python3 elf文件解析
原地址：https://github.com/guanchao/elfParser
作者是用python2写的，现在给出我修改后的python3版本。（测试发现有bug，以后自己写个，0.0）
1 #!/usr/bin/env python
2 # coding:utf-8
3
4 import sys
5 import binascii
6
7 '''
8 # 节区类型定义
9 /* sh_type */
10 #define SHT_NULL 0
11 #define SHT_PROGBITS 1
12 #define SHT_SYMTAB 2
13 #define SHT_STRTAB 3
14 #define SHT_RELA 4
15 #define SHT_HASH 5
16 #define SHT_DYNAMIC 6
17 #define SHT_NOTE 7
18 #define SHT_NOBITS 8
19 #define SHT_REL 9
20 #define SHT_SHLIB 10
21 #define SHT_DYNSYM 11
22 #define SHT_NUM 12
23 #define SHT_LOPROC 0x70000000
24 #define SHT_HIPROC 0x7fffffff
25 #define SHT_LOUSER 0x80000000
26 #define SHT_HIUSER 0xffffffff
27 #define SHT_MIPS_LIST 0x70000000
28 #define SHT_MIPS_CONFLICT 0x70000002
29 #define SHT_MIPS_GPTAB 0x70000003
30 #define SHT_MIPS_UCODE 0x70000004
31 '''
32 SH_TYPE_MAP_LIST = {0: 'SHT_NULL',
33 1: 'SHT_PROGBITS',
34 2: 'SHT_SYMTAB',
35 3: 'SHT_STRTAB',
36 4: 'SHT_RELA',
37 5: 'SHT_HASH',
38 6: 'SHT_DYNAMIC',
39 7: 'SHT_NOTE',
40 8: 'SHT_NOBITS',
41 9: 'SHT_REL',
42 10: 'SHT_SHLIB',
43 11: 'SHT_DYNSYM',
44 # 0x60000000:'SHT_LOOS',
45 # 0x6fffffff:'SHT_HIOS',
46 0x70000000: 'SHT_LOPROC',
47 0x7FFFFFFF: 'SHT_HIPROC',
48 0x80000000: 'SHT_LOUSER',
49 0x8FFFFFFF: 'SHT_HIUSER',
50 0x70000000: 'SHT_MIPS_LIST',
51 0x70000002: 'SHT_MIPS_CONFLICT',
52 0x70000003: 'SHT_MIPS_GPTAB',
53 0x70000004: 'SHT_MIPS_UCODE',
54 }
55
56 PT_TYPE_MAP_LIST = {
57 0: 'NULL',
58 1: 'LOAD',
59 2: 'DYNAMIC',
60 3: 'INTERP',
61 4: 'NOTE',
62 5: 'SHLIB',
63 6: 'PHDR',
64 7: 'TLS',
65 0x70000000: 'LOPROC',
66 0x70000001: 'HIPROC',
67 0x6474E551: 'GNU_STACK',
68 0x6474E552: 'GNU_RELRO',
69 }
70
71 '''
72 Elf32_Dyn.d_tag
73 '''
74 DYNAMIC_TYPE = {
75 0: 'NULL',
76 1: 'NEEDED',
77 2: 'PLTRELSZ',
78 3: 'PLTGOT',
79 4: 'HASH',
80 5: 'STRTAB',
81 6: 'SYMTAB',
82 7: 'RELA',
83 8: 'RELASZ',
84 9: 'RELAENT',
85 10: 'STRSZ',
86 11: 'SYMENT',
87 12: 'INIT',
88 13: 'FINIT',
89 14: 'SONAME',
90 15: 'RPATH',
91 16: 'SYMBOLIC',
92 17: 'REL',
93 18: 'RELSZ',
94 19: 'RELENT',
95 20: 'PLTREL',
96 21: 'DEBUG',
97 22: 'TEXTREL',
98 23: 'JMPREL',
99 26: 'FINIT_ARRAY',
100 28: 'FINIT_ARRAYSZ',
101 25: 'INIT_ARRAY',
102 27: 'INIT_ARRAYSZ',
103 30: 'FLAGS',
104 0x6FFFFFFA: 'RELCOUNT',
105 0x6FFFFFFB: 'FLAGS_1',
106 0x70000000: 'LOPROC',
107 0x7fffffff: 'HIPROC',
108 0x70000001: 'MIPS_RLD_VERSION',
109 0x70000002: 'MIPS_TIME_STAMP',
110 0x70000003: 'MIPS_ICHECKSUM',
111 0x70000004: 'MIPS_IVERSION',
112 0x70000005: 'MIPS_FLAGS',
113 0x70000006: 'MIPS_BASE_ADDRESS',
114 0x70000008: 'MIPS_CONFLICT',
115 0x70000009: 'MIPS_LIBLIST',
116 0x7000000a: 'MIPS_LOCAL_GOTNO',
117 0x7000000b: 'MIPS_CONFLICTNO',
118 0x70000010: 'MIPS_LIBLISTNO',
119 0x70000011: 'MIPS_SYMTABNO',
120 0x70000012: 'MIPS_UNREFEXTNO',
121 0x70000013: 'MIPS_GOTSYM',
122 0x70000014: 'MIPS_HIPAGENO',
123 0x70000016: 'MIPS_RLD_MAP',
124
125 }
126 '''
127 typedef struct elf32_hdr{
128 unsigned char e_ident[EI_NIDENT];
129 Elf32_Half e_type;
130 Elf32_Half e_machine;
131 Elf32_Word e_version;
132 Elf32_Addr e_entry; /* Entry point */
133 Elf32_Off e_phoff;
134 Elf32_Off e_shoff;
