ELF API - #282
Open
Frank01001 wants to merge 66 commits into
Open
Conversation
…vements to the general API
… of GNU Note Properties needed for runtime mitigation parsing
…cognition of runtime mitigations when binary is running
Member
Author
|
I don't know why my PRs are always enormous, but I think I finally finished. Mitigation parsing of ARM took a long time. This PR is finally ready for review. |
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a comprehensive ELF API for inspecting traced process binaries and their libraries. The implementation provides access to build IDs, sections, dynamic sections, symbols, program headers, GNU properties, and runtime security mitigations.
Key changes:
- New ELF inspection API with Python objects for ELF structures
- Nanobind implementation for parsing ELF objects
- Support for parsing libraries (both at load and dlopen time)
- Runtime security mitigations analysis
- Comprehensive test suite across amd64, i386, and aarch64 architectures
Reviewed Changes
Copilot reviewed 34 out of 66 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| test/utils/binary_utils.py | Added RESOLVE_EXE_CROSS utility for cross-platform binary resolution |
| test/srcs/sections_test.c | Comprehensive C test file exercising various ELF sections and features |
| test/srcs/mitigations.c | Test binary for security mitigation detection across platforms |
| test/srcs/dynamic_lib_load.c | Test case for dynamic library loading via dlopen |
| test/scripts/elf_api_test.py | Extensive test suite validating ELF API functionality |
| test/scripts/init.py | Added ElfApiTest to test exports |
| test/run_suite.py | Integrated ElfApiTest into test suite |
| test/binaries/* | Pre-compiled test binaries for multiple platforms |
| pyproject.toml | Moved 'rich' from optional to core dependencies |
| mkdocs.yml | Reorganized QoL documentation with new ELF API section |
| libdebug/utils/pprint_primitives.py | Added pprint_mitigations function for pretty printing security mitigations |
| libdebug/native/utils/binary_utils.{h,cpp} | Binary utility functions for ELF parsing (byte swapping, file I/O) |
Comments suppressed due to low confidence (1)
test/srcs/mitigations.c:1
- The build command on line 22 outputs to '../binaries/amd64/mitigationsv1' but is documented as building for AMD64 with 32-bit flag '-m32', which is contradictory. The correct output path should likely be '../binaries/i386/mitigationsv1' or the '-m32' flag should be removed.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Member
Author
|
One test that I should actually add is for the dynamic parsing of libraries when the binary calls EDIT: done |
MrIndeciso
reviewed
Jan 8, 2026
MrIndeciso
left a comment
MrIndeciso
left a comment
Member
There was a problem hiding this comment.
Just a few small comments for consistency, everything else looks good
MrIndeciso
previously approved these changes
Jan 22, 2026
…ensure uniform handling of them between the different functions
Those only work on M Thumb devices, which we don't support, and use a different instruction encoding style, so those patterns wouldn't even match there
MrIndeciso
previously approved these changes
Apr 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This draft PR introduces an API to inspect ELF files associated with the traced process — both the main binary and its libraries.
Libraries are parsed when loaded by the OS interpreter at process start, as well as when dynamically loaded at runtime via dlopen.
The new ELF inspection API provides access to detailed information such as:
Current Status
✅ Python objects for relevant ELF structures
✅ Nanobind implementation for parsing ELF objects
✅ Parsing of libraries
✅ Parsing of security mitigations
✅ Reorganization into a single nanobind module (excluding symbols, which are to be kept separate)
✅ Documentation
✅ Test suite
Notes
This PR is still in draft form — many features and improvements are ongoing.
This pr addresses #188 and #287.