public override ElfRelocator CreateRelocator(ElfMachine machine, SortedList <Address, ImageSymbol> imageSymbols)
{
switch (machine)
{
case ElfMachine.EM_386: return(new x86Relocator(this, imageSymbols));
case ElfMachine.EM_ARM: return(new ArmRelocator(this, imageSymbols));
case ElfMachine.EM_MIPS: return(new MipsRelocator(this, imageSymbols));
case ElfMachine.EM_NANOMIPS: return(new NanoMipsRelocator(this, imageSymbols));
case ElfMachine.EM_MSP430: return(new Msp430Relocator(this, imageSymbols));
case ElfMachine.EM_PPC: return(new PpcRelocator(this, imageSymbols));
case ElfMachine.EM_SPARC32PLUS:
case ElfMachine.EM_SPARC: return(new SparcRelocator(this, imageSymbols));
case ElfMachine.EM_XTENSA: return(new XtensaRelocator(this, imageSymbols));
case ElfMachine.EM_68K: return(new M68kRelocator(this, imageSymbols));
case ElfMachine.EM_AVR: return(new AvrRelocator(this, imageSymbols));
case ElfMachine.EM_SH: return(new SuperHRelocator(this, imageSymbols));
case ElfMachine.EM_BLACKFIN: return(new BlackfinRelocator(this, imageSymbols));
}
return(base.CreateRelocator(machine, imageSymbols));
}
public CoreDumpReader(string path)
{
_source = path;
_stream = File.OpenRead(path);
_core = new ElfCoreFile(_stream);
ElfMachine architecture = _core.ElfFile.Header.Architecture;
switch (architecture)
{
case ElfMachine.EM_X86_64:
PointerSize = 8;
Architecture = Architecture.Amd64;
break;
case ElfMachine.EM_386:
PointerSize = 4;
Architecture = Architecture.X86;
break;
case ElfMachine.EM_AARCH64:
PointerSize = 8;
Architecture = Architecture.Arm64;
break;
case ElfMachine.EM_ARM:
PointerSize = 4;
Architecture = Architecture.Arm;
break;
default:
throw new NotImplementedException($"Support for {architecture} not yet implemented.");
}
}
public CoredumpReader(string path, Stream stream)
{
DisplayName = path ?? throw new ArgumentNullException(nameof(path));
_stream = stream ?? throw new ArgumentNullException(nameof(stream));
_core = new ElfCoreFile(_stream);
ElfMachine architecture = _core.ElfFile.Header.Architecture;
switch (architecture)
{
case ElfMachine.EM_X86_64:
PointerSize = 8;
Architecture = Architecture.Amd64;
break;
case ElfMachine.EM_386:
PointerSize = 4;
Architecture = Architecture.X86;
break;
case ElfMachine.EM_AARCH64:
PointerSize = 8;
Architecture = Architecture.Arm64;
break;
case ElfMachine.EM_ARM:
PointerSize = 4;
Architecture = Architecture.Arm;
break;
default:
throw new NotImplementedException($"Support for {architecture} not yet implemented.");
}
}
protected ElfLoader(IServiceProvider services, ElfMachine machine, EndianServices endianness, byte[] rawImage) : this()
{
this.Services = services;
this.machine = machine;
this.endianness = endianness;
this.rawImage = rawImage;
}
public CoreDumpReader(string filename)
{
_source = filename;
_stream = File.Open(filename, FileMode.Open, FileAccess.Read, FileShare.Read);
_core = new ElfCoreFile(_stream);
ElfMachine architecture = _core.ElfFile.Header.Architecture;
switch (architecture)
{
case ElfMachine.EM_X86_64:
_pointerSize = 8;
_architecture = Architecture.Amd64;
break;
case ElfMachine.EM_386:
_pointerSize = 4;
_architecture = Architecture.X86;
break;
case ElfMachine.EM_AARCH64:
