看，宝藏就在那儿
在上一篇文章中，我们提到用按图索骥比喻库的初始化过程，那么现在有了地图，接下来的事情就是去寻找我们感兴趣的宝藏了。这个宝藏可能是一个ELF文件的程序文本段，也有可能是程序的某个不知名的代码段，这些都取决于你想要什么信息。我建议你去阅读ELF 的官方标准，那里边讲的比较清楚。
我这里只是实现了几个提取诸如：程序的大小端，能执行的CPU位数，程序的入口点，以及获得程序的所有节的编号和根据节的编号获取该节的详细信息。
提取信息：程序的大小端
1: long ELF_GetELFEnddian(SEF_ELFHEADER* pHandle)
2: {
3: long ret = 0;
4: SEF_ELFHEADER *handle = (SEF_ELFHEADER*)pHandle;
5: //// big_endding or litte_endding
6:
7: if(pHandle == NULL)
8: {
9: ret = -1;
10: }
11: else if(pHandle->nFlag_Data == 1)
12: {
13: ret = ELFDATA2LSB;
14: }
15: else if(pHandle->nFlag_Data == 2)
16: {
17: ret = ELFDATA2MSB;
18: }
19: else
20: {
21: ret = ELFDATANONE;
22: }
23: return ret;
24: }
可以看到输入之前初始化的elfheader二级数据管理句柄，返回这个elf文件的大小端信息。
提取信息：目标文件能执行的CPU位数
1: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine)
2: {
3: long ret=0;
4: *nMachine = 0;
5: //判断 CPU
6: if(pELF64Header == NULL)
7: {
8: ret = -1;
9: }
10: if(3 == pELF64Header->e_machine)
11: {
12: *nMachine = 1;
13: //printf("virtual program address: %p\n",pELF64Header->e_entry);
14: }
15: else if(62 == pELF64Header->e_machine)
16: {
17: *nMachine = 2;
18: }
19: else
20: {
21: *nMachine = 3;
22: }
23: return ret;
24: }
25:
26: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine)
27: {
28: long ret=0;
29: *nMachine = 0;
30: if(pELF32Header == NULL)
31: {
32: ret = -1;
33: }
34: //判断 CPU
35: if(3 == pELF32Header->e_machine)
36: {
37: *nMachine = 1;
38: //printf("virtual program address: %p\n",pELF32Header->e_entry);
39: }
40: else if(62 == pELF32Header->e_machine)
41: {
42: *nMachine = 2;
43: }
44: else
45: {
46: *nMachine = 3;
47: }
48: return ret;
49: }
这里展示 的两个函数分别对应着：32位和64位。
提取信息：目标程序的入口点
1: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA)
2: {
3: long ret=0;
4: uint64_t ProNum=0;
5: long nFlag = -1;
6: uint64_t i = 0;
7: uint64_t offset = 0;
8: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL)
9: {
10: ret = -1;
11: goto ELF_ENTRY32;
12: }
13: /*deal 32bits elf file*/
14: SEF_ELFHEADER_32 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_32);
15: ProNum = pElfHeader->e_phnum;
16: *RVA = pElfHeader->e_entry;
17: SEF_PROHEADER_32 *pSegTabFind=NULL;
18: SEF_PROHEADER_32 *pSegTabUse=NULL;
19: uint64_t nItemNum = *RVA;
20: /*find the first load segment*/
21: for (i=0; i<ProNum; i++)
22: {
23: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_32[i]);
24: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz)))
25: {
26: nFlag = i;
27: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_32[nFlag]);
28: break;
29: }
30: }
31: if (pSegTabUse != NULL)
32: {
33: offset = nItemNum - pSegTabUse->p_vaddr;
34: *RAW = pSegTabUse->p_offset + offset;
35: }
36: else
37: {
38: ret = -2;
39: goto ELF_ENTRY32;
40: }
41: ELF_ENTRY32:
42: return ret;
43: }
44:
45: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA)
46: {
47: long ret=0;
48: uint64_t ProNum=0;
49: long nFlag = -1;
50: uint64_t i = 0;
51: uint64_t offset = 0;
52: /*deal 32bits elf file*/
53: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL)
54: {
55: ret = -1;
56: goto ELF_ENTRY64;
57: }
58: SEF_ELFHEADER_64 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_64);
59: ProNum = pElfHeader->e_phnum;
60: *RVA = pElfHeader->e_entry;
61:
62: SEF_PROHEADER_64 *pSegTabFind=NULL;
63: SEF_PROHEADER_64 *pSegTabUse=NULL;
64: uint64_t nItemNum = *RVA;
65: /*find the first load segment*/
