Class: ELF

ELF

This is a description of the ELF class.

new ELF()

Methods

(static) calculateEntropy()

See:

(static) calculateMD5()

See:

(static) compare()

See:

(static) compareEP()

See:

(static) compareOverlay()

See:

(static) findByte()

See:

(static) findDword()

See:

(static) findSignature()

See:

(static) findString()

See:

(static) findWord()

See:

(static) getElfHeader_ehsize() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_entry() → {UInt}

Returns:
Type
UInt

(static) getElfHeader_entry64() → {UInt64}

Returns:
Type
UInt64

(static) getElfHeader_flags() → {UInt}

Returns:
Type
UInt

(static) getElfHeader_machine() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_phentsize() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_phnum() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_phoff() → {UInt}

Returns:
Type
UInt

(static) getElfHeader_phoff64() → {UInt64}

Returns:
Type
UInt64

(static) getElfHeader_shentsize() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_shnum() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_shoff() → {UInt}

Returns:
Type
UInt

(static) getElfHeader_shoff64() → {UInt64}

Returns:
Type
UInt64

(static) getElfHeader_shstrndx() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_type() → {UShort}

Returns:
Type
UShort

(static) getElfHeader_version() → {UInt}

Returns:
Type
UInt

(static) getEntryPointOffset() → {Int64}

Get the offset of the entry point.
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) getFileBaseName()

See:

(static) getFileCompleteSuffix()

See:

(static) getFileDirectory()

See:

(static) getFileSuffix()

See:

(static) getGeneralOptions() → {String}

Get a string in the form of "ELFtype ELFmode". For example "executable x86" or "shared object amd64".
Returns:
Type
String

(static) getOverlayOffset() → {Int}

Get the file offset of the overlay.
Returns:
Type
Int

(static) getOverlaySize() → {Int}

Get the size of the overlay.
Returns:
Type
Int

(static) getProgramFileOffset(nProgram) → {UInt}

Get the file offset of a program.
Parameters:
Name Type Description
nProgram Int Program number.
Returns:
Type
UInt

(static) getProgramFileSize(nProgram) → {UInt}

Get the file size of a program.
Parameters:
Name Type Description
nProgram Int Program number.
Returns:
Type
UInt

(static) getSectionFileOffset(nSection) → {UInt}

Get the file offset of a section.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSectionFileSize(nSection) → {UInt}

Get the file size of a section.
Parameters:
Name Type Description
nSection Int Section number.
Returns:
Type
UInt

(static) getSectionNumber(sSectionName) → {Int}

Get the number of a section with a specific name.
Parameters:
Name Type Description
sSectionName String Section name.
Returns:
0-based section number, or -1 if there is no section with that name.
Type
Int

(static) getSignature()

See:

(static) getSize()

See:

(static) getString()

See:

(static) isOverlayPresent() → {Bool}

Check if an overlay is present.
Returns:
Type
Bool

(static) isSectionNamePresent(sSectionName) → {Bool}

Check if a section exists with a specific name or matches a regular expression.
Parameters:
Name Type Description
sSectionName String Section name or pattern.
Returns:
Type
Bool

(static) isSignaturePresent()

See:

(static) isStringInTablePresent(sSectionName, sString) → {Bool}

Check if a string exists in the table.
Parameters:
Name Type Description
sSectionName String Section name.
sString String String.
Returns:
Type
Bool

(static) OffsetToRVA(nOffset) → {Int64}

Convert a file offset to a relative virtual address (RVA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) OffsetToVA(nOffset) → {Int64}

Convert a file offset to a virtual address (VA).
Parameters:
Name Type Description
nOffset UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) readByte()

See:

(static) readDword()

See:

(static) readWord()

See:

(static) RVAToOffset(nRVA) → {Int64}

Convert a relative virtual address (RVA) to a file offset.
Parameters:
Name Type Description
nRVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64

(static) swapBytes()

See:

(static) VAToOffset(nVA) → {Int64}

Convert a virtual address (VA) to a file offset.
Parameters:
Name Type Description
nVA UInt64
Returns:
If an error occurs, -1 will be returned.
Type
Int64