diff --git a/exeinfo/Program.cs b/exeinfo/Program.cs index 67e7741..eadb931 100644 --- a/exeinfo/Program.cs +++ b/exeinfo/Program.cs @@ -55,6 +55,7 @@ namespace exeinfo IExecutable coffExe = new COFF(args[0]); IExecutable peExe = new PE(args[0]); IExecutable geosExe = new Geos(args[0]); + IExecutable elfExe = new ELF(args[0]); if(neExe.Recognized) { @@ -284,6 +285,17 @@ namespace exeinfo foreach(string str in coffExe.Strings) Console.WriteLine("\t\t{0}", str); } } + else if(elfExe.Recognized) + { + recognized = true; + Console.Write(elfExe.Information); + + if(elfExe.Strings != null && elfExe.Strings.Any()) + { + Console.WriteLine("\tStrings:"); + foreach(string str in elfExe.Strings) Console.WriteLine("\t\t{0}", str); + } + } if(geosExe.Recognized) { diff --git a/exeinfogui/MainForm.xeto.cs b/exeinfogui/MainForm.xeto.cs index 8f44ec3..003afba 100644 --- a/exeinfogui/MainForm.xeto.cs +++ b/exeinfogui/MainForm.xeto.cs @@ -113,6 +113,7 @@ namespace exeinfogui IExecutable coffExe = new COFF(dlgOpen.FileName); IExecutable peExe = new libexeinfo.PE(dlgOpen.FileName); IExecutable geosExe = new Geos(dlgOpen.FileName); + IExecutable elfExe = new ELF(dlgOpen.FileName); IExecutable recognizedExe = null; if(mzExe.Recognized) @@ -176,6 +177,7 @@ namespace exeinfogui } } else if(coffExe.Recognized) recognizedExe = coffExe; + else if(elfExe.Recognized) recognizedExe = elfExe; else if(geosExe.Recognized) recognizedExe = geosExe; else txtType.Text = "Format not recognized"; diff --git a/libexeinfo/ELF/Consts.cs b/libexeinfo/ELF/Consts.cs new file mode 100644 index 0000000..f6149fc --- /dev/null +++ b/libexeinfo/ELF/Consts.cs @@ -0,0 +1,169 @@ +namespace libexeinfo +{ + public partial class ELF + { + const int EI_NIDENT = 16; + + const uint eFlagsPariscMask = 0xFFFF0000; + /// Architecture version + const uint EF_PARISC_ARCH = 0x0000FFFF; + /// PA-RISC 1.0 + const uint EFA_PARISC_1_0 = 0x020B; + /// PA-RISC 1.1 + const uint EFA_PARISC_1_1 = 0x0210; + /// PA-RISC 2.0 + const uint EFA_PARISC_2_0 = 0x0214; + + static readonly byte[] ELFMAG = {0x7F, 0x45, 0x4C, 0x46}; + + static readonly string[] SectionNames = + { + // This section holds uninitialized data that contribute to the program's memory image. By definition, the system initializes the data with zeros when the program begins to run. The section occupies no file space, as indicated by the section type, SHT_NOBITS. + ".bss", + // This section holds uninitialized data that contribute to the program's memory image. By definition, the system initializes the data with zeros when the program begins to run. The section occupies no file space, as indicated by the section type, SHT_NOBITS. + ".lbss", + // This section holds version control information. + ".comment", + // These sections hold initialized data that contribute to the program's memory image. + ".data", + // These sections hold initialized data that contribute to the program's memory image. + ".ldata", + // These sections hold initialized data that contribute to the program's memory image. + ".data1", + // These sections hold initialized data that contribute to the program's memory image. + ".ldata1", + // This section holds information for symbolic debugging. The contents are unspecified. All section names with the prefix .debug are reserved for future use in the ABI. + ".debug", + // This section holds dynamic linking information. The section's attributes will include the SHF_ALLOC bit. Whether the SHF_WRITE bit is set is processor specific. See Chapter 5 for more information. + ".dynamic", + // This section holds strings needed for dynamic linking, most commonly the strings that represent the names associated with symbol table entries. See Chapter 5 for more information. + ".dynstr", + // This section holds the dynamic linking symbol table, as described in ``Symbol Table''. See Chapter 5 for more information. + ".dynsym", + // This section holds the unwind function table. + ".eh_frame", + // This section holds executable instructions that contribute to the process termination code. That is, when a program exits normally, the system arranges to execute the code in this section. + ".fini", + // This section holds an array of function pointers that contributes to a single termination array for the executable or shared object containing the section. + ".fini_array", + // This section holds the global offset table. See ``Coding Examples'' in Chapter 3, ``Special Sections'' in Chapter 4, and ``Global Offset Table'' in Chapter 5 of the processor supplement for more information. + ".got", + // This section holds the global offset table. See ``Coding Examples'' in Chapter 3, ``Special Sections'' in Chapter 4, and ``Global Offset Table'' in Chapter 5 of the processor supplement for more information. + ".lgot", + // This section holds a symbol hash table. See ``Hash Table'' in Chapter 5 for more information. + ".hash", + // This section holds executable instructions that contribute to the process initialization code. When a program starts to run, the system arranges to execute the code in this section before calling the main program entry point (called main for C programs). + ".init", + // This section holds an array of function pointers that contributes to a single initialization array for the executable or shared object containing the section. + ".init_array", + // This section holds the path name of a program interpreter. If the file has a loadable segment that includes relocation, the sections' attributes will include the SHF_ALLOC bit; otherwise, that bit will be off. See Chapter 5 for more information. + ".interp", + // This section holds line number information for symbolic debugging, which describes the correspondence between the source program and the machine code. The contents are unspecified. + ".line", + // This section holds information in the format that ``Note Section''. in Chapter 5 describes. + ".note", + // This section holds the procedure linkage table. See ``Special Sections'' in Chapter 4 and ``Procedure Linkage Table'' in Chapter 5 of the processor supplement for more information. + ".lplt", + // This section holds the procedure linkage table. See ``Special Sections'' in Chapter 4 and ``Procedure Linkage Table'' in Chapter 5 of the processor supplement for more information. + ".plt", + // This section holds an array of function pointers that contributes to a single pre-initialization array for the executable or shared object containing the section. + ".preinit_array", + // These sections hold relocation information, as described in ``Relocation''. If the file has a loadable segment that includes relocation, the sections' attributes will include the SHF_ALLOC bit; otherwise, that bit will be off. Conventionally, name is supplied by the section to which the relocations apply. Thus a relocation section for .text normally would have the name .rel.text or .rela.text. + ".relname", + // These sections hold relocation information, as described in ``Relocation''. If the file has a loadable segment that includes relocation, the sections' attributes will include the SHF_ALLOC bit; otherwise, that bit will be off. Conventionally, name is supplied by the section to which the relocations apply. Thus a relocation section for .text normally would have the name .rel.text or .rela.text. + ".relaname", + // These sections hold read-only data that typically contribute to a non-writable segment in the process image. See ``Program Header'' in Chapter 5 for more information. + ".rodata", + // These sections hold read-only data that typically contribute to a non-writable segment in the process image. See ``Program Header'' in Chapter 5 for more information. + ".lrodata", + // These sections hold read-only data that typically contribute to a non-writable segment in the process image. See ``Program Header'' in Chapter 5 for more information. + ".rodata1", + // These sections hold read-only data that typically contribute to a non-writable segment in the process image. See ``Program Header'' in Chapter 5 for more information. + ".lrodata1", + // This section holds section names. + ".shstrtab", + // This section holds strings, most commonly the strings that represent the names associated with symbol table entries. If the file has a loadable segment that includes the symbol string table, the section's attributes will include the SHF_ALLOC bit; otherwise, that bit will be off. + ".strtab", + // This section holds a symbol table, as ``Symbol Table''. in this chapter describes. If the file has a loadable segment that includes the symbol table, the section's attributes will include the SHF_ALLOC bit; otherwise, that bit will be off. + ".symtab", + // This section holds the special symbol table