A reader for ELF images mapped into another process. More...

#include "snapshot/elf/elf_image_reader.h"

Classes
class	NoteReader
	This class enables reading note segments from an ELF image. More...

class	ProgramHeaderTable

class	ProgramHeaderTableSpecific

Public Member Functions
bool	Initialize (const ProcessMemoryRange &memory, VMAddress address, bool verbose=true)
	Initializes the reader. More...

VMAddress	Address () const
	Returns the base address of the image's memory range. More...

VMSize	Size () const
	Returns the size of the range containing all loaded segments for this image. More...

uint16_t	FileType () const
	Returns the file type for the image. More...

VMOffset	GetLoadBias () const
	Returns the load bias for the image. More...

bool	SoName (std::string *name)
	Determines the name of this object using `DT_SONAME`, if present. More...

bool	GetDynamicSymbol (const std::string &name, VMAddress address, VMSize size)
	Reads information from the dynamic symbol table about the symbol identified by name. More...

bool	ReadDynamicStringTableAtOffset (VMSize offset, std::string *string)
	Reads a `NUL`-terminated C string from this image's dynamic string table. More...

bool	GetDebugAddress (VMAddress *debug)
	Determine the debug address. More...

bool	GetDynamicArrayAddress (VMAddress *address)
	Determine the address of `PT_DYNAMIC` segment. More...

VMAddress	GetProgramHeaderTableAddress ()
	Return the address of the program header table.

std::unique_ptr< NoteReader >	Notes (size_t max_note_size)
	Return a NoteReader for this image, which scans all PT_NOTE segments in the image. More...

std::unique_ptr< NoteReader >	NotesWithNameAndType (const std::string &name, NoteReader::NoteType type, size_t max_note_size)
	Return a NoteReader for this image, which scans all PT_NOTE segments in the image, filtering by name and type. More...

const ProcessMemoryRange *	Memory () const
	Return a ProcessMemoryRange restricted to the range of this image. More...

bool	GetNumberOfSymbolEntriesFromDtHash (VMSize *number_of_symbol_table_entries)
	Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_HASH` section. More...

bool	GetNumberOfSymbolEntriesFromDtGnuHash (VMSize *number_of_symbol_table_entries)
	Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_GNU_HASH` section. More...

Detailed Description

A reader for ELF images mapped into another process.

This class is capable of reading both 32-bit and 64-bit images.

Member Function Documentation

◆ Address()

VMAddress crashpad::ElfImageReader::Address ( ) const

inline

Returns the base address of the image's memory range.

This may differ from the address passed to Initialize() if the ELF header is not loaded at the start of the first PT_LOAD segment.

◆ FileType()

uint16_t crashpad::ElfImageReader::FileType ( ) const

Returns the file type for the image.

Possible values include ET_EXEC or ET_DYN from <elf.h>.

◆ GetDebugAddress()

bool crashpad::ElfImageReader::GetDebugAddress ( VMAddress * debug )

Determine the debug address.

The debug address is a pointer to an r_debug struct defined in <link.h>.

Parameters

[out] debug the debug address, if found.

Returns: true if the debug address was found.

◆ GetDynamicArrayAddress()

bool crashpad::ElfImageReader::GetDynamicArrayAddress ( VMAddress * address )

Determine the address of PT_DYNAMIC segment.

Parameters

[out] address The address of the array, valid if this method returns true.

Returns: true on success. Otherwise false with a message logged.

◆ GetDynamicSymbol()

bool crashpad::ElfImageReader::GetDynamicSymbol	(	const std::string &	name,
		VMAddress *	address,
		VMSize *	size
	)

Reads information from the dynamic symbol table about the symbol identified by name.

Parameters

[in]	name	The name of the symbol to search for.
[out]	address	The address of the symbol in the target process' address space, if found.
[out]	size	The size of the symbol, if found.

Returns: true if the symbol was found.

◆ GetLoadBias()

VMOffset crashpad::ElfImageReader::GetLoadBias ( ) const

inline

Returns the load bias for the image.

The load bias is the actual load address minus the preferred load address.

◆ GetNumberOfSymbolEntriesFromDtGnuHash()

bool crashpad::ElfImageReader::GetNumberOfSymbolEntriesFromDtGnuHash ( VMSize * number_of_symbol_table_entries )

Retrieves the number of symbol table entries in DT_SYMTAB according to the data in the DT_GNU_HASH section.

