Struct Elf 

pub struct Elf { /* private fields */ }

These fields contain Linux Executable Linkable Format (ELF) metadata.

Implementations

impl Elf

pub fn get_creation_date(&self) -> Option<&Timestamp>

Extracted when possible from the file’s metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

pub fn set_creation_date(&mut self, creation_date_arg: Timestamp)

Extracted when possible from the file’s metadata. Indicates when it was built or compiled. It can also be faked by malware creators.

pub fn get_architecture(&self) -> Option<&String>

Machine architecture of the ELF file.

pub fn set_architecture(&mut self, architecture_arg: String)

Machine architecture of the ELF file.

Example

x86-64

pub fn get_byte_order(&self) -> Option<&String>

Byte sequence of ELF file.

pub fn set_byte_order(&mut self, byte_order_arg: String)

Byte sequence of ELF file.

Example

Little Endian

pub fn get_cpu_type(&self) -> Option<&String>

CPU type of the ELF file.

pub fn set_cpu_type(&mut self, cpu_type_arg: String)

CPU type of the ELF file.

Example

Intel

pub fn get_go_import_hash(&self) -> Option<&String>

A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

The algorithm used to calculate the Go symbol hash and a reference implementation are available here.

pub fn set_go_import_hash(&mut self, go_import_hash_arg: String)

A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

The algorithm used to calculate the Go symbol hash and a reference implementation are available here.

Example

10bddcb4cee42080f76c88d9ff964491

pub fn get_go_imports_names_entropy(&self) -> Option<&u64>

Shannon entropy calculation from the list of Go imports.

pub fn set_go_imports_names_entropy( &mut self, go_imports_names_entropy_arg: u64, )

Shannon entropy calculation from the list of Go imports.

pub fn get_go_imports_names_var_entropy(&self) -> Option<&u64>

Variance for Shannon entropy calculation from the list of Go imports.

pub fn set_go_imports_names_var_entropy( &mut self, go_imports_names_var_entropy_arg: u64, )

Variance for Shannon entropy calculation from the list of Go imports.

pub fn get_go_imports(&self) -> Option<&String>

List of imported Go language element names and types.

pub fn set_go_imports(&mut self, go_imports_arg: String)

List of imported Go language element names and types.

pub fn get_go_stripped(&self) -> Option<&bool>

Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.

pub fn set_go_stripped(&mut self, go_stripped_arg: bool)

Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.

pub fn get_header_class(&self) -> Option<&String>

Header class of the ELF file.

pub fn set_header_class(&mut self, header_class_arg: String)

Header class of the ELF file.

pub fn get_header_data(&self) -> Option<&String>

Data table of the ELF header.

pub fn set_header_data(&mut self, header_data_arg: String)

Data table of the ELF header.

pub fn get_header_os_abi(&self) -> Option<&String>

Application Binary Interface (ABI) of the Linux OS.

pub fn set_header_os_abi(&mut self, header_os_abi_arg: String)

Application Binary Interface (ABI) of the Linux OS.

pub fn get_header_type(&self) -> Option<&String>

Header type of the ELF file.

pub fn set_header_type(&mut self, header_type_arg: String)

Header type of the ELF file.

pub fn get_header_version(&self) -> Option<&String>

Version of the ELF header.

pub fn set_header_version(&mut self, header_version_arg: String)

Version of the ELF header.

pub fn get_header_abi_version(&self) -> Option<&String>

Version of the ELF Application Binary Interface (ABI).

pub fn set_header_abi_version(&mut self, header_abi_version_arg: String)

Version of the ELF Application Binary Interface (ABI).

pub fn get_header_entrypoint(&self) -> Option<&u64>

Header entrypoint of the ELF file.

pub fn set_header_entrypoint(&mut self, header_entrypoint_arg: u64)

Header entrypoint of the ELF file.

pub fn get_header_object_version(&self) -> Option<&String>

“0x1” for original ELF files.

pub fn set_header_object_version(&mut self, header_object_version_arg: String)

“0x1” for original ELF files.

pub fn get_import_hash(&self) -> Option<&String>

A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

This is an ELF implementation of the Windows PE imphash.

pub fn set_import_hash(&mut self, import_hash_arg: String)

A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.

This is an ELF implementation of the Windows PE imphash.