66: for (i=0; i<ProNum; i++)
67: {
68: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_64[i]);
69: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz)))
70: {
71: nFlag = i;
72: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_64[nFlag]);
73: break;
74: }
75: }
76: if (pSegTabUse != NULL)
77: {
78: offset = nItemNum - pSegTabUse->p_vaddr;
79: *RAW = pSegTabUse->p_offset + offset;
80: // printf("RAW is %d\n",*RAW);
81: }
82: else
83: {
84: ret = -2;
85: goto ELF_ENTRY64;
86: }
87: ELF_ENTRY64:
88: return ret;
89: }
展示的函数依然是分别对应着：32位和64位。
提取信息：获得目标程序所有节的编号
1: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo)
2: {
3: long ret = 0;
4: uint16_t SecNum = 0;
5: uint8_t i=0; //as temp circle num
6: SEF_HEADSET* handle = (SEF_HEADSET*)phandle;
7: if(phandle->pS_SecHeader == NULL)
8: {
9: ret = -1;
10: goto getsecinfo_finish;
11: }
12: SEF_ELFHEADER_32 *pElfHeader32=&(handle->pS_ElfHeader->S_ElfHeader_32);
13: SEF_SECHEADER_32 *pSecHead32=NULL;
14:
15: SecNum = pElfHeader32->e_shnum;
16:
17: if(nIndex < 0 || nIndex > SecNum)
18: {
19: printf("Your input number is illegal!!\n");
20: ret = -2;
21: goto getsecinfo_finish;
22: }
23:
24: pSecHead32 = &(handle->pS_SecHeader->pS_SecHeader_32[nIndex]);
25:
26: ELF_GetSecName(handle,nIndex,pSecInfo);
27:
28: pSecInfo->nType = pSecHead32->sh_type;
29: pSecInfo->nAddr = pSecHead32->sh_addr;
30: pSecInfo->nflags = pSecHead32->sh_flags;
31: pSecInfo->nOffset = pSecHead32->sh_offset;
32: pSecInfo->nSize = pSecHead32->sh_size;
33: pSecInfo->nLink = pSecHead32->sh_link;
34: pSecInfo->nInfo = pSecHead32->sh_info;
35: pSecInfo->nAddralign = pSecHead32->sh_addralign;
36: pSecInfo->nEntsize = pSecHead32->sh_entsize;
37:
38: //printf("nFlags is =====%p\n",pSecInfo->nflags);
39: //ELF_GetSecftInfo(pSecInfo);
40: getsecinfo_finish:
41: return ret;
42: }
43:
44: long ELF_GetSecInfo64(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo)
45: {
46: long ret = 0;
47: uint16_t SecNum = 0;
48: uint8_t i=0; //as temp circle num
49: SEF_HEADSET* handle = (SEF_HEADSET*)phandle;
50: if(phandle->pS_SecHeader == NULL)
51: {
52: ret = -1;
53: goto getsecinfo_finish;
54: }
55: SEF_ELFHEADER_64 *pElfHeader64=&(handle->pS_ElfHeader->S_ElfHeader_64);
56: SEF_SECHEADER_64 *pSecHead64=NULL;
57:
58: SecNum = pElfHeader64->e_shnum;
59:
60: if(nIndex < 0 || nIndex > SecNum)
61: {
62: printf("Your input number is illegal!!\n");
63: ret = -2;
64: goto getsecinfo_finish;
65: }
66: printf("--------------------------------");
67: pSecHead64 = &(handle->pS_SecHeader->pS_SecHeader_64[nIndex]);
68:
69: ELF_GetSecName(handle,nIndex,pSecInfo);
70:
71: pSecInfo->nType = pSecHead64->sh_type;
72: pSecInfo->nAddr = pSecHead64->sh_addr;
73: pSecInfo->nflags = pSecHead64->sh_flags;
74: pSecInfo->nOffset = pSecHead64->sh_offset;
75: pSecInfo->nSize = pSecHead64->sh_size;
76: pSecInfo->nLink = pSecHead64->sh_link;
77: pSecInfo->nInfo = pSecHead64->sh_info;
78: pSecInfo->nAddralign = pSecHead64->sh_addralign;
79: pSecInfo->nEntsize = pSecHead64->sh_entsize;
80:
81: //ELF_GetSecftInfo(pSecInfo);
82: getsecinfo_finish:
83: return ret;
84: }
实际上设计两个函数式为了保持目标文件的兼容性。
提取信息：根据节的编号获取该节的详细信息
1: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pElfInfo)
2: {
3: SEF_HEADSET * phandle = (SEF_HEADSET *)handle;
4: int ret = 0;