135 Elf32_Word e_flags;
136 Elf32_Half e_ehsize;
137 Elf32_Half e_phentsize;
138 Elf32_Half e_phnum;
139 Elf32_Half e_shentsize;
140 Elf32_Half e_shnum;
141 Elf32_Half e_shstrndx;
142 } Elf32_Ehdr;
143 '''
144
145
146 class Elf32_Ehdr(object):
147 """docstring for Elf32_Ehdr"""
148
149 def __init__(self):
150 super(Elf32_Ehdr, self).__init__()
151 self.e_ident = None
152 self.e_type = None
153 self.e_machine = None
154 self.e_version = None
155 self.e_entry = None
156 self.e_phoff = None
157 self.e_shoff = None
158 self.e_flags = None
159 self.e_ehsize = None
160 self.e_phentsize = None
161 self.e_phnum = None
162 self.e_shentsize = None
163 self.e_shnum = None
164 self.e_shstrndx = None
165
166
167 class e_ident(object):
168 """docstring for e_ident"""
169
170 def __init__(self):
171 super(e_ident, self).__init__()
172 self.file_identification = None
173 self.ei_class = None
174 self.ei_data = None
175 self.ei_version = None
176 self.ei_osabi = None
177 self.ei_abiversion = None
178 self.ei_pad = None
179 self.ei_nident = None
180
181 def __str__(self):
182 return 'e_ident=[file_identification=%s, ei_class=%d, ei_data=%d, ei_version=%d, ei_osabi=%d, ei_abiversion=%d, ei_pad=%s, ei_nident=%d]' % (
183 self.file_identification, self.ei_class, self.ei_data, self.ei_version, self.ei_osabi, self.ei_abiversion,
184 self.ei_pad, self.ei_nident)
185
186
187 class Elf32_Shdr(object):
188 """docstring for Elf32_Shdr"""
189
190 def __init__(self):
191 super(Elf32_Shdr, self).__init__()
192 '''
193 typedef struct Elf32_Shdr {
194 Elf32_Word sh_name;
195 Elf32_Word sh_type;
196 Elf32_Word sh_flags;
197 Elf32_Addr sh_addr;
198 Elf32_Off sh_offset;
199 Elf32_Word sh_size;
200 Elf32_Word sh_link;
201 Elf32_Word sh_info;
202 Elf32_Word sh_addralign;
203 Elf32_Word sh_entsize;
204 } Elf32_Shdr;
205 '''
206 self.sh_name = None
207 self.sh_type = None
208 self.sh_flags = None
209 self.sh_addr = None
210 self.sh_offset = None
211 self.size = None
212 self.sh_link = None
213 self.sh_addralign = None
214 self.sh_entsize = None
215
216 self.section_name = None
217
218 def __str__(self):
219 return 'Elf32_Shdr=[sh_name=%s, sh_type=%d, sh_flags=%d, sh_addr=%s, sh_sh_offset=%s, sh_size=%d, sh_link=%d, sh_info=%d, sh_addralign=%d, sh_entsize=%d]' % \
220 (hex(self.sh_name), self.sh_type, self.sh_flags, hex(self.sh_addr), hex(self.sh_offset), self.sh_size,
221 self.sh_link, self.sh_info, self.sh_addralign, self.sh_entsize)
222
223
224 class Elf32_Sym(object):
225 """docstring for Elf32_Sym"""
226
227 def __init__(self):
228 super(Elf32_Sym, self).__init__()
229 '''
230 typedef struct elf32_sym{
231 Elf32_Word st_name;
232 Elf32_Addr st_value;
233 Elf32_Word st_size;
234 unsigned char st_info;
235 unsigned char st_other;
236 Elf32_Half st_shndx;
237 } Elf32_Sym;
238 '''
239 self.st_name = None
240 self.st_value = None
241 self.st_size = None
242 self.st_info = None
243 self.st_other = None
244 self.st_shndx = None
245
246 self.symbol_name = None
247
248 def __str__(self):
249 return 'Elf32_Dyn=[st_name=%s, st_value=%d, st_size=%d, st_info=%d, st_other=%d, st_shndx=%d] #%s' % \
