FileInfo describes a binary file in a format-agnostic way.
Constructor | Description |
|
|
Instance member | Description | ||
|
|||
|
|
||
|
|
||
|
The entry point of this binary (the start address that this binary runs at). Note that some binaries (e.g., PE DLL files) do not have a specific entry point, and EntryPoint will return None in such a case.
|
||
|
|||
|
|
||
Full Usage:
this.FilePath
Returns: string
Modifiers: abstract |
|
||
|
|
||
Full Usage:
this.GetDynamicSymbols(?excludeImported)
Parameters:
bool
Returns: seq<Symbol>
A sequence of dynamic symbols.
Modifiers: abstract |
Return a list of all the dynamic symbols from the binary. Dynamic symbols are the ones that are required to run the binary. The "excludeImported" argument indicates whether to exclude external symbols that are imported from other files. However, even if "excludeImported" is true, returned symbols may include a forwarding entry that redirects to another function in an external file (cf. SymbolKind.ForwardType). When "excludeImported" argument is not given, this function will simply return all possible dynamic symbols.
|
||
|
|
||
Full Usage:
this.GetFunctionAddresses(arg1)
Parameters:
bool
Returns: seq<Addr>
A sequence of function addresses.
Modifiers: abstract |
Returns a sequence of local function addresses (excluding external functions) from a given FileInfo. If the argument is true, then this funciton utilizes exception information of the binary to infer function entries. Note that the inference process is not necessarily precise, so this is really just an experimental feature, and will be removed in the future.
|
||
Full Usage:
this.GetFunctionAddresses()
Returns: seq<Addr>
A sequence of function addresses.
Modifiers: abstract |
Returns a sequence of local function addresses (excluding external functions) from a given FileInfo. This function only considers addresses that are certain.
|
||
|
|
||
Full Usage:
this.GetLinkageTableEntries()
Returns: seq<LinkageTableEntry>
A sequence of linkage table entries, e.g., PLT entries for ELF files.
Modifiers: abstract |
|
||
|
Given a range r, return a list of address ranges (intervals) that are within r, and that are not in-file.
|
||
Full Usage:
this.GetRelocationSymbols()
Returns: seq<Symbol>
A sequence of relocation symbols.
Modifiers: abstract |
|
||
Full Usage:
this.GetSections(name)
Parameters:
string
-
The name of the section.
Returns: seq<Section>
A sequence of sections that have the specified name. This function
returns an empty sequence if there is no section of the given name.
Modifiers: abstract |
|
||
|
|
||
|
|
||
Full Usage:
this.GetSegments(perm)
Parameters:
Permission
Returns: seq<Segment>
A sequence of segments.
|
For a given permission, return a list of segments that satisfy the permission. For a given "READ-only" permission, this function may return a segment whose permission is "READABLE and WRITABLE", as an instance.
|
||
|
|
||
Full Usage:
this.GetSegments(?isLoadable)
Parameters:
bool
Returns: seq<Segment>
A sequence of segments.
Modifiers: abstract |
Return a list of segments from the binary. If the isLoadable parameter is true, it will only return a list of "loadable" segments. Otherwise, it will return all possible segments. By default, this function returns only loadable segments, e.g., PT_LOAD segment of ELF.
|
||
Full Usage:
this.GetStaticSymbols()
Returns: seq<Symbol>
A sequence of static symbols.
Modifiers: abstract |
Return a list of all the static symbols from the binary. Static symbols can be removed when we strip the binary. Unlike dynamic symbols, static symbols are not required to run the binary, thus they can be safely removed before releasing it.
|
||
|
|
||
Full Usage:
this.GetTextSections()
Returns: seq<Section>
A sequence of text sections.
Modifiers: abstract |
|
||
|
|||
Full Usage:
this.IsExecutableAddr(arg1)
Parameters:
Addr
Returns: bool
Returns true if the address is executable, false otherwise.
Modifiers: abstract |
Check if the given address is executable address for this binary. We say a given address is executable if the address is within an executable section.
|
||
Full Usage:
this.IsInFileAddr(arg1)
Parameters:
Addr
Returns: bool
Returns true if the address is within a mapped address range, false
otherwise.
Modifiers: abstract |
Check if the given address is valid and there is an actual mapping from the binary file to the corresponding memory. Unlike IsValidAddr, this function checks if we can decide the actual value of the given address from the binary. For example, a program header of an ELF file may contain 100 bytes in size, but when it is mapped to a segment in memory, the size of the segment can be larger than the size of the program header. This function checks if the given address is in the range of the segment that has a direct mapping to the file's program header.
|
||
Full Usage:
this.IsInFileRange(arg1)
Parameters:
AddrRange
Returns: bool
Returns true if the whole range of addresses is within a valid range,
false otherwise.
Modifiers: abstract |
Check if the given address range is valid and there exists a corresponding region in the actual binary file. This function returns true only if the whole range of the addressess are valid (for every address in the range, IsInFileAddr should return true).
|
||
Full Usage:
this.IsLinkageTable(arg1)
Parameters:
Addr
Returns: bool
True if the address is a linkage table address, false otherwise.
Modifiers: abstract |
|
||
Full Usage:
this.IsNXEnabled
Returns: bool
Modifiers: abstract |
|
||
Full Usage:
this.IsRelocatable
Returns: bool
Modifiers: abstract |
|
||
Full Usage:
this.IsStripped
Returns: bool
Modifiers: abstract |
|
||
Full Usage:
this.IsValidAddr(arg1)
Parameters:
Addr
Returns: bool
Returns true if the address is within a valid range, false otherwise.
Modifiers: abstract |
Check if the given address is valid for this binary. We say a given address is valid for the binary if the address is within the range of statically computable segment ranges.
|
||
Full Usage:
this.IsValidRange(arg1)
Parameters:
AddrRange
Returns: bool
Returns true if the whole range of addresses is within a valid range,
false otherwise.
Modifiers: abstract |
Check if the given address range is valid. This function returns true only if the whole range of the addressess are valid (for every address in the range, IsValidAddr should return true).
|
||
|
|
||
Full Usage:
this.ToBinaryPointer(arg1)
Parameters:
string
Returns: BinaryPointer
Modifiers: abstract |
Convert the section of the name (string) into a binary pointer, which can exclusively point to binary contents of the section.
|
||
Full Usage:
this.ToBinaryPointer(arg1)
Parameters:
Addr
Returns: BinaryPointer
Modifiers: abstract |
Convert the section at the address (Addr) into a binary pointer, which can exclusively point to binary contents of the section.
|
||
Full Usage:
this.TranslateAddress(addr)
Parameters:
Addr
-
Virtual address.
Returns: int
Returns an offset to this binary for a given virtual address.
Modifiers: abstract |
|
||
|
|
||
|
|
Static member | Description |
Full Usage:
FileInfo.EntryPointToString(entryPoint)
Parameters:
Addr option
-
Entry point of a given binary.
Returns: string
A converted string.
|
|
Full Usage:
FileInfo.FileTypeToString(ty)
Parameters:
FileType
-
A FileType to convert.
Returns: string
A converted string.
|
|
Full Usage:
FileInfo.PermissionToString(p)
Parameters:
Permission
-
A permission to convert.
Returns: string
A converted string.
|
|