_pointerSize = 8;
_architecture = Architecture.Arm64;
break;
case ElfMachine.EM_ARM:
_pointerSize = 4;
_architecture = Architecture.Arm;
break;
default:
throw new NotImplementedException($"Support for {architecture} not yet implemented.");
}
}
protected ElfLoader(ElfImageLoader imgLoader, ushort machine, byte endianness) : this()
{
this.imgLoader = imgLoader;
this.machine = (ElfMachine)machine;
this.endianness = endianness;
this.Architecture = CreateArchitecture(machine, endianness);
}
private void Given_ImageHeader(ElfMachine machine)
{
eih = new Elf64_EHdr
{
e_machine = (ushort)machine,
};
}
public override ElfRelocator CreateRelocator(ElfMachine machine, SortedList <Address, ImageSymbol> symbols)
{
switch (machine)
{
case ElfMachine.EM_AARCH64: return(new Arm64Relocator(this, symbols));
case ElfMachine.EM_X86_64: return(new x86_64Relocator(this, symbols));
case ElfMachine.EM_PPC64: return(new PpcRelocator64(this, symbols));
case ElfMachine.EM_MIPS: return(new MipsRelocator64(this, symbols));
case ElfMachine.EM_RISCV: return(new RiscVRelocator64(this, symbols));
case ElfMachine.EM_ALPHA: return(new AlphaRelocator(this, symbols));
case ElfMachine.EM_S390: return(new zSeriesRelocator(this, symbols));
case ElfMachine.EM_PARISC: return(new PaRiscRelocator(this, symbols));
case ElfMachine.EM_SPARCV9: return(new Sparc64Relocator(this, symbols));
case ElfMachine.EM_IA_64: return(new Ia64Relocator(this, symbols));
}
return(base.CreateRelocator(machine, symbols));
}
public DynamicSectionRenderer64(ElfLoader loader, ElfSection?shdr, ElfMachine machine)
{
this.loader = loader;
this.shdr = shdr;
if (!ElfDynamicEntry.MachineSpecificInfos.TryGetValue(machine, out machineSpecific))
{
machineSpecific = new Dictionary <long, ElfDynamicEntry.TagInfo>();
}
}
public DynamicSectionRenderer32(ElfLoader32 loader, ElfSection shdr, ElfMachine machine)
{
this.loader = loader;
this.shdr = shdr;
if (!machineSpecificEntries.TryGetValue(machine, out machineSpecific))
{
machineSpecific = new Dictionary <long, Entry>();
}
}
public IEnumerable <IElfPRStatus> EnumeratePRStatus()
{
ElfMachine architecture = ElfFile.Header.Architecture;
return(GetNotes(ElfNoteType.PrpsStatus).Select <ElfNote, IElfPRStatus>(r => {
return architecture switch
{
ElfMachine.EM_X86_64 => r.ReadContents <ElfPRStatusX64>(0),
ElfMachine.EM_ARM => r.ReadContents <ElfPRStatusArm>(0),
ElfMachine.EM_AARCH64 => r.ReadContents <ElfPRStatusArm64>(0),
_ => throw new NotSupportedException($"Invalid architecture {architecture}"),
};
}));
}
public TagInfo GetTagInfo(ElfMachine machine)
{
if (TagInfos.TryGetValue(Tag, out var info))
{
return(info);
}
if (MachineSpecificInfos.TryGetValue(machine, out var machineInfos))
{
if (machineInfos.TryGetValue(Tag, out info))
{
return(info);
}
}
return(null);
}
public CoredumpReader(string path, Stream stream, bool leaveOpen)
{
DisplayName = path ?? throw new ArgumentNullException(nameof(path));
_core = new ElfCoreFile(stream ?? throw new ArgumentNullException(nameof(stream)), leaveOpen);
ElfMachine architecture = _core.ElfFile.Header.Architecture;
(PointerSize, Architecture) = architecture switch
{
ElfMachine.EM_X86_64 => (8, Architecture.Amd64),
