crashpad::ElfImageReader Class Reference

A reader for ELF images mapped into another process. More...

`#include "snapshot/elf/elf_image_reader.h"`

## Classes

class | NoteReader
| This class enables reading note segments from an ELF image. More...
class | ProgramHeaderTable
class | ProgramHeaderTableSpecific

## Public Member Functions

bool | Initialize (const ProcessMemoryRange &memory, VMAddress address, bool verbose=true)
| Initializes the reader. More...
VMAddress | Address () const
| Returns the base address of the image's memory range. More...
VMSize | Size () const
| Returns the size of the range containing all loaded segments for this image. More...
uint16_t | FileType () const
| Returns the file type for the image. More...
VMOffset | GetLoadBias () const
| Returns the load bias for the image. More...
bool | GetDynamicSymbol (const std::string &name, VMAddress *address, VMSize *size)
| Reads information from the dynamic symbol table about the symbol identified by name. More...
bool | ReadDynamicStringTableAtOffset (VMSize offset, std::string *string)
| Reads a `NUL`-terminated C string from this image's dynamic string table. More...
bool | GetDebugAddress (VMAddress *debug)
| Determine the debug address. More...
bool | GetDynamicArrayAddress (VMAddress *address)
| Determine the address of `PT_DYNAMIC` segment. More...
VMAddress | GetProgramHeaderTableAddress ()
| Return the address of the program header table.
std::unique_ptr< NoteReader > | Notes (ssize_t max_note_size)
| Return a NoteReader for this image, which scans all PT_NOTE segments in the image. More...
std::unique_ptr< NoteReader > | NotesWithNameAndType (const std::string &name, NoteReader::NoteType type, ssize_t max_note_size)
| Return a NoteReader for this image, which scans all PT_NOTE segments in the image, filtering by name and type. More...
const ProcessMemoryRange * | Memory () const
| Return a ProcessMemoryRange restricted to the range of this image. More...
bool | GetNumberOfSymbolEntriesFromDtHash (VMSize *number_of_symbol_table_entries)
| Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_HASH` section. More...
bool | GetNumberOfSymbolEntriesFromDtGnuHash (VMSize *number_of_symbol_table_entries)
| Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_GNU_HASH` section. More...

## Detailed Description

A reader for ELF images mapped into another process.

This class is capable of reading both 32-bit and 64-bit images.

## Member Function Documentation

## Address()

VMAddress crashpad::ElfImageReader::Address | ( |  | ) | const

inline

Returns the base address of the image's memory range.

This may differ from the address passed to Initialize() if the ELF header is not loaded at the start of the first `PT_LOAD` segment.

## FileType()

uint16_t crashpad::ElfImageReader::FileType | ( |  | ) | const

Returns the file type for the image.

Possible values include `ET_EXEC` or `ET_DYN` from `<elf.h>`.

## GetDebugAddress()

bool crashpad::ElfImageReader::GetDebugAddress | ( | VMAddress * | debug | ) |

Determine the debug address.

The debug address is a pointer to an `r_debug` struct defined in `<link.h>`.

Parameters

  [out] | debug | the debug address, if found.

Returns
  `true` if the debug address was found.

## GetDynamicArrayAddress()

bool crashpad::ElfImageReader::GetDynamicArrayAddress | ( | VMAddress * | address | ) |

Determine the address of `PT_DYNAMIC` segment.

Parameters

  [out] | address | The address of the array, valid if this method returns `true`.

Returns
  `true` on success. Otherwise `false` with a message logged.

## GetDynamicSymbol()

bool crashpad::ElfImageReader::GetDynamicSymbol | ( | const std::string & | name,
|  | VMAddress * | address,
|  | VMSize * | size
| ) |  |

Reads information from the dynamic symbol table about the symbol identified by name.

Parameters

  [in] | name | The name of the symbol to search for.
  [out] | address | The address of the symbol in the target process' address space, if found.
  [out] | size | The size of the symbol, if found.

Returns
  `true` if the symbol was found.

## GetLoadBias()

VMOffset crashpad::ElfImageReader::GetLoadBias | ( |  | ) | const

inline

Returns the load bias for the image.

The load bias is the actual load address minus the preferred load address.

