Skip to content


Elf (Program) dataclass

An Executable and Linking Format (ELF) file.

See for details.

ElfBasicHeader (ResourceView) dataclass

See "e_ident" in for details.

ElfDynamicEntry (ResourceView) dataclass

ElfDynamicEntry describes a .dynamic table entry.


Name Type Description
d_tag int

one of ElfDynamicTableTag

d_un int

malleable word size value that changes meaning depending on d_tag

ElfDynamicSection (ElfSection)

The .dynamic ELF Section that appears in dynamically linked ELFs.

ElfDynamicTableTag (Enum)

An enumeration.

ElfHeader (ResourceView) dataclass

See "ELF header (Ehdr)" in for details.

ElfMachine (Enum)

An enumeration.

ElfPointerArraySection (UnanalyzedElfSection) dataclass

An ELF Section that can be interpreted as an array of pointers.

TODO: Except in the case of .init_array and .fini_array, this tag must be added by hand as overlapping with other tags, like CodeRegion results in Data Node inconsistencies and errors.

ElfProgramHeader (ElfSegmentStructure) dataclass

See "Program header (Phdr)" in for details.

ElfProgramHeaderPermission (Enum)

An enumeration.

ElfProgramHeaderType (Enum)

An enumeration.

ElfRelaEntry (ResourceView) dataclass

ElfRelaEntry describes relocation information within the program. Located in .rela.* sections.


Name Type Description
r_offset int

vm offset information for each relocation entry

r_info int

Describes the type of relocation and sometimes the symbol related to the relocation

r_addend int

Describes the VM offset for each relocation itself

ElfRelaInfo (Enum)

An Enum for r_info in ElfRela

Implemented in each respective arch

ElfRelaSection (ElfSection)

An ELF .rela.* section containing structs of type Elf{32, 64}_Rela

ElfSection (UnanalyzedElfSection, NamedProgramSection) dataclass

An analyzed ELF Section

ElfSectionFlag (Enum)

An enumeration.

ElfSectionHeader (ElfSectionStructure) dataclass

See "Section header (Shdr)" in for details.

ElfSectionNameStringSection (ElfStringSection)

A section with the STRTAB flag and named ".shstrtab". There should be at most one of these per ELF, and it contains only strings for the names of sections. Section headers' sh_name field is an index within this .shstrtab section.

ElfSectionStructure (ResourceView) dataclass

ElfSectionStructure(section_index: int)

ElfSectionType (Enum)

An enumeration.

ElfSegment (UnanalyzedElfSegment, ProgramSegment) dataclass

An analyzed ELF Segment

ElfSegmentStructure (ResourceView) dataclass

ElfSegmentStructure(segment_index: int)

ElfStringSection (UnanalyzedElfSection)

A section with the STRTAB flag. There may be several of these in an ELF.

ElfSymbol (ElfSymbolStructure) dataclass

See "String and symbol tables" in for details.

ElfSymbolBinding (Enum)

An enumeration.

ElfSymbolSection (ElfSection)

An ELF section containing structures of type Elf{32, 64}_Sym

ElfSymbolStructure (ResourceView) dataclass

ElfSymbolStructure(symbol_index: int)

ElfSymbolType (Enum)

An enumeration.

ElfSymbolVisibility (Enum)

An enumeration.

ElfType (Enum)

An enumeration.

ElfVirtualAddress (ResourceView) dataclass

Wrapper for a virtual address


Name Type Description
value int

an address

UnanalyzedElfSection (ElfSectionStructure) dataclass

An unanalyzed ELF Section

UnanalyzedElfSegment (ElfSegmentStructure) dataclass

An unanalyzed ELF Segment