Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

https://github.com/maxrt101/elfview

TUI Script to inspect ELF contents
https://github.com/maxrt101/elfview

Last synced: 2 months ago
JSON representation

TUI Script to inspect ELF contents

Awesome Lists containing this project

README 

        
```

 /$$$$$$$$ /$$       /$$$$$$$$ /$$    /$$ /$$                        

| $$_____/| $$      | $$_____/| $$   | $$|__/                        

| $$      | $$      | $$      | $$   | $$ /$$  /$$$$$$  /$$  /$$  /$$

| $$$$$   | $$      | $$$$$   |  $$ / $$/| $$ /$$__  $$| $$ | $$ | $$

| $$__/   | $$      | $$__/    \  $$ $$/ | $$| $$$$$$$$| $$ | $$ | $$

| $$      | $$      | $$        \  $$$/  | $$| $$_____/| $$ | $$ | $$

| $$$$$$$$| $$$$$$$$| $$         \  $/   | $$|  $$$$$$$|  $$$$$/$$$$/

|________/|________/|__/          \_/    |__/ \_______/ \_____/\___/    

```



## ELFView



Script to inspect ELF files.  

Uses pyelftools or lief (can be configured) to extract various information from ELF file.  

Currently extracts:  

 - Name  

 - Size  

 - Created/Modified/Accessed dates  

 - ELF File type  

 - Target Machine  

 - ABI  

 - Flags  

 - Entrypoint  

 - Sections (type, offset, size, flags, alignment)  

 - Hexdump of each sections' contents  

 - All source files that were used in compilation and their (compiled) sizes [1]  

 - All functions (code size, name, return type, argument names and types) [1]  

 - All variables (code size, name, type) [1]  

 - Cumulative size of functions and variable for whole ELF file [2] and for CU (source file) [1]  

 - All symbols (from `.symtab` section)  

 - All strings (either from string sections, or from whole file (scanned))  

 - Hexdump of whole ELF file  



[1] - Needs Dwarf sections present (can be enabled using debug a build).  

[2] - Use `f` key in Files window to filter files by part of name or folder.  



### Usage

Run elfview with desired ELF file: `python3 elfview.py Test.elf`.  



![General Info Window](img/general_info.png)



### Keybinds

Use `q` to exit.

Use `Tab` to switch between windows (topmost bar indicates which windows are available and which is currently selected)  

Use `LEFT ARROW`/`RIGHT ARROW` to switch between sub windows (pads).  

Use `UP ARRAY`/`DOWN ARROW` to scroll in lists.  

Use `/` to trigger search dialogue where it is applicable.  

Use `f` in `Files` pad of `Files/Functions` window to trigger filter dialogue.  

Use `[`/`]` to skip `config.PAGE_SCROLL_SKIP_SIZE` lines at once.  

Use `ESC` to close dialogues (search/filter and such).  

Use `n`/`p` to select next/prev occurrence of searched text.  



### Search/Filter

Press `f`, enter phrase to search for and press `Enter`.  



![Section Search Dialogue](img/sections_search_window.png)



It should work in any window with scrollable content.  



Upon successful search cursor will be moved to first occurrence of searched string.  

All occurrences will be highlighted.  



![Successful Section Search](img/sections_search_success.png)



If search didn't find anything, you will see an alert.  

It can be closed by pressing any key.  



![Failed Section Search](img/sections_search_failure.png)



Filter works the same way, but without alerts, if nothing's found and is usable only in `Files/Functions` window.  



### Installation

Clone the repo: `[email protected]:maxrt101/elfview.git`.  

Install pyelftools (recommended) or LIEF extended.  

Create virtual environment and activate it (or not): `python3 -m venv .venv && . .venv/bin/activate`.  

Install elfview: `pip3 install .` (use `pip3 install -e .` for development).  

Run the script, either directly `python3 elfview.py ` or through script install in env `bin` (e.g. if using venv: `./.venv/vin/elfview `).  



### Command Line Arguments

```commandline

usage: ELFView [-h] [-b BACKEND] [-r REMOVE_FILE_PREFIXES] [-c CONFIG_OVERRIDES] FILE



TUI Application to look into ELF files



positional arguments:

  FILE                                            ELF file to parse



options:

  -h, --help                                      show this help message and exit

  -b BACKEND, --backend BACKEND                   What library to use as backend (elftools or lief)

  -r REMOVE_FILE_PREFIXES, --remove-file-prefix REMOVE_FILE_PREFIXES

                                                  Removes specified file prefix from Files window (to see the actual file name)

  -c CONFIG_OVERRIDES, --config CONFIG_OVERRIDES  Override config variables at runtime. Example -c DEBUG=True

```



`FILE` - Path to ELF File.  

`-h, --help` - Prints above message.  

`-b, --backend` - Specifies backend library to use (`elftools` or `lief`).  

`-r, --remove-file-prefix` - Prefix for `Files` tab in `Files/Functions` window to be removed from CU path.  

`-c, --config` - Override config value.  



### Config

A lot of things can be configured through value present in `elfvview/config.py` file.  

You can configure your own installation (e.g. remap keys, change colors) by editing this file and reinstalling the package.  

Another possibility to reconfigure functionality on-the-fly is to use `-c, --config` (e.g. `-c DEBUG=True`).  



Here is a brief description of all configurable options:  

`BACKEND` - Select default backend (`elftools`/`lief`).  

`USE_COLORFUL_HEXDUMP` - Use color accents on every hexdump generated.  

`DEFER_HEXDUMP_GENERATION` - Don't generate whole hexdump upon file parsing.  

`RESET_FINDER_ON_LINKED_PAD_CHANGE` - Reset search when parent tab changed position (e.g. when selected file is changed, reset search in function pad).  

`SEARCH_WHOLE_BUFFER` - Affects all search. If on - will not search all buffer, only area around cursor, specified by `SEARCH_REACH`.  

`SEARCH_REACH` - Offsets (positive and negative) for cursor then `SEARCH_WHOLE_BUFFER` if off.  

`SEARCH_USE_NEXT_OCCURRENCE` - Turns on/off functionality of `n`/`p`. By default, mirrors `SEARCH_WHOLE_BUFFER` because selecting occurrences on partial search is unstable.  

`DEBUG` - Turns on some debug features (e.g. will print window and pad number in left corner, and print startup logs one line at a time, waiting for a keypress).  

`USE_STRINGS_FROM_SECTIONS` - Don't parse whole ELF for strings, use ones available in `.symtab` and such.  

`DEFAULT_STRING_MIN_LENGTH` - If `USE_STRINGS_FROM_SECTIONS` is `False`, will use this length as a minimal criteria for considering a null-terminated sequence of characters a string.  

`PAGE_SCROLL_SKIP_SIZE` - How many lines should `[`/`]` skip.  

`WINDOW_SWITCH_BAR_SIZE` - Height of window switch bar (topmost bar with currently selected window amongst list of all windows)  

`FILES_WINDOW_INFO_PAD_SIZE` - Height of `Info` pad under `Files/Variables` window.  

`HEXDUMP_WIDTH_TO_BYTE_SIZE_COEFFICIENT` - Magic number that is used to calculate number of bytes in line for hexdump considering screen width.  



`KeyMap` - Key mapping, name should suggest what the binding is responsible for, value shows default value. Uses int value of ascii char as value.  

`ColorMap` - Color mapping. First value in tuple is foreground color, second - background.  



There is currently no way to redefine keys or colors from command line, so reinstallation is required.