## GetNumberOfSymbolEntriesFromDtGnuHash()

bool crashpad::ElfImageReader::GetNumberOfSymbolEntriesFromDtGnuHash | ( | VMSize * | number_of_symbol_table_entries | ) |

Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_GNU_HASH` section.

Note
  Exposed for testing, not normally otherwise useful.
  Depending on the linker that generated the `DT_GNU_HASH` section, this value may not be as expected if there are zero exported symbols.

Parameters

  [out] | number_of_symbol_table_entries | The number of entries expected in `DT_SYMTAB`.

Returns
  `true` if a `DT_GNU_HASH` section was found, and was read successfully, otherwise `false` with an error logged.

## GetNumberOfSymbolEntriesFromDtHash()

bool crashpad::ElfImageReader::GetNumberOfSymbolEntriesFromDtHash | ( | VMSize * | number_of_symbol_table_entries | ) |

Retrieves the number of symbol table entries in `DT_SYMTAB` according to the data in the `DT_HASH` section.

Note
  Exposed for testing, not normally otherwise useful.

Parameters

  [out] | number_of_symbol_table_entries | The number of entries expected in `DT_SYMTAB`.

Returns
  `true` if a `DT_HASH` section was found, and was read successfully, otherwise `false` with an error logged.

## Initialize()

bool crashpad::ElfImageReader::Initialize | ( | const ProcessMemoryRange & | memory,
|  | VMAddress | address,
|  | bool | verbose = `true`
| ) |  |

Initializes the reader.

This method must be called once on an object and must be successfully called before any other method in this class may be called.

Parameters

  [in] | memory | A memory reader for the remote process.
  [in] | address | The address in the remote process' address space where the ELF image is loaded.
  [in] | verbose | `true` if this method should log error messages during initialization. Setting this value to `false` will reduce the error messages relating to verifying the ELF image, but may not suppress logging entirely.

## Memory()

const ProcessMemoryRange * crashpad::ElfImageReader::Memory | ( |  | ) | const

Return a ProcessMemoryRange restricted to the range of this image.

The caller does not take ownership of the returned object.

## Notes()

std::unique_ptr< ElfImageReader::NoteReader > crashpad::ElfImageReader::Notes | ( | ssize_t | max_note_size | ) |

Return a NoteReader for this image, which scans all PT_NOTE segments in the image.

The returned NoteReader is only valid for the lifetime of the ElfImageReader that created it.

Parameters

  [in] | max_note_size | The maximum note size to read. Notes whose combined name, descriptor, and padding size are greater than max_note_size will be silently skipped. A max_note_size of -1 indicates infinite maximum note size.

Returns
  A NoteReader object capable of reading notes in this image.

## NotesWithNameAndType()

std::unique_ptr< ElfImageReader::NoteReader > crashpad::ElfImageReader::NotesWithNameAndType | ( | const std::string & | name,
|  | NoteReader::NoteType | type,
|  | ssize_t | max_note_size
| ) |  |

Return a NoteReader for this image, which scans all PT_NOTE segments in the image, filtering by name and type.

The returned NoteReader is only valid for the lifetime of the ElfImageReader that created it.

Parameters

  [in] | name | The note name to match.
  [in] | type | The note type to match.
  [in] | max_note_size | The maximum note size to read. Notes whose combined name, descriptor, and padding size are greater than max_note_size will be silently skipped. A max_note_size of -1 indicates infinite maximum note size.

Returns
  A NoteReader object capable of reading notes in this image.

## ReadDynamicStringTableAtOffset()

bool crashpad::ElfImageReader::ReadDynamicStringTableAtOffset | ( | VMSize | offset,
|  | std::string * | string
| ) |  |

Reads a `NUL`-terminated C string from this image's dynamic string table.

Parameters

  [in] | offset | the byte offset in the string table to start reading.
  [out] | string | the string read.

Returns
  `true` on success. Otherwise `false` with a message logged.

## Size()

VMSize crashpad::ElfImageReader::Size | ( |  | ) | const

inline

Returns the size of the range containing all loaded segments for this image.

The size may include memory that is unmapped or mapped to other objects if this image's `PT_LOAD` segments are not contiguous.

The documentation for this class was generated from the following files:

- snapshot/elf/elf_image_reader.h
- snapshot/elf/elf_image_reader.cc