/* ELF Header */
typedef struct elfhdr {unsigned char    e_ident[EI_NIDENT]; /* ELF Identification */Elf32_Half    e_type;        /* object file type */Elf32_Half    e_machine;    /* machine */Elf32_Word    e_version;    /* object file version */Elf32_Addr    e_entry;    /* virtual entry point */Elf32_Off    e_phoff;    /* program header table offset */Elf32_Off    e_shoff;    /* section header table offset */Elf32_Word    e_flags;    /* processor-specific flags */Elf32_Half    e_ehsize;    /* ELF header size */Elf32_Half    e_phentsize;    /* program header entry size */Elf32_Half    e_phnum;    /* number of program header entries */Elf32_Half    e_shentsize;    /* section header entry size */Elf32_Half    e_shnum;    /* number of section header entries */Elf32_Half    e_shstrndx;    /* section header table's "section header string table" entry offset */
} Elf32_Ehdr;

/* Section Header */
typedef struct {Elf32_Word    sh_name;    /* name - index into section heade string table section */Elf32_Word    sh_type;    /* type */Elf32_Word    sh_flags;    /* flags */Elf32_Addr    sh_addr;    /* address */Elf32_Off     sh_offset;    /* file offset */Elf32_Word    sh_size;    /* section size */Elf32_Word    sh_link;    /* section header table index link */Elf32_Word    sh_info;    /* extra information */Elf32_Word    sh_addralign;    /* address alignment */Elf32_Word    sh_entsize;    /* section entry size */
} Elf32_Shdr;

typedef struct
{Elf32_Word     p_type;      /* Segment type */Elf32_Off      p_offset;      /* Segment offset in file */Elf32_Addr     p_vaddr;      /* Segment virtual address in    memory*/                           Elf32_Addr     p_paddr;      /* Segment      physical address */Elf32_Word     p_filesz;      /* Segment size in file */Elf32_Word     p_memsz;     /* Segment size in memory */Elf32_Word     p_flags;       /* Segment flags */Elf32_Word     p_align;      /* Segment alignment */
} Elf32_Phdr;    

#include <stdio.h>
#include <stdlib.h>
#include <elf.h>
#include <errno.h>
#include <fcntl.h>
#ifdef __x86_64#define Elf_Ehdr Elf64_Ehdr#define Elf_Shdr Elf64_Shdr#define Elf_Sym Elf64_Sym#define Elf_Rel Elf64_Rela#define ELF_R_SYM ELF64_R_SYM#define REL_DYN ".rela.dyn"#define REL_PLT ".rela.plt"
#else#define Elf_Ehdr Elf32_Ehdr#define Elf_Shdr Elf32_Shdr#define Elf_Sym Elf32_Sym#define Elf_Rel Elf32_Rel#define ELF_R_SYM ELF32_R_SYM#define REL_DYN ".rel.dyn"#define REL_PLT ".rel.plt"
#endif#define LOG(...) printf(__VA_ARGS__);static uint32_t get_module_base(pid_t pid, const char *module_path) {FILE *fp = NULL;char *pch = NULL;char filename[32];char line[512];uint32_t addr = 0;LOG("[+] get libc base...\n");if (pid < 0)snprintf(filename, sizeof(filename), "/proc/self/maps");elsesnprintf(filename, sizeof(filename), "/proc/%d/maps", pid);if ((fp = fopen(filename, "r")) == NULL) {LOG("[-]open %s failed!", filename);return 0;}while (fgets(line, sizeof(line), fp)) {if (strstr(line, module_path)) {pch = strtok(line, "-");addr = strtoul(pch, NULL, 16);break;}}fclose(fp);LOG("[+] libc base:0x%x...\n",addr);return addr;
}int read_header(int d, Elf_Ehdr **header)//read elf header structure
{*header = (Elf_Ehdr *)malloc(sizeof(Elf_Ehdr));if (lseek(d, 0, SEEK_SET) < 0)//seek to the begin of file
    {free(*header);return errno;}if (read(d, *header, sizeof(Elf_Ehdr)) <= 0)//read from begin,read sizof(Elf_Ehdr) bytes ==> header
    {free(*header);return errno = EINVAL;}return 0;
}static int read_section_table(int d, Elf_Ehdr const *header, Elf_Shdr **table)//read elf header,find section header base address
{size_t size;if (NULL == header)return EINVAL;size = header->e_shnum * sizeof(Elf_Shdr);//section numbers and total size*table = (Elf_Shdr *)malloc(size);if (lseek(d, header->e_shoff, SEEK_SET) < 0)//point to section header,offset 0
    {free(*table);return errno;}if (read(d, *table, size) <= 0)//read section header structure to **table
    {free(*table);return errno = EINVAL;}return 0;
}static int read_string_table(int d, Elf_Shdr const *section, char const **strings)
{if (NULL == section)//section == > .dynstr sectionreturn EINVAL;*strings = (char const *)malloc(section->sh_size);if (lseek(d, section->sh_offset, SEEK_SET) < 0){free((void *)*strings);return errno;}if (read(d, (char *)*strings, section->sh_size) <= 0)//strings include all strings in .dynstr sections
    {free((void *)*strings);return errno = EINVAL;}return 0;
}int main()
{LOG("[+]Arm ELF32 reader...\n");uint32_t lic_base = get_module_base(-1,"/system/lib/libc.so");int descriptor = open("/system/lib/libc.so", O_RDONLY);//open libc.so,and return the handleElf_Ehdr *header = NULL;//elf headerElf_Shdr *section_header = NULL;//section header array ptrchar const *strings = NULL;//string table ptrread_header(descriptor,&header);LOG("[+]libc.so elf header:\n");LOG("[+]e_ident[EI_NIDENT]:   %s\n",header->e_ident);LOG("[+]e_type:%d(ET_DYN:%d,DYN (Shared object file))\n",header->e_type,ET_DYN);LOG("[+]e_machine:%d(EM_ARM:%d,Advanced RISC Machines)\n",header->e_machine,EM_ARM);LOG("[+]e_shoff:%d bytes\n",header->e_shoff);LOG("[+]libc.so section header:\n");read_section_table(descriptor,header,§ion_header);read_string_table(descriptor,§ion_header[header->e_shstrndx], &strings);//header->e_shstrndx ==>the index of string section header in section headersint i = 0;for(i = 0;i<header->e_shnum;++i){LOG("Section[%d] name:%s,type:%d,addr:0x%x,offset:0x%x,size:%dbytes,etc...\n",i,&strings[section_header[i].sh_name],section_header[i].sh_type,section_header[i].sh_addr,section_header[i].sh_offset,section_header[i].sh_size);}close(descriptor);return 0;
}