250 (self.st_name, self.st_value, self.st_size, self.st_info, self.st_other, self.st_shndx, self.symbol_name)
251
252
253 class Elf32_Phdr(object):
254 """docstring for Elf32_Phdr"""
255
256 def __init__(self):
257 super(Elf32_Phdr, self).__init__()
258 '''
259 /* 32-bit ELF base types. */
260 typedef uint32_t Elf32_Addr;
261 typedef uint16_t Elf32_Half;
262 typedef uint32_t Elf32_Off;
263 typedef int32_t Elf32_Sword;
264 typedef uint32_t Elf32_Word;
265 '''
266 self.p_type = None # Elf32_Word
267 self.p_offset = None # Elf32_Off
268 self.p_vaddr = None # Elf32_Addr
269 self.p_paddr = None # Elf32_Addr
270 self.p_filesz = None # Elf32_word
271 self.p_memsz = None # Elf32_Word
272 self.p_flags = None # Elf32_Word
273 self.p_align = None # Elf32_Word
274
275
276 class Elf32_Dyn(object):
277 """docstring for Elf32_dyn"""
278
279 def __init__(self):
280 super(Elf32_Dyn, self).__init__()
281 '''
282 typedef struct dynamic{
283 Elf32_Sword d_tag;
284 union{
285 Elf32_Sword d_val;
286 Elf32_Addr d_ptr;
287 } d_un;
288 } Elf32_Dyn;
289 '''
290 self.d_tag = None
291 self.d_un = None
292
293 def __str__(self):
294 return 'Elf32_Dyn=[d_tag=%d, d_un=%d]' % \
295 (self.d_tag, self.d_un)
296
297
298 class ELF(object):
299 """docstring for ELF"""
300
301 def __init__(self, filepath):
302 super(ELF, self).__init__()
303 self.filepath = filepath
304 self.elf32_Ehdr = Elf32_Ehdr()
305
306 # section header table
307 self.sectionHeaderTable = []
308
309 # section name table
310 self.sectionNameTable = None
311
312 # program header table
313 self.programHeaderTable = []
314
315 # dynamic symbol table
316 self.symbolTable = [] # .dynsym
317 self.dynstrTable = None # .dynstr
318
319 # dynamic link table
320 self.dynamicLinkTable = [] # .dynamic
321
322 self.initELFHeader()
323 self.initSectionHeader()
324 self.initProgramHeader()
325 self.initSymbolTalbe()
326 self.initDynamicLinkTable()
327
328 def initELFHeader(self):
329 f = open(self.filepath, "rb")
330 self.f = f
331 # unsigned char e_ident[EI_NIDENT];
332 f.seek(0, 0)
333 self.elf32_Ehdr.e_ident = e_ident()
334 self.elf32_Ehdr.e_ident.file_identification = f.read(4)
335 self.elf32_Ehdr.e_ident.ei_class = int.from_bytes(f.read(1), 'little')
336 self.elf32_Ehdr.e_ident.ei_data = int.from_bytes(f.read(1), 'little')
337 self.elf32_Ehdr.e_ident.ei_version = int.from_bytes(f.read(1), 'little')
338 self.elf32_Ehdr.e_ident.ei_osabi = int.from_bytes(f.read(1), 'little')
339 self.elf32_Ehdr.e_ident.ei_abiversion = int.from_bytes(f.read(1), 'little')
340 self.elf32_Ehdr.e_ident.ei_pad = binascii.b2a_hex(f.read(6))
341 self.elf32_Ehdr.e_ident.ei_nident = int.from_bytes(f.read(1), 'little')
342
343 # Elf32_Half e_type;
344 f.seek(16, 0)
345 self.elf32_Ehdr.e_type = int.from_bytes(f.read(2), 'little')
346
347 # Elf32_Half e_machine;
348 f.seek(18, 0)
349 self.elf32_Ehdr.e_machine = int.from_bytes(f.read(2), 'little')
350
351 # Elf32_Word e_version;
352 f.seek(20, 0)
353 self.elf32_Ehdr.e_version = int.from_bytes(f.read(4), 'little')
354
355 # Elf32_Addr e_entry;
356 f.seek(24, 0)
