New in version 3.2.0.
The ELF module is very similar to the PE module, but for ELF files. This module exposes most of the fields present in a ELF header. Let’s see some examples:
import "elf"
rule single_section
{
condition:
elf.number_of_sections == 1
}
rule elf_64
{
condition:
elf.machine == elf.EM_X86_64
}
Integer with one of the following values:
No file type.
Relocatable file.
Executable file.
Shared object file.
Core file.
Example: elf.type == elf.ET_EXEC
Integer with one of the following values:
Example: elf.machine == elf.EM_X86_64
Entry point raw offset or virtual address depending if YARA is scanning a file or process memory respectively. This is equivalent to the deprecated entrypoint keyword.
Number of sections in the ELF file.
An zero-based array of section objects, one for each section the ELF has. Individual sections can be accessed by using the [] operator. Each section object has the following attributes:
Section’s name.
Example: elf.section[3].name == ”.bss”
Section’s size in bytes. Unless the section type is SHT_NOBITS, the section occupies sh_size bytes in the file. A section of SHT_NOBITS may have a non-zero size, but it occupies no space in the file.
Offset from the beginning of the file to the first byte in the section. One section type, SHT_NOBITS described below, occupies no space in the file, and its offset member locates the conceptual placement in the file.
Integer with one of the following value:
This value marks the section as inactive; it does not have an associated section. Other members of the section header have undefined values.
The section holds information defined by the program, whose format and meaning are determined solely by the program.
The section hold a symbol table.
The section holds a string table. An object file may have multiple string table sections.
The section holds relocation entries.
The section holds a symbol hash table.
The section holds information for dynamic linking.
The section holds information that marks the file in some way.
A section of this type occupies no space in the file but otherwise resembles SHT_PROGBITS.
The section holds relocation entries.
This section type is reserved but has unspecified semantics.
This section holds dynamic linking symbols.
Integer with sections’s flags as defined below:
The section contains data that should be writable during process execution.
The section occupies memory during process execution. Some control sections do not reside in the memory image of an object file; this attribute is off for those sections.
The section contains executable machine instructions.
Example: elf.section[2].flags & elf.SHF_WRITE