#ifndef ELFFILE_H
#define ELFFILE_H
#ifdef __cplusplus
extern "C" {
#endif
// standard C includes
#include <stdint.h>
#include <stdlib.h>
// compiler-specific glue
#ifdef _WIN32
#ifndef __BYTE_ORDER__
#define __ORDER_BIG_ENDIAN__ 4321
#define __ORDER_LITTLE_ENDIAN__ 1234
#define __BYTE_ORDER__ __ORDER_LITTLE_ENDIAN__ // all Windows machines are little endian
#endif // !__BYTE_ORDER__
#ifndef __builtin_bswap64
#ifdef _MSC_VER
#define __builtin_bswap64(x) _byteswap_uint64 ((unsigned long long) (x))
#endif // _MSC_VER
#endif // !__builtin_bswap64
#ifndef __builtin_bswap32
#ifdef _MSC_VER
#define __builtin_bswap32(x) _byteswap_ulong ((unsigned long) (x))
#endif // _MSC_VER
#endif // !__builtin_bswap32
#ifndef __builtin_bswap16
#ifdef _MSC_VER
#define __builtin_bswap16(x) _byteswap_ushort ((unsigned short) (x))
#endif // _MSC_VER
#endif // !__builtin_bswap32
#endif // _WIN32
#ifdef _MSC_VER
#define START_OF_PACKED_STRUCT() __pragma(pack(push)) __pragma(pack(1))
#define END_OF_PACKED_STRUCT() __pragma(pack(pop))
#define PACKED(thing) thing
#else // !_MSC_VER
#define START_OF_PACKED_STRUCT()
#define END_OF_PACKED_STRUCT()
#define PACKED(thing) thing __attribute__((packed))
#endif // _MSC_VER
// endianness proclamation macros
#define IS_HOST_LE (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)
#define IS_HOST_BE (__BYTE_ORDER__ == __ORDER_BIG_ENDIAN__)
// structures describing Executable and Linkable Format (ELF) files and macros for accessing them
#define ELF_MAGIC_STR ("\x7f" "ELF") // 4 bytes found at the start of every ELF file
// ELF platform size
#define ELF_SIZE_32BIT 1 // 'platform_size' member of an ELF header: ELF file contains 32-bit structures
#define ELF_SIZE_64BIT 2 // 'platform_size' member of an ELF header: ELF file contains 64-bit structures
#define IS_ELF_32BIT(elfhdr) ((elfhdr)->u.elf.platform_size == ELF_SIZE_32BIT)
#define IS_ELF_64BIT(elfhdr) ((elfhdr)->u.elf.platform_size == ELF_SIZE_64BIT)
// ELF endianness
#define ELF_ENDIAN_LITTLE 1 // 'endianness' member of an ELF header: ELF file is little endian
#define ELF_ENDIAN_BIG 2 // 'endianness' member of an ELF header: ELF file is big endian
#define IS_ELF_LE(elfhdr) ((elfhdr)->u.elf.endianness == ELF_ENDIAN_LITTLE)
#define IS_ELF_BE(elfhdr) ((elfhdr)->u.elf.endianness == ELF_ENDIAN_LITTLE)
// ELF file type
#define ELF_TYPE_RELOCATABLE 1 // 'type' member of an ELF header: ELF file is relocatable in memory (all offsets hardcoded in it are relative)
#define ELF_TYPE_EXECUTABLE 2 // 'type' member of an ELF header: ELF file is executable (has an entrypoint and can be invoked by exec())
#define ELF_TYPE_DYNAMICLIB 3 // 'type' member of an ELF header: ELF file is a shared object (requires the dynamic linker to be loaded)
#define ELF_TYPE_CORE 4 // 'type' member of an ELF header: ELF file is a core dump (produced by the kernel)
// ELF instruction set
#define ELF_MACHINE_X86_64 0x3e // 'instruction_set' member of an ELF header, also used in the IFS startup header: ELF file is for x86_64 processors (62 decimal)
#define ELF_MACHINE_AARCH64 0xb7 // 'instruction_set' member of an ELF header, also used in the IFS startup header: ELF file is for ARM64 processors (183 decimal)
// ELF segment types
#define ELF_SEGMENTTYPE_LOADABLE 1
// ELF section types
#define ELF_SECTIONTYPE_STRINGTABLE 3
// ELF dynamic section types
#define ELF_DT_NULL 0 // marks end of dynamic section
#define ELF_DT_SONAME 14 // canonical name of shared object
// returns the actual size of an ELF structure. Handles 32- and 64-bit ELF files in low and big endianness transparently.
