sqlelf: a SQL-centric Approach to ELF Analysis

TL;DR

sqlelf is a novel tool that models ELF objects as relational databases, enabling more intuitive and efficient analysis through SQL queries, improving over traditional UNIX tools.

Contribution

The paper introduces sqlelf, a SQL-based approach to ELF analysis that enhances flexibility and depth of exploration compared to conventional methods.

Findings

Provides more comprehensive ELF insights

Reduces analysis time and effort

Enables complex queries on ELF data

Abstract

The exploration and understanding of Executable and Linkable Format (ELF) objects underpin various critical activities in computer systems, from debugging to reverse engineering. Traditional UNIX tooling like readelf, nm, and objdump have served the community reliably over the years. However, as the complexity and scale of software projects has grown, there arises a need for more intuitive, flexible, and powerful methods to investigate ELF objects. In this paper, we introduce sqlelf, an innovative tool that empowers users to probe ELF objects through the expressive power of SQL. By modeling ELF objects as relational databases, sqlelf offers the following advantages over conventional methods. Our evaluations demonstrate that sqlelf not only provides more nuanced and comprehensive insights into ELF objects but also significantly reduces the effort and time traditionally required for ELF exploration tasks