Example

d41d8cd98f00b204e9800998ecf8427e

pub fn get_imports_names_entropy(&self) -> Option<&u64>

Shannon entropy calculation from the list of imported element names and types.

pub fn set_imports_names_entropy(&mut self, imports_names_entropy_arg: u64)

Shannon entropy calculation from the list of imported element names and types.

pub fn get_imports_names_var_entropy(&self) -> Option<&u64>

Variance for Shannon entropy calculation from the list of imported element names and types.

pub fn set_imports_names_var_entropy( &mut self, imports_names_var_entropy_arg: u64, )

Variance for Shannon entropy calculation from the list of imported element names and types.

pub fn get_sections(&self) -> &Vec<String>

An array containing an object for each section of the ELF file.

The keys that should be present in these objects are defined by sub-fields underneath elf.sections.*.

pub fn add_section(&mut self, section_arg: String)

An array containing an object for each section of the ELF file.

The keys that should be present in these objects are defined by sub-fields underneath elf.sections.*.

pub fn get_sections_flags(&self) -> Option<&String>

ELF Section List flags.

pub fn set_sections_flags(&mut self, sections_flags_arg: String)

ELF Section List flags.

pub fn get_sections_name(&self) -> Option<&String>

ELF Section List name.

pub fn set_sections_name(&mut self, sections_name_arg: String)

ELF Section List name.

pub fn get_sections_physical_offset(&self) -> Option<&String>

ELF Section List offset.

pub fn set_sections_physical_offset( &mut self, sections_physical_offset_arg: String, )

ELF Section List offset.

pub fn get_sections_type(&self) -> Option<&String>

ELF Section List type.

pub fn set_sections_type(&mut self, sections_type_arg: String)

ELF Section List type.

pub fn get_sections_physical_size(&self) -> Option<&u64>

ELF Section List physical size.

pub fn set_sections_physical_size(&mut self, sections_physical_size_arg: u64)

ELF Section List physical size.

pub fn get_sections_var_entropy(&self) -> Option<&u64>

Variance for Shannon entropy calculation from the section.

pub fn set_sections_var_entropy(&mut self, sections_var_entropy_arg: u64)

Variance for Shannon entropy calculation from the section.

pub fn get_sections_virtual_address(&self) -> Option<&u64>

ELF Section List virtual address.

pub fn set_sections_virtual_address( &mut self, sections_virtual_address_arg: u64, )

ELF Section List virtual address.

pub fn get_sections_virtual_size(&self) -> Option<&u64>

ELF Section List virtual size.

pub fn set_sections_virtual_size(&mut self, sections_virtual_size_arg: u64)

ELF Section List virtual size.

pub fn get_sections_entropy(&self) -> Option<&u64>

Shannon entropy calculation from the section.

pub fn set_sections_entropy(&mut self, sections_entropy_arg: u64)

Shannon entropy calculation from the section.

pub fn get_sections_chi2(&self) -> Option<&u64>

Chi-square probability distribution of the section.

pub fn set_sections_chi2(&mut self, sections_chi2_arg: u64)

Chi-square probability distribution of the section.

pub fn get_exports(&self) -> &Vec<String>

List of exported element names and types.

pub fn add_export(&mut self, export_arg: String)

List of exported element names and types.

pub fn get_imports(&self) -> &Vec<String>

List of imported element names and types.

pub fn add_import(&mut self, import_arg: String)

List of imported element names and types.

pub fn get_shared_libraries(&self) -> &Vec<String>

List of shared libraries used by this ELF object.

pub fn add_shared_librarie(&mut self, shared_librarie_arg: String)

List of shared libraries used by this ELF object.

pub fn get_telfhash(&self) -> Option<&String>

telfhash symbol hash for ELF file.

pub fn set_telfhash(&mut self, telfhash_arg: String)

telfhash symbol hash for ELF file.

pub fn get_segments(&self) -> &Vec<String>

An array containing an object for each segment of the ELF file.

The keys that should be present in these objects are defined by sub-fields underneath elf.segments.*.

pub fn add_segment(&mut self, segment_arg: String)

An array containing an object for each segment of the ELF file.

The keys that should be present in these objects are defined by sub-fields underneath elf.segments.*.

pub fn get_segments_type(&self) -> Option<&String>

ELF object segment type.

pub fn set_segments_type(&mut self, segments_type_arg: String)

ELF object segment type.

pub fn get_segments_sections(&self) -> Option<&String>

ELF object segment sections.

pub fn set_segments_sections(&mut self, segments_sections_arg: String)

ELF object segment sections.

Trait Implementations

impl Clone for Elf

fn clone(&self) -> Elf

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for Elf

fn default() -> Elf

Returns the “default value” for a type.

impl Serialize for Elf

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.