Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

sqlelf: a SQL-centric Approach to ELF Analysis

Farid Zakaria, Zheyuan Chen, Andrew Quinn, Thomas R. W. Scogland

TL;DR

sqlelf introduces a SQL-centric framework for ELF analysis by modeling ELF metadata as a relational database via SQLite, enabling cross-object queries and richer system-wide insights. The authors present a relational data model, implement it through SQLite virtual tables, and demonstrate its utility across four case studies (auditwheel, dynamic linking, symbol interposition, and aggregate analysis) along with performance benchmarks. The work argues that declarative SQL queries simplify complex analyses that traditional ELF tools handle only with ad-hoc scripting, and shows practical benefits in system administration and software-dependency management. By memoizing data into SQLite databases and leveraging existing visualization tools, sqlelf enables scalable, interactive exploration of large software ecosystems on Linux.

Abstract

The exploration and understanding of Executable and Linkable Format (ELF) objects underpin various critical activities in computer systems, from debugging to reverse engineering. Traditional UNIX tooling like readelf, nm, and objdump have served the community reliably over the years. However, as the complexity and scale of software projects has grown, there arises a need for more intuitive, flexible, and powerful methods to investigate ELF objects. In this paper, we introduce sqlelf, an innovative tool that empowers users to probe ELF objects through the expressive power of SQL. By modeling ELF objects as relational databases, sqlelf offers the following advantages over conventional methods. Our evaluations demonstrate that sqlelf not only provides more nuanced and comprehensive insights into ELF objects but also significantly reduces the effort and time traditionally required for ELF exploration tasks

sqlelf: a SQL-centric Approach to ELF Analysis

TL;DR

sqlelf introduces a SQL-centric framework for ELF analysis by modeling ELF metadata as a relational database via SQLite, enabling cross-object queries and richer system-wide insights. The authors present a relational data model, implement it through SQLite virtual tables, and demonstrate its utility across four case studies (auditwheel, dynamic linking, symbol interposition, and aggregate analysis) along with performance benchmarks. The work argues that declarative SQL queries simplify complex analyses that traditional ELF tools handle only with ad-hoc scripting, and shows practical benefits in system administration and software-dependency management. By memoizing data into SQLite databases and leveraging existing visualization tools, sqlelf enables scalable, interactive exploration of large software ecosystems on Linux.

Abstract

The exploration and understanding of Executable and Linkable Format (ELF) objects underpin various critical activities in computer systems, from debugging to reverse engineering. Traditional UNIX tooling like readelf, nm, and objdump have served the community reliably over the years. However, as the complexity and scale of software projects has grown, there arises a need for more intuitive, flexible, and powerful methods to investigate ELF objects. In this paper, we introduce sqlelf, an innovative tool that empowers users to probe ELF objects through the expressive power of SQL. By modeling ELF objects as relational databases, sqlelf offers the following advantages over conventional methods. Our evaluations demonstrate that sqlelf not only provides more nuanced and comprehensive insights into ELF objects but also significantly reduces the effort and time traditionally required for ELF exploration tasks
Paper Structure (15 sections, 14 figures)

This paper contains 15 sections, 14 figures.

Table of Contents

  1. Introduction
  2. Object File Formats
  3. ELF
  4. Other file format
  5. Data Model
  6. sqlelf: Design & Implementation
  7. Evaluation
  8. Case Studies
  9. auditwheel
  10. dynamic linking
  11. symbol interposition
  12. aggregate analysis
  13. Performance Evaluation
  14. Related Work
  15. Conclusion

Figures (14)

  • Figure 1: A simplified view of the ELF layout and its duality for execution and linking. © A. Burtsev
  • Figure 2: Sample output of present-day tooling to introspect dynamic symbols within an ELF file.
  • Figure 3: A simplified view of the Mach-O layout, adapted from "Mobile Application Penetration Testing" by Vijay Kumar Velu (2016), as cited in O'Reilly (2023)
  • Figure 4: A simplified view of the PE layout, adapted from "A dive into the PE file format - PE file structure" by Ahmed Hesham (Oct 22, 2021)
  • Figure 5: An equivalent but non-useful data model to the ELF file format.
  • ...and 9 more figures