Skip to content

eklitzke/parse-elf

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Parse ELF

This is some really bad code that can decode ELF symbol tables on x86-64 Linux tables. Actually there is nothing specific to Linux or x86-64 here you could probably delete those checks and be fine.

You should be able to do something like this on a Debian or Ubuntu system (which statically builds in the Python symbols):

$ make
$ ./parse_elf $(which python)

And then see a bunch of symbols that look like Python symbols, e.g. PyObject_Malloc should be somewhere in the output.

Or choose your other favorite binary; this should work on that too, as long as the ELF file has a .dynstr section and a .dynsym section.

This code is not super well written, but I found it pretty difficult to understand the offsets as specified in the elf(5) man page, so hopefully this will help anyone else trying to understand the string table offsets used to decode symbols.

I personally am using this code as the basis of decoding statically compiled symbols into a binary, but it should be straightforward to extend this code to work with true dynamic relocations.

About

An example of how to parse an ELF symbol table.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published