ElfMachine.EM_386 => (4, Architecture.X86),
ElfMachine.EM_AARCH64 => (8, Architecture.Arm64),
ElfMachine.EM_ARM => (4, Architecture.Arm),
_ => throw new NotImplementedException($"Support for {architecture} not yet implemented."),
};
}
public override ElfRelocator CreateRelocator(ElfMachine machine, SortedList <Address, ImageSymbol> imageSymbols)
{
switch (machine)
{
case ElfMachine.EM_68K: return(new M68kRelocator(this, imageSymbols));
case ElfMachine.EM_386: return(new x86Relocator(this, imageSymbols));
case ElfMachine.EM_ARM: return(new ArmRelocator(this, imageSymbols));
case ElfMachine.EM_HEXAGON: return(new HexagonRelocator(this, imageSymbols));
case ElfMachine.EM_MIPS: return(new MipsRelocator(this, imageSymbols));
case ElfMachine.EM_NANOMIPS: return(new NanoMipsRelocator(this, imageSymbols));
case ElfMachine.EM_MSP430: return(new Msp430Relocator(this, imageSymbols));
case ElfMachine.EM_PPC: return(new PpcRelocator(this, imageSymbols));
case ElfMachine.EM_SPARC32PLUS:
case ElfMachine.EM_SPARC: return(new Sparc32Relocator(this, imageSymbols));
case ElfMachine.EM_XTENSA: return(new XtensaRelocator(this, imageSymbols));
case ElfMachine.EM_AVR: return(new AvrRelocator(this, imageSymbols));
case ElfMachine.EM_AVR32:
case ElfMachine.EM_AVR32a: return(new Avr32Relocator(this, imageSymbols));
case ElfMachine.EM_SH: return(new SuperHRelocator(this, imageSymbols));
case ElfMachine.EM_BLACKFIN: return(new BlackfinRelocator(this, imageSymbols));
case ElfMachine.EM_PARISC: return(new PaRiscRelocator(this, imageSymbols));
case ElfMachine.EM_RISCV: return(new RiscVRelocator32(this, imageSymbols));
case ElfMachine.EM_VAX: return(new VaxRelocator(this, imageSymbols));
// Support for 32-bit pointers.
case ElfMachine.EM_X86_64: return(new x86Relocator(this, imageSymbols));
case ElfMachine.EM_ALTERA_NIOS2: return(new Nios2Relocator(this, imageSymbols));
}
return(base.CreateRelocator(machine, imageSymbols));
}
public ImageSegmentRenderer CreateRenderer(ElfSection shdr, ElfMachine machine)
{
switch (shdr.Type)
{
case SectionHeaderType.SHT_DYNAMIC:
return(new DynamicSectionRenderer32(this, shdr, machine));
case SectionHeaderType.SHT_REL:
return(new RelSegmentRenderer(this, shdr));
case SectionHeaderType.SHT_RELA:
return(new RelaSegmentRenderer(this, shdr));
case SectionHeaderType.SHT_SYMTAB:
case SectionHeaderType.SHT_DYNSYM:
return(new SymtabSegmentRenderer32(this, shdr));
default: return(null);
}
}
public DynamicSectionRenderer32(ElfLoader32 loader, ElfSection shdr, ElfMachine machine)
{
this.loader = loader;
this.shdr = shdr;
if (!machineSpecificEntries.TryGetValue(machine, out machineSpecific))
{
machineSpecific = new Dictionary<long, Entry>();
}
}
public override ElfRelocator CreateRelocator(ElfMachine machine)
{
switch (machine)
{
case ElfMachine.EM_X86_64: return new x86_64Relocator(this);
case ElfMachine.EM_PPC64: return new PpcRelocator64(this);
}
return base.CreateRelocator(machine);
}
public ElfAssembly(string url)
{
using (BinaryReader rd = new BinaryReader(File.OpenRead(url))) {
if (rd.ReadInt32() != 0x464c457f)
throw new Exception("Not ELF Format");
rd.BaseStream.Seek(16, SeekOrigin.Begin);
