Elf Binary - lua script

[XEKEX]

 

I'm building a lua script (tool) that retrieves the Elf Binary information from the memory of a running process. The script contains three Main functions:
----- this part work fine --- 
getElfBinaryStartAddress(): This function retrieves the start address of the Elf Binary.
getElfBinaryHeader(startadr): This function retrieves the Elf Binary header information. It takes the start address of the Elf Binary as a parameter and returns an object with the following information: magicNumber, class, data, version, osAbi, abiVersion, type, machine, version, entry, phoff, shoff, e_phentsize, e_phnum, e_phoff, e_shnum, e_shentsize, and e_shstrndx.
getProgramHeader(elfHeader): This function retrieves the Program Header information of the Elf Binary. It takes the Elf Binary header information as a parameter and returns an array of objects with information about each program header entry, such as type, offset, virtual address, physical address, file size, memory size, flags, and alignment.
---this part get bugged--->
getSymbolTable()
getElfFunctions()
these functions are the core it get the offset of every function within the lib and get it's pointers and name at real-time (here is the goal)
the problem is I cant get symbolTable correctly ,always nil 
I dumped the symtab and all the sections are 0 
I get burn out and I cant solve it in 3 days ... 
you can download the source code below (223 lines .. + comments)
 

 

ElfTest.lua

[Lover1500]

Some structures of your header are wrong. Have you checked in this link?

https://en.m.wikipedia.org/wiki/Executable_and_Linkable_Format

[XEKEX]

4 hours ago, Lover1500 said:

Some structures of your header are wrong. Have you checked in this link?

https://en.m.wikipedia.org/wiki/Executable_and_Linkable_Format

No I'll check it and rebuild it again

[CmP]

Quote

for i, section in ipairs(sectionHeader) do
  if section.sh_type == 2 then
    symtab = section
  end

  if section.sh_type == 3 and section.sh_name == shstrtab.sh_name + string.len(".strtab") then
    strtab = section
  end
end

Section headers from ELF file don't get loaded in process memory, so they can't be used to find symbol table. Symbol table can be located starting from program headers. Question that you should do some research on: how does "dlsym" function work.