5: if((phandle==NULL) || (phandle->pS_ElfHeader == NULL) || (phandle->pS_SecHeader==NULL))
6: {
7: ret = -1;
8: goto GetOut;
9: }
10:
11: SEF_ELFHEADER * pElfHeaderTemp = phandle->pS_ElfHeader;
12: SEF_SECHEADER * pSecHeaderTemp = phandle->pS_SecHeader;
13: int Index = 0;
14:
15: //deal 32bits elf file
16: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS32)
17: {
18: Index = pElfHeaderTemp->S_ElfHeader_32.e_shstrndx;
19:
20: //shstrname is the start address of the section name string section
21: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_32[Index].sh_offset;
22: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_32[num].sh_name;
23:
24:
25: }
26: //deal 64bits elf file
27: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS64)
28: {
29: Index = pElfHeaderTemp->S_ElfHeader_64.e_shstrndx;
30:
31: //shstrname is the start address of the section name string section
32: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_64[Index].sh_offset;
33: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_64[num].sh_name;
34: }
35: GetOut:
36: return ret;
37: }
把整个源码文件也贴出来：
1: #include<stdio.h>
2: #include<string.h>
3: #include<stdlib.h>
4: #include"elf_GetElfInfo.h"
5: #include"elf_interface.h"
6: #include"../../include/adt.h"
7:
8: long ELF_GetELFEnddian(SEF_ELFHEADER* pHandle)
9: {
10: long ret = 0;
11: SEF_ELFHEADER *handle = (SEF_ELFHEADER*)pHandle;
12: //// big_endding or litte_endding
13:
14: if(pHandle == NULL)
15: {
16: ret = -1;
17: }
18: else if(pHandle->nFlag_Data == 1)
19: {
20: ret = ELFDATA2LSB;
21: }
22: else if(pHandle->nFlag_Data == 2)
23: {
24: ret = ELFDATA2MSB;
25: }
26: else
27: {
28: ret = ELFDATANONE;
29: }
30: return ret;
31: }
32:
33: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine)
34: {
35: long ret=0;
36: *nMachine = 0;
37: //判断 CPU
38: if(pELF64Header == NULL)
39: {
40: ret = -1;
41: }
42: if(3 == pELF64Header->e_machine)
43: {
44: *nMachine = 1;
45: //printf("virtual program address: %p\n",pELF64Header->e_entry);
46: }
47: else if(62 == pELF64Header->e_machine)
48: {
49: *nMachine = 2;
50: }
51: else
52: {
53: *nMachine = 3;
54: }
55: return ret;
56: }
57:
58: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine)
59: {
60: long ret=0;
61: *nMachine = 0;
62: if(pELF32Header == NULL)
63: {
64: ret = -1;
65: }
66: //判断 CPU
67: if(3 == pELF32Header->e_machine)
68: {
69: *nMachine = 1;
70: //printf("virtual program address: %p\n",pELF32Header->e_entry);
71: }
72: else if(62 == pELF32Header->e_machine)
73: {
74: *nMachine = 2;
75: }
76: else
77: {
78: *nMachine = 3;
79: }
80: return ret;
81: }
82:
83: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA)
84: {
85: long ret=0;
86: uint64_t ProNum=0;
87: long nFlag = -1;
88: uint64_t i = 0;
89: uint64_t offset = 0;
90: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL)
91: {
92: ret = -1;
93: goto ELF_ENTRY32;
94: }
95: /*deal 32bits elf file*/
96: SEF_ELFHEADER_32 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_32);
97: ProNum = pElfHeader->e_phnum;
98: *RVA = pElfHeader->e_entry;
99: SEF_PROHEADER_32 *pSegTabFind=NULL;
100: SEF_PROHEADER_32 *pSegTabUse=NULL;
101: uint64_t nItemNum = *RVA;
102: /*find the first load segment*/
103: for (i=0; i<ProNum; i++)
104: {
105: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_32[i]);
106: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz)))
