konrad-kruczynski / elfsharp Goto Github PK

Konrad,
Thank you , this certainly is an excellent library!
I use it to parse and upload elf files to an ARM processor.
Can you make the "filesize" of the “Segment” class public? There is no need to program a segment of zero file size because it usually gets initialized by the boot code.
Thank you,
Natie.

Apparently this is at least acceptable.

When loading a ELF file during ReadSections(), FindStringTables() sets dynamicStringTable to null. Then during the loop performing TouchSection, GetSectionFromSectionHeader() there is a case where header.Type is SectionType.DynamicSymbolTable.

The null dynamicStringTable is passed to new SymbolTable<T>(header, readerSource, dynamicStringTable, this) and then during ReadSymbols() tries to access it as table on line var name = table[nameIdx];. This blows up.

This happens during TouchSection for i == 9 in the linked ELF.

Use strip --strip-all.

It does not make any sense now.

Also version assemblies according to this article: https://codingforsmarties.wordpress.com/2016/01/21/how-to-version-assemblies-destined-for-nuget/

At the moment, one cannot access the section header via API. If I want to get, for example, the file offset of a Section, I currently have to use reflection to get that:

foreach (PropertyInfo property in typeof(Section<long>).GetProperties(BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public))
{
    if (property.Name == "Header")
    {
        foreach (PropertyInfo p in property.GetValue(s).GetType().GetProperties(BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public))
        {
            if (p.Name == "Offset")
            {
                FileOffset = (long)p.GetValue(property.GetValue(s));
            }
        }
    }
}

This just doesn't feel right.

Just as it was done for ELF. Test infrastructure can then be simplified.

It would be great if you could add a strong-named assembly to the NuGet release of the library. That way ELFSharp could be referenced in projects that are themselves strong-named.

Hi. Cannot find way to get number of sections and segments count. Looks like they are stored in sectionHeaderEntryCount and segmentHeaderEntryCount, but fields are private and have no getters. Is there another way to get info? If no, suggesting to add public getter to all data from global elf header =)

Hello,
I'm trying to use ELFSharp to load program binaries for an instruction set simulator. However, part of the program loading sequence involves loading the raw program header data into memory. I see that there are methods to access program header information, but there doesn't seem to be any which allow you to access the data directly. Is this currently possible with ELFSharp? If not, is this something which might be added in the future?

Thanks!

Hi,

I created a dummy program in c that uses the following command line:

gcc -Wall hello.c -o hello -gdwarf

With that, it generated the hello file + a folder called hello.dSYM.
So, with that, how can I load that and read using ELFSharp?

Thank you!

Is there any way to access the properties of e.g Section Header like Start Address/Size like how the Section.ToString() method prints out the following:

text: ProgBits, load @0x3A02C0, 39796240 bytes long

So that one can access it by the following: mySection.Address, mySection.Size

Currently I am splitting this string manually and it is unwieldy.

It'd be useful for a project I'm working on that consumes ELFSharp (BinSkim -- https://github.com/Microsoft/binskim ) if ELFSharp could parse the Dynamic section of an ELF binary--we need to check some parts of that section in order to implement a check.

If you'd like, I can put together a PR with an implementation and send it over.

Method for testing if a given binary is proper ELF would be nice.

As documented here, the byte after info, referenced at https://github.com/konrad-kruczynski/elfsharp/blob/master/ELFSharp/ELF/Sections/SymbolTable.cs#L44 contains information about the visibility of the symbol. I would like to see that information exposed in the public API.

Hi,

I have been trying to read a mach-o binary.

Looking at the tests, I got the segments, for example, and I understood how to fetch the data inside it.
But there are things that I couldn't locate:

• is it possible to retrieve the command line?
• is it safe for every segment I use GetData() and from the byte[] convert to string like below? I'm asking this because for some Segments I receive some strange characters.

byte[] data = segment.GetData();
string text = Encoding.ASCII.GetString(data);

Just to let you know, I generated a sample using the following command in a Mac:

gcc -Wall -O2 hello.c -g -o hello
gcc -Wall -O2 hello.c -g -dwarf-5 -o hello5

thank you!

Hi konrad, I just tried to download and use the current version of your ElfShap library, but when I try to open a valid ELF I get the error "Given ELF file is of unknown version 16777216."

I know that there are different version of ELF / DWARF so maybe this is an issue. Unfortunately I cannot provide you the ELF file, but if you give me some indications I would be happy to help.

I would need an ELFWriter to load, modify and save elf files. I'm a little bit thinking of implementing it but it only works out if the ELFWriter actually reads out everything, otherwise it's not possible to get same output. Can anybody comment the completeness of the reader? Or does anybody have some ideas about writer?

It would be great if you would implement a way to explore dwarf information within the .debug sections.

If the FileSize of a segment is smaller than its Size, the part of the data that is not in the ELF should be filled up with zeroes, I think.

Steps to reproduce:

1. Create an ELF file with a segment that has a FileSize smaller than Size.
2. Call GetFileContents() and GetMemoryContents() on this segment.

