Module goblin::elf

The generic ELF module, which gives access to ELF constants and other helper functions, which are independent of ELF bithood. Also defines an ELF struct which has a parse method which returns a wrapped Elf64 or Elf32 binary.

To access the fields of the contents of the binary (i.e., ph.p_type), instead of directly getting the struct fields, you call the similarly named methods.

Example

use std::fs::File;

pub fn read (fd: &mut File) {
  match goblin::elf::Elf::parse(fd) {
    Ok(binary) => {
      let entry = binary.entry;
      for ph in binary.program_headers {
        if ph.p_type() == goblin::elf::program_header::PT_LOAD {
          let mut _buf = vec![0u8; ph.p_filesz() as usize];
          // read responsibly
         }
      }
    },
    Err(_) => ()
  }
}

This will properly access the underlying 32-bit or 64-bit binary automatically. Note that since 32-bit binaries typically have shorter 32-bit values in some cases (specifically for addresses and pointer values), these values are upcasted to u64/i64s when appropriate.

See goblin::elf::Elf for more information.

You are still free to use the specific 32-bit or 64-bit versions by accessing them through goblin::elf64, etc., but you will have to parse and/or construct the various components yourself. In other words, there is no 32/64-bit Elf struct, only the unified version.

Note

To use the automagic ELF datatype union parser, you must enable/opt-in to the elf64, elf32, and endian_fd features if you disable default.

Modules

dyn
header
program_header
rela
section_header
strtab	A byte-offset based string table. Commonly used in ELF binaries, and also archives.
sym

Structs

Elf	A "Unified" ELF binary. Contains either 32-bit or 64-bit underlying structs. To access the fields of the underlying struct, call the field name as a method, e.g., dyn.d_val()
ElfVec	A Union wrapper for a vector or list of wrapped ELF objects. Lazily converts its contents to a wrapped version during iteration.
ElfVecIter	Simple iterator implementation. Lazily converts underlying vector stream to wrapped version. Currently clones the element because I'm also lazy.
ElfVecIterBorrow	A hack so you can borrow the iterator instead of taking ownership if you don't want to. Doesn't work very well, need more robust solution.

Enums

Unified

Simple union wrapper for 32/64 bit versions of the structs. Really just the Either enum. Each wrapped elf object (Sym, Dyn) implements a deref coercion into the generic trait for that object, hence you access the fields via methods instead of direct field access. You shouldn't need to really worry about this enum though.

Type Definitions

Dynamic
ProgramHeaders
Relas
SectionHeaders
Syms