#define ELF_STRUCT_SIZE(elfhdr,elfstruct) (IS_ELF_64BIT (elfhdr) ? sizeof ((elfstruct)->u.elf64) : sizeof ((elfstruct)->u.elf32))
// gets a numeric value from an ELF structure. Handles 32- and 64-bit ELF files in low and big endianness transparently.
#define ELF_GET_NUMERIC(elfhdr,elfstruct,member) (IS_ELF_64BIT (elfhdr) ? /* is it a 64-bit ELF file ? */ \
( \
(sizeof ((elfstruct)->u.elf64.member) == 1) || (IS_ELF_LE (elfhdr) && IS_HOST_LE) || (IS_ELF_BE (elfhdr) && IS_HOST_BE) ? /* single-byte, or same endianness ? */ \
(elfstruct)->u.elf64.member /* same endianness, or single byte required: don't swap */ \
: /* else more than one byte and different endianness: swap */ \
(sizeof ((elfstruct)->u.elf64.member) == 8 ? __builtin_bswap64 ((elfstruct)->u.elf64.member) : \
(sizeof ((elfstruct)->u.elf64.member) == 4 ? __builtin_bswap32 ((elfstruct)->u.elf64.member) : \
/* member is necessarily a 2-byte 'word' */ __builtin_bswap16 ((elfstruct)->u.elf64.member))) \
) \
: /* else peek at 32-bit ELF */ \
( \
(sizeof ((elfstruct)->u.elf32.member) == 1) || (IS_ELF_LE (elfhdr) && IS_HOST_LE) || (IS_ELF_BE (elfhdr) && IS_HOST_BE) ? /* single-byte, or same endianness ? */ \
(elfstruct)->u.elf32.member /* same endianness, or single byte required: don't swap */ \
: /* else more than one byte and different endianness: swap */ \
(sizeof ((elfstruct)->u.elf32.member) == 4 ? __builtin_bswap32 ((elfstruct)->u.elf32.member) : \
/* member is necessarily a 2-byte 'word' */ __builtin_bswap16 ((elfstruct)->u.elf32.member)) \
) \
)
// sets a numeric value into an ELF structure. Handles 32- and 64-bit ELF files in low and big endianness transparently.
#define ELF_SET_NUMERIC(elfhdr,elfstruct,member,data) (IS_ELF_64BIT (elfhdr) ? /* is it a 64-bit ELF file ? */ \
((elfstruct)->u.elf64.member = ( \
(sizeof ((elfstruct)->u.elf64.member) == 1) || (IS_ELF_LE (elfhdr) && IS_HOST_LE) || (IS_ELF_BE (elfhdr) && IS_HOST_BE) ? /* single-byte, or same endianness ? */ \
(sizeof ((elfstruct)->u.elf64.member) == 8 ? (uint64_t) ((data)) : \
(sizeof ((elfstruct)->u.elf64.member) == 4 ? (uint32_t) ((data)) : \
(sizeof ((elfstruct)->u.elf64.member) == 2 ? (uint16_t) ((data)) : \
(uint8_t) ((data))))) /* same endianness, or single byte required: don't swap */ \
: /* else more than one byte and different endianness: swap */ \
(sizeof ((elfstruct)->u.elf64.member) == 8 ? __builtin_bswap64 ((data)) : \
(sizeof ((elfstruct)->u.elf64.member) == 4 ? __builtin_bswap32 ((data)) : \
/* member is necessarily a 2-byte 'word' */ __builtin_bswap16 ((data)))) \
)) \
: /* else poke at 32-bit ELF */ \
((elfstruct)->u.elf32.member = ( \
(sizeof ((elfstruct)->u.elf32.member) == 1) || (IS_ELF_LE (elfhdr) && IS_HOST_LE) || (IS_ELF_BE (elfhdr) && IS_HOST_BE) ? /* single-byte, or same endianness ? */ \
(sizeof ((elfstruct)->u.elf64.member) == 4 ? (uint32_t) ((data)) : \
(sizeof ((elfstruct)->u.elf64.member) == 2 ? (uint16_t) ((data)) : \
(uint8_t) ((data)))) /* same endianness, or single byte required: don't swap */ \
: /* else more than one byte and different endianness: swap */ \
(sizeof ((elfstruct)->u.elf32.member) == 4 ? __builtin_bswap32 ((data)) : \
/* member is necessarily a 2-byte 'word' */ __builtin_bswap16 ((data))) \
)) \
)
// gets a string from an ELF structure. Handles 32- and 64-bit ELF files in low and big endianness transparently.