357 self.elf32_Ehdr.e_entry = int.from_bytes(f.read(4), 'little')
358
359 # Elf32_Off e_phoff;
360 f.seek(28, 0)
361 self.elf32_Ehdr.e_phoff = int.from_bytes(f.read(4), 'little')
362
363 # Elf32_Off e_shoff;
364 f.seek(32, 0)
365 self.elf32_Ehdr.e_shoff = int.from_bytes(f.read(4), 'little')
366
367 # Elf32_Word e_flags;
368 f.seek(36, 0)
369 self.elf32_Ehdr.e_flags = int.from_bytes(f.read(4), 'little')
370
371 # Elf32_Half e_ehsize;
372 f.seek(40, 0)
373 self.elf32_Ehdr.e_ehsize = int.from_bytes(f.read(2), 'little')
374
375 # Elf32_Half e_phentsize;
376 f.seek(42, 0)
377 self.elf32_Ehdr.e_phentsize = int.from_bytes(f.read(2), 'little')
378
379 # Elf32_Half e_phnum;
380 f.seek(44, 0)
381 self.elf32_Ehdr.e_phnum = int.from_bytes(f.read(2), 'little')
382
383 # Elf32_Half e_shentsize;
384 f.seek(46, 0)
385 self.elf32_Ehdr.e_shentsize = int.from_bytes(f.read(2), 'little')
386
387 # Elf32_Half e_shnum;
388 f.seek(48, 0)
389 self.elf32_Ehdr.e_shnum = int.from_bytes(f.read(2), 'little')
390
391 # Elf32_Half e_shstrndx;
392 f.seek(50, 0)
393 self.elf32_Ehdr.e_shstrndx = int.from_bytes(f.read(2), 'little')
394
395 def initSectionHeader(self):
396 # print(self.elf32_Ehdr.e_shnum)
397 for i in range(self.elf32_Ehdr.e_shnum):
398 self.sectionHeaderTable.append(self.parseSectionHeader(self.elf32_Ehdr.e_shoff + i * self.elf32_Ehdr.e_shentsize))
399 if self.elf32_Ehdr.e_shnum == 0:
400 return
401 # init section name table
402 self.f.seek(self.sectionHeaderTable[self.elf32_Ehdr.e_shstrndx].sh_offset)
403 size = self.sectionHeaderTable[self.elf32_Ehdr.e_shstrndx].sh_size
404 self.sectionNameTable = self.f.read(size)
405
406 for i in range(self.elf32_Ehdr.e_shnum):
407 idx = self.sectionHeaderTable[i].sh_name
408 name = []
409 while self.sectionNameTable[idx] != 0:
410 name.append(chr(self.sectionNameTable[idx]))
411 idx += 1
412 # print("".join(name))
413 self.sectionHeaderTable[i].section_name = "".join(name)
414
415 def parseSectionHeader(self, offset):
416 self.f.seek(offset, 0)
417 elf32_Shdr = Elf32_Shdr()
418 # elf32_Shdr.sh_name = int.from_bytes(self.f.read(4), 16)
419 elf32_Shdr.sh_name = int.from_bytes(self.f.read(4), 'little')
420 elf32_Shdr.sh_type = int.from_bytes(self.f.read(4), 'little')
421 elf32_Shdr.sh_flags = int.from_bytes(self.f.read(4), 'little')
422 elf32_Shdr.sh_addr = int.from_bytes(self.f.read(4), 'little')
423 elf32_Shdr.sh_offset = int.from_bytes(self.f.read(4), 'little')
424 elf32_Shdr.sh_size = int.from_bytes(self.f.read(4), 'little')
425 elf32_Shdr.sh_link = int.from_bytes(self.f.read(4), 'little')
426 elf32_Shdr.sh_info = int.from_bytes(self.f.read(4), 'little')
427 elf32_Shdr.sh_addralign = int.from_bytes(self.f.read(4), 'little')
428 elf32_Shdr.sh_entsize = int.from_bytes(self.f.read(4), 'little')
429 return elf32_Shdr
430
431 def displaySectionHeader(self):
432 print('[+] Section Header Table:')
433
434 print(' # %-32s%-16s%-16s%-16s%-8s%-8s%-8s%-8s%-8s%-8s' % (
435 'Name', 'Type', 'Addr', 'Offset', 'Size', 'ES', 'Flg', 'Lk', 'Inf', 'Al'))
436
437 for index in range(len(self.sectionHeaderTable)):
438 elf32_Shdr = self.sectionHeaderTable[index]
