I'm actually trying to get the flags of given by the objdump -s command through a C program. But I don't know where to look for them. For example here:
./my_objdump: file format elf64-x86-64
architecture: i386:x86-64, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x00000000004006f0
I would like to know how to get: flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED in C. Thank you
I would like to know how to get: flags 0x00000112: EXEC_P, HAS_SYMS, D_PAGED in C.
It's not clear from your question whether you don't know how to get the number 0x112
, or how to translate that number into EXEC_P
, etc. [1]
The former is the value of e_flags in Elf64_Ehdr, which is right at the beginning of the file. That is, you read in sizeof(struct Elf64_Ehdr)
bytes from offset 0
in the file into a buffer [2], and then:
printf("flags: 0x%x\n", ((struct Elf64_Ehdr *)buf)->e_flags);
The latter: EXEC_P
, HAS_SYMS
, etc. represent flags that libbfd
uses internally, and have very little to do with actual ELF
file. They are internal abstraction, and are (or should be) of very little interest to anybody.
But if you really care, the D_PAGED
flag is set if the file has e_phnum != 0
, i.e.
if (((struct Elf64_Ehdr *)buf)->e_phnum != 0) {
printf("D_PAGED\n");
}
I am sure that HAS_SYMS
is set if .symtab
or .dynsym
sections are present, etc.
[1] Note: contrary to what one might think, EXEC_P
etc. flags are not derivable from flags
.
[2] This would need obvious adjustment if your file is 32-bit ELF. It also assumes that you are looking at native ELF file. Examining big-endian ELF file on little-endian machine (or vice versa) would require additional work.
User contributions licensed under CC BY-SA 3.0