include/monitor/analyzer/ElfAnalyzer.h

   1 /**
   2         Aesalon, a tool to visualize a program's behaviour at run-time.
   3         Copyright (C) 2010, Aesalon Development Team.
   4
   5         Aesalon is distributed under the terms of the GNU GPLv3. For more
   6         licensing information, see the file LICENSE included with the distribution.
   7
   8         @file include/monitor/analyzer/ElfAnalyzer.h
   9
  10 */
  11
  12 #ifndef AesalonMonitor_Analyzer_ElfAnalyzer_H
  13 #define AesalonMonitor_Analyzer_ElfAnalyzer_H
  14
  15 #include <stdint.h>
  16
  17 #include "ExecutableAnalyzer.h"
  18
  19 #define ELF32_TYPES Elf32_Ehdr, Elf32_Shdr, Elf32_Sym
  20 #define ELF64_TYPES Elf64_Ehdr, Elf64_Shdr, Elf64_Sym
  21
  22 namespace Monitor {
  23 namespace Analyzer {
  24
  25 class ElfAnalyzer : public ExecutableAnalyzer {
  26 private:
  27         int m_fd;
  28         Config::Vault *m_vault;
  29         uint8_t *m_file;
  30         uint32_t m_fileSize;
  31
  32         enum ElfType {
  33                 ELF32,
  34                 ELF64
  35         } m_elfType;
  36
  37         enum Encoding {
  38                 MSB_ENCODING,
  39                 LSB_ENCODING
  40         } m_encoding;
  41 public:
  42         ElfAnalyzer(std::string filename);
  43         virtual ~ElfAnalyzer();
  44
  45         virtual Config::Vault *analyzerVault() { return m_vault; }
  46 private:
  47         bool identValid();
  48
  49         template<typename ELFHeader, typename SectionHeader, typename SymbolHeader>
  50         void parseElf();
  51
  52         template<typename SymbolHeader>
  53         void parseSymbols(SymbolHeader *symbols, int symbolCount, const char *stringTable);
  54 };
  55
  56 } // namespace Analyzer
  57 } // namespace Monitor
  58
  59 #endif