#define ELF_GET_STRING(elfhdr,elfstruct,member) (IS_ELF_64BIT (elfhdr) ? (elfstruct)->u.elf64.member : (elfstruct)->u.elf32.member)
// sets a string into an ELF structure. Handles 32- and 64-bit ELF files in low and big endianness transparently.
#define ELF_SET_STRING(elfhdr,elfstruct,member,data,len) memcpy ((IS_ELF_64BIT (elfhdr) ? (elfstruct)->u.elf64.member : (elfstruct)->u.elf32.member), (data), (len)) // this macro supports 32- and 64-bit ELF files transparently
// Executable and Linkable Format master header structure type definition
START_OF_PACKED_STRUCT () // we need byte-alignment for this struct
typedef PACKED (struct) elf_header_s
{
PACKED (union)
{
PACKED (struct)
{
uint8_t magic[4]; // offset 0: "\x7f" + "ELF"
uint8_t platform_size; // offset 4: 1 = 32-bit, 2 = 64-bit
uint8_t endianness; // offset 5: 1 = little endian, 2 = big endian
uint8_t header_version; // offset 6: typically 1
uint8_t os_abi; // offset 7: 0 = SysV, 1 = HP/UX, 2 = NetBSD, 3 = Linux, 4 = GNU/Hurd, 6 = Solaris, 7 = AIX, 8 = IRIX, 9 = FreeBSD, 10 = Tru64, 11 = Novell, 12 = OpenBSD, 13 = OpenVMS, 14 = NonStop kernel, 15 = AROS, 16 = FenixOS, 17 = Nuxi CloudABI, 18 = OpenVOS
uint8_t spare[8]; // offset 8: zeroes
uint16_t type; // offset 16: 1 = relocatable, 2 = executable, 3 = shared, 4 = core dump
uint16_t instruction_set; // offset 18: 2 = Sparc, 3 = i386, 8 = MIPS, 20 = PowerPC, 40 = ARM, 42 = SuperH, 50 = IA-64, 62 = x86_64, 183 = AArch64, 243 = RISC-V
uint32_t elf_version; // offset 20: typically 1
} elf;
PACKED (struct) // size == 52
{
uint8_t magic[4]; // offset 0: "\x7f" + "ELF"
uint8_t platform_size; // offset 4: 1 = 32-bit, 2 = 64-bit
uint8_t endianness; // offset 5: 1 = little endian, 2 = big endian
uint8_t header_version; // offset 6: typically 1
uint8_t os_abi; // offset 7: 0 = SysV, 1 = HP/UX, 2 = NetBSD, 3 = Linux, 4 = GNU/Hurd, 6 = Solaris, 7 = AIX, 8 = IRIX, 9 = FreeBSD, 10 = Tru64, 11 = Novell, 12 = OpenBSD, 13 = OpenVMS, 14 = NonStop kernel, 15 = AROS, 16 = FenixOS, 17 = Nuxi CloudABI, 18 = OpenVOS
uint8_t spare[8]; // offset 8: zeroes
uint16_t type; // offset 16: 1 = relocatable, 2 = executable, 3 = shared, 4 = core dump
uint16_t instruction_set; // offset 18: 2 = Sparc, 3 = i386, 8 = MIPS, 20 = PowerPC, 40 = ARM, 42 = SuperH, 50 = IA-64, 62 = x86_64, 183 = AArch64, 243 = RISC-V
uint32_t elf_version; // offset 20: typically 1
uint32_t entrypoint_offset; // offset 24: offset to program entrypoint
uint32_t program_header_table_offset; // offset 28: offset to program header table
uint32_t section_header_table_offset; // offset 32: offset to section header table
uint32_t flags; // offset 36: flags (architecture-dependent, none for x86)
uint16_t header_size; // offset 40: size of ELF header, 52 for 32-bit ELF and 64 for 64-bit ELF -- DO NOT USE sizeof() ON THE elf_header_s STRUCT BECAUSE OF THE UNION! WRITE THE CORRECT SIZE YOURSELF!