this.type = (ElfFileType)rd.ReadUInt16(); // 1Reloc, 2Exec,3Shared, 4Core, 0xff00|0xffff Process
this.machine = (ElfMachine)rd.ReadUInt16(); // 0-8 (3)
this.version = rd.ReadUInt32();
this.entry = rd.ReadUInt32();
this.phOff = rd.ReadUInt32();
this.shOff = rd.ReadUInt32();
this.flags = rd.ReadUInt32();
this.ehSize = rd.ReadInt16();
this.phSize = rd.ReadInt16();
this.phCount = rd.ReadInt16();
this.shSize = rd.ReadInt16();
this.shCount = rd.ReadInt16();
this.shstRndx = rd.ReadInt16();
rd.BaseStream.Seek(this.phOff, SeekOrigin.Begin);
for (int i = 0; i < phCount; ++i) {
rd.BaseStream.Seek(this.phOff + i * 32, SeekOrigin.Begin);
ElfPHeader eph = new ElfPHeader(rd);
headers.Add(eph);
}
rd.BaseStream.Seek(this.shOff, SeekOrigin.Begin);
for (int i = 0; i < shCount; ++i) {
rd.BaseStream.Seek(this.shOff + i * this.shSize, SeekOrigin.Begin);
ElfSection esh = new ElfSection(rd);
sections.Add(esh);
if (esh.type == ElfSType.StrTab && (esh.flags & ElfSFlags.Alloc) == 0)
sectionNames = esh;
}
foreach (ElfSection sec in sections) {
int k = (int)sec.name;
while (sectionNames.data[k] != '\0')
++k;
k -= (int)sec.name;
sec.Title = Encoding.ASCII.GetString(sectionNames.data, (int)sec.name, k);
switch (sec.Title) {
case ".text":
textSection = sec;
break;
}
Console.WriteLine(sec.Title);
}
}
}
public virtual ElfRelocator CreateRelocator(ElfMachine machine, SortedList <Address, ImageSymbol> symbols)
{
throw new NotSupportedException($"Relocator for architecture {machine} not implemented yet.");
}
private void Given_ImageHeader(ElfMachine machine)
{
eih = new Elf64_EHdr
{
e_machine = (ushort)machine,
};
}
protected ElfLoader(ElfImageLoader imgLoader, ushort machine, byte endianness) : this()
{
this.imgLoader = imgLoader;
this.machine = (ElfMachine)machine;
this.endianness = endianness;
}
public virtual ElfRelocator CreateRelocator(ElfMachine machine)
{
throw new NotSupportedException(
string.Format("Relocator for architecture {0} not implemented yet.",
machine));
}
/// <summary>ELFヘッダ情報</summary>
public Elf32_Header(string ProgramFilePath) : this()
{
this.ProgramFilePath = ProgramFilePath;
long fileSize = 0;
using (BinaryReader br = new BinaryReader(File.Open(this.ProgramFilePath, FileMode.Open))) {
int ptr = 0;
e_ident = new char[16];
byte[] ehBytes = new byte[52];
fileSize = br.BaseStream.Length;
br.Read(ehBytes, 0, ehBytes.Length);
foreach (byte b in ehBytes.Take(16))
{
e_ident[ptr++] = (char)b;
}
ei_class = (ElfIdClass)e_ident[4];
ei_data = (ElfIdData)e_ident[5];
e_type = (ElfType)BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_machine = (ElfMachine)BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_version = (ElfVersion)BitConverter.ToUInt32(ehBytes, ptr); ptr += 4;
e_entry = BitConverter.ToUInt32(ehBytes, ptr); ptr += 4;
e_phoff = BitConverter.ToUInt32(ehBytes, ptr); ptr += 4;
e_shoff = BitConverter.ToUInt32(ehBytes, ptr); ptr += 4;
e_flags = BitConverter.ToUInt32(ehBytes, ptr); ptr += 4;
e_ehsize = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_phentsize = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_phnum = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_shentsize = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_shnum = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