107: {
108: nFlag = i;
109: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_32[nFlag]);
110: break;
111: }
112: }
113: if (pSegTabUse != NULL)
114: {
115: offset = nItemNum - pSegTabUse->p_vaddr;
116: *RAW = pSegTabUse->p_offset + offset;
117: }
118: else
119: {
120: ret = -2;
121: goto ELF_ENTRY32;
122: }
123: ELF_ENTRY32:
124: return ret;
125: }
126:
127: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA)
128: {
129: long ret=0;
130: uint64_t ProNum=0;
131: long nFlag = -1;
132: uint64_t i = 0;
133: uint64_t offset = 0;
134: /*deal 32bits elf file*/
135: if(pHandle->pS_ElfHeader == NULL || pHandle->pS_ProHeader == NULL)
136: {
137: ret = -1;
138: goto ELF_ENTRY64;
139: }
140: SEF_ELFHEADER_64 *pElfHeader = &(pHandle->pS_ElfHeader->S_ElfHeader_64);
141: ProNum = pElfHeader->e_phnum;
142: *RVA = pElfHeader->e_entry;
143:
144: SEF_PROHEADER_64 *pSegTabFind=NULL;
145: SEF_PROHEADER_64 *pSegTabUse=NULL;
146: uint64_t nItemNum = *RVA;
147: /*find the first load segment*/
148: for (i=0; i<ProNum; i++)
149: {
150: pSegTabFind = &(pHandle->pS_ProHeader->pS_ProHeader_64[i]);
151: if(nItemNum >= pSegTabFind->p_vaddr && (nItemNum <= (pSegTabFind->p_vaddr +pSegTabFind->p_memsz)))
152: {
153: nFlag = i;
154: pSegTabUse = &(pHandle->pS_ProHeader->pS_ProHeader_64[nFlag]);
155: break;
156: }
157: }
158: if (pSegTabUse != NULL)
159: {
160: offset = nItemNum - pSegTabUse->p_vaddr;
161: *RAW = pSegTabUse->p_offset + offset;
162: // printf("RAW is %d\n",*RAW);
163: }
164: else
165: {
166: ret = -2;
167: goto ELF_ENTRY64;
168: }
169: ELF_ENTRY64:
170: return ret;
171: }
172:
173: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo)
174: {
175: long ret = 0;
176: uint16_t SecNum = 0;
177: uint8_t i=0; //as temp circle num
178: SEF_HEADSET* handle = (SEF_HEADSET*)phandle;
179: if(phandle->pS_SecHeader == NULL)
180: {
181: ret = -1;
182: goto getsecinfo_finish;
183: }
184: SEF_ELFHEADER_32 *pElfHeader32=&(handle->pS_ElfHeader->S_ElfHeader_32);
185: SEF_SECHEADER_32 *pSecHead32=NULL;
186:
187: SecNum = pElfHeader32->e_shnum;
188:
189: if(nIndex < 0 || nIndex > SecNum)
190: {
191: printf("Your input number is illegal!!\n");
192: ret = -2;
193: goto getsecinfo_finish;
194: }
195:
196: pSecHead32 = &(handle->pS_SecHeader->pS_SecHeader_32[nIndex]);
197:
198: ELF_GetSecName(handle,nIndex,pSecInfo);
199:
200: pSecInfo->nType = pSecHead32->sh_type;
201: pSecInfo->nAddr = pSecHead32->sh_addr;
202: pSecInfo->nflags = pSecHead32->sh_flags;
203: pSecInfo->nOffset = pSecHead32->sh_offset;
204: pSecInfo->nSize = pSecHead32->sh_size;
205: pSecInfo->nLink = pSecHead32->sh_link;
206: pSecInfo->nInfo = pSecHead32->sh_info;
207: pSecInfo->nAddralign = pSecHead32->sh_addralign;
208: pSecInfo->nEntsize = pSecHead32->sh_entsize;
209:
210: //printf("nFlags is =====%p\n",pSecInfo->nflags);
211: //ELF_GetSecftInfo(pSecInfo);
212: getsecinfo_finish:
213: return ret;
214: }
215:
216: long ELF_GetSecInfo64(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo)
217: {
218: long ret = 0;
219: uint16_t SecNum = 0;
220: uint8_t i=0; //as temp circle num
221: SEF_HEADSET* handle = (SEF_HEADSET*)phandle;
222: if(phandle->pS_SecHeader == NULL)
223: {
224: ret = -1;
225: goto getsecinfo_finish;
226: }
227: SEF_ELFHEADER_64 *pElfHeader64=&(handle->pS_ElfHeader->S_ElfHeader_64);