uint16_t program_header_item_size; // offset 42: size of an entry in the program header table
uint16_t program_header_table_len; // offset 44: number of entries in the program header table
uint16_t section_header_item_size; // offset 46: size of an entry in the section header table
uint16_t section_header_table_len; // offset 48: number of entries in the section header table
uint16_t section_header_names_idx; // offset 50: index of the entry in the section header table that contains the section names
} elf32; // size == 52
PACKED (struct) // size == 64
{
uint8_t magic[4]; // offset 0: "\x7f" + "ELF"
uint8_t platform_size; // offset 4: 1 = 32-bit, 2 = 64-bit
uint8_t endianness; // offset 5: 1 = little endian, 2 = big endian
uint8_t header_version; // offset 6: typically 1
uint8_t os_abi; // offset 7: 0 = SysV, 1 = HP/UX, 2 = NetBSD, 3 = Linux, 4 = GNU/Hurd, 6 = Solaris, 7 = AIX, 8 = IRIX, 9 = FreeBSD, 10 = Tru64, 11 = Novell, 12 = OpenBSD, 13 = OpenVMS, 14 = NonStop kernel, 15 = AROS, 16 = FenixOS, 17 = Nuxi CloudABI, 18 = OpenVOS
uint8_t spare[8]; // offset 8: zeroes
uint16_t type; // offset 16: 1 = relocatable, 2 = executable, 3 = shared, 4 = core dump
uint16_t instruction_set; // offset 18: 2 = Sparc, 3 = i386, 8 = MIPS, 20 = PowerPC, 40 = ARM, 42 = SuperH, 50 = IA-64, 62 = x86_64, 183 = AArch64, 243 = RISC-V
uint32_t elf_version; // offset 20: typically 1
uint64_t entrypoint_offset; // offset 24: program entry offset
uint64_t program_header_table_offset; // offset 32: offset to program header table
uint64_t section_header_table_offset; // offset 40: offset to section header table
uint32_t flags; // offset 48: flags (architecture-dependent, none for x86)
uint16_t header_size; // offset 52: size of ELF header, 52 for 32-bit ELF and 64 for 64-bit ELF
uint16_t program_header_item_size; // offset 54: size of an entry in the program header table
uint16_t program_header_table_len; // offset 56: number of entries in the program header table
uint16_t section_header_item_size; // offset 58: size of an entry in the section header table
uint16_t section_header_table_len; // offset 60: number of entries in the section header table
uint16_t section_header_names_idx; // offset 62: index of the entry in the section header table that contains the section names
} elf64; // size == 64
} u;
} elf_header_t;
END_OF_PACKED_STRUCT () // restore default alignment
// Executable and Linkable Format program header structure type definition
START_OF_PACKED_STRUCT () // we need byte-alignment for this struct
typedef PACKED (struct) elf_program_header_s
{
PACKED (union)
{
PACKED (struct)
{
uint32_t segment_type; // offset 0: type of segment (0: unused table entry, 1: loadable, 2: dynamic linking information, 3: interpreter information, 4: auxiliary information, 5: reserved, 6: this very segment, 7: TLS template)
} elf;
PACKED (struct) // size == 32
{
uint32_t segment_type; // offset 0: type of segment (0: unused table entry, 1: loadable, 2: dynamic linking information, 3: interpreter information, 4: auxiliary information, 5: reserved, 6: this very segment, 7: TLS template)
uint32_t file_offset; // offset 4: file offset of this segment
