Get programs flags with a C program

0

I'm actually trying to get the flags of given by the objdump -s command through a C program. But I don't know where to look for them. For example here:

./my_objdump:     file format elf64-x86-64
architecture: i386:x86-64, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x00000000004006f0

I would like to know how to get: flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED in C. Thank you

c
unix
elf
asked on Stack Overflow Mar 12, 2013 by E-Kami

1 Answer

2

I would like to know how to get: flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED in C.

It's not clear from your question whether you don't know how to get the number 0x112, or how to translate that number into EXEC_P, etc. [1]

The former is the value of e_flags in Elf64_Ehdr, which is right at the beginning of the file. That is, you read in sizeof(struct Elf64_Ehdr) bytes from offset 0 in the file into a buffer [2], and then:

printf("flags: 0x%x\n", ((struct Elf64_Ehdr *)buf)->e_flags);

The latter: EXEC_P, HAS_SYMS, etc. represent flags that libbfd uses internally, and have very little to do with actual ELF file. They are internal abstraction, and are (or should be) of very little interest to anybody.

But if you really care, the D_PAGED flag is set if the file has e_phnum != 0, i.e.

if (((struct Elf64_Ehdr *)buf)->e_phnum != 0) {
  printf("D_PAGED\n");
}

I am sure that HAS_SYMS is set if .symtab or .dynsym sections are present, etc.

[1] Note: contrary to what one might think, EXEC_P etc. flags are not derivable from flags.

[2] This would need obvious adjustment if your file is 32-bit ELF. It also assumes that you are looking at native ELF file. Examining big-endian ELF file on little-endian machine (or vice versa) would require additional work.

answered on Stack Overflow Mar 18, 2013 by Employed Russian • edited Mar 18, 2013 by Employed Russian

User contributions licensed under CC BY-SA 3.0