I am writing an ELF32 parser and disassembler for PowerPC.
Does anyone knows how to detect if the file is using VLE architecture from ELF header? I see that IDA can do it automatically.
Add a comment
|
According to the code of readelf in the GNU binutils package, the presence of VLE instructions can be found in the p_flags and sh_flags fields with the mask 0x10000000 (see binutils-xxx/include/elf/ppc.h and look for PF_PPC_VLE and SHF_PPC_VLE).
These flags seems to be present at the begining of each section in the ELF format. So, you should look for it.
A few interesting readings:
- Power Architecture® 32-bit Application Binary Interface Supplement 1.0.
- Variable-Length Encoding (VLE) extension programming interface manual.
- Variable-Length Encoding (VLE) Extension Programming Interface Manual.
- 64-bit PowerPC ELF Application Binary Interface Supplement 1.9.
- The binutils source code (
grep -r _PPC_VLE).
