ElfScannerMgr Class Reference

Manager class for ELF scanners. More...

#include <KittyScanner.hpp>

Collaboration diagram for ElfScannerMgr:

Public Member Functions
	ElfScannerMgr (IKittyMemOp *pMem)
	Constructor for ElfScannerMgr.
ElfScanner	createWithBase (uintptr_t elfBase) const
	Constructs ElfScanner class with the given ELF base address.
ElfScanner	createWithMap (const KittyMemoryEx::ProcMap &map) const
	Constructs ElfScanner class with the given process memory map info.
ElfScanner	createWithSoInfo (const kitty_soinfo_t &soinfo) const
	Constructs ElfScanner class with the given soinfo.
bool	isValidELF (uintptr_t elfBase) const
	Checks if provided base address is an Elf.
bool	isElfNative (const ElfScanner &elf)
	Checks if the memory-mapped ELF file is native to the Android device.
bool	isElfEmulated (const ElfScanner &elf)
	Checks if the memory-mapped ELF file is emulated to the Android device.
ElfScanner &	getProgramElf ()
	Returns the program ELF.
std::vector< ElfScanner >	getAllELFs (EScanElfType type=EScanElfType::Any, EScanElfFilter filter=EScanElfFilter::Any)
	Fetches all memory mapped ELFs.
ElfScanner	findElf (const std::string &path, EScanElfType type=EScanElfType::Any, EScanElfFilter filter=EScanElfFilter::Any)
	Searches for a memory mapped ELF file based on the given path, type, and filter.
std::vector< std::pair< uintptr_t, ElfScanner > >	findSymbolAll (const std::string &symbolName, EScanElfType type=EScanElfType::Any, EScanElfFilter filter=EScanElfFilter::Any)
	Lookup dynamic symbol name in all loaded ELFs.
uintptr_t	findRemoteSymbol (const std::string &local_sym_name, uintptr_t local_sym_addr)
	Finds the remote address of a local symbol.

Protected Attributes
IKittyMemOp *	_pMem
ElfScanner	_programElf
std::unordered_map< uintptr_t, ElfScanner >	_cached_elfs

Friends
class	NativeBeidgeScannerMgr

Detailed Description

Manager class for ELF scanners.

Constructor & Destructor Documentation

ElfScannerMgr()

ElfScannerMgr::ElfScannerMgr ( IKittyMemOp * pMem )

inline

Constructor for ElfScannerMgr.

Parameters

pMem	Pointer to the memory operation interface.

Member Function Documentation

createWithBase()

ElfScanner ElfScannerMgr::createWithBase ( uintptr_t elfBase ) const

inline

Constructs ElfScanner class with the given ELF base address.

Parameters

elfBase

The base address of the ELF file in memory.

createWithMap()

ElfScanner ElfScannerMgr::createWithMap ( const KittyMemoryEx::ProcMap & map ) const

inline

Constructs ElfScanner class with the given process memory map info.

Parameters

elfMap

The base process memory map of the ELF file.

createWithSoInfo()

ElfScanner ElfScannerMgr::createWithSoInfo ( const kitty_soinfo_t & soinfo ) const

inline

Constructs ElfScanner class with the given soinfo.

Parameters

soinfo

The soinfo of the ELF file.

findElf()

ElfScanner ElfScannerMgr::findElf	(	const std::string &	path,
		EScanElfType	type = EScanElfType::Any,
		EScanElfFilter	filter = EScanElfFilter::Any )

Searches for a memory mapped ELF file based on the given path, type, and filter.

Note

If multiple ELFs found, it will prioritize ELFs with dynamic and return the latest mapped one with the most segments. This function can extract full path to loaded zipped Elf files.

Parameters

path	The path to the ELF file to find.
type	(optional) The type of ELF file to find (e.g., Any, Native, Emulated).
filter	(optional) The filter to apply when searching for ELF files. (e.g., Any, System, App).

Returns

An ElfScanner object representing the found ELF file, or an empty ElfScanner object if not found.

findRemoteSymbol()

uintptr_t ElfScannerMgr::findRemoteSymbol	(	const std::string &	local_sym_name,
		uintptr_t	local_sym_addr )

Finds the remote address of a local symbol.

This function searches for the remote address of a local symbol based on its name and address.

Parameters

local_sym_name	The name of the local symbol.
local_sym_addr	The address of the local symbol.

Returns

The remote address of the symbol, or 0 if not found.

findSymbolAll()

std::vector< std::pair< uintptr_t, ElfScanner > > ElfScannerMgr::findSymbolAll	(	const std::string &	symbolName,
		EScanElfType	type = EScanElfType::Any,
		EScanElfFilter	filter = EScanElfFilter::Any )

Lookup dynamic symbol name in all loaded ELFs.

Parameters

symbolName	The name of the symbol to lookup.
type	(optional) The type of ELF file to find (e.g., Any, Native, Emulated).
filter	(optional) The filter to apply when searching for ELF files. (e.g., Any, System, App).

Returns

A vector of pairs containing the symbol's absolute address and the ELF where the symbol was found.

getAllELFs()

std::vector< ElfScanner > ElfScannerMgr::getAllELFs	(	EScanElfType	type = EScanElfType::Any,
		EScanElfFilter	filter = EScanElfFilter::Any )

Fetches all memory mapped ELFs.

Parameters

type	(optional) The type of ELF file to find (e.g., Any, Native, Emulated).
filter	(optional) The filter to apply when searching for ELF files (e.g., Any, System, App).

Returns

A vector of all memory mapped ELFs.

isElfEmulated()

bool ElfScannerMgr::isElfEmulated ( const ElfScanner & elf )

inline

Checks if the memory-mapped ELF file is emulated to the Android device.

Parameters

elf	The ELF scanner object.

Returns

True if the ELF is emulated, false otherwise.

Here is the call graph for this function:

isElfNative()

bool ElfScannerMgr::isElfNative ( const ElfScanner & elf )

inline

Checks if the memory-mapped ELF file is native to the Android device.

Parameters

elf	The ELF scanner object.

Returns

True if the ELF is native, false otherwise.

Here is the call graph for this function:

isValidELF()

bool ElfScannerMgr::isValidELF

(

uintptr_t

elfBase

)

const

Checks if provided base address is an Elf.

Parameters

elfBase

ELF base address

---

The documentation for this class was generated from the following file:

• /home/runner/work/KittyMemoryEx/KittyMemoryEx/KittyMemoryEx/KittyScanner.hpp