Represents a scanner for memory ELF files. This class is used to scan ELF files from memory and extract information about their contents. More...

#include <KittyScanner.hpp>

Inheritance diagram for ElfScanner:

[legend]

Collaboration diagram for ElfScanner:

[legend]

Public Member Functions
	ElfScanner (IKittyMemOp *pMem, uintptr_t elfBase, const std::vector< KittyMemoryEx::ProcMap > &maps)
	Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given ELF base address.
	ElfScanner (IKittyMemOp *pMem, uintptr_t elfBase)
	Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given ELF base address.
	ElfScanner (IKittyMemOp *pMem, const kitty_soinfo_t &soinfo, const std::vector< KittyMemoryEx::ProcMap > &maps)
	Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given soinfo.
	ElfScanner (IKittyMemOp *pMem, const kitty_soinfo_t &soinfo)
	Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given soinfo.
bool	isValid () const
	Checks if the ElfScanner class is valid.
bool	isFixedBySoInfo () const
	Checks if the ELF file is fixed by soinfo. Some Elf headers are obfuscated or removed, createWithSoInfo(const kitty_soinfo_t&, const std::vector<KittyMemory::ProcMap>&) may fix header.
uintptr_t	base () const
	Elf's Base address in memory.
uintptr_t	end () const
	Elf's end address in memory.
	KT_ElfW (Ehdr) header() const
	Elf's header.
uintptr_t	phdr () const
	Elf's program header address in memory.
std::vector< KT_ElfW(Phdr)>	programHeaders () const
	Vector of Elf's program headers.
int	loads () const
	Elf's number of loads.
uintptr_t	loadBias () const
	Elf's load bias address in memory.
uintptr_t	loadSize () const
	Elf's load size.
uintptr_t	dynamic () const
	Elf's dynamic section address in memory.
std::vector< KT_ElfW(Dyn)>	dynamics () const
	Vector of Elf's dynamic sections.
uintptr_t	stringTable () const
	Elf's dynamic string table address in memory.
uintptr_t	symbolTable () const
	Elf's dynamic symbol table address in memory.
size_t	stringTableSize () const
	Elf's dynamic string table size.
size_t	symbolEntrySize () const
	Elf's symbol entry size.
uintptr_t	elfHashTable () const
	Elf's ELF hash table address in memory (DT_HASH), zero if not present.
uintptr_t	gnuHashTable () const
	Elf's GNU hash table address in memory (DT_GNU_HASH), zero if not present.
std::unordered_map< std::string, uintptr_t >	dsymbols ()
	Returns a map of symbols from the symbol table (SHT_SYMTAB) on disk.
uintptr_t	findSymbol (const std::string &symbolName) const
	Finds a symbol from the dynamic symbol table by name.
uintptr_t	findDebugSymbol (const std::string &symbolName)
	Finds a symbol from the symbol table (SHT_SYMTAB) on disk by name.
KittyMemoryEx::ProcMap	baseSegment () const
	Elf's base memory map info.
std::vector< KittyMemoryEx::ProcMap >	segments () const
	Returns all of Elf's memory maps info.
std::vector< KittyMemoryEx::ProcMap >	bssSegments () const
	Returns all of Elf's BSS memory maps.
std::string	filePath () const
	Returns the file path of the memory mapped Elf file.
std::string	realPath () const
	Returns the real path of the memory mapped Elf file (e.g, incase if it's inside a zip, it will return full path to zip entry).
bool	isZipped () const
	Returns if the memory mapped Elf file was loaded from zip file.
bool	find_r_debug (r_debug *out) const
	Finds the r_debug structure in the process.

