Reference Manual

Overview

The beginning is open() which examines the beginning of the file and returns an instance of ElfFile. ElfFile isn’t intended for direct instantiation so what’s actually returned is an instance of one of the subclasses. There are four - which represent all permutations of 32-bit, 64-bit, big-endian, and little-endian. This is their only difference.

Inheritance Diagram

Reference

Elffile is a library which reads and writes ELF format object files. Elffile is pure python so installation is easy.

Note

while this library uses some classes as abstract base classes, it does not use abc.

Todo

need a “copy” method

Todo

need a reverse write method, (for testing)

class elffile.EM(name=u'', code=0, closure=None)

Encodes the processor type represented in this elf file as recorded in the ELF file header.

This is a subclass of coding.Coding and encodes ElfFileHeader.machine.

class elffile.ET(name=u'', code=0, closure=None)

Encodes the type of this elf file, (relocatable, executable, shared library, etc.), as represented in the ELF file header. This is a subclass of coding.Coding and encodes ElfFileHeader.type.

class elffile.EV(name=u'', code=0, closure=None)

Encodes the elf file format version of this elf file as from the ident portion of the elf file header. This is a subclass of coding.Coding.

class elffile.ElfClass(name=u'', code=0, closure=None)

Encodes the word size of the elf file as from the ident portion of the ELF file header. This is a subclass of coding.Coding and encodes ElfFileIdent.elfClass.

class elffile.ElfData(name=u'', code=0, closure=None)

Encodes the byte-wise endianness of the elf file as from the ident portion of the elf file header. This is a subclass of coding.Coding and encodes ElfFileIdent.elfData.

class elffile.ElfFile(name, fileIdent)

This class corresponds to an entire ELF format file. It is an abstract base class which is not intended to be instantiated by rather subclassed.

This abstract base class works in tight concert with it’s subclasses: ElfFile32b, ElfFile32l, ElfFile64b, and ElfFile64l. This abstract base class sets useless defaults and includes byte order and word size independent methods while the subclasses define byte order and word size dependent methods.

exception NO_CLASS

Raised when attempting to decode an unrecognized value for ElfClass, (that is, word size).

exception ElfFile.NO_ENCODING

Raised when attempting to decode an unrecognized value for ElfData, (that is, byte order).

ElfFile.close_enough(other)

Todo

it would not be difficult to break up the string table, sort, and compare the results. But then we’ll also need a way to stub out the embedded path names.

static ElfFile.encodedClass(ident)

:param ElfFileIdent: This is :rtype ElfFile: broken .. todo:: file sphinx bug on this once code is released so that they can see it.

Given an ident, return a suitable ElfFile subclass to represent that file.

Raises NO_CLASS if the ElfClass, (word size), cannot be represented.

Raises NO_ENCODING if the ElfData, (byte order), cannot be represented.

ElfFile.pack_into(block, offset=0)

Pack the entire file. Rewrite offsets as necessary.

ElfFile.sectionName(section)

Given a section, return it’s name.

:param ElfSectionHeader section:

ElfFile.unpack_from(block, offset=0)

Unpack an entire file.

Todo

I don’t understand whether segments overlap sections or not.

class elffile.ElfFile32b(name, fileIdent)

A subclass of ElfFile. Represents 32-bit, big-endian files.

fileHeaderClass

alias of ElfFileHeader32b

programHeaderClass

alias of ElfProgramHeader32b

sectionHeaderClass

alias of ElfSectionHeader32b

class elffile.ElfFile32l(name, fileIdent)

A subclass of ElfFile. Represents 32-bit, little-endian files.

fileHeaderClass

alias of ElfFileHeader32l

programHeaderClass

alias of ElfProgramHeader32l

sectionHeaderClass

alias of ElfSectionHeader32l

class elffile.ElfFile64b(name, fileIdent)

A subclass of ElfFile. Represents 64-bit, big-endian files.

fileHeaderClass

alias of ElfFileHeader64b

programHeaderClass

alias of ElfProgramHeader64b

sectionHeaderClass

alias of ElfSectionHeader64b

class elffile.ElfFile64l(name, fileIdent)

A subclass of ElfFile. Represents 64-bit, little-endian files.

fileHeaderClass

alias of ElfFileHeader64l

programHeaderClass

alias of ElfProgramHeader64l

sectionHeaderClass

alias of ElfSectionHeader64l

class elffile.ElfFileHeader

This abstract base class corresponds to the portion of the ELF file header which follows e_ident, that is, the word size and byte order dependent portion. This includes thirteen fields.

Most attributes are int‘s. Some have encoded meanings which can be decoded with the accompanying coding.Coding subclasses.

This abstract base class works in tight concert with it’s subclasses: ElfFileHeader32b, ElfFileHeader32l, ElfFileHeader64b, and ElfFileHeader64l. This base class sets useless defaults and includes any byte order and word size independent methods while the subclasses define byte order and word size dependent methods.

class elffile.ElfFileHeader32b

A subclass of ElfFileHeader. This one represents 32-bit, big-endian headers.

class elffile.ElfFileHeader32l

A subclass of ElfFileHeader. This one represents 32-bit, little-endian headers.

class elffile.ElfFileHeader64b

A subclass of ElfFileHeader. This one represents 64-bit, big-endian headers.

class elffile.ElfFileHeader64l

A subclass of ElfFileHeader. This one represents 64-bit, little-endian headers.

class elffile.ElfFileIdent

This class corresponds to the first, byte-endian-independent, values in an elf file. These tell us about the encodings for the rest of the file. This is the e_ident field of the elf file header.

