pwnlib.elf — ELF Executables and Libraries

Most exploitable CTF challenges are provided in the Executable and Linkable Format (ELF). Generally, it is very useful to be able to interact with these files to extract data such as function addresses, ROP gadgets, and writable page addresses.

ELF Modules

• pwnlib.elf.elf — ELF Files
  • Example Usage
  • Module Members
  • ELF
    • ELF.__getitem__()
    • ELF.__init__()
    • ELF.__repr__()
    • ELF._decompress_dwarf_section()
    • ELF._get_linked_strtab_section()
    • ELF._get_linked_symtab_section()
    • ELF._get_section_header()
    • ELF._get_section_header_stringtable()
    • ELF._get_section_name()
    • ELF._get_segment_header()
    • ELF._identify_file()
    • ELF._make_gnu_verdef_section()
    • ELF._make_gnu_verneed_section()
    • ELF._make_gnu_versym_section()
    • ELF._make_section()
    • ELF._make_segment()
    • ELF._make_sunwsyminfo_table_section()
    • ELF._make_symbol_table_index_section()
    • ELF._make_symbol_table_section()
    • ELF._parse_elf_header()
    • ELF._patch_elf_and_read_maps()
    • ELF._populate_functions()
    • ELF._populate_got()
    • ELF._populate_libraries()
    • ELF._populate_plt()
    • ELF._populate_symbols()
    • ELF._populate_synthetic_symbols()
    • ELF._read_dwarf_section()
    • ELF._section_offset()
    • ELF._segment_offset()
    • ELF.asm()
    • ELF.bss()
    • ELF.checksec()
    • ELF.debug()
    • ELF.disable_nx()
    • ELF.disasm()
    • ELF.dynamic_by_tag()
    • ELF.dynamic_string()
    • ELF.dynamic_value_by_tag()
    • ELF.fit()
    • ELF.flat()
    • ELF.from_assembly()
    • ELF.from_bytes()
    • ELF.get_dwarf_link()
    • ELF.get_ehabi_infos()
    • ELF.get_machine_arch()
    • ELF.get_section_by_name()
    • ELF.get_section_index()
    • ELF.get_segment_for_address()
    • ELF.get_shstrndx()
    • ELF.get_supplementary_dwarfinfo()
    • ELF.has_dwarf_link()
    • ELF.has_ehabi_info()
    • ELF.has_phantom_bytes()
    • ELF.has_section()
    • ELF.iter_notes()
    • ELF.iter_properties()
    • ELF.iter_segments_by_type()
    • ELF.load_from_path()
    • ELF.make_relative_loader()
    • ELF.num_sections()
    • ELF.num_segments()
    • ELF.offset_to_vaddr()
    • ELF.p16()
    • ELF.p32()
    • ELF.p64()
    • ELF.p8()
    • ELF.pack()
    • ELF.patch_custom_libraries()
    • ELF.process()
    • ELF.read()
    • ELF.save()
    • ELF.search()
    • ELF.section()
    • ELF.set_interpreter()
    • ELF.set_runpath()
    • ELF.string()
    • ELF.u16()
    • ELF.u32()
    • ELF.u64()
    • ELF.u8()
    • ELF.unpack()
    • ELF.vaddr_to_offset()
    • ELF.write()
    • ELF.__weakref__
    • ELF.address
    • ELF.arch
    • ELF.asan
    • ELF.aslr
    • ELF.bits
    • ELF.build
    • ELF.buildid
    • ELF.bytes
    • ELF.canary
    • ELF.config
    • ELF.data
    • ELF.debuginfo
    • ELF.dwarf
    • ELF.elftype
    • ELF.endian
    • ELF.entry
    • ELF.entrypoint
    • ELF.execstack
    • ELF.executable
    • ELF.executable_segments
    • ELF.file
    • ELF.fortify
    • ELF.functions
    • ELF.got
    • ELF.ibt
    • ELF.libc
    • ELF.libc_start_main_return
    • ELF.library
    • ELF.libs
    • ELF.linker
    • ELF.maps
    • ELF.memory
    • ELF.mmap
    • ELF.msan
    • ELF.native
    • ELF.non_writable_segments
    • ELF.nx
    • ELF.os
    • ELF.packed
    • ELF.path
    • ELF.pie
    • ELF.plt
    • ELF.relro
    • ELF.rpath
    • ELF.runpath
    • ELF.rwx_segments
    • ELF.sections
    • ELF.segments
    • ELF.shadowstack
    • ELF.start
    • ELF.statically_linked
    • ELF.stripped
    • ELF.sym
    • ELF.symbols
    • ELF.ubsan
    • ELF.version
    • ELF.writable_segments
  • Function
    • Function.__init__()
    • Function.__repr__()
    • Function.__weakref__
    • Function.address
    • Function.elf
    • Function.name
    • Function.size
  • dotdict
    • dotdict.__weakref__
• pwnlib.elf.config — Kernel Config Parsing
  • parse_kconfig()
• pwnlib.elf.corefile — Core Files
  • Using Corefiles to Automate Exploitation
  • Module Members
  • Corefile
    • Corefile.__init__()
    • Corefile._populate_got()
    • Corefile._populate_plt()
    • Corefile.debug()
    • Corefile.getenv()
    • Corefile.argc
    • Corefile.argc_address
    • Corefile.argv
    • Corefile.argv_address
    • Corefile.envp_address
    • Corefile.exe
    • Corefile.fault_addr
    • Corefile.libc
    • Corefile.mappings
    • Corefile.maps
    • Corefile.pc
    • Corefile.pid
    • Corefile.ppid
    • Corefile.prpsinfo
    • Corefile.prstatus
    • Corefile.registers
    • Corefile.siginfo
    • Corefile.signal
    • Corefile.sp
    • Corefile.stack
    • Corefile.vdso
    • Corefile.vsyscall
    • Corefile.vvar
  • Mapping
    • Mapping.__init__()
    • Mapping.__repr__()
    • Mapping.__str__()
    • Mapping.find()
    • Mapping.rfind()
    • Mapping.__weakref__
    • Mapping.address
    • Mapping.data
    • Mapping.flags
    • Mapping.name
    • Mapping.page_offset
    • Mapping.path
    • Mapping.permstr
    • Mapping.size
    • Mapping.start
    • Mapping.stop