MCPcopy Create free account
hub / github.com/MagnetForensics/dumpit-linux / build_elf_header

Method build_elf_header

src/main.rs:504–627  ·  view source on GitHub ↗
(
        &self,
        endian: P::Endian,
        in_elf: &FileHeader64<Endianness>,
        in_segments: &[P], 
        in_data: &[u8],
        is_class_64: bool
    )

Source from the content-addressed store, hash-verified

502 }
503
504 fn build_elf_header<P: ProgramHeader<Word = u64, Endian = Endianness>>(
505 &self,
506 endian: P::Endian,
507 in_elf: &FileHeader64<Endianness>,
508 in_segments: &[P],
509 in_data: &[u8],
510 is_class_64: bool
511 ) -> Result<Vec<u8>> {
512
513 let mut out_data = Vec::new();
514 let mut writer = object::write::elf::Writer::new(endian, is_class_64, &mut out_data);
515
516 // reserve file header
517 writer.reserve_file_header();
518 assert!(in_elf.e_phoff(endian) == writer.reserved_len() as u64);
519 // debug!("File header reserved. (size = 0x{:x})", writer.reserved_len());
520 // reserve program headers (PT_NOTE + PT_LOAD)
521 writer.reserve_program_headers((self.mem_ranges.len() + 1) as u32);
522 // debug!("Program headers reserved. (size = 0x{:x})", writer.reserved_len());
523 // reserve program notes
524 let notes_off = writer.reserved_len() as u64;
525 self.reserve_program_notes(endian, &mut writer, in_segments, in_data);
526 let notes_sz = writer.reserved_len() as u64 - notes_off;
527 // debug!("Program notes reserved. (size = 0x{:x})", writer.reserved_len());
528
529 // null bytes
530 let next_page_offset = round_up(writer.reserved_len(), PAGE_SIZE);
531 writer.reserve_until(next_page_offset);
532 debug!("Reserved size of the new ELF header is 0x{:x}.", writer.reserved_len());
533
534 writer.write_file_header(&object::write::elf::FileHeader {
535 os_abi: in_elf.e_ident().os_abi,
536 abi_version: in_elf.e_ident().abi_version,
537 e_type: in_elf.e_type(endian),
538 e_machine: in_elf.e_machine(endian),
539 e_entry: in_elf.e_entry(endian).into(),
540 e_flags: in_elf.e_flags(endian),
541 })?;
542
543 writer.write_align_program_headers();
544
545 // The first entry should be a PT_NOTE.
546 debug!("write_program_header(PT_NOTE)...");
547 writer.write_program_header(&object::write::elf::ProgramHeader {
548 p_type : PT_NOTE,
549 p_flags : 0,
550 p_offset: notes_off,
551 p_vaddr : 0,
552 p_paddr : 0,
553 p_filesz: notes_sz,
554 p_memsz : 0,
555 // This needs to be zero for some tools.
556 p_align : 0,
557 });
558
559 // The other entries are the PT_LOAD entries.
560 // Building the new PHdrs
561 // Blocks will be after the ELF Header.

Callers 1

parse_kcoreMethod · 0.80

Calls 2

round_upFunction · 0.85
reserve_program_notesMethod · 0.80

Tested by

no test coverage detected