Struct ElfBinary 

pub struct ElfBinary {
    pub load_address: u64,
    pub segments: Vec<LoadSegment>,
    pub analysis: ElfAnalysis,
    pub architecture: Arch,
    pub needed_libraries: Vec<String>,
    pub kind: ElfKind,
    pub program_headers: ProgramHeaderTable,
    pub tls: Option<TlsSegment>,
}

A parsed and loaded ELF binary.

Every PT_LOAD segment is recorded as a mapped region. File-backed bytes are preserved per segment, and any p_memsz > p_filesz tail is modeled as implicit zero-fill rather than materialized up front.

ElfBinary::analysis is populated by two analysis passes run at parse time:

• Entrypoint: e_entry from the ELF header.
• Known functions: all STT_FUNC symbols found in .symtab or .dynsym.

Fields

load_address: u64

segments: Vec<LoadSegment>

analysis: ElfAnalysis

architecture: Arch

needed_libraries: Vec<String>

Shared-library sonames from the .dynamic section’s DT_NEEDED entries, in link order (e.g. libc.so.6).

kind: ElfKind

The file type.

program_headers: ProgramHeaderTable

The program header table’s location.

tls: Option<TlsSegment>

The thread-local storage template, if the file has one.

Implementations

impl ElfBinary

pub fn parse(file_bytes: &[u8]) -> Result<Self, ElfError>

Parse an ELF binary from raw file bytes.

Records every PT_LOAD segment as a mapped region, reads the entrypoint from the ELF header, and collects all STT_FUNC symbols from .symtab and .dynsym.

Trait Implementations

impl BinaryFormat for ElfBinary

fn is_known_read_only(&self, addr: u64) -> bool

ELF program headers carry PF_W, so a mapped segment without it is proven read-only for the lifetime of the process.

fn entry_points(&self) -> Vec<u64>

Entry points are the ELF entrypoint plus all known function starts.

fn entrypoint(&self) -> Option<u64>

The ELF entry point (e_entry from the header).

fn load_address(&self) -> u64

The lowest virtual address mapped by this binary image.

fn architecture(&self) -> Arch

Name of the architecture, should use embedded information from known binary format, or raw values from the blob.

fn os(&self) -> TargetOs

The operating system this binary targets, inferred from the container format. Defaults to TargetOs::Unknown; PE returns Windows, ELF Linux.

fn byte_at(&self, addr: u64) -> Option<u8>

Return the byte mapped at addr, or None if the address is unmapped.

fn bytes_at(&self, addr: u64) -> Option<&[u8]>

Return the contiguous bytes available at addr.

fn is_executable(&self, addr: u64) -> bool

Return true if addr lies in an executable region of this binary image. Defaults to “mapped” for formats that don’t track per-region permissions; formats with permission information (e.g. ELF segment flags) should override this.

fn segment_bounds(&self, addr: u64) -> Option<(u64, u64)>

The [start, end) bounds of the mapped region containing addr, if any. Used to key per-segment facts (e.g. executability propositions) so repeated queries in one region collapse to a single entry. Defaults to None for formats that do not expose their segments.

fn is_known_writable(&self, addr: u64) -> bool

Return true only if addr lies in a region known to be writable (from the container’s segment flags). Passes that fold a value out of initialized memory use this to refuse mutable memory — e.g. a GOT slot the dynamic linker overwrites at load time. Defaults to false (“not proven writable”); Blob keeps the default.

fn linked_libraries(&self) -> Vec<String>

Library names this binary links against: ELF DT_NEEDED sonames, PE import-directory DLL names (original case; matching is case-insensitive). Empty when the format has no such notion (Blob).

fn mapped_regions(&self) -> Vec<(u64, Vec<u8>, bool, bool)>

Enumerate the binary’s mapped regions as (start, bytes, executable, writable).

fn symbol_name(&self, addr: u64) -> Option<&str>

Return the symbol name for the function starting at addr, if the binary format has one (e.g. from an ELF symbol table). Returns None for formats with no symbol information.

fn is_external_symbol(&self, addr: u64) -> bool

Returns true if addr is an external (imported) function stub, e.g. a PLT thunk. The recursive disassembler will not lift the body of external functions. Defaults to false.

fn import_symbol_name(&self, addr: u64) -> Option<&str>

Return the imported symbol whose resolver slot lives at addr, if any.

fn import_library(&self, addr: u64) -> Option<&str>

Return the name of the library providing the external function stub at addr: the PE import-directory DLL, or the ELF .gnu.version_r soname the symbol’s version requirement points at. None when the format does not record a per-symbol source library (e.g. an unversioned ELF import).

fn hex_rows( &self, addr: u64, len: usize, width: usize, ) -> Vec<(u64, Vec<Option<u8>>)>

Return rows of bytes suitable for a hex viewer.

fn contains(&self, addr: u64) -> bool

Return true if addr is mapped by this binary image.

fn read_bytes(&self, addr: u64, n: usize) -> Option<Vec<u8>>

Read n bytes at virtual address addr.

fn read_uint(&self, addr: u64, size: usize) -> Option<u64>

Read a little-endian unsigned integer of size bytes (1..=8) at addr.

fn read_cstring(&self, addr: u64, max_len: Option<usize>) -> Option<Vec<u8>>

Read a null-terminated C string at virtual address addr, returning the bytes up to (but not including) the null terminator.

fn read_printable_cstring( &self, addr: u64, max_len: Option<usize>, ) -> Option<Vec<u8>>

Read a null-terminated C string at virtual address addr, requiring every byte before the null terminator to be printable ASCII.

impl Clone for ElfBinary

fn clone(&self) -> ElfBinary

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ElfBinary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.