section index array, as described above. The section's attributes will include the SHF_ALLOC bit if the associated symbol table section does; otherwise that bit will be off. + ".symtab_shndx", + // This section holds uninitialized thread-local data that contribute to the program's memory image. By definition, the system initializes the data with zeros when the data is instantiated for each new execution flow. The section occupies no file space, as indicated by the section type, SHT_NOBITS. Implementations need not support thread-local storage. + ".tbss", + // This section holds initialized thread-local data that contributes to the program's memory image. A copy of its contents is instantiated by the system for each new execution flow. Implementations need not support thread-local storage. + ".tdata", + // This section holds the ``text,'' or executable instructions, of a program. + ".text", + // This section holds the ``text,'' or executable instructions, of a program. + ".ltext", + // Names beginning .ARM.exidx name sections containing index entries for section unwinding. + ".ARM.exidx", + // Names beginning .ARM.extab name sections containing exception unwinding information. + ".ARM.extab", + // Names a section that contains a BPABI DLL dynamic linking pre-emption map. + ".ARM.preemptmap", + // Names a section that contains build attributes. + ".ARM.attributes", + // Name sections used by the Debugging Overlaid Programs ABI extension. + ".ARM.debug_overlay", + // Name sections used by the Debugging Overlaid Programs ABI extension. + ".ARM.overlay_table", + // This section holds initialized short data that contribute to the program memory image. + ".sdata", + // This section holds uninitialized short data that contribute to the program memory image. By definition, the system initializes the data with zeros when the program begins to run. + ".sbss", + // This section holds 4 byte read-only literals that contribute to the program memory image. Its purpose is to provide a list of unique 4-byte literals used by a program. + ".lit4", + // This section holds 8 byte read-only literals that contribute to the program memory image. Its purpose is to provide a list of unique 4-byte literals used by a program. + ".lit8", + // This section provides information on the program register usage to the system. + ".reginfo", + // This section contains information on each of the libraries used at static link time + ".liblist", + // This section provides additional dynamic linking information about symbols in an executable file that conflict with symbols defined in the dynamic shared libraries with which the file is linked. + ".conflict", + // This section contains a global pointer table. The global pointer table is described in "Global Data Area" in this chapter. The section is named .gptab.sbss,.gptab.sdata, gptab.bss, or .gptab.data depending on which data section the particular .gptab refers. + ".gptab", + // This section name is reserved and the contents of this type of section are unspecified. The section contents can be ignored. + ".ucode", + // This section contains symbol table information as emitted by the MIPS compilers. Its content is described in Chapter 10 of the MIPS Assembly Language Programmer’s Guide, order number ASM-01-DOC, (Copyright  1989, MIPS Computer Systems, Inc.). The information in this section is dependent on the location of other sections in the file; if an object is relocated, the section must be updated. Discard this section if an object file is relocated and the ABI compliant system does not update the section. + ".mdebug", + // This relocation section contains run-time entries for the .data and .sdata sections. + ".rel.dyn", + // This section holds DWARF 2.0 abbreviation tables. + ".debug_abbrev", + // This section holds the DWARF 2.0 lookup table to find the debugging information for an object by address. + ".debug_aranges", + // This section holds DWARF 2.0 virtual unwind information. + ".debug_frame", + // This section holds DWARF 2.0 debugging information entries. + ".debug_info", + // This section holds DWARF 2.0 line number information. + ".debug_line", + // This section holds DWARF 2.0 location lists. + ".debug_loc", + // This section holds DWARF 2.0 macro information. + ".debug_macinfo", + // This section holds the DWARF 2.0 lookup table to find the debugging information for an object by name. + ".debug_pubnames", + // This section holds string values for DWARF 2.0 attributes. + ".debug_str", + // Product-specific extension bits + ".PARISC.archext", + // Millicode + ".PARISC.milli", + // Unwind table + ".PARISC.unwind", + // Stack unwind and exception handling information + ".PARISC.unwind_info", + // This section contains tags. The size (sh_entsize) of each entry in this section is 8 and the alignment (sh_addralign) is 4. The relocation section .rela.tags, associated with the .tags section, should have the SHF_EXCLUDE attribute. + ".tags", + // This section contains data that enable a program to locate its tags. Locating tags is described in Tags below. + ".taglist", + // This section, which appears in object files only (not executable or shared objects), contains one entry for each entry in the .tags section. Each entry has STB_LOCAL binding and is of type STT_NOTYPE. The st_shndx and st_value fields of the entries specify the index of the section and the section offset to which the tag applies, respectively. + ".tagsym", + // This section on some operating systems (e.g. BeOS) contains application resources + ".rsrc" + }; + } +} \ No newline at end of file diff --git a/libexeinfo/ELF/ELF.cs b/libexeinfo/ELF/ELF.cs new file mode 100644 index 0000000..6a2cd96 --- /dev/null +++ b/libexeinfo/ELF/ELF.cs @@ -0,0 +1,167 @@ +using System; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Runtime.InteropServices; + +namespace libexeinfo +{ + public partial class ELF : IExecutable + { + List architectures; + Elf64_Ehdr Header; + + /// + /// Initializes a new instance of the class. + /// + /// Executable path. + public ELF(string path) + { + BaseStream = File.Open(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite); + + string pathDir = Path.GetDirectoryName(path); + string filename = Path.GetFileNameWithoutExtension(path); + string testPath = Path.Combine(pathDir, filename); + string resourceFilePath = null; + + Initialize(); + } + + /// + /// Initializes a new instance of the class. + /// + /// Stream containing the executable. + public ELF(Stream stream) + { + BaseStream = stream; + Initialize(); + } + + /// + /// Initializes a new instance of the class. + /// + /// Byte array containing the executable. + public ELF(byte[] data) + { + BaseStream = new MemoryStream(data); + Initialize(); + } + + public bool Recognized { get; private set; } + public string Type { get; private set; } + public IEnumerable Architectures => architectures; + public OperatingSystem RequiredOperatingSystem { get; } + public IEnumerable Strings { get; private set; } + public IEnumerable Segments { get; } + + /// + /// The that contains the executable represented by this instance + /// + public Stream BaseStream { get; } + public bool IsBigEndian { get; private set; } + + void Initialize() + { + Recognized = false; + if(BaseStream == null) return; + + byte[] buffer = new byte[Marshal.SizeOf(typeof(Elf64_Ehdr))]; + + BaseStream.Position = 0; + BaseStream.Read(buffer, 0, buffer.Length); + Header = BigEndianMarshal.ByteArrayToStructureLittleEndian(buffer); + Recognized = Header.ei_mag.SequenceEqual(ELFMAG); + + if(!Recognized) return; + + Type = "Executable and Linkable Format (ELF)"; + IsBigEndian = Header.ei_data == eiData.ELFDATA2MSB; + architectures = new List(); + + switch(Header.ei_class) + { + case eiClass.ELFCLASS32: + Header = UpBits(buffer, Header.ei_data == eiData.ELFDATA2MSB); + break; + case eiClass.ELFCLASS64: + Header = BigEndianMarshal.ByteArrayToStructureBigEndian(buffer); + Header.e_type = (eType)Swapping.Swap((ushort)Header.e_type); + Header.e_machine = (eMachine)Swapping.Swap((ushort)Header.e_machine); + Header.e_version = (eVersion)Swapping.Swap((uint)Header.e_version); + break; + default: return; + } + + if(Header.ei_data != eiData.ELFDATA2LSB && Header.ei_data != eiData.ELFDATA2MSB || + Header.ei_version != eiVersion.EV_CURRENT) return; + + List strings = new List(); + + if(strings.Count > 0) + { + strings.Sort(); + Strings = strings.Distinct(); + } + } + + static Elf64_Ehdr UpBits(byte[] buffer, bool bigEndian) + { + Elf32_Ehdr ehdr32 = bigEndian + ? BigEndianMarshal.ByteArrayToStructureBigEndian(buffer) + : BigEndianMarshal.ByteArrayToStructureLittleEndian(buffer); + return new Elf64_Ehdr + { + ei_mag = ehdr32.ei_mag, + ei_class = ehdr32.ei_class, + ei_data = ehdr32.ei_data, + ei_version = ehdr32.ei_version, + ei_osabi = ehdr32.ei_osabi, + ei_abiversion = ehdr32.ei_abiversion, + ei_pad = ehdr32.ei_pad, + e_type = bigEndian ? (eType)Swapping.Swap((ushort)ehdr32.e_type) : ehdr32.e_type, + e_machine = bigEndian ? (eMachine)Swapping.Swap((ushort)ehdr32.e_machine) : ehdr32.e_machine, + e_version = bigEndian ? (eVersion)Swapping.Swap((uint)ehdr32.e_version) : ehdr32.e_version, + e_entry = ehdr32.e_entry, + e_phoff = ehdr32.e_phoff, + e_shoff = ehdr32.e_shoff, + e_flags = ehdr32.e_flags, + e_ehsize = ehdr32.e_ehsize, + e_phentsize = ehdr32.e_phentsize, + e_phnum = ehdr32.e_phnum, + e_shentsize = ehdr32.e_shentsize, + e_shnum = ehdr32.e_shnum, + e_shstrndx = ehdr32.e_shstrndx + }; + } + + /// + /// Identifies if the specified executable is an Executable and Linkable Format + /// + /// true if the specified executable is an Executable and Linkable Format, false otherwise. + /// Executable path. + public static bool Identify(string path) + { + FileStream exeFs = File.Open(path, FileMode.Open, FileAccess.Read); + return Identify(exeFs); + } + + /// + /// Identifies if the specified executable is an Executable and Linkable Format + /// + /// true if the specified executable is an Executable and Linkable Format, false otherwise. + /// Stream containing the executable. + public static bool Identify(FileStream stream) + { + byte[] buffer = new byte[Marshal.SizeOf(typeof(Elf32_Ehdr))]; + + stream.Position = 0; + stream.Read(buffer, 0, buffer.Length); + IntPtr hdrPtr = Marshal.AllocHGlobal(buffer.Length); + Marshal.Copy(buffer, 0, hdrPtr, buffer.Length); + Elf32_Ehdr elfHdr = (Elf32_Ehdr)Marshal.PtrToStructure(hdrPtr, typeof(Elf32_Ehdr)); + Marshal.FreeHGlobal(hdrPtr); + + return elfHdr.ei_mag.SequenceEqual(ELFMAG); + } + } +} \ No newline at end of file diff --git a/libexeinfo/ELF/Enums.cs b/libexeinfo/ELF/Enums.cs new file mode 100644 index 0000000..33a21c3 --- /dev/null +++ b/libexeinfo/ELF/Enums.cs @@ -0,0 +1,931 @@ +// ReSharper disable InconsistentNaming + +using System; + +namespace libexeinfo +{ + public partial class ELF + { + enum eiClass : byte + { + /// Invalid class + ELFCLASSNONE = 0, + /// 32-bit objects + ELFCLASS32 = 1, + /// 64-bit objects + ELFCLASS64 = 2 + } + + enum eiData : byte + { + /// Invalid data encoding + ELFDATANONE = 0, + /// Little-endian + ELFDATA2LSB = 1, + /// Big-endian + ELFDATA2MSB = 2 + } + + enum eiOsabi : byte + { + /// No extensions or unspecified + ELFOSABI_NONE = 0, + /// Hewlett-Packard HP-UX + ELFOSABI_HPUX = 1, + /// NetBSD + ELFOSABI_NETBSD = 2, + /// GNU + ELFOSABI_GNU = 3, + /// Linux, historical - alias for ELFOSABI_GNU + ELFOSABI_LINUX = ELFOSABI_GNU, + /// Sun Solaris + ELFOSABI_SOLARIS = 6, + /// AIX + ELFOSABI_AIX = 7, + /// IRIX + ELFOSABI_IRIX = 8, + /// FreeBSD + ELFOSABI_FREEBSD = 9, + /// Compaq TRU64 UNIX + ELFOSABI_TRU64 = 10, + /// Novell Modesto + ELFOSABI_MODESTO = 11, + /// Open BSD + ELFOSABI_OPENBSD = 12, + /// Open VMS + ELFOSABI_OPENVMS = 13, + /// Hewlett-Packard Non-Stop Kernel + ELFOSABI_NSK = 14, + /// Amiga Research OS + ELFOSABI_AROS = 15, + /// The FenixOS highly scalable multi-core OS + ELFOSABI_FENIXOS = 16, + /// Nuxi CloudABI + ELFOSABI_CLOUDABI = 17, + /// Stratus Technologies OpenVOS + ELFOSABI_OPENVOS = 18, + /// The object contains symbol versioning extensions + ELFOSABI_ARM_AEABI = 64 + } + + enum eiVersion : byte + { + EV_NONE = (byte)eVersion.EV_NONE, + EV_CURRENT = (byte)eVersion.EV_CURRENT + } + + enum eMachine : ushort + { + /// No machine + EM_NONE = 0, + /// AT&T WE 32100 + EM_M32 = 1, + /// SPARC + EM_SPARC = 2, + /// Intel 80386 + EM_386 = 3, + /// Motorola 68000 + EM_68K = 4, + /// Motorola 88000 + EM_88K = 5, + /// Intel MCU + EM_IAMCU = 6, + /// Intel 80860 + EM_860 = 7, + /// MIPS I Architecture + EM_MIPS = 8, + /// IBM System/370 Processor + EM_S370 = 9, + /// MIPS RS3000 Little-endian + EM_MIPS_RS3_LE = 10, + /// Hewlett-Packard PA-RISC + EM_PARISC = 15, + /// Fujitsu VPP500 + EM_VPP500 = 17, + /// Enhanced instruction set SPARC + EM_SPARC32PLUS = 18, + /// Intel 80960 + EM_960 = 19, + /// PowerPC + EM_PPC = 20, + /// 64-bit PowerPC + EM_PPC64 = 21, + /// IBM System/390 Processor + EM_S390 = 22, + /// IBM SPU/SPC + EM_SPU = 23, + /// NEC V800 + EM_V800 = 36, + /// Fujitsu FR20 + EM_FR20 = 37, + /// TRW RH-32 + EM_RH32 = 38, + /// Motorola RCE + EM_RCE = 39, + /// ARM 32-bit architecture (AARCH32) + EM_ARM = 40, + /// Digital Alpha + EM_ALPHA = 41, + /// Hitachi SH + EM_SH = 42, + /// SPARC Version 9 + EM_SPARCV9 = 43, + /// Siemens TriCore embedded processor + EM_TRICORE = 44, + /// Argonaut RISC Core, Argonaut Technologies Inc. + EM_ARC = 45, + /// Hitachi H8/300 + EM_H8_300 = 46, + /// Hitachi H8/300H + EM_H8_300H = 47, + /// Hitachi H8S + EM_H8S = 48, + /// Hitachi H8/500 + EM_H8_500 = 49, + /// Intel IA-64 processor architecture + EM_IA_64 = 50, + /// Stanford MIPS-X + EM_MIPS_X = 51, + /// Motorola ColdFire + EM_COLDFIRE = 52, + /// Motorola M68HC12 + EM_68HC12 = 53, + /// Fujitsu MMA Multimedia Accelerator + EM_MMA = 54, + /// Siemens PCP + EM_PCP = 55, + /// Sony nCPU embedded RISC processor + EM_NCPU = 56, + /// Denso NDR1 microprocessor + EM_NDR1 = 57, + /// Motorola Star*Core processor + EM_STARCORE = 58, + /// Toyota ME16 processor + EM_ME16 = 59, + /// STMicroelectronics ST100 processor + EM_ST100 = 60, + /// Advanced Logic Corp. TinyJ embedded processor family + EM_TINYJ = 61, + /// AMD x86-64 architecture + EM_X86_64 = 62, + /// Sony DSP Processor + EM_PDSP = 63, + /// Digital Equipment Corp. PDP-10 + EM_PDP10 = 64, + /// Digital Equipment Corp. PDP-11 + EM_PDP11 = 65, + /// Siemens FX66 microcontroller + EM_FX66 = 66, + /// STMicroelectronics ST9+ 8/16 bit microcontroller + EM_ST9PLUS = 67, + /// STMicroelectronics ST7 8-bit microcontroller + EM_ST7 = 68, + /// Motorola MC68HC16 Microcontroller + EM_68HC16 = 69, + /// Motorola MC68HC11 Microcontroller + EM_68HC11 = 70, + /// Motorola MC68HC08 Microcontroller + EM_68HC08 = 71, + /// Motorola MC68HC05 Microcontroller + EM_68HC05 = 72, + /// Silicon Graphics SVx + EM_SVX = 73, + /// STMicroelectronics ST19 8-bit microcontroller + EM_ST19 = 74, + /// Digital VAX + EM_VAX = 75, + /// Axis Communications 32-bit embedded processor + EM_CRIS = 76, + /// Infineon Technologies 32-bit embedded processor + EM_JAVELIN = 77, + /// Element 14 64-bit DSP Processor + EM_FIREPATH = 78, + /// LSI Logic 16-bit DSP Processor + EM_ZSP = 79, + /// Donald Knuth's educational 64-bit processor + EM_MMIX = 80, + /// Harvard University machine-independent object files + EM_HUANY = 81, + /// SiTera Prism + EM_PRISM = 82, + /// Atmel AVR 8-bit microcontroller + EM_AVR = 83, + /// Fujitsu FR30 + EM_FR30 = 84, + /// Mitsubishi D10V + EM_D10V = 85, + /// Mitsubishi D30V + EM_D30V = 86, + /// NEC v850 + EM_V850 = 87, + /// Mitsubishi M32R + EM_M32R = 88, + /// Matsushita MN10300 + EM_MN10300 = 89, + /// Matsushita MN10200 + EM_MN10200 = 90, + /// picoJava + EM_PJ = 91, + /// OpenRISC 32-bit embedded processor + EM_OPENRISC = 92, + /// ARC International ARCompact processor + EM_ARC_COMPACT = 93, + /// Tensilica Xtensa Architecture + EM_XTENSA = 94, + /// Alphamosaic VideoCore processor + EM_VIDEOCORE = 95, + /// Thompson Multimedia General Purpose Processor + EM_TMM_GPP = 96, + /// National Semiconductor 32000 series + EM_NS32K = 97, + /// Tenor Network TPC processor + EM_TPC = 98, + /// Trebia SNP 1000 processor + EM_SNP1K = 99, + /// STMicroelectronics ST200 microcontroller + EM_ST200 = 100, + /// Ubicom IP2xxx microcontroller family + EM_IP2K = 101, + /// MAX Processor + EM_MAX = 102, + /// National Semiconductor CompactRISC microprocessor + EM_CR = 103, + /// Fujitsu F2MC16 + EM_F2MC16 = 104, + /// Texas Instruments embedded microcontroller msp430 + EM_MSP430 = 105, + /// Analog Devices Blackfin (DSP) processor + EM_BLACKFIN = 106, + /// S1C33 Family of Seiko Epson processors + EM_SE_C33 = 107, + /// Sharp embedded microprocessor + EM_SEP = 108, + /// Arca RISC Microprocessor + EM_ARCA = 109, + /// Microprocessor series from PKU-Unity Ltd. and MPRC of Peking University + EM_UNICORE = 110, + /// eXcess: 16/32/64-bit configurable embedded CPU + EM_EXCESS = 111, + /// Icera Semiconductor Inc. Deep Execution Processor + EM_DXP = 112, + /// Altera Nios II soft-core processor + EM_ALTERA_NIOS2 = 113, + /// National Semiconductor CompactRISC CRX microprocessor + EM_CRX = 114, + /// Motorola XGATE embedded processor + EM_XGATE = 115, + /// Infineon C16x/XC16x processor + EM_C166 = 116, + /// Renesas M16C series microprocessors + EM_M16C = 117, + /// Microchip Technology dsPIC30F Digital Signal Controller + EM_DSPIC30F = 118, + /// Freescale Communication Engine RISC core + EM_CE = 119, + /// Renesas M32C