uint32_t virtual_addr; // offset 8: virtual address where this segment should be mapped in memory
uint32_t physical_addr; // offset 12: on systems where this is relevant, PHYSICAL address where this segment should be mapped in memory
uint32_t size_in_file; // offset 16: size of this segment in the ELF file (may be zero)
uint32_t size_in_memory; // offset 20: size of this segment in memory (may be zero)
uint32_t segment_flags; // offset 24: bitmap of segment flags (1: executable, 2: writable, 4: readable)
uint32_t alignment; // offset 28: memory alignment (0 or 1 mean non alignment, else must be a power of 2 where virtual_addr == file_offset % alignment)
} elf32; // size == 32
PACKED (struct) // size == 56
{
uint32_t segment_type; // offset 0: type of segment (0: unused table entry, 1: loadable, 2: dynamic linking information, 3: interpreter information, 4: auxiliary information, 5: reserved, 6: this very segment, 7: TLS template)
uint32_t segment_flags; // offset 4: bitmap of segment flags (1: executable, 2: writable, 4: readable)
uint64_t file_offset; // offset 8: file offset of this segment
uint64_t virtual_addr; // offset 16: virtual address where this segment should be mapped in memory
uint64_t physical_addr; // offset 24: on systems where this is relevant, PHYSICAL address where this segment should be mapped in memory
uint64_t size_in_file; // offset 32: size of this segment in the ELF file (may be zero)
uint64_t size_in_memory; // offset 40: size of this segment in memory (may be zero)
uint64_t alignment; // offset 48: memory alignment (0 or 1 mean non alignment, else must be a power of 2 where virtual_addr == file_offset % alignment)
} elf64; // size == 56
} u;
} elf_program_header_t;
END_OF_PACKED_STRUCT () // restore default alignment
// Executable and Linkable Format section header structure type definition
START_OF_PACKED_STRUCT () // we need byte-alignment for this struct
typedef PACKED (struct) elf_section_header_s
{
PACKED (union)
{
PACKED (struct)
{
uint32_t name_offset; // offset 0: offset in the string table of the name of this section
uint32_t type; // offset 4: section type (0: unused, 1: program data, 2: symbols table, 3: strings table, 4: relocs with addends, 5: symbols hash table, 6: dyld info, 7: notes, 8: BSS, 9: relocs without addends, 11: dyld symbols table, 14: constructors, 15: destructors, 16, preconstructors, 17: group, 18: extended section indices, 19: number of typedefs ...)
} elf;
PACKED (struct) // size == 40
{
uint32_t name_offset; // offset 0: offset in the string table of the name of this section
uint32_t type; // offset 4: section type (0: unused, 1: program data, 2: symbols table, 3: strings table, 4: relocs with addends, 5: symbols hash table, 6: dyld info, 7: notes, 8: BSS, 9: relocs without addends, 11: dyld symbols table, 14: constructors, 15: destructors, 16, preconstructors, 17: group, 18: extended section indices, 19: number of typedefs ...)
uint32_t flags; // offset 8: bitmapped flags (1: writable, 2: takes RAM, 4: executable, 8: reserved, 16: mergeable, 32: contains C-strings, 64: sh_info contains SHT index, 128: preserve order, 256: OS-specific, 512: group member, 1024: TLS template ...)
