I am writing an ELF32 parser and disassembler for PowerPC.
Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this communityI am writing an ELF32 parser and disassembler for PowerPC.
Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.
According to the code of readelf
in the GNU binutils package, the presence of VLE instructions can be found in the p_flags
and sh_flags
fields with the mask 0x10000000
(see binutils-xxx/include/elf/ppc.h
and look for PF_PPC_VLE
and SHF_PPC_VLE
).
These flags seems to be present at the begining of each section in the ELF format. So, you should look for it.
A few interesting readings:
grep -r _PPC_VLE
).