Note: Exposed for testing, not normally otherwise useful.; Depending on the linker that generated the DT_GNU_HASH section, this value may not be as expected if there are zero exported symbols.

Parameters

[out] number_of_symbol_table_entries The number of entries expected in DT_SYMTAB.

Returns: true if a DT_GNU_HASH section was found, and was read successfully, otherwise false with an error logged.

◆ GetNumberOfSymbolEntriesFromDtHash()

bool crashpad::ElfImageReader::GetNumberOfSymbolEntriesFromDtHash ( VMSize * number_of_symbol_table_entries )

Retrieves the number of symbol table entries in DT_SYMTAB according to the data in the DT_HASH section.

Note: Exposed for testing, not normally otherwise useful.

Parameters

[out] number_of_symbol_table_entries The number of entries expected in DT_SYMTAB.

Returns: true if a DT_HASH section was found, and was read successfully, otherwise false with an error logged.

◆ Initialize()

bool crashpad::ElfImageReader::Initialize	(	const ProcessMemoryRange &	memory,
		VMAddress	address,
		bool	verbose = `true`
	)

Initializes the reader.

This method must be called once on an object and must be successfully called before any other method in this class may be called.

Parameters

[in]	memory	A memory reader for the remote process.
[in]	address	The address in the remote process' address space where the ELF image is loaded.
[in]	verbose	`true` if this method should log error messages during initialization. Setting this value to `false` will reduce the error messages relating to verifying the ELF image, but may not suppress logging entirely.

◆ Memory()

const ProcessMemoryRange * crashpad::ElfImageReader::Memory ( ) const

Return a ProcessMemoryRange restricted to the range of this image.

The caller does not take ownership of the returned object.

◆ Notes()

std::unique_ptr< ElfImageReader::NoteReader > crashpad::ElfImageReader::Notes ( size_t max_note_size )

Return a NoteReader for this image, which scans all PT_NOTE segments in the image.

The returned NoteReader is only valid for the lifetime of the ElfImageReader that created it.

Parameters

[in] max_note_size The maximum note size to read. Notes whose combined name, descriptor, and padding size are greater than max_note_size will be silently skipped.

Returns: A NoteReader object capable of reading notes in this image.

◆ NotesWithNameAndType()

std::unique_ptr< ElfImageReader::NoteReader > crashpad::ElfImageReader::NotesWithNameAndType	(	const std::string &	name,
		NoteReader::NoteType	type,
		size_t	max_note_size
	)

Return a NoteReader for this image, which scans all PT_NOTE segments in the image, filtering by name and type.

The returned NoteReader is only valid for the lifetime of the ElfImageReader that created it.

Parameters

[in]	name	The note name to match.
[in]	type	The note type to match.
[in]	max_note_size	The maximum note size to read. Notes whose combined name, descriptor, and padding size are greater than max_note_size will be silently skipped.

Returns: A NoteReader object capable of reading notes in this image.

◆ ReadDynamicStringTableAtOffset()

bool crashpad::ElfImageReader::ReadDynamicStringTableAtOffset	(	VMSize	offset,
		std::string *	string
	)

Reads a NUL-terminated C string from this image's dynamic string table.

Parameters

[in]	offset	the byte offset in the string table to start reading.
[out]	string	the string read.

Returns: true on success. Otherwise false with a message logged.

◆ Size()

VMSize crashpad::ElfImageReader::Size ( ) const

inline

Returns the size of the range containing all loaded segments for this image.

The size may include memory that is unmapped or mapped to other objects if this image's PT_LOAD segments are not contiguous.

◆ SoName()

bool crashpad::ElfImageReader::SoName ( std::string * name )

Determines the name of this object using DT_SONAME, if present.

Parameters

[out] name The name of this object, only valid if this method returns true.

Returns: true if a name was found for this object.

The documentation for this class was generated from the following files:

snapshot/elf/elf_image_reader.h
snapshot/elf/elf_image_reader.cc

Classes

Public Member Functions

Detailed Description

Member Function Documentation

◆ Address()

◆ FileType()

◆ GetDebugAddress()

◆ GetDynamicArrayAddress()

◆ GetDynamicSymbol()

◆ GetLoadBias()

◆ GetNumberOfSymbolEntriesFromDtGnuHash()

◆ GetNumberOfSymbolEntriesFromDtHash()

◆ Initialize()

◆ Memory()

◆ Notes()

◆ NotesWithNameAndType()

◆ ReadDynamicStringTableAtOffset()

◆ Size()

◆ SoName()