ElfAnalyzer

Description

This module parses and analyzes ELF file for Forensic and investigations.

Parses:

ELF identification
ELF headers
Program headers
ELF sections
ELF symbols tables
Comment section
Note sections
Dynamic section

Requirements

This package require:

python3
python3 Standard Library

Optional

matplotlib
EntropyAnalysis

Matplotlib and EntropyAnalysis are not installed by ProgramExecutableAnalyzer because this package can be installed on server without GUI. You can install optinal required packages with the following command: python3 -m pip install matplotlib EntropyAnalysis

Installation

python3 -m pip install ElfAnalyzer

git clone "https://github.com/mauricelambert/ElfAnalyzer.git"
cd "ElfAnalyzer"
python3 -m pip install .

Usages

Command line

ElfAnalyzer              # Using CLI package executable
python3 -m ElfAnalyzer   # Using python module
python3 ElfAnalyzer.pyz  # Using python executable
ElfAnalyzer.exe          # Using python Windows executable

./ElfAnalyzer.pyz ./local/ElfFile
ElfAnalyzer.exe -u https://github.com/mauricelambert/FastRC4/releases/download/v0.0.1/librc4.so
./ElfAnalyzer.pyz -v ./local/ElfFile
python3 ElfAnalyzer.pyz -c ./local/ElfFile

Python script

from ElfAnalyzer import *

file = open("./local/ElfFile", "rb")
elfindent, elf_headers, programs_headers, elf_sections, symbols_tables, comments, note_sections, notes, dynamics, sections = parse_elffile(file)
cli(elfindent, elf_headers, programs_headers, elf_sections, symbols_tables, comments, notes, dynamics, sections)
file.close()

License

Licensed under the GPL, version 3.

Metadata

Release files for ElfAnalyzer 0.0.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for ElfAnalyzer 0.0.3
File	Size	Uploaded
ElfAnalyzer-0.0.3.tar.gz	30.3 kB	Sep 5, 2023	Details

Release files / ElfAnalyzer-0.0.3.tar.gz

Download URL	ElfAnalyzer-0.0.3.tar.gz
Size	30.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`4a88b01d0f311b0b8b3ed0d19cc3fee2c2ae0a720699c275f1a7678a1fbfef9d`
BLAKE2b-256 checksum How to use checksums	`b1826f2d33c9406588bb0617352862f25f80a8ddc1f0347013d7e5d700295324`
Upload date	Sep 5, 2023
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/4.0.2 CPython/3.11.4`