dBddlZddlmZddlmZGddeZGdd eeZGd d eZGd d eeZ y)N) struct_parse)Sectionc2eZdZdZdZdZdZedZy) ELFHashTablea Representation of an ELF hash table to find symbols in the symbol table - useful for super-stripped binaries without section headers where only the start of the symbol table is known from the dynamic segment. The layout and contents are nicely described at https://flapenguin.me/2017/04/24/elf-lookup-dt-hash/. The symboltable argument needs to implement a get_symbol() method - in a regular ELF file, this will be the linked symbol table section as indicated by the sh_link attribute. For super-stripped binaries, one should use the DynamicSegment object as the symboltable as it supports symbol lookup without access to a symbol table section. c||_||_t|jjj|jj ||_y)N)elffile _symboltablerstructsElf_Hashstreamparamsselfr start_offset symboltables 3/usr/lib/python3/dist-packages/elftools/elf/hash.py__init__zELFHashTable.__init__s? '"4<<#7#7#@#@#'<<#6#6#/1 c |jdS)zC Get the number of symbols from the hash table parameters. nchains)r)rs rget_number_of_symbolsz"ELFHashTable.get_number_of_symbols%s{{9%%rc"|jddk(ry|j||jdz}|jd|}|dk7rD|jj|}|j|k(r|S|jd|}|dk7rDy)D Look up a symbol from this hash table with the given name. nbucketsrNbucketschains)relf_hashr get_symbolname)rr!hvalsymndxsyms rr zELFHashTable.get_symbol*s ;;z "a '}}T"T[[%<<Y'-k##..v6Cxx4 [[*62F k rct|ts|jd}d}d}t|D]"}|dz|z}|dz}|dk7r||dz z}||z}$|S)z9 Compute the hash value for a given symbol name. utf-8rl` isinstancebytesencode bytearray)r!hxcs rrzELFHashTable.elf_hash8su$&;;w'D  4 Aa1 AJAAva2g !GA   rN) __name__ __module__ __qualname____doc__rrr staticmethodrrrrrs* 1&   rrceZdZdZdZy)ELFHashSectionz Section representation of an ELF hash table. In regular ELF files, this allows us to use the common functions defined on Section objects when dealing with the hash table. cjtj||||tj|||d|yN sh_offset)rrrrheaderr!r rs rrzELFHashSection.__init__N/vtW5dGT+-> LrNr1r2r3r4rr6rrr8r8I Mrr8c8eZdZdZdZdZdZdZedZ y) GNUHashTablea Representation of a GNU hash table to find symbols in the symbol table - useful for super-stripped binaries without section headers where only the start of the symbol table is known from the dynamic segment. The layout and contents are nicely described at https://flapenguin.me/2017/05/10/elf-lookup-dt-gnu-hash/. The symboltable argument needs to implement a get_symbol() method - in a regular ELF file, this will be the linked symbol table section as indicated by the sh_link attribute. For super-stripped binaries, one should use the DynamicSegment object as the symboltable as it supports symbol lookup without access to a symbol table section. c*||_||_t|jjj|jj ||_|jjjdj|_ |jjjdj|_ |d|jzz|j d|jzz|j d|jzz|_ y)Nr' bloom_sizer) r r rr Gnu_HashrrElf_wordsizeof _wordsize Elf_xword _xwordsize _chain_posrs rrzGNUHashTable.__init__`s '"4<<#7#7#@#@#'<<#6#6#/1 --66r:AAC,,..88<CCE&T^^);; KK % 78 KK #dnn 45rct|jd}||jdkr|jdS|j||jdz |jzz}|jj j ||jjrdnd} tj||jj j|jd}|dzr|dzS|dz }V)z Get the number of symbols in the hash table by finding the bucket with the highest symbol index and walking to the end of its chain. r symoffsetIrr) maxrrLrIr rseek little_endianstructunpackread)rmax_idx max_chain_pos hash_formatcur_hashs rrz"GNUHashTable.get_number_of_symbolsms dkk),- T[[- -;;{+ + t{{;/ /4>> AB    /"ll88dd }}[$,,2E2E2J2J4>>2Z[\]^H!|{" qLG rc|jj}||jdz }t||z |jdz}d||zzd||zzz}|jd||z|k(S)z Helper function to check if the given hash could be in the hash table by testing it against the bloom filter. bloom_shiftrErbloom)r elfclassrint)rH1 arch_bitsH2word_idxBITMASKs r_matches_bloomzGNUHashTable._matches_blooms|LL)) 4;;}- -rI~&\)BBi(Q2 >-BC G$X.8WDDrc|j|}|j|sy|jd||jdz}||jdkry|jjj |j ||jdz |jzz|jjrdnd} tj||jjj|jd}|dz|dzk(r,|jj|}||jk(r|S|dzr y|dz }) rNrrrNrOrPrr)gnu_hashrerr rrRrLrIrSrTrUrVr r r!)rr!namehashsymidxrYrZsymbols rr zGNUHashTable.get_symbols,==&""8,Y'4;;z3J(JK DKK , ,   FT[[=U4UY]YgYg3g!gh"ll88dd }}[$,,2E2E2J2J4>>2Z[\]^H!|x!|+**55f=6;;&!M!| aKFrct|ts|jd}d}t|D] }|dz|z} |dzS)zC Compute the GNU-style hash value for a given symbol name. r&i!lr))keyr.r0s rrgzGNUHashTable.gnu_hashsK#u%**W%C 3 AB A :~rN) r1r2r3r4rrrer r5rgr6rrrBrBSs0  5.E2rrBceZdZdZdZy)GNUHashSectionz Section representation of a GNU hash table. In regular ELF files, this allows us to use the common functions defined on Section objects when dealing with the hash table. cjtj||||tj|||d|yr:)rrrBr<s rrzGNUHashSection.__init__r>rNr?r6rrroror@rro) rT common.utilsrsectionsrobjectrr8rBror6rrrtsL'666rMWlM]6]@MWlMr