228: SEF_SECHEADER_64 *pSecHead64=NULL;
229:
230: SecNum = pElfHeader64->e_shnum;
231:
232: if(nIndex < 0 || nIndex > SecNum)
233: {
234: printf("Your input number is illegal!!\n");
235: ret = -2;
236: goto getsecinfo_finish;
237: }
238: printf("--------------------------------");
239: pSecHead64 = &(handle->pS_SecHeader->pS_SecHeader_64[nIndex]);
240:
241: ELF_GetSecName(handle,nIndex,pSecInfo);
242:
243: pSecInfo->nType = pSecHead64->sh_type;
244: pSecInfo->nAddr = pSecHead64->sh_addr;
245: pSecInfo->nflags = pSecHead64->sh_flags;
246: pSecInfo->nOffset = pSecHead64->sh_offset;
247: pSecInfo->nSize = pSecHead64->sh_size;
248: pSecInfo->nLink = pSecHead64->sh_link;
249: pSecInfo->nInfo = pSecHead64->sh_info;
250: pSecInfo->nAddralign = pSecHead64->sh_addralign;
251: pSecInfo->nEntsize = pSecHead64->sh_entsize;
252:
253: //ELF_GetSecftInfo(pSecInfo);
254: getsecinfo_finish:
255: return ret;
256: }
257:
258: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pElfInfo)
259: {
260: SEF_HEADSET * phandle = (SEF_HEADSET *)handle;
261: int ret = 0;
262: if((phandle==NULL) || (phandle->pS_ElfHeader == NULL) || (phandle->pS_SecHeader==NULL))
263: {
264: ret = -1;
265: goto GetOut;
266: }
267:
268: SEF_ELFHEADER * pElfHeaderTemp = phandle->pS_ElfHeader;
269: SEF_SECHEADER * pSecHeaderTemp = phandle->pS_SecHeader;
270: int Index = 0;
271:
272: //deal 32bits elf file
273: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS32)
274: {
275: Index = pElfHeaderTemp->S_ElfHeader_32.e_shstrndx;
276:
277: //shstrname is the start address of the section name string section
278: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_32[Index].sh_offset;
279: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_32[num].sh_name;
280:
281:
282: }
283: //deal 64bits elf file
284: if(pElfHeaderTemp->nFlag_Bits == ELFCLASS64)
285: {
286: Index = pElfHeaderTemp->S_ElfHeader_64.e_shstrndx;
287:
288: //shstrname is the start address of the section name string section
289: char * shstrname = phandle->pBuffer + pSecHeaderTemp->pS_SecHeader_64[Index].sh_offset;
290: pElfInfo->szName = shstrname + pSecHeaderTemp->pS_SecHeader_64[num].sh_name;
291: }
292: GetOut:
293: return ret;
294: }
最后给出.h头文件：
1: #include"../../include/elf_type.h"
2: #include "elf_interface.h"
3: #include"../../include/adt.h"
4:
5: #define ELF_FLAG_WRITE 0X1
6: #define ELF_FLAG_ALLOC 0X2
7: #define ELF_FLAG_EXECINSTR 0X4
8: #define ELF_FLAG_MERGE 0X10
9: #define ELF_FLAG_STRINGS 0X20
10: #define ELF_FLAG_LINK 0X40
11: #define ELF_FLAG_ORDER 0X80
12: #define ELF_FLAG_NONCONFORMING 0X100
13: #define ELF_FLAG_CROUP 0X200
14: #define ELF_FLAG_MASKOS 0X0ff00000
15: #define ELF_FLAG_MASKPROC 0Xf0000000
16:
17:
18: ///////////////////////////////////Get ELF‘s Enddian ///////////////////////////////////////////
19: /*
20: function : get ELF‘s enddian
21: input : [in point] pHandle is Call InitElf will return handle
22: result : ret ;
23: -1 input point is NULL
24: 0 ELFDATANONE can‘t decide which enddian
25: 1 ELFDATA2LSB little enddian
26: 2 ELFDATA2MSB big enddian
27: */
28: long ELF_GetELFEnddian(SEF_ELFHEADER *pHandle);
29:
30:
31:
32:
33: //////////////////////////////////////Get ELF‘s Machine/////////////////////////////////////////
34: /*
35: funtinon: decide ELF‘s Machine when class is 64_class
36: input:
37: result: 0 success
