Elfina 2.0.0

Elfina 2.0.0 is now available. This release introduces a major rewrite of the project in Rust. You can check the GitHub release here: https://github.com/iss4cf0ng/Elfina/releases/tag/v2.0.0.

If you find this project useful or informative, a ⭐ would be appreciated!

Background

After the first version was released, I re-implemented it using Rust and added new features for ELF analysis. Since v2.0.0, Elfina has been implemented in Rust.

New Features

Elfina now includes additional ELF analysis utilities:

• --hexdump: Display the hexadecimal representation of the ELF file.
• --hexdump-out: Save --hexdump result into a specific file.
• --entropy: Calculate entropy to help identify packed or compressed sections.
• --entropy-out: Save --entropy result into a specific file.
• --disasm: Disassemble the ELF binary.
• --disasm-out: Save --disasm result into a specific file.

Screenshots

Hexdump (--hexdump)

Entropy (--entropy)

Disassembly (--disasm)

Q&A

Most of these questions and suggestions actually came from discussions about another similar project of mine, IronPE, However, since they are also relevant to Elfina, I decided to include them here as well.

Suggestion: Codes should be separated into individual functions.

A: Excellent suggestion. I am still relatively new to Rust, so there are definitely parts of the code that could be structured better. My experience with Rust isn’t as strong as with C# or C++, so I am still learning the idiomatic patterns.

Question: How does Rust provide better memory safety than C#?

A: C# already provides strong memory safety through the managed runtime and garbage collector. Rust approaches this differently by enforcing memory safety at compile time through its ownership and borrowing model.

Just to clarify, I wasn’t trying to suggest that one language is better than another (I am definitely not qualified to settle that debate!). The original goal of this project was simply to review the PE file format for my reverse engineering works and learn Rust, so rewriting it was mainly a learning exercise.

THANKS FOR READING