Expected result:
Let's assume the FileSize is 4 and the Size is 8. Then GetFileContents() should return something like
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ }
where 0xZZ is any number
and GetMemoryContents() should return something like
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ, 0x00, 0x00, 0x00, 0x00 }

Actual result:
GetFileContents() returns
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ }
GetMemoryContents() returns
new byte[] { 0xZZ, 0xZZ, 0xZZ, 0xZZ, 0xGG, 0xGG, 0xGG, 0xGG }
where 0xGG are random numbers

Version I used: 2.1.0

The magic is 0xCAFEBABE.

I am trying to extract information regarding the target platform from the ELF file. Architecture, Endianess and EntryPoint are all easy to grab. But what about pointer size?

E.g Class only takes values Bit32 or Bit64, so I assume that isn't it since it doesn't cover 16 bit architectures.

It is not available for the .NET Standard 2.0 and ELFSharp only uses some pieces out of the whole library, so it would be nice to actually implement the necessary functionality directly.

Hi everyone,
I am trying to figure out how to get the file offset of a segment in an ELF. I observe that the field offset in Segment has private attribute, so the only way to get offset is to parse again the header of this segment? Is there some reason to make offset as private?
Many thanks.

The cast in the below line sometimes throws.

I worked around the issue by putting it in a try catch block.

I found the issue when trying to load libcoreclr.so.dbg from .NET Core SDK 3.1.100-preview2.

If you want the binary follow the install instructions from https://dotnet.microsoft.com/download/dotnet-core/3.1. Installing https://dotnet.microsoft.com/download/dotnet-core/thank-you/sdk-3.1.100-preview2-linux-x64-binaries

run

$ #install the dotnet symbol tool
$ dotnet tool install dotnet-symbol --global
$ #find the 3.1.100-preview2 runtime
$ dotnet --info | grep Microsoft.NETCore.App
  Microsoft.NETCore.App 2.1.13 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.7 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.0.0 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.0-preview2.19525.6 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
$ # Download libcoreclr.so.dbg with symbols
$ dotnet-symbol /usr/share/dotnet/shared/Microsoft.NETCore.App/3.1.0-preview2.19525.6/libcoreclr.so -o .
Downloading from http://msdl.microsoft.com/download/symbols/
Writing files to .
Writing: ./libcoreclr.so
Writing: ./libcoreclr.so.dbg
Writing: ./libmscordaccore.so
Writing: ./libmscordbi.so
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/libsos.so/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/libsos.so'
ERROR: HttpSymbolStore: 404 Not Found 'http://msdl.microsoft.com/download/symbols/sos.netcore.dll/elf-buildid-coreclr-fb968d23ab1fce2659bfc2f13064a45716fc2712/sos.netcore.dll'

Please enhance the "enum Machine" with these Architectures:
6 Intel 80486
36 Renesas V800 series
37 Fujitsu FR
40 ARM
42 Hitachi SH
44 Infineon TriCore
52 Motorola ColdFire
54 Motorola MCore
58 Motorola StarCore
60 STMicroelectronics ST100
78 Broadcom FirePath
88 Renesas M32R
106 ADI Blackfin

Thanks!

I'm running an application which only has the ELFs in memory, but not on disk, and I cannot guarantee that I can write to disk at all. It would be super helpful if there was an ELFReader.Load variant which accepts a Stream instead of the filename of the string.

Additionally, this would also simplify the unit tests in this library itself instead of having to write temporary files.

For the beginning:

• listing symbols (for shared objects)
• entry point
• segments to load

Trying out a simple example, using VS Express 2015 and targeting .NET 4.5:

using ELFSharp.ELF;
using ELFSharp.ELF.Sections;
using System;
using System.ComponentModel;
using System.Data;
using System.Linq;
using System.Windows.Forms;

...

var elf = ELFReader.Load(elfFile);
var symbols = ((ISymbolTable)elf.GetSection(".symtab")).Entries.Where(x => x.Type == SymbolType.Object);

But I can't seem to get past this weird "call is ambiguous". The calls look identical to me.

Severity Code Description Project File Line Suppression State
Error CS0121 The call is ambiguous between the following methods or properties: 'System.Linq.Enumerable.Where(System.Collections.Generic.IEnumerable, System.Func<TSource, bool>)' and 'System.Linq.Enumerable.Where(System.Collections.Generic.IEnumerable, System.Func<TSource, bool>)' Elf-Parser C:\dev\Elf-Parser\Form1.cs 30 Active

Any idea on what this could be?

Hey:

It looks like due to an issue with NuGetizer (NuGet/Home#6270), the entire netstandard set of libraries is included in the NuGet package. This isn't an issue if you're consuming the library via .NET Core, but it will cause numerous build conflicts with the standard libraries if you try to consume the library in .NET 4.6.1 (which should be possible).

It should be possible to build the NuGet package from the CSProj file without NuGetizer via dotnet pack ELFSharp.csproj (see: https://docs.microsoft.com/en-us/dotnet/core/tools/dotnet-pack?tabs=netcore2x), which seems to avoid including all of the dependencies and removes the dependency on a nonstandard tool, and seems to correctly version/set authors/etc.

--Everett Maus