uint32_t virtual_addr; // offset 12: address in virtual memory where this section may be loaded
uint32_t file_offset; // offset 16: offset of this section in the ELF file
uint32_t size; // offset 20: size of this section
uint32_t linked_index; // offset 24: optional section index of an associated section
uint32_t info; // offset 28: optional extra information
uint32_t alignment; // offset 32: required memory alignment (must be a power of 2)
uint32_t entry_size; // offset 36: for table-like sections, size of an element in the table
} elf32; // size == 40
PACKED (struct) // size == 64
{
uint32_t name_offset; // offset 0: offset in the string table of the name of this section
uint32_t type; // offset 4: section type (0: unused, 1: program data, 2: symbols table, 3: strings table, 4: relocs with addends, 5: symbols hash table, 6: dyld info, 7: notes, 8: BSS, 9: relocs without addends, 11: dyld symbols table, 14: constructors, 15: destructors, 16, preconstructors, 17: group, 18: extended section indices, 19: number of typedefs ...)
uint64_t flags; // offset 8: bitmapped flags (1: writable, 2: takes RAM, 4: executable, 8: reserved, 16: mergeable, 32: contains C-strings, 64: sh_info contains SHT index, 128: preserve order, 256: OS-specific, 512: group member, 1024: TLS template ...)
uint64_t virtual_addr; // offset 16: address in virtual memory where this section may be loaded
uint64_t file_offset; // offset 24: offset of this section in the ELF file
uint64_t size; // offset 32: size of this section
uint32_t linked_index; // offset 40: optional section index of an associated section
uint32_t info; // offset 44: optional extra information
uint64_t alignment; // offset 48: required memory alignment (must be a power of 2)
uint64_t entry_size; // offset 56: for table-like sections, size of an element in the table
} elf64; // size == 64
} u;
} elf_section_header_t;
END_OF_PACKED_STRUCT () // restore default alignment
// Executable and Linkable Format dynamic section entry structure type definition
START_OF_PACKED_STRUCT () // we need byte-alignment for this struct
typedef PACKED (struct) elf_dynamic_section_entry_s
{
PACKED (union)
{
PACKED (struct) // size == 8
{
int32_t tag; // dynamic entry type (one of ELF_DT_xxx #defines)
uint32_t value; // value (as integer, or as pointed address)
} elf32; // size == 8
PACKED (struct) // size == 16
{
int64_t tag; // dynamic entry type (one of ELF_DT_xxx #defines)
uint64_t value; // value (as integer, or as pointed address)
} elf64; // size == 16
} u;
} elf_dynamic_section_entry_t;
END_OF_PACKED_STRUCT () // restore default alignment
static inline elf_section_header_t *elf_get_section_header_by_name (const elf_header_t *elf, const char *section_name)
{
// convenience helper function that returns a pointer to a section header by its associated name stored in the section headers strings table
elf_section_header_t *shdr_shstrtab; // section header of the section header strings table
elf_section_header_t *shdr;
size_t table_count;
size_t table_index;
char *shstrtab; // section header strings table
char *name;
shdr_shstrtab = (elf_section_header_t *) ((uint8_t *) elf + ELF_GET_NUMERIC (elf, elf, section_header_table_offset) + (size_t) ELF_GET_NUMERIC (elf, elf, section_header_item_size) * ELF_GET_NUMERIC (elf, elf, section_header_names_idx)); // quick access to section header for the section that contains the section names
shstrtab = ((uint8_t *) elf + ELF_GET_NUMERIC (elf, shdr_shstrtab, file_offset)); // locate the start of the strings table that contains the section names
// cycle through the sections table
table_count = ELF_GET_NUMERIC (elf, elf, section_header_table_len);
for (table_index = 0; table_index < table_count; table_index++)
{
shdr = (elf_section_header_t *) ((uint8_t *) elf + ELF_GET_NUMERIC (elf, elf, section_header_table_offset) + (size_t) ELF_GET_NUMERIC (elf, elf, section_header_item_size) * table_index); // quick access to section header
name = &shstrtab[ELF_GET_NUMERIC (elf, shdr, name_offset)]; // peek at its name
if (strcmp (name, section_name) == 0)
return (shdr); // if found, return a pointer to this section header
}
return (NULL); // section not found
}
// undefine the helpers we no longer need
#undef START_OF_PACKED_STRUCT
#undef END_OF_PACKED_STRUCT
#undef PACKED
#ifdef __cplusplus
}
#endif
#endif // ELFFILE_H