elfexec

func FindTextProgHeader ¶

func FindTextProgHeader(f *elf.File) *elf.ProgHeader

FindTextProgHeader finds the program segment header containing the .text section or nil if the segment cannot be found.

func GetBase ¶

func GetBase(fh *elf.FileHeader, loadSegment *elf.ProgHeader, stextOffset *uint64, start, limit, offset uint64) (uint64, error)

GetBase determines the base address to subtract from virtual address to get symbol table address. For an executable, the base is 0. Otherwise, it's a shared library, and the base is the address where the mapping starts. The kernel needs special handling.

func GetBuildID ¶

func GetBuildID(f *elf.File) ([]byte, error)

GetBuildID returns the GNU build-ID for an ELF binary.

If no build-ID was found but the binary was read without error, it returns (nil, nil).

func HeaderForFileOffset ¶

func HeaderForFileOffset(headers []*elf.ProgHeader, fileOffset uint64) (*elf.ProgHeader, error)

HeaderForFileOffset attempts to identify a unique program header that includes the given file offset. It returns an error if it cannot identify a unique header.

func ProgramHeadersForMapping ¶

func ProgramHeadersForMapping(phdrs []elf.ProgHeader, mapOff, mapSz uint64) []*elf.ProgHeader

ProgramHeadersForMapping returns the program segment headers that overlap the runtime mapping with file offset mapOff and memory size mapSz. We skip over segments zero file size because their file offset values are unreliable. Even if overlapping, a segment is not selected if its aligned file offset is greater than the mapping file offset, or if the mapping includes the last page of the segment, but not the full segment and the mapping includes additional pages after the segment end. The function returns a slice of pointers to the headers in the input slice, which are valid only while phdrs is not modified or discarded.