oblivionsage/elfpeekMinimal ELF inspector written in C for quick binary layout inspection
Minimal ELF inspector with interactive REPL for quick binary analysis
Not a replacement for readelf or . Just a quick, focused tool for common RE questions:
objdumpAlso serves as readable ELF parsing example in C. Handles stripped and segment-only binaries gracefully.
(elfpeek:ls).dynsym and .symtab<elf.h>make
Optional: Install libreadline-dev for command history in REPL.
./elfpeek
./elfpeek /bin/ls # show headers, sections, symbols
./elfpeek /bin/ls 0x6760 # resolve address
| Command | Alias | Description |
|---|---|---|
open <path> | o | Open ELF file |
close | Close current file | |
info | i | Show ELF header |
sections | s | List section headers |
phdr | p | List program headers |
entry | e | Show entry point |
symbols [dyn|sym] | sym | Dump symbol tables |
resolve <addr> | r | Resolve virtual address |
dump <.sec|@off> [n] | d | Hex dump (section or offset) |
help | ? | Show help |
quit | q | Exit |
Sections:
.text, .plt).data, .bss).rodata)Hexdump:
00)20-7E)01-1F)80-FF)tests/ contains sample ELF files:
| File | Description |
|---|---|
elf32_le.bin | 32-bit little-endian (i386) |
elf32_be.bin | 32-bit big-endian (PowerPC) |
elf64_be.bin | 64-bit big-endian (PowerPC64) |
elf64_le_pie.bin | PIE executable |
elf64_le_static.bin | Statically linked |
elf64_le_dynsym_only.bin | Stripped, dynsym only |
elf64_le_so.bin | Shared object |
elf64_le_segments_only.bin | No section headers |
relocs command - show relocationsgot/plt analysisMIT