Module elf 

ELF reader and writer with byte-identical round-trip.

Handles both ELFCLASS32 and ELFCLASS64 little-endian images. The parsed representation always uses 64-bit-shaped headers (Ehdr64, Phdr64, Shdr64) regardless of input class — 32-bit fields are zero-extended on parse and truncated on write. The on-disk format is recorded in Elf64File::class and used to dispatch the right header layout when serialising.

The contract: for any supported input bytes, Elf64File::parse(bytes)?.write_to_vec() == bytes.

Anything not in scope for this crate is preserved as opaque bytes and re-emitted verbatim. Section contents (bytes inside .text, .rodata, .symtab, etc.) are never interpreted here — that belongs to the arch backends and analysis crates.

Structs

Ehdr64

Parsed ELF64 ELF header.

Elf64File

A parsed ELF64 file in a form that round-trips byte-identically.

Phdr64

Parsed ELF64 program header entry.

Shdr64

Parsed ELF64 section header entry.

Enums

ElfClass

Whether the on-disk image used 32-bit or 64-bit headers. Recorded at parse time and consulted on write to round-trip the original byte layout exactly.

Error

Errors surfaced when parsing or writing an ELF64 file.

Constants

EM_386

e_machine value for i386 (32-bit x86).

EM_AARCH64

e_machine value for AArch64.

EM_X86_64

e_machine value for x86-64.

SHF_EXECINSTR

sh_flags bit indicating the section contains executable instructions.

SHT_DYNSYM

sh_type for the dynamic-linking symbol table (always present in dynamic executables and shared objects).

SHT_RELA

sh_type for a relocation table with explicit addends (Elf64_Rela).

SHT_STRTAB

sh_type for a string table.

SHT_SYMTAB

sh_type for a fully-linked symbol table.

Functions

is_elf

Returns true if bytes start with the ELF magic.

is_elf64_le

Returns true iff bytes are an ELF little-endian image of either class — the flavors Elf64File::parse handles. Callers that route by format (e.g. the CLI’s round-trip pipeline) should gate on this and fall through to a byte-copy for unsupported variants so the round-trip contract still holds.

Type Aliases

Result