fzakaria / sqlelf

Explore ELF objects through the power of SQL
MIT License
240 stars 8 forks source link

feat: add elf_instructions table #1

Closed fzakaria closed 1 year ago

fzakaria commented 1 year ago

This adds a new table 'elf_instructions' that has the shared object instructions in all sections set with the appropriate flag.

It uses the Capstone library for the disassembly and comparing it to objdump looks to be correct:

$ sqlelf /usr/bin/ruby --sql "select mnemonic || ' ' || operands from elf_instructions where section = '.text'" | head
sub rsp, 0x28
mov dword ptr [rsp + 0xc], edi
xor edi, edi
mov qword ptr [rsp], rsi
lea rsi, [rip + 0xf3f]
mov rax, qword ptr fs:[0x28]
mov qword ptr [rsp + 0x18], rax
xor eax, eax
call 0x1090
mov rsi, rsp

$ objdump -S -d /usr/bin/ruby | grep .text -A 10
Disassembly of section .text:

00000000000010b0 <_start@@Base-0x80>:
10b0:       48 83 ec 28             sub    $0x28,%rsp
10b4:       89 7c 24 0c             mov    %edi,0xc(%rsp)
10b8:       31 ff                   xor    %edi,%edi
10ba:       48 89 34 24             mov    %rsi,(%rsp)
10be:       48 8d 35 3f 0f 00 00    lea    0xf3f(%rip),%rsi        # 2004 <_IO_stdin_used@@Base+0x4>
10c5:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
10cc:       00 00
10ce:       48 89 44 24 18          mov    %rax,0x18(%rsp)

I also added stub typings for capstone in a separate commit for pyright.