series microprocessors + EM_M32C = 120, + /// Altium TSK3000 core + EM_TSK3000 = 131, + /// Freescale RS08 embedded processor + EM_RS08 = 132, + /// Analog Devices SHARC family of 32-bit DSP processors + EM_SHARC = 133, + /// Cyan Technology eCOG2 microprocessor + EM_ECOG2 = 134, + /// Sunplus S+core7 RISC processor + EM_SCORE7 = 135, + /// New Japan Radio (NJR) 24-bit DSP Processor + EM_DSP24 = 136, + /// Broadcom VideoCore III processor + EM_VIDEOCORE3 = 137, + /// RISC processor for Lattice FPGA architecture + EM_LATTICEMICO32 = 138, + /// Seiko Epson C17 family + EM_SE_C17 = 139, + /// The Texas Instruments TMS320C6000 DSP family + EM_TI_C6000 = 140, + /// The Texas Instruments TMS320C2000 DSP family + EM_TI_C2000 = 141, + /// The Texas Instruments TMS320C55x DSP family + EM_TI_C5500 = 142, + /// Texas Instruments Application Specific RISC Processor, 32bit fetch + EM_TI_ARP32 = 143, + /// Texas Instruments Programmable Realtime Unit + EM_TI_PRU = 144, + /// STMicroelectronics 64bit VLIW Data Signal Processor + EM_MMDSP_PLUS = 160, + /// Cypress M8C microprocessor + EM_CYPRESS_M8C = 161, + /// Renesas R32C series microprocessors + EM_R32C = 162, + /// NXP Semiconductors TriMedia architecture family + EM_TRIMEDIA = 163, + /// QUALCOMM DSP6 Processor + EM_QDSP6 = 164, + /// Intel 8051 and variants + EM_8051 = 165, + /// STMicroelectronics STxP7x family of configurable and extensible RISC processors + EM_STXP7X = 166, + /// Andes Technology compact code size embedded RISC processor family + EM_NDS32 = 167, + /// Cyan Technology eCOG1X family + EM_ECOG1 = 168, + /// Cyan Technology eCOG1X family + EM_ECOG1X = 168, + /// Dallas Semiconductor MAXQ30 Core Micro-controllers + EM_MAXQ30 = 169, + /// New Japan Radio (NJR) 16-bit DSP Processor + EM_XIMO16 = 170, + /// M2000 Reconfigurable RISC Microprocessor + EM_MANIK = 171, + /// Cray Inc. NV2 vector architecture + EM_CRAYNV2 = 172, + /// Renesas RX family + EM_RX = 173, + /// Imagination Technologies META processor architecture + EM_METAG = 174, + /// MCST Elbrus general purpose hardware architecture + EM_MCST_ELBRUS = 175, + /// Cyan Technology eCOG16 family + EM_ECOG16 = 176, + /// National Semiconductor CompactRISC CR16 16-bit microprocessor + EM_CR16 = 177, + /// Freescale Extended Time Processing Unit + EM_ETPU = 178, + /// Infineon Technologies SLE9X core + EM_SLE9X = 179, + /// Intel L10M + EM_L10M = 180, + /// Intel K10M + EM_K10M = 181, + /// ARM 64-bit architecture (AARCH64) + EM_AARCH64 = 183, + /// Atmel Corporation 32-bit microprocessor family + EM_AVR32 = 185, + /// STMicroeletronics STM8 8-bit microcontroller + EM_STM8 = 186, + /// Tilera TILE64 multicore architecture family + EM_TILE64 = 187, + /// Tilera TILEPro multicore architecture family + EM_TILEPRO = 188, + /// Xilinx MicroBlaze 32-bit RISC soft processor core + EM_MICROBLAZE = 189, + /// NVIDIA CUDA architecture + EM_CUDA = 190, + /// Tilera TILE-Gx multicore architecture family + EM_TILEGX = 191, + /// CloudShield architecture family + EM_CLOUDSHIELD = 192, + /// KIPO-KAIST Core-A 1st generation processor family + EM_COREA_1ST = 193, + /// KIPO-KAIST Core-A 2nd generation processor family + EM_COREA_2ND = 194, + /// Synopsys ARCompact V2 + EM_ARC_COMPACT2 = 195, + /// Open8 8-bit RISC soft processor core + EM_OPEN8 = 196, + /// Renesas RL78 family + EM_RL78 = 197, + /// Broadcom VideoCore V processor + EM_VIDEOCORE5 = 198, + /// Renesas 78KOR family + EM_78KOR = 199, + /// Freescale 56800EX Digital Signal Controller (DSC) + EM_56800EX = 200, + /// Beyond BA1 CPU architecture + EM_BA1 = 201, + /// Beyond BA2 CPU architecture + EM_BA2 = 202, + /// XMOS xCORE processor family + EM_XCORE = 203, + /// Microchip 8-bit PIC(r) family + EM_MCHP_PIC = 204, + /// Reserved by Intel + EM_INTEL205 = 205, + /// Reserved by Intel + EM_INTEL206 = 206, + /// Reserved by Intel + EM_INTEL207 = 207, + /// Reserved by Intel + EM_INTEL208 = 208, + /// Reserved by Intel + EM_INTEL209 = 209, + /// KM211 KM32 32-bit processor + EM_KM32 = 210, + /// KM211 KMX32 32-bit processor + EM_KMX32 = 211, + /// KM211 KMX16 16-bit processor + EM_KMX16 = 212, + /// KM211 KMX8 8-bit processor + EM_KMX8 = 213, + /// KM211 KVARC processor + EM_KVARC = 214, + /// Paneve CDP architecture family + EM_CDP = 215, + /// Cognitive Smart Memory Processor + EM_COGE = 216, + /// Bluechip Systems CoolEngine + EM_COOL = 217, + /// Nanoradio Optimized RISC + EM_NORC = 218, + /// CSR Kalimba architecture family + EM_CSR_KALIMBA = 219, + /// Zilog Z80 + EM_Z80 = 220, + /// Controls and Data Services VISIUMcore processor + EM_VISIUM = 221, + /// FTDI Chip FT32 high performance 32-bit RISC architecture + EM_FT32 = 222, + /// Moxie processor family + EM_MOXIE = 223, + /// AMD GPU architecture + EM_AMDGPU = 224, + /// RISC-V + EM_RISCV = 243, + EM_ALPHA_OLD = 0x9026, + /// Bogus old v850 magic number, used by old tools. + EM_CYGNUS_V850 = 0x9080, + /// Bogus old m32r magic number, used by old tools. + EM_CYGNUS_M32R = 0x9041, + /// This is the old interim value for S/390 architecture. + EM_S390_OLD = 0xA390, + /// Fujitsu FR-V + EM_FRV = 0x5441 + } + + enum eType : ushort + { + /// No file type + ET_NONE = 0, + /// Relocatable file + ET_REL = 1, + /// Executable file + ET_EXEC = 2, + /// Shared object file + ET_DYN = 3, + /// Core file + ET_CORE = 4, + /// Operating system-specific + ET_LOOS = 0xfe00, + /// Operating system-specific + ET_HIOS = 0xfeff, + /// Processor-specific + ET_LOPROC = 0xff00, + /// Processor-specific + ET_HIPROC = 0xffff + } + + enum eVersion : uint + { + /// Invalid version + EV_NONE = 0, + /// Current version + EV_CURRENT = 1 + } + + enum shType : uint + { + /// + /// This value marks the section header as inactive; it does not have an associated section. Other members of the + /// section header have undefined values. + /// + SHT_NULL = 0, + /// + /// The section holds information defined by the program, whose format and meaning are determined solely by the + /// program. + /// + SHT_PROGBITS = 1, + /// + /// These sections hold a symbol table. Currently, an object file may have only one section of each type, but this + /// restriction may be relaxed in the future. Typically, SHT_SYMTAB provides symbols for link editing, though it may + /// also be used for dynamic linking. As a complete symbol table, it may contain many symbols unnecessary for dynamic + /// linking. Consequently, an object file may also contain a SHT_DYNSYM section, which holds a minimal set of dynamic + /// linking symbols, to save space. + /// + SHT_SYMTAB = 2, + /// The section holds a string table. An object file may have multiple string table sections. + SHT_STRTAB = 3, + /// + /// The section holds relocation entries with explicit addends, such as type Elf32_Rela for the 32-bit class of + /// object files or type Elf64_Rela for the 64-bit class of object files. An object file may have multiple relocation + /// sections. + /// + SHT_RELA = 4, + /// + /// The section holds a symbol hash table. Currently, an object file may have only one hash table, but this + /// restriction may be relaxed in the future. + /// + SHT_HASH = 5, + /// + /// The section holds information for dynamic linking. Currently, an object file may have only one dynamic + /// section, but this restriction may be relaxed in the future. + /// + SHT_DYNAMIC = 6, + /// The section holds information that marks the file in some way. + SHT_NOTE = 7, + /// + /// A section of this type occupies no space in the file but otherwise resembles SHT_PROGBITS. Although this + /// section contains no bytes, the sh_offset member contains the conceptual file offset. + /// + SHT_NOBITS = 8, + /// + /// The section holds relocation entries without explicit addends, such as type Elf32_Rel for the 32-bit class of + /// object files or type Elf64_Rel for the 64-bit class of object files. An object file may have multiple relocation + /// sections. + /// + SHT_REL = 9, + /// This section type is reserved but has unspecified semantics. + SHT_SHLIB = 10, + /// + /// These sections hold a symbol table. Currently, an object file may have only one section of each type, but this + /// restriction may be relaxed in the future. Typically, SHT_SYMTAB provides symbols for link editing, though it may + /// also be used for dynamic linking. As a complete symbol table, it may contain many symbols unnecessary for dynamic + /// linking. Consequently, an object file may also contain a SHT_DYNSYM section, which holds a minimal set of dynamic + /// linking symbols, to save space. + /// + SHT_DYNSYM = 11, + /// + /// This section contains an array of pointers to initialization functions. Each pointer in the array is taken as + /// a parameterless procedure with a void return. + /// + SHT_INIT_ARRAY = 14, + /// + /// This section contains an array of pointers to termination functions. Each pointer in the array is taken as a + /// parameterless procedure with a void return. + /// + SHT_FINI_ARRAY = 15, + /// + /// This section contains an array of pointers to functions that are invoked before all other initialization + /// functions. Each pointer in the array is taken as a parameterless procedure with a void return. + /// + SHT_PREINIT_ARRAY = 16, + /// + /// This section defines a section group. A section group is a set of sections that are related and that must be + /// treated specially by the linker (see below for further details). Sections of type SHT_GROUP may appear only in + /// relocatable objects (objects with the ELF header e_type member set to ET_REL). The section header table entry for a + /// group section must appear in the section header table before the entries for any of the sections that are members + /// of the group. + /// + SHT_GROUP = 17, + /// + /// This section is associated with a symbol table section and is required if any of the section header indexes + /// referenced by that symbol table contain the escape value SHN_XINDEX. The section is an array of Elf32_Word values. + /// Each value corresponds one to one with a symbol table entry and appear in the same order as those entries. The + /// values represent the section header indexes against which the symbol table entries are defined. Only if the + /// corresponding symbol table entry's st_shndx field contains the escape value SHN_XINDEX will the matching Elf32_Word + /// hold the actual section header index; otherwise, the entry must be SHN_UNDEF (0). + /// + SHT_SYMTAB_SHNDX = 18, + /// Values from this to are reserved for operating system-specific semantics + SHT_LOOS = 0x60000000, + /// Values from to this are reserved for operating system-specific semantics + SHT_HIOS = 0x6fffffff, + /// Values from this to are reserved for processor-specific semantics + SHT_LOPROC = 0x70000000, + /// Values from to this are reserved for processor-specific semantics + SHT_HIPROC = 0x7fffffff, + /// Values from this to are reserved for application programs + SHT_LOUSER = 0x80000000, + /// Values from to this are reserved for application programs + SHT_HIUSER = 0xffffffff + } + + enum shTypeGnu : uint + { + /// This section contains the symbol versions that are provided. + SHT_GNU_VERDEF = 0x6ffffffd, + /// This section contains the symbol versions that are required. + SHT_GNU_VERNEED = 0x6ffffffe, + /// This section contains the Symbol Version Table. + SHT_GNU_VERSYM = 0x6fffffff + } + + enum shTypeAmd64 : uint + { + /// This section contains unwind function table entries for stack unwinding. + SHT_X86_64_UNWIND = 0x70000001 + } + + enum shTypeArm : uint + { + /// Exception Index table + SHT_ARM_EXIDX = 0x70000001, + /// BPABI DLL dynamic linking pre-emption map + SHT_ARM_PREEMPTMAP = 0x70000002, + /// Object file compatibility attributes + SHT_ARM_ATTRIBUTES = 0x70000003, + /// See DBGOVL for details + SHT_ARM_DEBUGOVERLAY = 0x70000004, + /// See DBGOVL for details + SHT_ARM_OVERLAYSECTION = 0x70000005 + } + + enum shTypeMips : uint + { + /// + /// The section contains information about the set of dynamic shared object libraries used when statically linking + /// a program. Each entry contains information such as the library name, timestamp, and version. + /// + SHT_MIPS_LIBLIST = 0x70000000, + /// + /// The section contains a list of symbols in an executable whose definitions conflict with shared-object defined + /// symbols. + /// + SHT_MIPS_CONFLICT = 0x70000002, + /// + /// The section contains the global pointer table. The global pointer table includes a list of possible global + /// data area sizes. The list allows the linker to provide the user with information on the optimal size criteria to + /// use for gp register relative addressing. + /// + SHT_MIPS_GPTAB = 0x70000003, + /// This section type is reserved and the contents are unspecified. The section contents can be ignored. + SHT_MIPS_UCODE = 0x70000004, + /// + /// The section contains debug information specific to MIPS. An ABI-compliant application does not need to have a + /// section of this type. + /// + SHT_MIPS_DEBUG = 0x70000005, + /// The section contains information regarding register usage information for the object file. + SHT_MIPS_REGINFO = 0x70000006 + } + + enum shTypePaRisc : uint + { + /// Section contains product-specific extension bits + SHT_PARISC_EXT = 0x70000000, + /// Section contains unwind table entries + SHT_PARISC_UNWIND = 0x70000001, + /// Section contains debug information for optimized code + SHT_PARISC_DOC = 0x70000002, + /// Section contains code annotations + SHT_PARISC_ANNOT = 0x70000003 + } + + [Flags] + enum shFlags : uint + { + /// The section contains data that should be writable during process execution. + SHF_WRITE = 0x1, + /// + /// The section occupies memory during process execution. Some control sections do not reside in the memory image + /// of an object file; this attribute is off for those sections. + /// + SHF_ALLOC = 0x2, + /// The section contains executable machine instructions. + SHF_EXECINSTR = 0x4, + /// + /// The data in the section may be merged to eliminate duplication. Unless the SHF_STRINGS flag is also set, the + /// data elements in the section are of a uniform size. The size of each element is specified in the section header's + /// sh_entsize field. If the SHF_STRINGS flag is also set, the data elements consist of null-terminated character + /// strings. The size of each character is specified in the section header's sh_entsize field. Each element in the + /// section is compared against other elements in sections with the same name, type and flags. Elements that would have + /// identical values at program run-time may be merged. Relocations referencing elements of such sections must be + /// resolved to the merged locations of the referenced values. Note that any relocatable values, including values that + /// would result in run-time relocations, must be analyzed to determine whether the run-time values would actually be + /// identical. An ABI-conforming object file may not depend on specific elements being merged, and an ABI-conforming + /// link editor may choose not to merge specific elements. + /// + SHF_MERGE = 0x10, + /// + /// The data elements in the section consist of null-terminated character strings. The size of each character is + /// specified in the section header's sh_entsize field. + /// + SHF_STRINGS = 0x20, + /// The sh_info field of this section header holds a section header table index. + SHF_INFO_LINK = 0x40, + /// + /// This flag adds special ordering requirements for link editors. The requirements apply if the sh_link field of + /// this section's header references another section (the linked-to section). If this section is combined with other + /// sections in the output file, it must appear in the same relative order with respect to those sections, as the + /// linked-to section appears with respect to sections the linked-to section is combined with. + /// + SHF_LINK_ORDER = 0x80, + /// + /// This section requires special OS-specific processing (beyond the standard linking rules) to avoid incorrect + /// behavior. If this section has either an sh_type value or contains sh_flags bits in the OS-specific ranges for those + /// fields, and a link editor processing this section does not recognize those values, then the link editor should + /// reject the object file containing this section with an error. + /// + SHF_OS_NONCONFORMING = 0x100, + /// + /// This section is a member (perhaps the only one) of a section group. The section must be referenced by a + /// section of type SHT_GROUP. The SHF_GROUP flag may be set only for sections contained in relocatable objects + /// (objects with the ELF header e_type member set to ET_REL). See below for further details. + /// + SHF_GROUP = 0x200, + /// + /// This section holds Thread-Local Storage, meaning that each separate execution flow has its own distinct + /// instance of this data. Implementations need not support this flag. + /// + SHF_TLS = 0x400, + /// + /// This flag identifies a section containing compressed data. SHF_COMPRESSED applies only to non-allocable + /// sections, and cannot be used in conjunction with SHF_ALLOC. In addition, SHF_COMPRESSED cannot be applied to + /// sections of type SHT_NOBITS. All relocations to a compressed section specifiy offsets to the uncompressed section + /// data. It is therefore necessary to decompress the section data before relocations can be applied. Each compressed + /// section specifies the algorithm independently. It is permissible for different