README.md

ELFtool

Tiny universal tool for exploring executable ELF files (Executable and Linkable Format).

python elftool.py /bin/bash

As an optional parameter, you can set TO_DICT=true

TO_DICT=true python elftool.py /bin/bash

To parse output I use jq:

python elftool.py /bin/bash | jq

Example output:

[
  {
    "type": "PT_PHDR",
    "offset": "0x40",
    "virtual_address": "0x40",
    "physical_address": "0x40",
    "size_in_file": "0x2d8",
    "size_in_memory": "0x2d8",
    "segment_sections": null
  },
  {
    "type": "PT_INTERP",
    "offset": "0x318",
    "virtual_address": "0x318",
    "physical_address": "0x318",
    "size_in_file": "0x1c",
    "size_in_memory": "0x1c",
    "segment_sections": [
      [
        ".interp",
        "0x318"
      ]
    ]
},
... 
]

Or get only the desired section

python elftool.py /bin/bash | jq '.[0]'

Example output:

{
  "offset": "0x40",
  "physical_address": "0x40",
  "segment_sections": null,
  "size_in_file": "0x2d8",
  "size_in_memory": "0x2d8",
  "type": "PT_PHDR",
  "virtual_address": "0x40"
}

Or just one value

python elftool.py /bin/bash | jq '.[0] | .size_in_memory'

Example output:

"0x2d8"

More jq usage examples can be found here.