Functions for parsing and printing ELF file metadata. More...

#include "b_elf_metadata.h"
#include "../b_hashmap/b_hashmap.h"
#include <elf.h>
#include <string.h>

Functions
void	dump_elf32hdr (Elf32_Ehdr *elf)
	Dump the ELF header information for a 32-bit ELF file.
void	dump_elf64hdr (Elf64_Ehdr *elf)
	Dump the ELF header information for a 64-bit ELF file.
void	dump_elf32_shdr (Elf32_Ehdr elf, Elf32_Shdr shdrs, bparser *parser)
	Dump the section header table of a 32-bit ELF file.
void	dump_elf64_shdr (Elf64_Ehdr elf, Elf64_Shdr shdrs, bparser *parser)
	Dump the section header table of a 64-bit ELF file.
void	dump_elf32_phdr (Elf32_Ehdr elf, Elf32_Phdr phdr, bparser *parser)
	Dump the program header table of a 32-bit ELF file.
void	dump_elf64_phdr (Elf64_Ehdr elf, Elf64_Phdr phdr, bparser *parser)
	Dump the program header table of a 64-bit ELF file.
bool	print_meta_data (bparser parser, void args)
	Print high-level metadata of an ELF file and dispatch detailed dump functions.

Detailed Description

Functions for parsing and printing ELF file metadata.

This module provides utilities to extract and display metadata from ELF binaries. It determines the ELF class (32-bit or 64-bit), endianness, and dispatches specialized functions to dump headers:

ELF headers
Section headers
Program headers

The output is formatted with colors for readability.

Note

This file depends on:

bparser for memory access
ELF structures (Elf32_Ehdr, Elf32_Phdr, Elf32_Shdr, etc.)
Helper functions like dump_elf32hdr(), dump_elf64hdr(), dump_elf32_shdr(), dump_elf64_shdr(), dump_elf32_phdr(), dump_elf64_phdr()

Function Documentation

◆ dump_elf32_phdr()

void dump_elf32_phdr	(	Elf32_Ehdr *	elf,
		Elf32_Phdr *	phdr,
		bparser *	parser )

Dump the program header table of a 32-bit ELF file.

This function iterates over the program headers of a 32-bit ELF file and prints metadata and raw contents for each segment.

Printed metadata includes:

Program header type (human-readable and numeric)
Flags (R/W/X)
Offset
Virtual and physical addresses
File size, memory size, and alignment

Special cases:

If the segment type is PT_INTERP, the interpreter path is printed.
If the segment type is PT_DYNAMIC, it indicates the binary is dynamically linked.

Raw segment bytes:

If a segment has file size > 0, its raw bytes are read from the ELF file using bparser_read and printed in hexadecimal format.

Parameters

elf	Pointer to the ELF header (Elf32_Ehdr).
phdr	Pointer to the program header table (array of Elf32_Phdr).
parser	Pointer to a bparser structure that provides access to the file data.

Note: Output is color formatted and written to standard output.

See also: dump_elf64_phdr()

◆ dump_elf32_shdr()

void dump_elf32_shdr	(	Elf32_Ehdr *	elf,
		Elf32_Shdr *	shdrs,
		bparser *	parser )

Dump the section header table of a 32-bit ELF file.

This function iterates over the section headers of a 32-bit ELF file and prints human-readable information for each section.

Printed metadata includes:

Section index (ID)
Section name (resolved from the section string table)
Section type (as string and numeric)
Flags (W/A/X)
Virtual address, file offset, and section size
Link, Info, Alignment, and Entry size

Raw section bytes:

If a section has size > 0, its contents are read from the ELF file using bparser_read and printed in hexadecimal format.

Parameters

elf	Pointer to the ELF header (Elf32_Ehdr).
shdrs	Pointer to the section header table (array of Elf32_Shdr).
parser	Pointer to a bparser structure that provides access to the file data.

Note: Output is color formatted and written to standard output.

See also: dump_elf64_shdr()

◆ dump_elf32hdr()

void dump_elf32hdr ( Elf32_Ehdr * elf )

Dump the ELF header information for a 32-bit ELF file.

