How to get elf header via IDAPython?

Question

In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the input file, like elf header, or other sections, like ".dynsym"?
In most elf files, the elf header can be located with address 0x400000. But what if the address changed? Can I read it directly from the binary file?

Answer 1

You are actually asking multiple questions here :

• If you checked "Manual Load" when creating your IDB, and answered "Yes" when IDA asks you if you want to load the header, you should have a "HEADER" section with the header data in it as your first Segment. This is pretty generic and should work for any binary format.

• I do believe that the other sections of the ELF might be loaded that way if you answer "Yes" when IDA asks you if you want to parse the header.

• To get the base address of your programm, you can use the IDAPython call get_imagebase() but that should be your first section anyway in most binary formats (that is, if you loaded the header)

• If you have loaded the header, you can read it directly from IDA using your usual IDAPython functions.

Answer 2

With LIEF you do it as follow:

import lief
elf = lief.parse("my_binary")
init_section = elf.get_section(".init")
dynsym_section = elf.get_section(".dynsym")
print(init_section)
print(dynsym_section)

Source code is available here: https://github.com/lief-project/LIEF