smda 0.6.2

Recursive x86/x64/AArch64 disassembler library for control-flow recovery from memory dumps. Iced-x86 + disarm64-backed; zero-copy.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

use crate::{BinaryInfo, Result, demangle};

#[derive(Debug)]
pub struct ElfSymbolProvider {
    func_symbols: std::collections::HashMap<u64, String>,
}

impl ElfSymbolProvider {
    pub fn new() -> Result<Self> {
        Ok(Self {
            func_symbols: std::collections::HashMap::new(),
        })
    }

    pub fn update(&mut self, binary_info: &BinaryInfo) -> Result<()> {
        // Symbol sources handled here: the ELF entry point (so the OEP
        // gets a friendly label) and any symbols in `.symtab` /
        // `.dynsym` whose type is `STT_FUNC`. Imported-API resolution
        // (PLT / GOT slot → symbol-name via `.rela.plt` / `.rela.dyn`)
        // is handled separately by `elf::extract_elf_dynamic_apis`,
        // which feeds `Disassembler::addr_to_api`. Don't duplicate
        // that here — keeps the two concerns (local function names
        // vs. imported APIs) cleanly separated.
        if let goblin::Object::Elf(elf) = goblin::Object::parse(binary_info.raw_data)? {
            self.parse_oep(&elf)?;
            self.parse_symbols(&elf.syms, &elf.strtab)?;
            self.parse_symbols(&elf.dynsyms, &elf.strtab)?;
        }
        Ok(())
    }

    fn parse_oep(&mut self, elf: &goblin::elf::Elf) -> Result<()> {
        self.func_symbols
            .insert(elf.header.e_entry, "original_entry_point".to_string());
        Ok(())
    }

    fn parse_symbols(
        &mut self,
        symbols: &goblin::elf::sym::Symtab,
        strtab: &goblin::strtab::Strtab,
    ) -> Result<()> {
        for symbol in symbols {
            if symbol.is_function() && symbol.st_value != 0 {
                let raw = strtab.get_at(symbol.st_name).unwrap_or("");
                // 0.4.2 (N3): demangle Rust-mangled symbols in place. Non-Rust
                // names pass through unchanged.
                let func_name = demangle::maybe_demangle(raw);
                self.func_symbols.insert(symbol.st_value, func_name);
            }
        }
        Ok(())
    }

    pub fn get_functions_symbols(&self) -> Result<&std::collections::HashMap<u64, String>> {
        Ok(&self.func_symbols)
    }
}