sections in a given ELF object to + /// employ different compression algorithms. Compressed sections begin with a compression header structure that + /// identifies the compression algorithm. + /// + SHF_COMPRESSED = 0x800, + /// All bits included in this mask are reserved for operating system-specific semantics + SHF_MASKOS = 0x0ff00000, + /// All bits included in this mask are reserved for processor-specific semantics + SHF_MASKPROC = 0xf0000000 + } + + [Flags] + enum shFlags64 : ulong + { + /// The section contains data that should be writable during process execution. + SHF_WRITE = shFlags.SHF_WRITE, + /// + /// The section occupies memory during process execution. Some control sections do not reside in the memory image + /// of an object file; this attribute is off for those sections. + /// + SHF_ALLOC = shFlags.SHF_ALLOC, + /// The section contains executable machine instructions. + SHF_EXECINSTR = shFlags.SHF_EXECINSTR, + /// + /// The data in the section may be merged to eliminate duplication. Unless the SHF_STRINGS flag is also set, the + /// data elements in the section are of a uniform size. The size of each element is specified in the section header's + /// sh_entsize field. If the SHF_STRINGS flag is also set, the data elements consist of null-terminated character + /// strings. The size of each character is specified in the section header's sh_entsize field. Each element in the + /// section is compared against other elements in sections with the same name, type and flags. Elements that would have + /// identical values at program run-time may be merged. Relocations referencing elements of such sections must be + /// resolved to the merged locations of the referenced values. Note that any relocatable values, including values that + /// would result in run-time relocations, must be analyzed to determine whether the run-time values would actually be + /// identical. An ABI-conforming object file may not depend on specific elements being merged, and an ABI-conforming + /// link editor may choose not to merge specific elements. + /// + SHF_MERGE = shFlags.SHF_MERGE, + /// + /// The data elements in the section consist of null-terminated character strings. The size of each character is + /// specified in the section header's sh_entsize field. + /// + SHF_STRINGS = shFlags.SHF_STRINGS, + /// The sh_info field of this section header holds a section header table index. + SHF_INFO_LINK = shFlags.SHF_INFO_LINK, + /// + /// This flag adds special ordering requirements for link editors. The requirements apply if the sh_link field of + /// this section's header references another section (the linked-to section). If this section is combined with other + /// sections in the output file, it must appear in the same relative order with respect to those sections, as the + /// linked-to section appears with respect to sections the linked-to section is combined with. + /// + SHF_LINK_ORDER = shFlags.SHF_LINK_ORDER, + /// + /// This section requires special OS-specific processing (beyond the standard linking rules) to avoid incorrect + /// behavior. If this section has either an sh_type value or contains sh_flags bits in the OS-specific ranges for those + /// fields, and a link editor processing this section does not recognize those values, then the link editor should + /// reject the object file containing this section with an error. + /// + SHF_OS_NONCONFORMING = shFlags.SHF_OS_NONCONFORMING, + /// + /// This section is a member (perhaps the only one) of a section group. The section must be referenced by a + /// section of type SHT_GROUP. The SHF_GROUP flag may be set only for sections contained in relocatable objects + /// (objects with the ELF header e_type member set to ET_REL). See below for further details. + /// + SHF_GROUP = shFlags.SHF_GROUP, + /// + /// This section holds Thread-Local Storage, meaning that each separate execution flow has its own distinct + /// instance of this data. Implementations need not support this flag. + /// + SHF_TLS = shFlags.SHF_TLS, + /// + /// This flag identifies a section containing compressed data. SHF_COMPRESSED applies only to non-allocable + /// sections, and cannot be used in conjunction with SHF_ALLOC. In addition, SHF_COMPRESSED cannot be applied to + /// sections of type SHT_NOBITS. All relocations to a compressed section specifiy offsets to the uncompressed section + /// data. It is therefore necessary to decompress the section data before relocations can be applied. Each compressed + /// section specifies the algorithm independently. It is permissible for different sections in a given ELF object to + /// employ different compression algorithms. Compressed sections begin with a compression header structure that + /// identifies the compression algorithm. + /// + SHF_COMPRESSED = shFlags.SHF_COMPRESSED, + SHF_MASKOS = shFlags.SHF_MASKOS, + SHF_MASKPROC = shFlags.SHF_MASKPROC + } + + [Flags] + enum shFlagsAmd64 : uint + { + /// + /// If an object file section does not have this flag set, then it may not hold more than 2GB and can be freely + /// referred to in objects using smaller code models. Otherwise, only objects using larger code models can refer to + /// them. For example, a medium code model object can refer to data in a section that sets this flag besides being able + /// to refer to data in a section that does not set it; likewise, a small code model object can refer only to code in a + /// section that does not set this flag + /// + SHF_X86_64_LARGE = 0x10000000 + } + + [Flags] + enum shFlagsArm : uint + { + /// The content of this section should not be read by program executor + SHF_ARM_NOREAD = 0x20000000 + } + + [Flags] + enum shFlagsMips : uint + { + /// + /// The section contains data that must be part of the global data area during program execution. Data in this + /// area is addressable with a gp relative address. Any section with the SHF_MIPS_GPREL attribute must have a section + /// header index of one of the .gptab special sections in the sh_link member of its section header table entry. + /// + SHF_MIPS_GPREL = 0x10000000 + } + + [Flags] + enum shFlagsParisc : uint + { + /// Section contains code compiled for static branch prediction + SHF_PARISC_SBP = 0x80000000, + /// Section should be allocated far from gp + SHF_PARISC_HUGE = 0x40000000, + /// Section should be near gp + SHF_PARISC_SHORT = 0x20000000 + } + + [Flags] + enum chType : uint + { + /// + /// The section data is compressed with the ZLIB algoritm. The compressed ZLIB data bytes begin with the byte + /// immediately following the compression header, and extend to the end of the section. + /// + ELFCOMPRESS_ZLIB = 1, + /// Values from this to are reserved for operating system-specific semantics + ELFCOMPRESS_LOOS = 0x60000000, + /// Values from to this are reserved for operating system-specific semantics + ELFCOMPRESS_HIOS = 0x6fffffff, + /// Values from this to are reserved for processor-specific semantics + ELFCOMPRESS_LOPROC = 0x70000000, + /// Values from to this are reserved for processor-specific semantics + ELFCOMPRESS_HIPROC = 0x7fffffff + } + + enum eFlagsArm : uint + { + /// This masks an 8-bit version number, the version of the ABI to which this ELF file conforms. + EF_ARM_ABIMASK = 0xFF000000, + /// The ELF file contains BE-8 code, suitable for execution on an ARM Architecture v6 processor. + EF_ARM_BE8 = 0x00800000, + /// Legacy code (ABI version 4 and earlier) generated by gcc-arm-xxx might use these bits. + EF_ARM_GCCMASK = 0x00400FFF, + /// + /// Set in executable file headers (e_type = ET_EXEC or ET_DYN) to note that the executable file was built to + /// conform to the hardware floating-point procedure-call standard. + /// + EF_ARM_ABI_FLOAT_HARD = 0x00000400, + /// + /// Set in executable file headers (e_type = ET_EXEC or ET_DYN) to note that the executable file was built to + /// conform to the software floating-point procedure-call standard. + /// + EF_ARM_ABI_FLOAT_SOFT = 0x00000200 + } + + [Flags] + enum eFlagsMips : uint + { + /// + /// This bit is asserted when at least one .noreorder directive in an assembly language source contributes to the + /// object module. + /// + EF_MIPS_NOREORDER = 0x00000001, + /// This bit is asserted when the file contains position-independent code that can be relocated in memory. + EF_MIPS_PIC = 0x00000002, + /// + /// This bit is asserted when the file contains code that follows standard calling sequence rules for calling + /// position-independent code. The code in this file is not necessarily position independent. The + /// and flags must be mutually exclusive. + /// + EF_MIPS_CPIC = 0x00000004, + /// Extension to the basic MIPS I architecture. + EF_MIPS_ARCH_EXT1 = 0x10000000, + /// Extension