e_shstrndx = BitConverter.ToUInt16(ehBytes, ptr); ptr += 2;
ehBytes = null;
// プログラムヘッダテーブル
if (e_phoff != br.BaseStream.Position)
{
// 現在のファイル内の位置が e_phoff と違っている場合は、e_phoff までシークする
br.BaseStream.Seek(e_phoff, SeekOrigin.Begin);
}
e_phdrtab = new Elf32_Phdr[e_phnum];
for (int i = 0; i < e_phnum; i++)
{
byte[] e_ph = new byte[e_phentsize];
br.Read(e_ph, 0, e_ph.Length);
e_phdrtab[i] = new Elf32_Phdr(e_ph);
}
// セクションヘッダテーブル
if (e_shoff != br.BaseStream.Position)
{
// 現在のファイル内の位置が e_shoff と違っている場合は、e_shoff までシークする
br.BaseStream.Seek(e_shoff, SeekOrigin.Begin);
}
e_shdrtab = new Elf32_Shdr[e_shnum];
for (int i = 0; i < e_shnum; i++)
{
byte[] e_sh = new byte[e_shentsize];
br.Read(e_sh, 0, e_sh.Length);
e_shdrtab[i] = new Elf32_Shdr(e_sh);
e_sh = null;
}
char[] sh_strtab = null;
// セクションヘッダ名文字列テーブルを検索
Encoding enc = Encoding.ASCII;
foreach (Elf32_Shdr shdr in e_shdrtab)
{
if (shdr.sh_type == ShType.SHT_STRTAB)
{
sh_strtab = new char[shdr.sh_size];
if (shdr.sh_offset != br.BaseStream.Position)
{
// 現在のファイル内の位置が sh_offset と違っている場合は、sh_offset までシークする
br.BaseStream.Seek(shdr.sh_offset, SeekOrigin.Begin);
}
br.Read(sh_strtab, 0, sh_strtab.Length);
// 読み出したセクションヘッダ名文字列テーブルで自信のセクションヘッダ名をチェック
if (new string(sh_strtab.Skip((int)shdr.sh_nameidx).TakeWhile(c => c != '\0').ToArray()).Equals(".shstrtab"))
{
break;
}
sh_strtab = null;
}
}
// 各セクションテーブルにセクション名(string)を付与
if (sh_strtab != null)
{
for (int i = 0; i < e_shdrtab.Length; i++)
{
e_shdrtab[i].sh_name = new string(sh_strtab.Skip((int)e_shdrtab[i].sh_nameidx).TakeWhile(c => c != '\0').ToArray());
}
}
// シンボルテーブル
foreach (Elf32_Shdr shdr in e_shdrtab)
{
if (shdr.sh_type == ShType.SHT_SYMTAB)
{
// シンボル名文字列テーブル
char[] sym_strtab = null;
foreach (Elf32_Shdr shdr_strtab in e_shdrtab)
{
if (shdr_strtab.sh_name.Equals(".strtab"))
{
sym_strtab = new char[shdr_strtab.sh_size];
br.BaseStream.Seek(shdr_strtab.sh_offset, SeekOrigin.Begin);
br.Read(sym_strtab, 0, sym_strtab.Length);
}
}
// シンボルを作成
List <Elf32_Sym> symtab = new List <Elf32_Sym>();
br.BaseStream.Seek(shdr.sh_offset, SeekOrigin.Begin);
for (int i = 0; i < shdr.sh_size / shdr.sh_entsize; i++)
{
byte[] e_sym = new byte[shdr.sh_entsize];
br.Read(e_sym, 0, e_sym.Length);
symtab.Add(new Elf32_Sym(e_sym, sym_strtab));
}
sym_strtab = null;
// 作成したシンボルのうち、セクションに紐付くものは紐付け
List <Elf32_Sym> l = new List <Elf32_Sym>();
for (int i = 0; i < e_shdrtab.Length; i++)
{
for (int j = 0; j < symtab.Count(); j++)
{
if (symtab[j].st_shndx == i)
{
l.Add(symtab[j]);
symtab.RemoveAt(j--);
}
}
e_shdrtab[i].sh_symtab = l.ToArray();
l.Clear();
}
e_symtab = symtab.ToArray();
symtab = null;
}
}
}
}
public override ElfRelocator CreateRelocator(ElfMachine machine)
{
switch (machine)
{
case ElfMachine.EM_386: return new x86Relocator(this);
case ElfMachine.EM_ARM: return new ArmRelocator(this);
case ElfMachine.EM_MIPS: return new MipsRelocator(this);
case ElfMachine.EM_PPC: return new PpcRelocator(this);
case ElfMachine.EM_SPARC: return new SparcRelocator(this);
case ElfMachine.EM_XTENSA: return new XtensaRelocator(this);
}
return base.CreateRelocator(machine);
}
