7etsuo / elfread Goto Github PK

This code is a command-line utility that allows users to display information about ELF (Executable and Linking Format) files.

C 59.76% Makefile 0.16% HTML 2.23% JavaScript 37.86%

elf-parser elf-binaries elf64

elfread's Introduction

7etsuo

Excessively driven developer, constantly labouring on self-improvement and supporting others.

🧮 Statistics

🌟 Small Contributions

Contribution	Details
Microsoft	Fixed misplaced closing brace in WndProc.
Rust	Updated an unnecessary newline following the println examples.
Kali	Fixed a broken historical link in the 'Kali Linux History' topic.
Kali	Got a shoutout for contributing to the community by sharing my notes, and resources with users.
Ronin	Updated broken link for Pragmatic Programmers Guide to Ruby

🐛 CVE-2003-0358

Buffer overflow in (1) nethack 3.4.0 and earlier, and (2) falconseye 1.9.3 and earlier, which is based on nethack, allows local users to gain privileges via a long -s command line option.

https://github.com/7etsuo/CVE-2003-0358
https://www.exploit-db.com/?author=4939

🏁 CTF Writeups

https://github.com/7etsuo/zh3r0-CTF-binaryexploit
https://ctftime.org/writeup/21710
https://ctftime.org/writeup/21729
https://ctftime.org/writeup/21728

elfread's People

Contributors

Stargazers

elfread's Issues

Use e_phoff rather than offset from sizeof Ehdr_64

https://github.com/thesc1ent1st/elfread/blob/1d16fd81aa7381b28e3d5c29a80395c23cbe2b4f/elfread.c#L150

Add feature to list the program headers elfread

Overview

   Display the information contained in the file's segment headers, if it has any

Additional context

   The output should mimic readelf -l

Feature implement option [-S|--section-headers|--sections]

According to man readelf this feature should be as follows

  -S
  --sections
  --section-headers
      Displays the information contained in the file's section headers, if it has any.

from man 5 elf we have

      typedef struct {
          uint32_t   sh_name;
          uint32_t   sh_type;
          uint64_t   sh_flags;
          Elf64_Addr sh_addr;
          Elf64_Off  sh_offset;
          uint64_t   sh_size;
          uint32_t   sh_link;
          uint32_t   sh_info;
          uint64_t   sh_addralign;
          uint64_t   sh_entsize;
      } Elf64_Shdr;

   sh_name
          This member specifies the name of the section.  Its value is an index into the section header string table section, giving
          the location of a null-terminated string.

   sh_type
          This member categorizes the section's contents and semantics.

  sh_flags
          Sections support one-bit flags that describe miscellaneous attributes.  If a flag bit is set in sh_flags, the attribute is
          "on" for the section.  Otherwise, the attribute is "off" or does not apply.  Undefined attributes are set to zero.
   sh_addr
          If this section appears in the memory image of a process, this member holds the address at which the section's first  byte
          should reside.  Otherwise, the member contains zero.

   sh_offset
          This  member's  value  holds the byte offset from the beginning of the file to the first byte in the section.  One section
          type, SHT_NOBITS, occupies no space in the file, and its sh_offset member locates the conceptual placement in the file.

   sh_size
          This member holds the section's size in bytes.  Unless the section type is SHT_NOBITS, the section occupies sh_size  bytes
          in the file.  A section of type SHT_NOBITS may have a nonzero size, but it occupies no space in the file.

   sh_link
          This member holds a section header table index link, whose interpretation depends on the section type.

   sh_info
          This member holds extra information, whose interpretation depends on the section type.

   sh_addralign
          Some  sections  have  address  alignment  constraints.  If a section holds a doubleword, the system must ensure doubleword
          alignment for the entire section.  That is, the value of sh_addr must be congruent to zero, modulo  the  value  of  sh_ad‐
          dralign.   Only  zero  and  positive  integral  powers of two are allowed.  The value 0 or 1 means that the section has no
          alignment constraints.

   sh_entsize
          Some sections hold a table of fixed-sized entries, such as a symbol table.  For such a section, this member gives the size
          in bytes for each entry.  This member contains zero if the section does not hold a table of fixed-size entries.