1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
|
import os, struct
class NotELFFileError(Exception):
pass
class ELFFile:
EI_NIDENT = 16
EI_CLASS = 4
EI_DATA = 5
EI_VERSION = 6
EI_OSABI = 7
EI_ABIVERSION = 8
E_MACHINE = 0x12
# possible values for EI_CLASS
ELFCLASSNONE = 0
ELFCLASS32 = 1
ELFCLASS64 = 2
# possible value for EI_VERSION
EV_CURRENT = 1
# possible values for EI_DATA
ELFDATANONE = 0
ELFDATA2LSB = 1
ELFDATA2MSB = 2
PT_INTERP = 3
def my_assert(self, expectation, result):
if not expectation == result:
#print "'%x','%x' %s" % (ord(expectation), ord(result), self.name)
raise NotELFFileError("%s is not an ELF" % self.name)
def __init__(self, name, bits = 0):
self.name = name
self.bits = bits
self.objdump_output = {}
def open(self):
if not os.path.isfile(self.name):
raise NotELFFileError("%s is not a normal file" % self.name)
with open(self.name, "rb") as f:
# Read 4k which should cover most of the headers we're after
self.data = f.read(4096)
if len(self.data) < ELFFile.EI_NIDENT + 4:
raise NotELFFileError("%s is not an ELF" % self.name)
self.my_assert(self.data[0], 0x7f)
self.my_assert(self.data[1], ord('E'))
self.my_assert(self.data[2], ord('L'))
self.my_assert(self.data[3], ord('F'))
if self.bits == 0:
if self.data[ELFFile.EI_CLASS] == ELFFile.ELFCLASS32:
self.bits = 32
elif self.data[ELFFile.EI_CLASS] == ELFFile.ELFCLASS64:
self.bits = 64
else:
# Not 32-bit or 64.. lets assert
raise NotELFFileError("ELF but not 32 or 64 bit.")
elif self.bits == 32:
self.my_assert(self.data[ELFFile.EI_CLASS], ELFFile.ELFCLASS32)
elif self.bits == 64:
self.my_assert(self.data[ELFFile.EI_CLASS], ELFFile.ELFCLASS64)
else:
raise NotELFFileError("Must specify unknown, 32 or 64 bit size.")
self.my_assert(self.data[ELFFile.EI_VERSION], ELFFile.EV_CURRENT)
self.sex = self.data[ELFFile.EI_DATA]
if self.sex == ELFFile.ELFDATANONE:
raise NotELFFileError("self.sex == ELFDATANONE")
elif self.sex == ELFFile.ELFDATA2LSB:
self.sex = "<"
elif self.sex == ELFFile.ELFDATA2MSB:
self.sex = ">"
else:
raise NotELFFileError("Unknown self.sex")
def osAbi(self):
return self.data[ELFFile.EI_OSABI]
def abiVersion(self):
return self.data[ELFFile.EI_ABIVERSION]
def abiSize(self):
return self.bits
def isLittleEndian(self):
return self.sex == "<"
def isBigEndian(self):
return self.sex == ">"
def getShort(self, offset):
return struct.unpack_from(self.sex+"H", self.data, offset)[0]
def getWord(self, offset):
return struct.unpack_from(self.sex+"i", self.data, offset)[0]
def isDynamic(self):
"""
Return True if there is a .interp segment (therefore dynamically
linked), otherwise False (statically linked).
"""
offset = self.getWord(self.bits == 32 and 0x1C or 0x20)
size = self.getShort(self.bits == 32 and 0x2A or 0x36)
count = self.getShort(self.bits == 32 and 0x2C or 0x38)
for i in range(0, count):
p_type = self.getWord(offset + i * size)
if p_type == ELFFile.PT_INTERP:
return True
return False
def machine(self):
"""
We know the sex stored in self.sex and we
know the position
"""
return self.getShort(ELFFile.E_MACHINE)
def run_objdump(self, cmd, d):
import bb.process
import sys
if cmd in self.objdump_output:
return self.objdump_output[cmd]
objdump = d.getVar('OBJDUMP', True)
env = os.environ.copy()
env["LC_ALL"] = "C"
env["PATH"] = d.getVar('PATH', True)
try:
bb.note("%s %s %s" % (objdump, cmd, self.name))
self.objdump_output[cmd] = bb.process.run([objdump, cmd, self.name], env=env, shell=False)[0]
return self.objdump_output[cmd]
except Exception as e:
bb.note("%s %s %s failed: %s" % (objdump, cmd, self.name, e))
return ""
def elf_machine_to_string(machine):
"""
Return the name of a given ELF e_machine field or the hex value as a string
if it isn't recognised.
"""
try:
return {
0x02: "SPARC",
0x03: "x86",
0x08: "MIPS",
0x14: "PowerPC",
0x28: "ARM",
0x2A: "SuperH",
0x32: "IA-64",
0x3E: "x86-64",
0xB7: "AArch64"
}[machine]
except:
return "Unknown (%s)" % repr(machine)
if __name__ == "__main__":
import sys
elf = ELFFile(sys.argv[1])
elf.open()
print(elf.isDynamic())
|
