elfsharp > ReadFields() > Type / Machine / version など読込み

private void ReadFields()
        {
            using(var reader = localReaderSource())
            {
                Type = (FileType)reader.ReadUInt16();
                Machine = (Machine)reader.ReadUInt16();
                var version = reader.ReadUInt32();
                if(version != 1)
                {
                    throw new ArgumentException(string.Format(
                        "Given ELF file is of unknown version {0}.",
                        version
                    ));
                }
                EntryPoint = (Class == Class.Bit32 ? reader.ReadUInt32() : reader.ReadUInt64()).To<T>();
                // TODO: assertions for (u)longs
                segmentHeaderOffset = Class == Class.Bit32 ? reader.ReadUInt32() : reader.ReadInt64();
                sectionHeaderOffset = Class == Class.Bit32 ? reader.ReadUInt32() : reader.ReadInt64();
                MachineFlags = reader.ReadUInt32().To<T>(); // TODO: always 32bit?
                reader.ReadUInt16(); // elf header size
                segmentHeaderEntrySize = reader.ReadUInt16();
                segmentHeaderEntryCount = reader.ReadUInt16();
                sectionHeaderEntrySize = reader.ReadUInt16();
                sectionHeaderEntryCount = reader.ReadUInt16();
                stringTableIndex = reader.ReadUInt16();
            }
        }

ReadIdentificator()の実行後に呼ばれる。

Typeの読取前のバッファbuf[]は例として以下のようになっている (Little endianの場合)。

buf[0] = 0x02
buf[1] = 0x00
buf[2] = 0x28
buf[3] = 0x00
buf[4] = 0x01
buf[5] = 0x00
buf[6] = 0x00
buf[7] = 0x00
buf[8] = 0x00
...

上記コードを読むと
[0..1] : Type (0x0002)
[2..3] : Machine (0x0028)
[4..7] : version (0x00000001)
が対応し、versionは一応1であり正しい。

linuxで読込んだ例
http://qiita.com/7of9/items/b8fdd66c6ef3511f6042