38: -5 can not decide which Machine it is
39: readme: nEndding: 1 liteld+ending ； 2 big-edding
40: nMachine: 1 Intel 0x386 CPU ,2 AMD 64 CPU
41: nELFType: 1 ET_REL ; 2 ET_EXEC ; 3 ET_DYN ; 0 it‘s not ELF type
42: */
43: long ELF_GetELFMachine64(SEF_ELFHEADER_64 *pELF64Header, uint8_t *nMachine);
44:
45: /*
46: funtinon: decide ELF‘s Machine when class is 32_class
47: input:
48: result: 0 success
49: -5 can not decide which Machine it is
50: readme: nEndding: 1 little_endding ； 2 big_endding
51: nMachine: 1 Intel 0x386 CPU , 2 AMD 64 CPU
52: nELFType: 1 ET_REL ; 2 ET_EXEC ;3 ET_DYN ; 0 it‘s not ELF type
53: */
54: long ELF_GetELFMachine32(SEF_ELFHEADER_32 *pELF32Header, uint8_t *nMachine);
55:
56: /////////////////////////////////////Get ELF‘s Entry////////////////////////////////////////////
57: /*
58: function: Get know Program exev begin point ‘s virtual Address --- RVA and Physics Offset---RAW
59: input: [int point] Common struct include pS_ElfHeader Struct and Program Struct
60: [int/out point] RAW
61: result: ret = 0; success
62: ret = -1; input point is NULL
63: ret = -2 can‘t find which program table has the first command
64: readme:
65: */
66: long ELF_GetEntry32(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA);
67:
68: /*
69: function: Get know Program exev begin point ‘s virtual Address --- RVA and Physics Offset---RAW
70: input: [int point] Common struct include pS_ElfHeader Struct and Program Struct
71: [int/out point] RAW
72: result: ret = 0; success
73: ret = -1; input point is NULL
74: ret = -2 can‘t find which program table has the first command
75: readme:
76: */
77: long ELF_GetEntry64(SEF_HEADSET *pHandle,uint64_t *RAW,uint64_t *RVA);
78:
79: long ELF_GetSecInfo32(SEF_HEADSET *phandle,uint32_t nIndex,ELF_SECINFO *pSecInfo);
80:
81: long ELF_GetSecInfo64(SEF_HEADSET*phandle,uint32_t nIndex,ELF_SECINFO *pElfSecInfo);
82:
83:
84: /*
85: *function : Get know Program exec begin point‘s virtual Address ---RVA and Physics Offset---RAW
86: *input ; [int point] pHandle is CAll InitELF will return handle ,pAddressHandle from InitAddressELF
87: [in/out point] RAW and RVA
88: *result ; ret==0; success
89: ret==-1; input point is illegal
90: ret==-2; can‘t find which Program table has the first command
91: `readme :
92: *
93: * */
94: //long ELF_GetEntry(void *handle, uint64_t *RAW, uint64_t *RVA);
95:
96: //////////////////////////////////////Get ELF‘s ALL Information////////////////////////////////////////
97: /*
98: funtinon: Get ELF bit, machine, bigendding
99: input: [in point] pHandle is Call InitELF will return handle
100: [in/out poing] ELFInfo struct point, recfrese Buf.h
101: result: 0 success
102: -1 input point is null
103: -2 length is too short or it‘s firt four bits don‘t fit ELF style so it‘s not ELF style
104:
105: readme: InitElF , handle Call InitELF()
106: output bIsElfStyle TURE elf文件 ；FALSE 非elf文件
107: nEndding: 1 little_endding ； 2 big_endding ;3 can‘t decide which enddian
108: nClass : 1 32_class ； 2 64_class ;3 can‘t decide which class
109: nMachine: 1 Intel 0x386 CPU ;2 AMD 64 CPU;3 can‘t decide which class
110: */
111: //long ELF_GetElfHeaderInfo(void *pHandle,ELF_HEADERINFO *pElfInfo);
112:
113:
114：
115: long ELF_GetSecName(void *handle,int num,ELF_SECINFO *pSecInfo);
116:
ELF格式解析库之提取信息
时间： 2024-11-10 00:19:47