ELFSharp.ELF;
using ELFSharp.ELF.Sections;
using System;
using System.ComponentModel;
using System.Data;
using System.Linq;
using System.Windows.Forms;
...
var elf = ELFReader.Load(elfFile);
var symbols = ((ISymbolTable)elf.GetSection(".symtab")).Entries.Where(x => x.Type == SymbolType.Object);
But I can't seem to get past this weird "call is ambiguous". The calls look identical to me.
Severity Code Description Project File Line Suppression State
Error CS0121 The call is ambiguous between the following methods or properties: 'System.Linq.Enumerable.Where(System.Collections.Generic.IEnumerable, System.Func<TSource, bool>)' and 'System.Linq.Enumerable.Where(System.Collections.Generic.IEnumerable, System.Func<TSource, bool>)' Elf-Parser C:\dev\Elf-Parser\Form1.cs 30 Active
Any idea on what this could be?
As documented here, the byte after info
, referenced at https://github.com/konrad-kruczynski/elfsharp/blob/master/ELFSharp/ELF/Sections/SymbolTable.cs#L44 contains information about the visibility of the symbol. I would like to see that information exposed in the public API.
Apparently this is at least acceptable.
It'd be useful for a project I'm working on that consumes ELFSharp (BinSkim -- https://github.com/Microsoft/binskim ) if ELFSharp could parse the Dynamic section of an ELF binary--we need to check some parts of that section in order to implement a check.
If you'd like, I can put together a PR with an implementation and send it over.
I would need an ELFWriter to load, modify and save elf files. I'm a little bit thinking of implementing it but it only works out if the ELFWriter actually reads out everything, otherwise it's not possible to get same output. Can anybody comment the completeness of the reader? Or does anybody have some ideas about writer?
At the moment, one cannot access the section header via API. If I want to get, for example, the file offset of a Section, I currently have to use reflection to get that:
foreach (PropertyInfo property in typeof(Section<long>).GetProperties(BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public))
{
if (property.Name == "Header")
{
foreach (PropertyInfo p in property.GetValue(s).GetType().GetProperties(BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public))
{
if (p.Name == "Offset")
{
FileOffset = (long)p.GetValue(property.GetValue(s));
}
}
}
}
This just doesn't feel right.
It would be great if you could add a strong-named assembly to the NuGet release of the library. That way ELFSharp could be referenced in projects that are themselves strong-named.
Method for testing if a given binary is proper ELF would be nice.
I am trying to extract information regarding the target platform from the ELF file. Architecture
, Endianess
and EntryPoint
are all easy to grab. But what about pointer size?
E.g Class
only takes values Bit32
or Bit64
, so I assume that isn't it since it doesn't cover 16 bit architectures.
It does not make any sense now.
Also version assemblies according to this article: https://codingforsmarties.wordpress.com/2016/01/21/how-to-version-assemblies-destined-for-nuget/
When loading a ELF file during ReadSections()
, FindStringTables()
sets dynamicStringTable
to null
. Then during the loop performing TouchSection
, GetSectionFromSectionHeader()
there is a case where header.Type
is SectionType.DynamicSymbolTable
.
The null dynamicStringTable
is passed to new SymbolTable<T>(header, readerSource, dynamicStringTable, this)
and then during ReadSymbols()
tries to access it as table
on line var name = table[nameIdx];
. This blows up.
This happens during TouchSection
for i == 9
in the linked ELF.
Is there any way to access the properties of e.g Section Header like Start Address/Size like how the Section.ToString() method prints out the following:
text: ProgBits, load @0x3A02C0, 39796240 bytes long
So that one can access it by the following: mySection.Address, mySection.Size
Currently I am splitting this string manually and it is unwieldy.
The cast in the below line sometimes throws.
Line 291 in 48f5204
I worked around the issue by putting it in a try catch block.
I found the issue when trying to load libcoreclr.so.dbg
from .NET Core SDK 3.1.100-preview2.
