Elf

This package will let you use programatic ninja-fu when trying to parse Elf binaries. The API is based around several objects representing constructs in the Elf binary format. The Elf object itself contains parsed metadata and lists of things like section headers and relocation entries. Additionally, most of the objects implement repr() in some form or another which allows you a bunch of readelf-like functionality.

*Eventually* this API will allow you to modify Elf binaries and spit them back out in working order (not complete, you may notice some of the initial code).

dt_types

Value:

{0: 'Marks end of dynamic section ',
 1: 'Name of needed library ',
 2: 'Size in bytes of PLT relocs ',
 3: 'Processor defined value ',
 4: 'Address of symbol hash table ',
 5: 'Address of string table ',
 6: 'Address of symbol table ',
 7: 'Address of Rela relocs ',
...

e_flags_68k

Value:

{0: 'No reloc',
 1: 'Direct 32 bit',
 2: 'Direct 16 bit',
 3: 'Direct 8 bit',
 4: 'PC relative 32 bit',
 5: 'PC relative 16 bit',
 6: 'PC relative 8 bit',
 7: '32 bit PC relative GOT entry',
...

e_machine_types

Value:

{0: 'No machine',
 1: 'AT&T WE 32100',
 2: 'SUN SPARC',
 3: 'Intel 80386',
 4: 'Motorola m68k family',
 5: 'Motorola m88k family',
 7: 'Intel 80860',
 8: 'MIPS R3000 big-endian',
...

e_types

Value:

{0: 'No file type',
 1: 'Relocatable file',
 2: 'Executable file',
 3: 'Shared object file',
 4: 'Core file',
 5: 'Number of defined types',
 65024: 'OS-specific range start',
 65279: 'OS-specific range end',
...

e_versions

Value:

{0: 'Invalid ELF version', 1: 'Current version', 2: ''}

ph_types

Value:

{0: 'Program header table entry unused',
 1: 'Loadable program segment',
 2: 'Dynamic linking information',
 3: 'Program interpreter',
 4: 'Auxiliary information',
 5: 'Reserved',
 6: 'Entry for header table itself',
 7: 'Thread-local storage segment',
...

r_types_386

Value:

{0: 'No reloc',
 1: 'Direct 32 bit',
 2: 'PC relative 32 bit',
 3: '32 bit GOT entry',
 4: '32 bit PLT address',
 5: 'Copy symbol at runtime',
 6: 'Create GOT entry',
 7: 'Create PLT entry',
...

r_types_amd64

Value:

{0: 'No reloc',
 1: 'Direct 64 bit ',
 2: 'PC relative 32 bit signed',
 3: '32 bit GOT entry',
 4: '32 bit PLT address',
 5: 'Copy symbol at runtime',
 6: 'Create GOT entry',
 7: 'Create PLT entry',
...

sh_flags

Value:

{1: 'Writable',
 2: 'Occupies memory during execution',
 4: 'Executable',
 16: 'Might be merged',
 32: 'Contains nul-terminated strings',
 64: '`sh_info\' contains SHT index',
 128: 'Preserve order after combining',
 256: 'Non-standard OS specific',
...

sh_type

Value:

{0: 'Section header table entry unused',
 1: 'Program data',
 2: 'Symbol table',
 3: 'String table',
 4: 'Relocation entries with addends',
 5: 'Symbol hash table',
 6: 'Dynamic linking information',
 7: 'Notes',
...

st_info_bind

Value:

{0: 'Local symbol',
 1: 'Global symbol',
 2: 'Weak symbol',
 10: 'Start of OS-specific',
 12: 'End of OS-specific',
 13: 'Start of processor-specific',
 15: 'End of processor-specific'}

st_info_type

Value:

{0: 'Symbol type is unspecified',
 1: 'Symbol is a data object',
 2: 'Symbol is a code object',
 3: 'Symbol associated with a section',
 4: 'Symbol\'s name is file name',
 5: 'Symbol is a common data object',
 6: 'Symbol is thread-local data',
 10: 'Start of OS-specific',
...

Package Elf

dt_types

e_flags_68k

e_machine_types

e_types

e_versions

ph_types

r_types_386

r_types_amd64

sh_flags

sh_type

st_info_bind

st_info_type