to the basic MIPS I architecture. + EF_MIPS_ARCH_EXT2 = 0x20000000, + /// Extension to the basic MIPS I architecture. + EF_MIPS_ARCH_EXT3 = 0x40000000, + /// Extension to the basic MIPS I architecture. + EF_MIPS_ARCH_EXT4 = 0x80000000 + } + + [Flags] + enum eFlagsPaRisc : uint + { + /// Trap nil pointer dereferences + EF_PARISC_TRAPNIL = 0x00010000, + /// Program uses arch. extensions + EF_PARISC_EXT = 0x00020000, + /// Program expects little-endian mode + EF_PARISC_LSB = 0x00040000, + /// Program expects wide mode + EF_PARISC_WIDE = 0x00080000, + /// Do not allow kernel-assisted branch prediction + EF_PARISC_NO_KABP = 0x00100000, + /// Allow lazy swap for dynamically-allocated program segments + EF_PARISC_LAZYSWAP = 0x00400000 + } + } +} \ No newline at end of file diff --git a/libexeinfo/ELF/Info.cs b/libexeinfo/ELF/Info.cs new file mode 100644 index 0000000..26b1f47 --- /dev/null +++ b/libexeinfo/ELF/Info.cs @@ -0,0 +1,10 @@ +namespace libexeinfo +{ + public partial class ELF : IExecutable + { + public string Information + { + get { return ""; } + } + } +} \ No newline at end of file diff --git a/libexeinfo/ELF/Structs.cs b/libexeinfo/ELF/Structs.cs new file mode 100644 index 0000000..a899506 --- /dev/null +++ b/libexeinfo/ELF/Structs.cs @@ -0,0 +1,373 @@ +using System.Runtime.InteropServices; + +namespace libexeinfo +{ + public partial class ELF + { + [StructLayout(LayoutKind.Sequential)] + struct Elf32_Ehdr + { + /// + /// A file's first 4 bytes hold a ``magic number,'' identifying the file as an ELF object file. + /// + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] ei_mag; + /// Identifies the file's class, or capacity. + public eiClass ei_class; + /// + /// Specifies the encoding of both the data structures used by object file container and data contained in object + /// file sections. + /// + public eiData ei_data; + /// + /// Specifies the ELF header version number. + /// + public eiVersion ei_version; + /// + /// Identifies the OS- or ABI-specific ELF extensions used by this file. Some fields in other ELF structures have flags + /// and values that have operating system and/or ABI specific meanings; the interpretation of those fields is + /// determined by the value of this byte. If the object file does not use any extensions, it is recommended that this + /// byte be set to 0. If the value for this byte is 64 through 255, its meaning depends on the value of the e_machine + /// header member. The ABI processor supplement for an architecture can define its own associated set of values for + /// this byte in this range. If the processor supplement does not specify a set of values, one of the following values + /// shall be used, where 0 can also be taken to mean unspecified. + /// + public eiOsabi ei_osabi; + /// + /// Identifies the version of the ABI to which the object is targeted. This field is used to distinguish among + /// incompatible versions of an ABI. The interpretation of this version number is dependent on the ABI identified by + /// the EI_OSABI field. If no values are specified for the EI_OSABI field by the processor supplement or no version + /// values are specified for the ABI determined by a particular value of the EI_OSABI byte, the value 0 shall be used + /// for the EI_ABIVERSION byte; it indicates unspecified. + /// + public byte ei_abiversion; + /// + /// This value marks the beginning of the unused bytes in e_ident. These bytes are reserved and set to zero; programs + /// that read object files should ignore them. The value of EI_PAD will change in the future if currently unused bytes + /// are given meanings. + /// + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 7)] + public byte[] ei_pad; + + /// + /// This member identifies the object file type. + /// + public eType e_type; + /// + /// This member's value specifies the required architecture for an individual file. + /// + public eMachine e_machine; + /// + /// This member identifies the object file version. + /// + public eVersion e_version; + /// + /// This member gives the virtual address to which the system first transfers control, thus starting the process. If + /// the file has no associated entry point, this member holds zero. + /// + public uint e_entry; + /// + /// This member holds the program header table's file offset in bytes. If the file has no program header table, this + /// member holds zero. + /// + public uint e_phoff; + /// + /// This member holds the section header table's file offset in bytes. If the file has no section header table, this + /// member holds zero. + /// + public uint e_shoff; + /// + /// This member holds processor-specific flags associated with the file. Flag names take the form EF_machine_flag. + /// + public uint e_flags; + /// + /// This member holds the ELF header's size in bytes. + /// + public ushort e_ehsize; + /// + /// This member holds the size in bytes of one entry in the file's program header table; all entries are the same size. + /// + public ushort e_phentsize; + /// + /// This member holds the number of entries in the program header table. Thus the product of e_phentsize and e_phnum + /// gives the table's size in bytes. If a file has no program header table, e_phnum holds the value zero. + /// + public ushort e_phnum; + /// + /// This member holds a section header's size in bytes. A section header is one entry in the section header table; all + /// entries are the same size. + /// + public ushort e_shentsize; + /// + /// This member holds the number of entries in the section header table. Thus the product of e_shentsize and e_shnum + /// gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value + /// zero. + /// If the number of sections is greater than or equal to SHN_LORESERVE (0xff00), this member has the value zero and + /// the actual number of section header table entries is contained in the sh_size field of the section header at index + /// 0. (Otherwise, the sh_size member of the initial entry contains 0.) + /// + public ushort e_shnum; + /// + /// This member holds the section header table index of the entry associated with the section name string table. If the + /// file has no section name string table, this member holds the value SHN_UNDEF. + /// If the section name string table section index is greater than or equal to SHN_LORESERVE (0xff00), this member has + /// the value SHN_XINDEX (0xffff) and the actual index of the section name string table section is contained in the + /// sh_link field of the section header at index 0. (Otherwise, the sh_link member of the initial entry contains 0.) + /// + public ushort e_shstrndx; + } + + [StructLayout(LayoutKind.Sequential)] + struct Elf64_Ehdr + { + /// + /// A file's first 4 bytes hold a ``magic number,'' identifying the file as an ELF object file. + /// + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] + public byte[] ei_mag; + /// Identifies the file's class, or capacity. + public eiClass ei_class; + /// + /// Specifies the encoding of both the data structures used by object file container and data contained in object + /// file sections. + /// + public eiData ei_data; + /// + /// Specifies the ELF header version number. + /// + public eiVersion ei_version; + /// + /// Identifies the OS- or ABI-specific ELF extensions used by this file. Some fields in other ELF structures have flags + /// and values that have operating system and/or ABI specific meanings; the interpretation of those fields is + /// determined by the value of this byte. If the object file does not use any extensions, it is recommended that this + /// byte be set to 0. If the value for this byte is 64 through 255, its meaning depends on the value of the e_machine + /// header member. The ABI processor supplement for an architecture can define its own associated set of values for + /// this byte in this range. If the processor supplement does not specify a set of values, one of the following values + /// shall be used, where 0 can also be taken to mean unspecified. + /// + public eiOsabi ei_osabi; + /// + /// Identifies the version of the ABI to which the object is targeted. This field is used to distinguish among + /// incompatible versions of an ABI. The interpretation of this version number is dependent on the ABI identified by + /// the EI_OSABI field. If no values are specified for the EI_OSABI field by the processor supplement or no version + /// values are specified for the ABI determined by a particular value of the EI_OSABI byte, the value 0 shall be used + /// for the EI_ABIVERSION byte; it indicates unspecified. + /// + public byte ei_abiversion; + /// + /// This value marks the beginning of the unused bytes in e_ident. These bytes are reserved and set to