File Explorer

1"""2ELF file parser.3 4This provides a class ``ELFFile`` that parses an ELF executable in a similar5interface to ``ZipFile``. Only the read interface is implemented.6 7Based on: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca8ELF header: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html9"""10 11import enum12import os13import struct14from typing import IO, Optional, Tuple15 16 17class ELFInvalid(ValueError):18    pass19 20 21class EIClass(enum.IntEnum):22    C32 = 123    C64 = 224 25 26class EIData(enum.IntEnum):27    Lsb = 128    Msb = 229 30 31class EMachine(enum.IntEnum):32    I386 = 333    S390 = 2234    Arm = 4035    X8664 = 6236    AArc64 = 18337 38 39class ELFFile:40    """41    Representation of an ELF executable.42    """43 44    def __init__(self, f: IO[bytes]) -> None:45        self._f = f46 47        try:48            ident = self._read("16B")49        except struct.error:50            raise ELFInvalid("unable to parse identification")51        if (magic := bytes(ident[:4])) != b"\x7fELF":52            raise ELFInvalid(f"invalid magic: {magic!r}")53 54        self.capacity = ident[4]  # Format for program header (bitness).55        self.encoding = ident[5]  # Data structure encoding (endianness).56 57        try:58            # e_fmt: Format for program header.59            # p_fmt: Format for section header.60            # p_idx: Indexes to find p_type, p_offset, and p_filesz.61            e_fmt, self._p_fmt, self._p_idx = {62                (1, 1): ("<HHIIIIIHHH", "<IIIIIIII", (0, 1, 4)),  # 32-bit LSB.63                (1, 2): (">HHIIIIIHHH", ">IIIIIIII", (0, 1, 4)),  # 32-bit MSB.64                (2, 1): ("<HHIQQQIHHH", "<IIQQQQQQ", (0, 2, 5)),  # 64-bit LSB.65                (2, 2): (">HHIQQQIHHH", ">IIQQQQQQ", (0, 2, 5)),  # 64-bit MSB.66            }[(self.capacity, self.encoding)]67        except KeyError:68            raise ELFInvalid(69                f"unrecognized capacity ({self.capacity}) or "70                f"encoding ({self.encoding})"71            )72 73        try:74            (75                _,76                self.machine,  # Architecture type.77                _,78                _,79                self._e_phoff,  # Offset of program header.80                _,81                self.flags,  # Processor-specific flags.82                _,83                self._e_phentsize,  # Size of section.84                self._e_phnum,  # Number of sections.85            ) = self._read(e_fmt)86        except struct.error as e:87            raise ELFInvalid("unable to parse machine and section information") from e88 89    def _read(self, fmt: str) -> Tuple[int, ...]:90        return struct.unpack(fmt, self._f.read(struct.calcsize(fmt)))91 92    @property93    def interpreter(self) -> Optional[str]:94        """95        The path recorded in the ``PT_INTERP`` section header.96        """97        for index in range(self._e_phnum):98            self._f.seek(self._e_phoff + self._e_phentsize * index)99            try:100                data = self._read(self._p_fmt)101            except struct.error:102                continue103            if data[self._p_idx[0]] != 3:  # Not PT_INTERP.104                continue105            self._f.seek(data[self._p_idx[1]])106            return os.fsdecode(self._f.read(data[self._p_idx[2]])).strip("\0")107        return None108