encoding.elf

parse_file(path)! or parse_bytes(data)! reads ELF64 little-endian header fields, section headers, and symbol tables. Other classes, endianness, extended section numbering, invalid headers, and truncated tables return errors. Files without a section table or section names are supported.

file.machine identifies known architectures and uses .unknown for other values. file.entry is the entry address. file.sections() returns headers in file order. file.symbols()! reads all symtab and dynsym sections and resolves their names through linked string tables. Each Symbol exposes its name, value, size, section index, binding via bind(), and type via typ(). A file without a symbol table returns an error.

Section and symbol tables are checked against the input size before reading. Invalid symbol entry sizes, incomplete entries, wrong string-table types, and unterminated names return errors. The reader does not load executables, process relocations, or verify code.

fn parse_bytes(data []u8) !&File

parse_bytes parses one in-memory ELF64 image.

fn parse_file(path string) !&File

parse_file reads and parses the ELF file at path.

fn Machine.from[W](input W) !Machine

from returns the Machine value of an integer or of a field name, or an error if there is none.

fn SectionType.from[W](input W) !SectionType

from returns the SectionType value of an integer or of a field name, or an error if there is none.

enum Machine {
	unknown = 0xFFFF
	none    = 0
	x86     = 3
	mips    = 8
	arm     = 40
	x86_64  = 62
	aarch64 = 183
	riscv   = 243
}

Machine names an ELF e_machine architecture. Unlisted architectures map to .unknown. Discriminants are the raw e_machine numbers.

enum SectionType {
	unknown
	null
	progbits
	symtab
	strtab
	rela
	hash
	dynamic
	note
	nobits
	rel
	dynsym
}

SectionType names an ELF section type. Unlisted types map to .unknown.

struct File {
mut:
	data     []u8
	sections []SectionHeader
pub:
	machine Machine
	entry   u64
}

File is a parsed ELF64 file: header fields plus section headers. It is the V-idiomatic equivalent of Zig's std.elf / Go's debug/elf readers, starting with 64-bit little-endian objects (32-bit and big-endian are clear errors).

fn (f &File) sections() []SectionHeader

sections returns all section headers in file order (index 0 is the null section, per the format).

fn (f &File) symbols() ![]Symbol

symbols reads every symtab/dynsym section, resolving names through each table's linked string table. Files without any symbol table are an error.

struct SectionHeader {
pub mut:
	name string
pub:
	typ     SectionType
	flags   u64
	addr    u64
	offset  u64
	size    u64
	link    u32
	info    u32
	align   u64
	entsize u64
}

SectionHeader is one decoded ELF64 section header with its resolved name.

struct Symbol {
pub:
	name  string
	value u64
	size  u64
	info  u8
	other u8
	shndx u16
}

Symbol is one decoded ELF64 symbol table entry with its resolved name.

fn (s &Symbol) bind() u8

bind returns the symbol binding (upper nibble of info: 0 local, 1 global..).

fn (s &Symbol) typ() u8

typ returns the symbol type (lower nibble of info: 0 none, 1 object, 2 func..).