If you want the binary follow the install instructions from https://dotnet.microsoft.com/download/dotnet-core/3.1. Installing https://dotnet.microsoft.com/download/dotnet-core/thank-you/sdk-3.1.100-preview2-linux-x64-binaries
run
$ #install the dotnet symbol tool
$ dotnet tool install dotnet-symbol --global
$ #find the 3.1.100-preview2 runtime
$ dotnet --info | grep Microsoft.NETCore.App
Microsoft.NETCore.App 2.1.13 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 2.2.7 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 3.1.0-preview2.19525.6 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
$ # Download libcoreclr.so.dbg with symbols
$ dotnet-symbol /usr/share/dotnet/shared/Microsoft.NETCore.App/3.1.0-preview2.19525.6/libcoreclr.so -o .
Downloading from http://msdl.microsoft.com/download/symbols/
Writing files to .
Writing: ./libcoreclr.so
Writing: ./libcoreclr.so.dbg
Writing: ./libmscordaccore.so
Writing: ./libmscordbi.so
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/libsos.so/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/libsos.so'
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/sos.netcore.dll/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/sos.netcore.dll'
It would be great if you would implement a way to explore dwarf information within the .debug sections.
Just as it was done for ELF. Test infrastructure can then be simplified.
Hey:
It looks like due to an issue with NuGetizer (NuGet/Home#6270), the entire netstandard set of libraries is included in the NuGet package. This isn't an issue if you're consuming the library via .NET Core, but it will cause numerous build conflicts with the standard libraries if you try to consume the library in .NET 4.6.1 (which should be possible).
It should be possible to build the NuGet package from the CSProj file without NuGetizer via dotnet pack ELFSharp.csproj
(see: https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-pack?tabs=netcore2x), which seems to avoid including all of the dependencies and removes the dependency on a nonstandard tool, and seems to correctly version/set authors/etc.
--Everett Maus
The magic is 0xCAFEBABE
.
Hi,
I created a dummy program in c that uses the following command line:
gcc -Wall hello.c -o hello -gdwarf
With that, it generated the hello file + a folder called hello.dSYM.
So, with that, how can I load that and read using ELFSharp?
Thank you!
Hi. Cannot find way to get number of sections and segments count. Looks like they are stored in sectionHeaderEntryCount and segmentHeaderEntryCount, but fields are private and have no getters. Is there another way to get info? If no, suggesting to add public getter to all data from global elf header =)
Use strip --strip-all
.
Hi,
I have been trying to read a mach-o binary.
Looking at the tests, I got the segments, for example, and I understood how to fetch the data inside it.
But there are things that I couldn't locate:
byte[] data = segment.GetData();
string text = Encoding.ASCII.GetString(data);
Just to let you know, I generated a sample using the following command in a Mac:
gcc -Wall -O2 hello.c -g -o hello
gcc -Wall -O2 hello.c -g -dwarf-5 -o hello5
thank you!
For the beginning:
I'm running an application which only has the ELFs in memory, but not on disk, and I cannot guarantee that I can write to disk at all. It would be super helpful if there was an ELFReader.Load
variant which accepts a Stream instead of the filename of the string.
Additionally, this would also simplify the unit tests in this library itself instead of having to write temporary files.
Please enhance the "enum Machine" with these Architectures:
6 Intel 80486
36 Renesas V800 series
37 Fujitsu FR
40 ARM
42 Hitachi SH
44 Infineon TriCore
52 Motorola ColdFire
54 Motorola MCore
58 Motorola StarCore
60 STMicroelectronics ST100
78 Broadcom FirePath
88 Renesas M32R
106 ADI Blackfin
Thanks!
Konrad,
Thank you , this certainly is an excellent library!
I use it to parse and upload elf files to an ARM processor.
Can you make the "filesize" of the “Segment” class public? There is no need to program a segment of zero file size because it usually gets initialized by the boot code.
Thank you,
Natie.
Hi konrad, I just tried to download and use the current version of your ElfShap library, but when I try to open a valid ELF I get the error "Given ELF file is of unknown version 16777216."
I know that there are different version of ELF / DWARF so maybe this is an issue. Unfortunately I cannot provide you the ELF file, but if you give me some indications I would be happy to help.
Hello,
I'm trying to use ELFSharp to load program binaries for an instruction set simulator. However, part of the program loading sequence involves loading the raw program header data into memory. I see that there are methods to access program header information, but there doesn't seem to be any which allow you to access the data directly. Is this currently possible with ELFSharp? If not, is this something which might be added in the future?
Thanks!
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.