pyelftools
pyelftools copied to clipboard
eliben
Parsing ELF and DWARF in Python
The said function is only invoked if the binary has both loc and loclists (a mix of DWARF 4 and 5). It tries to forward the call to the right...
I tried to speed up parsing by using ProcessPoolExecutor: ``` import concurrent.futures from elftools.elf.elffile import ELFFile elf_name = "examples/sample_exe64.elf" def parse_DIEs_in_CU(CU_offset): with open(elf_name, 'rb') as f: elffile = ELFFile(f) dwarfinfo...
I don't have a binary for this, but I have a crash report that DW_FORM_indirect exists out in the wild. The encoding for the form is: ULEB128, interpreted as a...
With Python 3, some times labels are type(str) other times they are type(bytes). For instance with a DT_NEEDED tagged item it might be a bytes, other times it's might be...
readelf.py -s have the fix length 25 self._emitline('%6d: %s %s %-7s %-6s %-7s %4s %.25s%s' % ( suggest like readelf add -W para, so the ndx string can display all....
[test.zip](https://github.com/eliben/pyelftools/files/7528696/test.zip) Version 0.27, Oct 27, 2020 I use this version to process dwarf of my elf. Use pyelftools I got this: ``` DIE DW_TAG_variable, size=25, has_children=False |DW_AT_name : AttributeValue(name='DW_AT_name', form='DW_FORM_string',...
I was trying to diagnose why I was getting 3 different line numbers for the same address and found out they were different views. Still trying to learn about what...
Hi, I've written an (minimal) python version of addr2line based on one of your examples (see below), due to some issues encountered with the one packaged in binutils. When I...
pyelftools still doesn't support DWARF version 5 as seen [here](https://github.com/eliben/pyelftools/blob/master/elftools/dwarf/dwarfinfo.py#L434). Is there anything considerable to be done except changing those lines and adding the new `DW_TAG` and `DW_AT`? If no...
Hi guys! I was using pyelftools to analyze some malware and I encountered an error with some ARM samples: - 56bebd4b9558bb9f539022bd2c5e40aecfa8d59c09784de61d1ba92766e2a30b - 2e5d2159b8a118f7a6a37ab28d1105b56021e46318193c1ef7cb41c5f4555896 The samples are present on both VirusTotal...
