class Rex::ElfParsey::Elf
Attributes
base_addr[RW]
elf_header[RW]
isource[RW]
program_header[RW]
Public Class Methods
new(isource)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 12 def initialize(isource) offset = 0 base_addr = 0 # ELF Header elf_header = ElfHeader.new(isource.read(offset, ELF_HEADER_SIZE)) # Data encoding ei_data = elf_header.e_ident[EI_DATA,1].unpack("C")[0] e_phoff = elf_header.e_phoff e_phentsize = elf_header.e_phentsize e_phnum = elf_header.e_phnum # Program Header Table program_header = [] e_phnum.times do |i| offset = e_phoff + (e_phentsize * i) program_header << ProgramHeader.new( isource.read(offset, PROGRAM_HEADER_SIZE), ei_data ) if program_header[-1].p_type == PT_LOAD && program_header[-1].p_flags & PF_EXEC > 0 base_addr = program_header[-1].p_vaddr end end self.elf_header = elf_header self.program_header = program_header self.base_addr = base_addr self.isource = isource end
new_from_file(filename, disk_backed = false)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 48 def self.new_from_file(filename, disk_backed = false) file = ::File.new(filename) # file.binmode # windows... :\ if disk_backed return self.new(ImageSource::Disk.new(file)) else obj = new_from_string(file.read) file.close return obj end end
new_from_string(data)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 62 def self.new_from_string(data) return self.new(ImageSource::Memory.new(data)) end
Public Instance Methods
close()
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 114 def close isource.close end
index(*args)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 110 def index(*args) isource.index(*args) end
offset_to_rva(offset)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 94 def offset_to_rva(offset) base_addr + offset end
ptr_32?()
click to toggle source
Returns true if this binary is for a 32-bit architecture. This check does not take into account 16-bit binaries at the moment.
# File lib/rex/elfparsey/elf.rb, line 82 def ptr_32? ptr_64? == false end
ptr_64?()
click to toggle source
Returns true if this binary is for a 64-bit architecture.
# File lib/rex/elfparsey/elf.rb, line 69 def ptr_64? unless [ ELFCLASS32, ELFCLASS64 ].include?( elf_header.e_ident[EI_CLASS,1].unpack("C*")[0]) raise ElfHeaderError, 'Invalid class', caller end elf_header.e_ident[EI_CLASS,1].unpack("C*")[0] == ELFCLASS64 end
ptr_s(rva)
click to toggle source
Converts a virtual address to a string representation based on the underlying architecture.
# File lib/rex/elfparsey/elf.rb, line 90 def ptr_s(rva) (ptr_32?) ? ("0x%.8x" % rva) : ("0x%.16x" % rva) end
read(offset, len)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 102 def read(offset, len) isource.read(offset, len) end
read_rva(rva, len)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 106 def read_rva(rva, len) isource.read(rva_to_offset(rva), len) end
rva_to_offset(rva)
click to toggle source
# File lib/rex/elfparsey/elf.rb, line 98 def rva_to_offset(rva) rva - base_addr end