zero; programs + /// that read object files should ignore them. The value of EI_PAD will change in the future if currently unused bytes + /// are given meanings. + /// + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 7)] + public byte[] ei_pad; + /// + /// This member identifies the object file type. + /// + public eType e_type; + /// + /// This member's value specifies the required architecture for an individual file. + /// + public eMachine e_machine; + /// + /// This member identifies the object file version. + /// + public eVersion e_version; + /// + /// This member gives the virtual address to which the system first transfers control, thus starting the process. If + /// the file has no associated entry point, this member holds zero. + /// + public ulong e_entry; + /// + /// This member holds the program header table's file offset in bytes. If the file has no program header table, this + /// member holds zero. + /// + public ulong e_phoff; + /// + /// This member holds the section header table's file offset in bytes. If the file has no section header table, this + /// member holds zero. + /// + public ulong e_shoff; + /// + /// This member holds processor-specific flags associated with the file. Flag names take the form EF_machine_flag. + /// + public uint e_flags; + /// + /// This member holds the ELF header's size in bytes. + /// + public ushort e_ehsize; + /// + /// This member holds the size in bytes of one entry in the file's program header table; all entries are the same size. + /// + public ushort e_phentsize; + /// + /// This member holds the number of entries in the program header table. Thus the product of e_phentsize and e_phnum + /// gives the table's size in bytes. If a file has no program header table, e_phnum holds the value zero. + /// + public ushort e_phnum; + /// + /// This member holds a section header's size in bytes. A section header is one entry in the section header table; all + /// entries are the same size. + /// + public ushort e_shentsize; + /// + /// This member holds the number of entries in the section header table. Thus the product of e_shentsize and e_shnum + /// gives the section header table's size in bytes. If a file has no section header table, e_shnum holds the value + /// zero. + /// If the number of sections is greater than or equal to SHN_LORESERVE (0xff00), this member has the value zero and + /// the actual number of section header table entries is contained in the sh_size field of the section header at index + /// 0. (Otherwise, the sh_size member of the initial entry contains 0.) + /// + public ushort e_shnum; + /// + /// This member holds the section header table index of the entry associated with the section name string table. If the + /// file has no section name string table, this member holds the value SHN_UNDEF. + /// If the section name string table section index is greater than or equal to SHN_LORESERVE (0xff00), this member has + /// the value SHN_XINDEX (0xffff) and the actual index of the section name string table section is contained in the + /// sh_link field of the section header at index 0. (Otherwise, the sh_link member of the initial entry contains 0.) + /// + public ushort e_shstrndx; + } + + [StructLayout(LayoutKind.Sequential)] + struct Elf32_Shdr + { + /// + /// This member specifies the name of the section. Its value is an index into the section header string table section, + /// giving the location of a null-terminated string. + /// + public uint sh_name; + /// + /// This member categorizes the section's contents and semantics. + /// + public shType sh_type; + /// + /// Sections support 1-bit flags that describe miscellaneous attributes. + /// + public shFlags sh_flags; + /// + /// If the section will appear in the memory image of a process, this member gives the address at which the section's + /// first byte should reside. Otherwise, the member contains 0. + /// + public uint sh_addr; + /// + /// This member's value gives the byte offset from the beginning of the file to the first byte in the section. One + /// section type, SHT_NOBITS described below, occupies no space in the file, and its sh_offset member locates the + /// conceptual placement in the file. + /// + public uint sh_offset; + /// + /// This member gives the section's size in bytes. Unless the section type is SHT_NOBITS, the section occupies sh_size + /// bytes in the file. A section of type SHT_NOBITS may have a non-zero size, but it occupies no space in the file. + /// + public uint sh_size; + /// + /// This member holds a section header table index link, whose interpretation depends on the section type. + /// + public uint sh_link; + /// + /// This member holds extra information, whose interpretation depends on the section type. + /// + public uint sh_info; + /// + /// Some sections have address alignment constraints. For example, if a section holds a doubleword, the system must + /// ensure doubleword alignment for the entire section. The value of sh_addr must be congruent to 0, modulo the value + /// of sh_addralign. Currently, only 0 and positive integral powers of two are allowed. Values 0 and 1 mean the section + /// has no alignment constraints. + /// + public uint sh_addralign; + /// + /// Some sections hold a table of fixed-size entries, such as a symbol table. For such a section, this member gives the + /// size in bytes of each entry. The member contains 0 if the section does not hold a table of fixed-size entries. + /// + public uint sh_entsize; + } + + [StructLayout(LayoutKind.Sequential)] + struct Elf64_Shdr + { + /// + /// This member specifies the name of the section. Its value is an index into the section header string table section, + /// giving the location of a null-terminated string. + /// + public uint sh_name; + /// + /// This member categorizes the section's contents and semantics. + /// + public shType sh_type; + /// + /// Sections support 1-bit flags that describe miscellaneous attributes. + /// + public shFlags64 sh_flags; + /// + /// If the section will appear in the memory image of a process, this member gives the address at which the section's + /// first byte should reside. Otherwise, the member contains 0. + /// + public ulong sh_addr; + /// + /// This member's value gives the byte offset from the beginning of the file to the first byte in the section. One + /// section type, SHT_NOBITS described below, occupies no space in the file, and its sh_offset member locates the + /// conceptual placement in the file. + /// + public ulong sh_offset; + /// + /// This member gives the section's size in bytes. Unless the section type is SHT_NOBITS, the section occupies sh_size + /// bytes in the file. A section of type SHT_NOBITS may have a non-zero size, but it occupies no space in the file. + /// + public ulong sh_size; + /// + /// This member holds a section header table index link, whose interpretation depends on the section type. + /// + public uint sh_link; + /// + /// This member holds extra information, whose interpretation depends on the section type. + /// + public uint sh_info; + /// + /// Some sections have address alignment constraints. For example, if a section holds a doubleword, the system must + /// ensure doubleword alignment for the entire section. The value of sh_addr must be congruent to 0, modulo the value + /// of sh_addralign. Currently, only 0 and positive integral powers of two are allowed. Values 0 and 1 mean the section + /// has no alignment constraints. + /// + public ulong sh_addralign; + /// + /// Some sections hold a table of fixed-size entries, such as a symbol table. For such a section, this member gives the + /// size in bytes of each entry. The member contains 0 if the section does not hold a table of fixed-size entries. + /// + public ulong sh_entsize; + } + + struct Elf32_Chdr + { + /// + /// This member specifies the compression algorithm. + /// + public uint ch_type; + /// + /// This member provides the size in bytes of the uncompressed data. + /// + public uint ch_size; + /// + /// Specifies the required alignment for the uncompressed data. + /// + public uint ch_addralign; + } + + struct Elf64_Chdr + { + /// + /// This member specifies the compression algorithm. + /// + public chType ch_type; + public uint ch_reserved; + /// + /// This member provides the size in bytes of the uncompressed data. + /// + public ulong ch_size; + /// + /// Specifies the required alignment for the uncompressed data. + /// + public ulong ch_addralign; + } + } +} \ No newline at end of file diff --git a/libexeinfo/libexeinfo.csproj b/libexeinfo/libexeinfo.csproj index c78c93f..94030d2 100644 --- a/libexeinfo/libexeinfo.csproj +++ b/libexeinfo/libexeinfo.csproj @@ -54,6 +54,11 @@ + + + + +