439 if elf32_Shdr.sh_type in SH_TYPE_MAP_LIST:
440 print(' [%4d] %-32s%-16s%-16s%-16s%-8s%-8d%-8d%-8d%-8d%-8d' % \
441 (index,
442 self.getSectionName(elf32_Shdr),
443 SH_TYPE_MAP_LIST[elf32_Shdr.sh_type].strip(),
444 hex(elf32_Shdr.sh_addr),
445 hex(elf32_Shdr.sh_offset),
446 hex(elf32_Shdr.sh_size),
447 elf32_Shdr.sh_entsize,
448 elf32_Shdr.sh_flags,
449 elf32_Shdr.sh_link,
450 elf32_Shdr.sh_info,
451 elf32_Shdr.sh_addralign,
452 ))
453
454 else:
455 print(' [%4d] %-32s%-16d%-16s%-16s%-8s%-8d%-8d%-8d%-8d%-8d' % \
456 (index,
457 self.getSectionName(elf32_Shdr),
458 elf32_Shdr.sh_type,
459 hex(elf32_Shdr.sh_addr),
460 hex(elf32_Shdr.sh_offset),
461 hex(elf32_Shdr.sh_size),
462 elf32_Shdr.sh_entsize,
463 elf32_Shdr.sh_flags,
464 elf32_Shdr.sh_link,
465 elf32_Shdr.sh_info,
466 elf32_Shdr.sh_addralign,
467 ))
468
469 print()
470
471 def getSectionName(self, elf32_Shdr):
472 idx = self.sectionNameTable.find(0, elf32_Shdr.sh_name)
473 return self.sectionNameTable[elf32_Shdr.sh_name:idx]
474
475 def initProgramHeader(self):
476 for i in range(self.elf32_Ehdr.e_phnum):
477 self.programHeaderTable.append(
478 self.parseProgramHeader(self.elf32_Ehdr.e_phoff + i * self.elf32_Ehdr.e_phentsize))
479
480 def parseProgramHeader(self, offset):
481 '''
482 typedef struct elf32_phdr{
483 Elf32_Word p_type;
484 Elf32_Off p_offset;
485 Elf32_Addr p_vaddr;
486 Elf32_Addr p_paddr;
487 Elf32_Word p_filesz;
488 Elf32_Word p_memsz;
489 Elf32_Word p_flags;
490 Elf32_Word p_align;
491 } Elf32_Phdr;
492 '''
493 self.f.seek(offset, 0)
494 elf32_Phdr = Elf32_Phdr()
495 elf32_Phdr.p_type = int.from_bytes(self.f.read(4), 'little')
496 elf32_Phdr.p_offset = int.from_bytes(self.f.read(4), 'little')
497 elf32_Phdr.p_vaddr = int.from_bytes(self.f.read(4), 'little')
498 elf32_Phdr.p_paddr = int.from_bytes(self.f.read(4), 'little')
499 elf32_Phdr.p_filesz = int.from_bytes(self.f.read(4), 'little')
500 elf32_Phdr.p_memsz = int.from_bytes(self.f.read(4), 'little')
501 elf32_Phdr.p_flags = int.from_bytes(self.f.read(4), 'little')
502 elf32_Phdr.p_align = int.from_bytes(self.f.read(4), 'little')
503 return elf32_Phdr
504
505 def displayProgramHeader(self):
506 print('[+] Program Header Table:')
507
508 print(' # %-16s%-16s%-16s%-16s%-8s%-8s%-8s%-8s' % (
509 'Type', 'offset', 'VirtAddr', 'PhysAddr', 'FileSiz', 'MemSiz', 'Flg', 'Align'))
510
511 for index in range(len(self.programHeaderTable)):
512 elf32_Phdr = self.programHeaderTable[index]
513
514 if elf32_Phdr.p_type in PT_TYPE_MAP_LIST:
515 print(' [%4d] %-16s%-16s%-16s%-16s%-8s%-8s%-8d%-8s' % (
516 index,
517 PT_TYPE_MAP_LIST[elf32_Phdr.p_type],
518 hex(elf32_Phdr.p_offset),
519 hex(elf32_Phdr.p_vaddr),
520 hex(elf32_Phdr.p_paddr),
521 hex(elf32_Phdr.p_filesz),
522 hex(elf32_Phdr.p_memsz),
523 elf32_Phdr.p_flags,
524 hex(elf32_Phdr.p_align),
525 ))
526
527 else:
528 print(' [%4d] %-16d%-16s%-16s%-16s%-8s%-8s%-8d%-8s' % (
529 index,
530 elf32_Phdr.p_type,
531 hex(elf32_Phdr.p_offset),
532 hex(elf32_Phdr.p_vaddr),
533 hex(elf32_Phdr.p_paddr),
534 hex(elf32_Phdr.p_filesz),
535 hex(elf32_Phdr.p_memsz),
536 elf32_Phdr.p_flags,
