Reading ELF by Hand, Because libelf is GPL

#cpp #linux #elf #opensource

I needed a lightweight way to read ELF binaries for my own tool.

libelf is GPL.
libdw — same.
ELFIO — too heavy for what I need.
objdump — external tool, not meant to be parsed.

So I started writing my own ELF parser instead — it's still in progress.
No dependencies.
No objdump.
Rough around the edges, but it works.

What it does

Parses ELF headers (ELF64)
Reads Section Header Table
Handles symbol tables (.symtab, .dynsym)
Parses .strtab for symbol names
Uses manually defined structs: Elf64_Ehdr, Elf64_Shdr, Elf64_Sym (no <elf.h>)

Everything via mmap. Zero-copy.
MIT licensed.

Example

ElfFile elf("/usr/bin/bash");

for (const auto& sym : elf.symbols()) {
    if (sym.is_function()) {
        std::cout << sym.name() << " at 0x" << std::hex << sym.addr() << "\n";
    }
}

Source Code

The code is available here:
github.com/trianmon/libMiniELF

Why?

I'm building a low-level Linux tool.
GPL isn't an option.
Most existing ELF parsers are either too complex or too restrictive license-wise.
ELF itself isn't that scary, if you keep things minimal.

DWARF might come later. Maybe.

Roadmap

Core Enhancements

Status	Feature	Description
[x]	ELF64 parsing	Parse headers and sections from ELF64 binaries
[x]	`.symtab` / `.dynsym`	Extract symbols from standard ELF tables
[x]	CLI tool	Command-line utility `dump_elf`
[x]	Unit tests via CTest	Basic test coverage using CTest
[ ]	`getSymbolByName(name)`	Retrieve symbol by name
[ ]	`getNearestSymbol(addr)`	Nearest symbol matching an address

Planned Extensions

Status	Feature	Description
[ ]	DWARF support	Separate library (`libTinyDWARF`) for debug info
[ ]	Address-to-section mapping	Map address to section with `getSectionByAddress()`
[ ]	ELF metadata API	Provide entry point, architecture, etc.

Stay tuned.

DEV Community