Most attributes are int‘s. Some have encoded meanings which can be decoded with the accompanying coding.Coding subclasses.

class elffile.ElfOsabi(name=u'', code=0, closure=None)

Encodes OSABI values which represent operating system ELF format extensions as from the ‘ident’ portion of the elf file header.

This is a subclass of coding.Coding which codes ElfFileIdent.osabi.

class elffile.ElfProgramHeader

This abstract base class corresponds to a program header.

Most attributes are int‘s. Some have encoded meanings which can be decoded with the accompanying coding.Coding subclasses.

This abstract base class works in tight concert with it’s subclasses: ElfProgramHeader32b, ElfProgramHeader32l, ElfProgramHeader64b, and ElfProgramHeader64l. This base class sets useless defaults and includes any byte order and word size independent methods while the subclasses define byte order and word size dependent methods.

class elffile.ElfProgramHeader32

32 vs 64 bit files have differing element orders. This class represents the 32 bit element order. A subclass of ElfProgramHeader.

class elffile.ElfProgramHeader32b

A subclass of ElfProgramHeader32. Represents big endian byte order.

class elffile.ElfProgramHeader32l

A subclass of ElfProgramHeader32. Represents little endian byte order.

class elffile.ElfProgramHeader64

32 vs 64 bit files have differing element orders. This class represents the 64 bit element order. A subclass of ElfProgramHeader.

class elffile.ElfProgramHeader64b

A subclass of ElfProgramHeader64. Represents big endian byte order.

class elffile.ElfProgramHeader64l

A subclass of ElfProgramHeader64. Represents little endian byte order.

class elffile.ElfSectionHeader

This abstract base class corresponds to an entry in the section header table. This includes ten fields.

Most attributes are int‘s. Some have encoded meanings which can be decoded with the accompanying coding.Coding subclasses.

This abstract base class works in tight concert with it’s subclasses: ElfSectionHeader32b, ElfSectionHeader32l, ElfSectionHeader64b, and ElfSectionHeader64l. This base class sets useless defaults and includes any byte order and word size independent methods while the subclasses define byte order and word size dependent methods.

pack_into(block, offset=0)

Note

this is a special case. block here must be the entire file or we won’t know how to place our content.

class elffile.ElfSectionHeader32b

A subclass of ElfSectionHeader. This one represents 32-bit, big-endian structs.

class elffile.ElfSectionHeader32l

A subclass of ElfSectionHeader. This one represents 32-bit, little-endian structs.

class elffile.ElfSectionHeader64b

A subclass of ElfSectionHeader. This one represents 64-bit, big-endian structs.

class elffile.ElfSectionHeader64l

A subclass of ElfSectionHeader. This one represents 64-bit, little-endian structs.

class elffile.PF(name=u'', code=0, closure=None)

Encodes the segment flags as recorded in the program header.

This is a subclass of coding.Coding and encodes ElfProgramHeader.flags.

class elffile.PT(name=u'', code=0, closure=None)

Encodes the segment type as recorded in the program header.

This is a subclass of coding.Coding and encodes ElfProgramHeader.type.

class elffile.SHF(name=u'', code=0, closure=None)

Encodes the section flags as represented in the section header entry of the section header table.

This is a subclass of coding.Coding and encodes ElfSectionHeader.flags. These are bit flags which are or’d together.

class elffile.SHN(name=u'', code=0, closure=None)

Encodes special section indices into the section header table.

This is a subclass of coding.Coding.

class elffile.SHT(name=u'', code=0, closure=None)

Encodes the type of a section as represented in the section header entry of the section header table.

This is a subclass of coding.Coding and encodes ElfSectionHeader.type.

class elffile.StructBase

An abstract base class representing objects which are inherently based on a struct.

close_enough(other)

This is a comparison similar to __eq__ except that here the goal is to determine whether two objects are “close enough” despite perhaps having been produced at different times in different locations in the file system.

pack_into(block, offset=0)

Store the values of this instance into an in-memory representation of the file.

Parameters:

• block (string) – block of memory into which to pack
• offset (int) – optional offset into the memory block into which to start packing

unpack_from(block, offset=0)

Set the values of this instance from an in-memory representation of the struct.

Parameters:

• block (string) – block of memory from which to unpack
• offset (int) – optional offset into the memory block from which to start unpacking

elffile.open(name=None, fileobj=None, map=None, block=None)

The open function takes some form of file identifier and creates an ElfFile instance from it.

:param str name: a file name :param file fileobj: if given, this overrides name :param mmap.mmap map: if given, this overrides fileobj :param bytes block: file contents in a block of memory, (if given, this overrides map)

The file to be used can be specified in any of four different forms, (in reverse precedence):

1. a file name
2. file object
3. mmap.mmap, or
4. a block of memory