537 hex(elf32_Phdr.p_align),
538 ))
539
540 print('\n[+] Section to segment mapping:')
541
542 for index in range(len(self.programHeaderTable)):
543 elf32_Phdr = self.programHeaderTable[index]
544 sections = self.getSegmentSections(elf32_Phdr)
545
546 sections_str = ''
547 for elf32_Shdr in sections:
548 idx = self.sectionNameTable.index(0, elf32_Shdr.sh_name)
549 sections_str += self.sectionNameTable[elf32_Shdr.sh_name:idx].decode() + ' '
550 print(' [%4d] %s' % (index, sections_str))
551
552 print()
553
554
555 def getSegmentSections(self, elf32_Phdr):
556 start = elf32_Phdr.p_offset
557 end = elf32_Phdr.p_offset + elf32_Phdr.p_filesz
558
559 sections = []
560 for index in range(len(self.sectionHeaderTable)):
561 elf32_Shdr = self.sectionHeaderTable[index]
562 section_start = elf32_Shdr.sh_offset
563 section_end = elf32_Shdr.sh_offset + elf32_Shdr.sh_size
564 if section_start >= start and section_end <= end:
565 sections.append(elf32_Shdr)
566
567 return sections
568
569 def initSymbolTalbe(self):
570 # init dynsym
571 elf32_Shdr = self.getSectionByName('.dynsym')
572 if elf32_Shdr != None:
573 for i in range(int(elf32_Shdr.sh_size / elf32_Shdr.sh_entsize)):
574 self.symbolTable.append(self.parseSymbolTable(elf32_Shdr.sh_offset + i * elf32_Shdr.sh_entsize))
575
576 # init dynstr
577 dynstr_elf32_Shdr = self.getSectionByName('.dynstr')
578 self.f.seek(dynstr_elf32_Shdr.sh_offset)
579
580 self.dynstrTable = self.f.read(dynstr_elf32_Shdr.sh_size)
581
582 for i in range(len(self.symbolTable)):
583 idx = self.symbolTable[i].st_name
584 name = []
585 while self.dynstrTable[idx+1] != 0:
586 name.append(chr(self.dynstrTable[idx]))
587 idx += 1
588 # print("".join(name))
589 self.symbolTable[i].symbol_name = "".join(name)
590
591 def parseSymbolTable(self, offset):
592 '''
593 typedef struct elf32_sym{
594 Elf32_Word st_name;
595 Elf32_Addr st_value;
596 Elf32_Word st_size;
597 unsigned char st_info;
598 unsigned char st_other;
599 Elf32_Half st_shndx;
600 } Elf32_Sym;
601 '''
602 self.f.seek(offset, 0)
603 elf32_Sym = Elf32_Sym()
604 elf32_Sym.st_name = int.from_bytes(self.f.read(4), 'little')
605 elf32_Sym.st_value = int.from_bytes(self.f.read(4), 'little')
606 elf32_Sym.st_size = int.from_bytes(self.f.read(4), 'little')
607 elf32_Sym.st_info = int.from_bytes(self.f.read(1), 'little')
608 elf32_Sym.st_other = int.from_bytes(self.f.read(1), 'little')
609 elf32_Sym.st_shndx = int.from_bytes(self.f.read(2), 'little')
610 return elf32_Sym
611
612 def displaySymbolTable(self):
613 print('[+] Dynamic Symbol Table:')
614
615 print(' # %-10s%-8s%-8s%-8s%-8s%-8s%-8s'
616 % ('Value', 'Size', 'Type', 'Bind', 'Other', 'Ndx', 'Name'))
617 BIND_TYPE = {0: 'LOCAL', 1: 'GLOBAL', 2: 'WEAK', 13: 'LOPROC', 15: 'HIPROC'}
618 ELF32_ST_TYPE = {0: 'NOTYPE', 1: 'OBJECT', 2: 'FUNC', 3: 'SECTION', 4: 'FILE', 13: 'LOPROC', 15: 'HIPROC'}
619 SHN_TYPE = {0: 'UNDEF', 0xfff1: 'ABS', 0xfff2: 'COMMON', }
620
621 for index in range(len(self.symbolTable)):
622 elf32_Sym = self.symbolTable[index]
623 bind = elf32_Sym.st_info >> 4
624 type = elf32_Sym.st_info & 0xf
625
