class Rex::ElfParsey::Elf

Attributes

base_addr[RW]
elf_header[RW]
isource[RW]
program_header[RW]

Public Class Methods

new(isource) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 12
def initialize(isource)
  offset = 0
  base_addr = 0

  # ELF Header
  elf_header = ElfHeader.new(isource.read(offset, ELF_HEADER_SIZE))

  # Data encoding
  ei_data = elf_header.e_ident[EI_DATA,1].unpack("C")[0]

  e_phoff = elf_header.e_phoff
  e_phentsize = elf_header.e_phentsize
  e_phnum = elf_header.e_phnum

  # Program Header Table
  program_header = []

  e_phnum.times do |i|
    offset = e_phoff + (e_phentsize * i)

    program_header << ProgramHeader.new(
      isource.read(offset, PROGRAM_HEADER_SIZE), ei_data
    )

    if program_header[-1].p_type == PT_LOAD && program_header[-1].p_flags & PF_EXEC > 0
      base_addr = program_header[-1].p_vaddr
    end

  end

  self.elf_header = elf_header
  self.program_header = program_header
  self.base_addr = base_addr
  self.isource = isource
end
new_from_file(filename, disk_backed = false) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 48
def self.new_from_file(filename, disk_backed = false)

  file = ::File.new(filename)
  # file.binmode # windows... :\

  if disk_backed
    return self.new(ImageSource::Disk.new(file))
  else
    obj = new_from_string(file.read)
    file.close
    return obj
  end
end
new_from_string(data) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 62
def self.new_from_string(data)
  return self.new(ImageSource::Memory.new(data))
end

Public Instance Methods

close() click to toggle source
# File lib/rex/elfparsey/elf.rb, line 114
def close
  isource.close
end
index(*args) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 110
def index(*args)
  isource.index(*args)
end
offset_to_rva(offset) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 94
def offset_to_rva(offset)
  base_addr + offset
end
ptr_32?() click to toggle source

Returns true if this binary is for a 32-bit architecture. This check does not take into account 16-bit binaries at the moment.

# File lib/rex/elfparsey/elf.rb, line 82
def ptr_32?
  ptr_64? == false
end
ptr_64?() click to toggle source

Returns true if this binary is for a 64-bit architecture.

# File lib/rex/elfparsey/elf.rb, line 69
def ptr_64?
  unless [ ELFCLASS32, ELFCLASS64 ].include?(
  elf_header.e_ident[EI_CLASS,1].unpack("C*")[0])
    raise ElfHeaderError, 'Invalid class', caller
  end

  elf_header.e_ident[EI_CLASS,1].unpack("C*")[0] == ELFCLASS64
end
ptr_s(rva) click to toggle source

Converts a virtual address to a string representation based on the underlying architecture.

# File lib/rex/elfparsey/elf.rb, line 90
def ptr_s(rva)
  (ptr_32?) ? ("0x%.8x" % rva) : ("0x%.16x" % rva)
end
read(offset, len) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 102
def read(offset, len)
  isource.read(offset, len)
end
read_rva(rva, len) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 106
def read_rva(rva, len)
  isource.read(rva_to_offset(rva), len)
end
rva_to_offset(rva) click to toggle source
# File lib/rex/elfparsey/elf.rb, line 98
def rva_to_offset(rva)
  rva - base_addr
end