Protected Member Functions
	KT_ElfW (Ehdr) _ehdr

Protected Attributes
IKittyMemOp *	_pMem
uintptr_t	_elfBase
uintptr_t	_phdr
std::vector< KT_ElfW(Phdr)>	_phdrs
int	_loads
uintptr_t	_loadBias
uintptr_t	_loadSize
uintptr_t	_dynamic
std::vector< KT_ElfW(Dyn)>	_dynamics
uintptr_t	_stringTable
uintptr_t	_symbolTable
uintptr_t	_elfHashTable
uintptr_t	_gnuHashTable
size_t	_strsz
size_t	_syment
bool	_fixedBySoInfo
KittyMemoryEx::ProcMap	_baseSegment
std::vector< KittyMemoryEx::ProcMap >	_segments
std::vector< KittyMemoryEx::ProcMap >	_bssSegments
std::string	_filepath
std::string	_realpath
bool	_dsymbols_init
std::unordered_map< std::string, uintptr_t >	_dsymbolsMap

Friends
class	ElfScannerMgr
class	LinkerScannerMgr
class	NativeBeidgeScannerMgr

Detailed Description

Represents a scanner for memory ELF files. This class is used to scan ELF files from memory and extract information about their contents.

Constructor & Destructor Documentation

◆ ElfScanner() [1/4]

ElfScanner::ElfScanner	(	IKittyMemOp *	pMem,
		uintptr_t	elfBase,
		const std::vector< KittyMemoryEx::ProcMap > &	maps )

Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given ELF base address.

Parameters

pMem	Pointer to the memory operation interface.
elfBase	The base address of the ELF file.
maps	The vector of cached process memory maps.

◆ ElfScanner() [2/4]

ElfScanner::ElfScanner	(	IKittyMemOp *	pMem,
		uintptr_t	elfBase )

inline

Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given ELF base address.

Parameters

pMem	Pointer to the memory operation interface.
elfBase	The base address of the ELF file.
maps	The vector of cached process memory maps (optional).

◆ ElfScanner() [3/4]

ElfScanner::ElfScanner	(	IKittyMemOp *	pMem,
		const kitty_soinfo_t &	soinfo,
		const std::vector< KittyMemoryEx::ProcMap > &	maps )

Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given soinfo.

Parameters

pMem	Pointer to the memory operation interface.
soinfo	The soinfo of the ELF file.
maps	The vector of cached process memory maps.

◆ ElfScanner() [4/4]

ElfScanner::ElfScanner	(	IKittyMemOp *	pMem,
		const kitty_soinfo_t &	soinfo )

inline

Constructor for ElfScanner class. This constructor initializes the ElfScanner class with the given soinfo.

Parameters

pMem	Pointer to the memory operation interface.
soinfo	The soinfo of the ELF file.
maps	The vector of cached process memory maps (optional).

Member Function Documentation

◆ dsymbols()

std::unordered_map< std::string, uintptr_t > ElfScanner::dsymbols ( )

Returns a map of symbols from the symbol table (SHT_SYMTAB) on disk.

Returns: A map where keys are symbol names and values are their corresponding memory addresses.

◆ find_r_debug()

bool ElfScanner::find_r_debug ( r_debug * out ) const

inline

Finds the r_debug structure in the process.

Parameters

out	Pointer to store the r_debug structure.

Returns: True if the r_debug structure is found, false otherwise.

◆ findDebugSymbol()

uintptr_t ElfScanner::findDebugSymbol ( const std::string & symbolName )

Finds a symbol from the symbol table (SHT_SYMTAB) on disk by name.

Parameters

symbolName The name of the symbol to find.

Returns: The memory address of the symbol if found, otherwise zero.

◆ findSymbol()

uintptr_t ElfScanner::findSymbol ( const std::string & symbolName ) const

Finds a symbol from the dynamic symbol table by name.

Parameters

symbolName The name of the symbol to find.

Returns: The memory address of the symbol if found, otherwise zero.

The documentation for this class was generated from the following file:

/home/runner/work/KittyMemoryEx/KittyMemoryEx/KittyMemoryEx/KittyScanner.hpp

Public Member Functions

Protected Member Functions

Protected Attributes

Friends

Detailed Description

Constructor & Destructor Documentation

◆ ElfScanner() [1/4]

◆ ElfScanner() [2/4]

◆ ElfScanner() [3/4]

◆ ElfScanner() [4/4]

Member Function Documentation

◆ dsymbols()

◆ find_r_debug()

◆ findDebugSymbol()

◆ findSymbol()