626 if elf32_Sym.st_shndx == 0 or elf32_Sym.st_shndx == 0xfff1 or elf32_Sym.st_shndx == 0xfff2:
627 shn_type = SHN_TYPE[elf32_Sym.st_shndx]
628 else:
629 shn_type = str(elf32_Sym.st_shndx)
630 print(' [%4d] %-10s%-8d%-8s%-8s%-8d%-8s%-8s' % (
631 index,
632 hex(elf32_Sym.st_value),
633 elf32_Sym.st_size,
634 ELF32_ST_TYPE[type],
635 BIND_TYPE[bind],
636 elf32_Sym.st_other,
637 shn_type,
638 elf32_Sym.symbol_name
639 ))
640 print()
641
642 def initDynamicLinkTable(self):
643 # init dynamic
644 elf32_Shdr = self.getSectionByName('.dynamic')
645 if elf32_Shdr != None:
646 for i in range(int(elf32_Shdr.sh_size / elf32_Shdr.sh_entsize)):
647 self.dynamicLinkTable.append(
648 self.parseDynamicLinkTable(elf32_Shdr.sh_offset + i * elf32_Shdr.sh_entsize))
649
650 def parseDynamicLinkTable(self, offset):
651 '''
652 typedef struct dynamic{
653 Elf32_Sword d_tag;
654 union{
655 Elf32_Sword d_val;
656 Elf32_Addr d_ptr;
657 } d_un;
658 } Elf32_Dyn;
659 '''
660 self.f.seek(offset, 0)
661 elf32_Dyn = Elf32_Dyn()
662 elf32_Dyn.d_tag = int.from_bytes(self.f.read(4), 'little')
663 elf32_Dyn.d_un = int.from_bytes(self.f.read(4), 'little')
664 return elf32_Dyn
665
666 def displayDynamicLinkTable(self):
667 print('[+] Dynamic Link Table:')
668 print(' # %-16s%-16s%-8s' % ('Tag', 'Type', 'Name/Value'))
669
670 for index in range(len(self.dynamicLinkTable)):
671 elf32_Dyn = self.dynamicLinkTable[index]
672 print(' [%4d] %-16s%-16s%-16s' % (
673 index,
674 hex(elf32_Dyn.d_tag),
675 DYNAMIC_TYPE[elf32_Dyn.d_tag],
676 self.getElf32_Dyn_TypeInfo(elf32_Dyn),
677
678 ))
679
680 def getElf32_Dyn_TypeInfo(self, elf32_Dyn):
681 if elf32_Dyn.d_tag == 1: # DT_NEEDED
682 idx = self.dynstrTable.find(0, elf32_Dyn.d_un)
683 return 'Shared library: [%s]' % self.dynstrTable[elf32_Dyn.d_un: idx]
684
685 elif elf32_Dyn.d_tag == 0xe: # DT_SONAME
686 idx = self.dynstrTable.find(0, elf32_Dyn.d_un)
687 return 'Library soname: [%s]' % self.dynstrTable[elf32_Dyn.d_un: idx]
688
689 return hex(elf32_Dyn.d_un)
690
691 def displayELFHeader(self):
692 print('[+] ELF Header:')
693 print('e_ident:\t%s' % self.elf32_Ehdr.e_ident)
694 print('e_type: \t%s' % self.elf32_Ehdr.e_type)
695 print('e_machine:\t%s' % self.elf32_Ehdr.e_machine)
696 print('e_version:\t%s' % self.elf32_Ehdr.e_version)
697 print('e_entry:\t%s' % self.elf32_Ehdr.e_entry)
698 print('e_phoff:\t%s\t//Program header offset' % hex(self.elf32_Ehdr.e_phoff))
699 print('e_shoff:\t%s\t//Section header offset' % hex(self.elf32_Ehdr.e_shoff))
700 print('e_flags:\t%s' % self.elf32_Ehdr.e_flags)
701 print('e_ehsize:\t%s\t//ELF header size' % self.elf32_Ehdr.e_ehsize)
702 print('e_phentsize:\t%s\t//Program header entry size' % self.elf32_Ehdr.e_phentsize)
703 print('e_phnum:\t%s\t//Program header number' % self.elf32_Ehdr.e_phnum)
704 print('e_shentsize:\t%s\t//Section header entry size' % (self.elf32_Ehdr.e_shentsize))
705 print('e_shnum:\t%s\t//Section header number' % (self.elf32_Ehdr.e_shnum))
706 print('e_shstrndx:\t%s\t//Section header string index' % (self.elf32_Ehdr.e_shstrndx))
707 print()
708
709 def disassemble(self):
710 '''