This function prints human-readable information about the provided 32-bit ELF header, including:

The ELF class (32-bit)
Entry point address
Program header count and offset
Section header count and offset
Section header string table index
File type and machine type (both as strings and raw values)

Parameters

elf	Pointer to an Elf32_Ehdr structure representing the ELF header.

Note: The output is printed to standard output with color formatting.

See also: dump_elf64hdr()

◆ dump_elf64_phdr()

void dump_elf64_phdr	(	Elf64_Ehdr *	elf,
		Elf64_Phdr *	phdr,
		bparser *	parser )

Dump the program header table of a 64-bit ELF file.

This function iterates over the program headers of a 64-bit ELF file and prints metadata and raw contents for each segment.

Printed metadata includes:

Program header type (human-readable and numeric)
Flags (R/W/X)
Offset
Virtual and physical addresses
File size, memory size, and alignment

Special cases:

If the segment type is PT_INTERP, the interpreter path is printed.
If the segment type is PT_DYNAMIC, it indicates the binary is dynamically linked.

Raw segment bytes:

If a segment has file size > 0, its raw bytes are read from the ELF file using bparser_read and printed in hexadecimal format.

Parameters

elf	Pointer to the ELF header (Elf64_Ehdr).
phdr	Pointer to the program header table (array of Elf64_Phdr).
parser	Pointer to a bparser structure that provides access to the file data.

Note: Output is color formatted and written to standard output.

See also: dump_elf32_phdr()

◆ dump_elf64_shdr()

void dump_elf64_shdr	(	Elf64_Ehdr *	elf,
		Elf64_Shdr *	shdrs,
		bparser *	parser )

Dump the section header table of a 64-bit ELF file.

This function iterates over the section headers of a 64-bit ELF file and prints human-readable information for each section.

Printed metadata includes:

Section index (ID)
Section name (resolved from the section string table)
Section type (as string and numeric)
Flags (W/A/X)
Virtual address, file offset, and section size
Link, Info, Alignment, and Entry size

Raw section bytes:

If a section has size > 0, its contents are read from the ELF file using bparser_read and printed in hexadecimal format.

Parameters

elf	Pointer to the ELF header (Elf64_Ehdr).
shdrs	Pointer to the section header table (array of Elf64_Shdr).
parser	Pointer to a bparser structure that provides access to the file data.

Note: Output is color formatted and written to standard output.

See also: dump_elf32_shdr()

◆ dump_elf64hdr()

void dump_elf64hdr ( Elf64_Ehdr * elf )

Dump the ELF header information for a 64-bit ELF file.

This function prints human-readable information about the provided 64-bit ELF header, including:

The ELF class (64-bit)
Entry point address
Program header count and offset
Section header count and offset
Section header string table index
File type and machine type (both as strings and raw values)

Parameters

elf	Pointer to an Elf64_Ehdr structure representing the ELF header.

Note: The output is printed to standard output with color formatting.

See also: dump_elf32hdr()

◆ print_meta_data()

bool print_meta_data	(	bparser *	parser,
		void *	args )

Print high-level metadata of an ELF file and dispatch detailed dump functions.

This function reads the ELF identification bytes from the parser source memory to determine:

Endianness (Little Endian, Big Endian, or Unknown)
ELF class (32-bit or 64-bit)

Based on the ELF class, it parses the ELF header, program headers, and section headers, then calls the corresponding dump functions:

For 32-bit ELF: dump_elf32hdr(), dump_elf32_shdr(), dump_elf32_phdr()
For 64-bit ELF: dump_elf64hdr(), dump_elf64_shdr(), dump_elf64_phdr()

Parameters

parser	Pointer to a bparser structure containing the ELF file in memory.
args	Optional arguments (currently unused).

Returns: true if the ELF class was recognized and processed (32-bit or 64-bit), false otherwise (invalid or unknown ELF class).

Note: Output is color formatted and written to standard output.

See also: dump_elf32hdr(), dump_elf32_shdr(), dump_elf32_phdr(), dump_elf64hdr(), dump_elf64_shdr(), dump_elf64_phdr()