Module elf 

ELF reader and writer with byte-identical round-trip.

Handles both ELFCLASS32 and ELFCLASS64 little-endian images. The parsed representation always uses 64-bit-shaped headers (Ehdr64, Phdr64, Shdr64) regardless of input class — 32-bit fields are zero-extended on parse and truncated on write. The on-disk format is recorded in Elf64File::class and used to dispatch the right header layout when serialising.

The contract: for any supported input bytes, Elf64File::parse(bytes)?.write_to_vec() == bytes.

Anything not in scope for this crate is preserved as opaque bytes and re-emitted verbatim. Section contents (bytes inside .text, .rodata, .symtab, etc.) are never interpreted here — that belongs to the arch backends and analysis crates.

Structs

Ehdr64

Parsed ELF64 ELF header.

Elf64File

A parsed ELF64 file in a form that round-trips byte-identically.

Phdr64

Parsed ELF64 program header entry.

Shdr64

Parsed ELF64 section header entry.

Enums

ElfClass

Whether the on-disk image used 32-bit or 64-bit headers. Recorded at parse time and consulted on write to round-trip the original byte layout exactly.

Error

Errors surfaced when parsing or writing an ELF64 file.

Constants

ELF_MAGIC

ELF magic bytes (\x7fELF) at the start of e_ident.

EM_386

e_machine value for i386 (32-bit x86).

EM_AARCH64

e_machine value for AArch64.

EM_BPF

e_machine value for Linux eBPF.

EM_SBF

e_machine value for Solana SBF (classic sBPFv1 / sBPFv2). Not assigned in the GABI registry but used by the Solana toolchain and Agave loader for on-chain programs.

EM_X86_64

e_machine value for x86-64.

R_BPF_64_32

R_BPF_64_64

R_BPF_64_ABS32

R_BPF_64_ABS64

R_BPF_64_NODYLD32

R_BPF_64_RELATIVE

Solana-specific dynamic relocation: an absolute 64-bit pointer adjusted at load time by the program’s load address. Used by BPFLoaderUpgradeable for data refs.

R_BPF_NONE

BPF relocation types (LLVM lib/Target/BPF/MCTargetDesc/BPFELFObjectWriter.cpp). R_BPF_64_32 is the one we care about for syscall name resolution — the call <imm> form. Other types apply to data references and lddw r, imm64 slots; we recognise the names but don’t need to act on them for layer 1.

SHF_EXECINSTR

sh_flags bit indicating the section contains executable instructions.

SHT_DYNSYM

sh_type for the dynamic-linking symbol table (always present in dynamic executables and shared objects).

SHT_REL

sh_type for an ELF relocation table (no addend) — Elf64_Rel entries, 16 bytes each: r_offset:8 ; r_info:8. Used by BPF (LLVM emits SHT_REL, not SHT_RELA, for BPF objects).

SHT_RELA

sh_type for a relocation table with explicit addends (Elf64_Rela).

SHT_STRTAB

sh_type for a string table.

SHT_SYMTAB

sh_type for a fully-linked symbol table.

Functions

is_elf

Returns true if bytes start with the ELF magic.

is_elf64_le

Returns true iff bytes are an ELF little-endian image of either class — the flavors Elf64File::parse handles. Callers that route by format (e.g. the CLI’s round-trip pipeline) should gate on this and fall through to a byte-copy for unsupported variants so the round-trip contract still holds.

Type Aliases

Result