Method ParseHeaders

view/elf/elfview.cpp:2844–2975

uint64_t ElfViewType::ParseHeaders(BinaryView* data, ElfIdent& ident, ElfCommonHeader& commonHeader, Elf64Header& header, Ref<Architecture>* arch, Ref<Platform>* plat, string& errorMsg, BNEndianness& endianness)
{
	if (!IsTypeValidForData(data))
	{
		errorMsg = "invalid signature";
		return 0;
	}

	// parse ElfIdent
	if (data->Read(&ident, 0, sizeof(ident)) != sizeof(ident))
	{
		errorMsg = "unable to read header";
		return 0;
	}

	BinaryReader reader(data);
	if (ident.encoding <= 1)
		endianness = LittleEndian;
	else if (ident.encoding == 2)
		endianness = BigEndian;
	else
	{
		errorMsg = "invalid encoding";
		return 0;
	}

	// parse ElfCommonHeader
	reader.SetEndianness(endianness);
	reader.Seek(sizeof(ident));
	commonHeader.type = reader.Read16();
	commonHeader.arch = reader.Read16();
	commonHeader.version = reader.Read32();

	// Promote the file class to 64-bit
	// TODO potentially add a setting to allow the user to override header interpretation
	if ((commonHeader.type == ET_EXEC) && (commonHeader.arch == EM_X86_64) && (ident.fileClass == 1))
	{
		ident.fileClass = 2;
		m_logger->LogWarn(
			"Executable file claims to be 32-bit but specifies a 64-bit architecture. It is likely malformed or "
			"malicious. Treating it as 64-bit.");
	}

	// parse Elf64Header
	if (ident.fileClass == 1) // 32-bit ELF
	{
		header.entry = reader.Read32();
		header.programHeaderOffset = reader.Read32();
		header.sectionHeaderOffset = reader.Read32();
		header.flags = reader.Read32();
		header.headerSize = reader.Read16();
		header.programHeaderSize = reader.Read16();
		header.programHeaderCount = reader.Read16();
		header.sectionHeaderSize = reader.Read16();
		header.sectionHeaderCount = reader.Read16();
		header.stringTable = reader.Read16();
	}
	else if (ident.fileClass == 2) // 64-bit ELF