elfclassify: New tool to analyze ELF objects.
Usage: elfclassify [OPTION...] FILE...
Determine the type of an ELF file.
All of the classification options must apply at the same time to a
particular file. Classification options can be negated using a
"--not-" prefix.
Since modern ELF does not clearly distinguish between programs and
dynamic shared objects, you should normally use either --executable or
--shared to identify the primary purpose of a file. Only one of the
--shared and --executable checks can pass for a file.
If you want to know whether an ELF object might a program or a shared
library (but could be both), then use --program or --library. Some ELF
files will classify as both a program and a library.
If you just want to know whether an ELF file is loadable (as program
or library) use --loadable. Note that files that only contain
(separate) debug information (--debug-only) are never --loadable (even
though they might contain program headers). Linux kernel modules are
also not --loadable (in the normal sense).
Without any of the --print options, the program exits with status 0 if
the requested checks pass for all input files, with 1 if a check fails
for any file, and 2 if there is an environmental issue (such as a file
read error or a memory allocation error).
When printing file names, the program exits with status 0 even if no
file names are printed, and exits with status 2 if there is an
environmental issue.
On usage error (e.g. a bad option was given), the program exits with a
status code larger than 2.
The --quiet or -q oose_filestion suppresses some error warning output,
but doesn't change the exit status.
Classification options
--core File is an ELF core dump file
--debug-only File is a debug only ELF file (separate .debug,
.dwo or dwz multi-file)
--elf File looks like an ELF object or archive/static
library (default)
--elf-archive File is an ELF archive or static library
--elf-file File is an regular ELF object (not an
archive/static library)
--executable File is (primarily) an ELF program executable (not
primarily a DSO)
--library File is an ELF shared object (DSO) (might also be
an executable)
--linux-kernel-module File is a linux kernel module
--loadable File is a loadable ELF object (program or shared
object)
--program File is an ELF program executable (might also be a
DSO)
--shared File is (primarily) an ELF shared object (DSO)
(not primarily an executable)
--unstripped File is an ELF file with symbol table or .debug_*
sections and can be stripped further
Input flags
-f, --file Only classify regular (not symlink nor special
device) files
--no-stdin Do not read files from standard input (default)
--stdin Also read file names to process from standard
input, separated by newlines
--stdin0 Also read file names to process from standard
input, separated by ASCII NUL bytes
-z, --compressed Try to open compressed files or embedded (kernel)
ELF images
Output flags
--matching If printing file names, print matching files
(default)
--no-print Do not output file names
--not-matching If printing file names, print files that do not
match
--print Output names of files, separated by newline
--print0 Output names of files, separated by ASCII NUL
Additional flags
-q, --quiet Suppress some error output (counterpart to
--verbose)
-v, --verbose Output additional information (can be specified
multiple times)
-?, --help Give this help list
--usage Give a short usage message
-V, --version Print program version
Report bugs to https://sourceware.org/bugzilla.
Signed-off-by: Florian Weimer <fweimer@redhat.com>
Signed-off-by: Mark Wielaard <mark@klomp.org>
7 files changed