711 Display assembler contents of executable sections (.text .plt ...)
712 '''
713 self.__disassembleTEXTSection()
714 self.__disassemblePLTSection()
715
716 def __disassembleTEXTSection(self):
717 elf32_Shdr = self.getSectionByName('.text')
718 if elf32_Shdr == None:
719 return
720 # TODO
721 pass
722
723 def __disassemblePLTSection(self):
724 elf32_Shdr = self.getSectionByName('.plt')
725 if elf32_Shdr == None:
726 return
727 # TODO
728 pass
729
730 def getSectionByName(self, name):
731 for elf32_Shdr in self.sectionHeaderTable:
732 if elf32_Shdr.section_name == name:
733 return elf32_Shdr
734 return None
735
736
737 if __name__ == '__main__':
738 elf = ELF(sys.argv[1])
739 elf.displayELFHeader()
740 elf.displaySectionHeader()
741 elf.displayProgramHeader()
742 elf.displaySymbolTable()
743 elf.displayDynamicLinkTable()
744 elf.disassemble()
python3 elf文件解析的更多相关文章
- ELF文件解析（一）：Segment和Section
ELF 是Executable and Linking Format的缩写,即可执行和可链接的格式,是Unix/Linux系统ABI (Application Binary Interface)规范的 ...
- Android ELF文件解析
0X01 ELF初认识 elf文件是linux下的二进制文件,相当于windows下的PE文件,Android系统里的dll. 解析elf文件两个用处:1.so加固:2.frida(xposed)检 ...
- ELF文件解析（二）：ELF header详解
上一篇讲了ELF文件的总体布局,以及section和segment的概念.按照计划,今天继续讲 ELF header. 讲新的内容之前,先更正一个错误:上一篇中讲section header tabl ...
- ELF文件解析器支持x86x64ELF文件
此文为静态分析ELF文件结构,遍历其中Elf_Ehdr文件头信息,遍历Elf_Shdr节表头信息,并将所有节放置在左侧树控件上,遍历Elf_Phdr程序头也放置在左侧树控件上,并着重分析字符串表,重定 ...
- Python3将xml文件解析为Python对象
一.说明 从最开始写javascript开始,我就很烦感使用getElementById()等函数来获取节点的方法,获取了一个节点要访问其子孙节点要么child半天要么就再来一个getElementB ...
- 实例分析ELF文件静态链接
参考文献: <ELF V1.2> <程序员的自我修养---链接.装载与库>第4章 静态链接 开发平台: [thm@tanghuimin static_link]$ uname ...
- bin文件和elf文件
ELF文件格式是一个开放标准,各种UNIX系统的可执行文件都采用ELF格式,它有三种不同的类型: 可重定位的目标文件(Relocatable,或者Object File) 可执行文件(Executab ...
- Python实现XML文件解析
1. XML简介 XML(eXtensible Markup Language)指可扩展标记语言,被设计用来传输和存储数据,已经日趋成为当前许多新生技术的核心,在不同的领域都有着不同的应用.它是web ...
- ELF文件的加载过程(load_elf_binary函数详解)--Linux进程的管理与调度（十三）
加载和动态链接 从编译/链接和运行的角度看,应用程序和库程序的连接有两种方式. 一种是固定的.静态的连接,就是把需要用到的库函数的目标代码(二进制)代码从程序库中抽取出来,链接进应用软件的目标映像中: ...
随机推荐
- [转]论基于DSSA的软件架构设计与应用
[摘要] 去年三月份,我所在的公司启动国网电力用户用电信息采集系统项目,我被任命为项目负责人.国网电力用户用电信息采集系统是国家电网公司坚强智能电网建设的一部分.由于公司之前为南网(主要是广东省) ...
- Vue & Sentry
Vue & Sentry config.errorHandler https://cn.vuejs.org/v2/api/#errorHandler Vue.config.errorHandl ...
- image auto downloader
image auto downloader icons killer / js crawler http only + same-origin OK "use strict"; / ...
- cnblogs 日期错乱 bug
cnblogs 日期错乱 bug 时间错乱 bug archive/2004/01/13/ 什么鬼 呀默认时间戳 https://www.cnblogs.com/xgqfrms/archive/200 ...
- webpack 5
webpack 5 webpack 5 requires at least Node.js 10.13.0 (LTS). https://webpack.js.org/migrate/5/ https ...
- npx & yarn & npm
npx & yarn & npm React Redux App https://reactjs.org/ https://github.com/facebook/create-rea ...
- dragable tabs & iframe & new window
dragable tabs & iframe & new window https://www.npmjs.com/package/react-draggable-tab demo h ...
- js 增加数组的嵌套层数
class A {} const proxy = new Proxy(new A(), { get(o, k) { if (!/\d+/.test(k.toString())) return o[k] ...
- nodejs 查看进程表
psaux tasklist system-tasks const { exec } = require("child_process"); const isWindows = p ...
- std::vector与std::list效能对比（基于c++11）
测试对象类型不同,数量级不同时,表现具有差异: 测试数据对象为std::function时: test: times(1000)vector push_back time 469 usvector e ...