ELF File Format Parsing

In this post i will explain how to parse 32 bit ELF File Format for finding offsets of segments. Firstly we need to lookup ELF Header (First 52 bytes) for taking offsets of Program Headers Table, EntryPoint Addr, Section Headers Tables etc..

If we take an DWORD value from 24th offset of ELF Header we can grab EntryPoint of executable file. DWORD value at 32th offset is start offset of Section Headers Table and size of this headers table is located at 46th offset as a WORD value. We also need number of section headers that located at 48th offset as a WORD value. Also Section Header String Table Index is located at 50th offset as a WORD value. So we can say ELF Header structure is like this;

string to chr() array - ruby style

Hi everyone on my boring blog's readers.(really anybody read my blog? if u read please drop an comment or click my ads :> )
I will only share tiny code snippet that usefull for me. Its converts any string into chr() array, i use it on my php code obfuscator tool. It's here..

def to_chr_array(str)
  ret = ""
  i = 0
  len = str.length

  str.each_byte { |c|
    i+=1
    if i == len:
     ret << "chr(#{c.to_s})"
    else
     ret << "chr(#{c.to_s})."
    end
  }

ret
end

Simple usage:

puts "$variable = #{to_chr_array("hello")};"

Output:
$variable = chr(104).chr(101).chr(108).chr(108).chr(111);