2

I am writing an ELF32 parser and disassembler for PowerPC.

Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.

4

According to the code of readelf in the GNU binutils package, the presence of VLE instructions can be found in the p_flags and sh_flags fields with the mask 0x10000000 (see binutils-xxx/include/elf/ppc.h and look for PF_PPC_VLE and SHF_PPC_VLE).

These flags seems to be present at the begining of each section in the ELF format. So, you should look for it.

A few interesting readings:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.