elftools 2.0.0 → 2.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ec85f62d56b2fe312d1e3aa73093f7f2ddee77da2fc3479ce6656d2df2d06c6
-  data.tar.gz: 6e8d33b1c9d0b7e9f2de9684b764a33fc90164333bd9a0d2b07a647bb79895a6
+  metadata.gz: cbbd11ec3b95d867ab34551c14f1a0a53c3c5e2ebb539d226b16378873a0f74a
+  data.tar.gz: 05301ad23c8d366858d57f58cccf4a3274608a036de07e629e85075b4e1babd5
 SHA512:
-  metadata.gz: 37fff29d3b9cd9ca69a6a6b50289636dd8e20e54e051c42ecee1a889aca94b7cbd8b16b40a1ca8a64279c395f8d992c8cb7e501d81d10cd66c7658ecd6649727
-  data.tar.gz: 279fb63197a5e4a5100739734e6cba39f294eebb09fb643461fe65f55e00bcb51e6fac5d11d383fd54018f4da3e8a8e663b59614d6f6dc44f0741c64f4693855
+  metadata.gz: 2e96723b2a63f7f6692cc6777bd64bd3b5e3aae7321a09da3a9098e26a4a95162bc892a2933088bc6fef89f14cb72269434e71c32bc2551f5b252105b09d6aa8
+  data.tar.gz: b177302e11ea50108f582dc4f70651136dcc5a15e2363856f2cfc453fbd2979eb202520a40468b4349af12e0dc1c84960b4972548c360bf902729e3acb98f456

data/README.md

@@ -97,6 +97,15 @@ symbols.map(&:name).reject(&:empty?).first(5).join(' ')
 #=> "crtstuff.c __JCR_LIST__ deregister_tm_clones register_tm_clones __do_global_dtors_aux"
 ```
 
+Where a symbol is and how large it is:
+```ruby
+main = symtab_section.symbol_by_name('main')
+'%#x' % main.value
+#=> "0x4006dd"
+main.size
+#=> 142
+```
+
 What a symbol refers to and how it is linked are recorded in `st_info` and `st_other`,
 values are defined in `ELFTools::Constants::STT`, `STB`, and `STV` respectively.
 ```ruby
@@ -139,6 +148,33 @@ dynamic.relocations.map { |rel| dynamic.symbol_at(rel.symbol_index).name }.first
 #=> ["__gmon_start__", "stdin", "puts"]
 ```
 
+A symbol of a file that is loaded binds to a version of the name, which is how one file
+offers `memcpy` twice and each caller keeps the one it was built against. The name is left
+as the file records it.
+```ruby
+dynamic.symbol_by_name('printf').version
+#=> "GLIBC_2.2.5"
+dynamic.symbol_by_name('__stack_chk_fail').version
+#=> "GLIBC_2.4"
+
+# What the file needs, without walking a symbol at all.
+dynamic.version_requirements.map { |need| [need.file, need.versions.map(&:name)] }
+#=> [["libc.so.6", ["GLIBC_2.4", "GLIBC_2.2.5"]]]
+
+# The sections record the same, for a file that still has them.
+elf.sections_by_type(:gnu_verneed).first.requirements.first.file
+#=> "libc.so.6"
+elf.section_by_name('.dynsym').symbol_by_name('printf').version
+#=> "GLIBC_2.2.5"
+
+# What a library defines, the first naming the library rather than a version of it.
+libc = ELFTools::ELFFile.new(File.open('spec/files/libc.so.6'))
+libc.dynamic.version_definitions.map(&:name).first(3)
+#=> ["libc.so.6", "GLIBC_2.2.5", "GLIBC_2.2.6"]
+libc.dynamic.version_definitions[2].parents
+#=> ["GLIBC_2.2.5"]
+```
+
 Nothing a file is loaded by records how large its symbol table is, because the loader
 looks a name up through a hash table and jumps straight to an index rather than ever
 enumerating it. `num_symbols` is therefore how far the hash table and the relocations
@@ -159,6 +195,19 @@ libc.dynamic.symbol_by_name('malloc').type_name
 #=> "STT_FUNC"
 ```
 
+What a section is for is recorded in `sh_flags`, as a segment records it in `p_flags`.
+```ruby
+[elf.section_by_name('.text').executable?, elf.section_by_name('.text').writable?]
+#=> [true, false]
+
+# Only some of the sections take memory while the file runs, the rest being what is
+# recorded about it.
+elf.sections.select(&:allocated?).map(&:name).first(5).join(' ')
+#=> ".interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym"
+elf.sections.reject(&:allocated?).map(&:name).reject(&:empty?).join(' ')
+#=> ".comment .shstrtab .symtab .strtab"
+```
+
 ## Segments
 
 ```ruby
@@ -228,6 +277,19 @@ elf.dynamic.relocations.map(&:type_name).uniq
 #=> ["R_X86_64_GLOB_DAT", "R_X86_64_COPY", "R_X86_64_JUMP_SLOT"]
 ```
 
+Nearly every relocation of a file that is loaded only adds the load bias to a word, so a
+file may pack them into a bitmap instead of spending an entry on each. They are read with
+the rest, from the tags or from the section holding them, and are named after the machine
+because the bitmap records no type of its own.
+```ruby
+packed = ELFTools::ELFFile.new(File.open('spec/files/aarch64.relr.elf'))
+packed.dynamic.relocations.count { |rel| rel.type_name == 'R_AARCH64_RELATIVE' }
+#=> 132
+section = packed.sections_by_type(:relr).first
+[section.name, section.header.sh_size, section.num_relocations]
+#=> [".relr.dyn", 48, 132]
+```
+
 ## Patch
 
 Patch ELF is so easy!
@@ -256,6 +318,26 @@ interp_segment.interp_name
 # save the patched ELF
 elf.save('elf.patched')
 
+Values that share a byte with others, which a symbol and a relocation both record, are
+assigned as what they mean rather than as the bits holding them. A value too large for
+its bits is reported instead of being written over its neighbours.
+```ruby
+elf = ELFTools::ELFFile.new(File.open('spec/files/amd64.elf'))
+symbol = elf.section_by_name('.symtab').symbol_by_name('main')
+symbol.type = ELFTools::Constants::STT_OBJECT
+symbol.bind = ELFTools::Constants::STB_WEAK
+[symbol.type_name, symbol.bind_name]
+#=> ["STT_OBJECT", "STB_WEAK"]
+symbol.bind = 16
+#=> ArgumentError: Symbol binding must be in 0..15, got 16
+
+relocation = elf.dynamic.relocations.first
+relocation.symbol_index = 3
+relocation.type = ELFTools::Constants::R::X86_64::R_X86_64_JUMP_SLOT
+[relocation.symbol_index, relocation.type_name]
+#=> [3, "R_X86_64_JUMP_SLOT"]
+```
+
 # in bash
 # $ file elf.patched
 # elf.patched: ELF 64-bit LSB executable, ARM, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86, for GNU...

data/lib/elftools/constants.rb

@@ -288,6 +288,23 @@ module ELFTools
     end
     include EM
 
+    # Flags of a version, recorded in the +vd_flags+ of a definition and the
+    # +vna_flags+ of a requirement.
+    module VER_FLG
+      VER_FLG_BASE = 0x1 # The version the file itself is, rather than one of the versions it defines
+      VER_FLG_WEAK = 0x2 # A version no symbol is bound to
+      VER_FLG_INFO = 0x4 # A version recorded for information rather than to be matched
+    end
+    include VER_FLG
+
+    # The indices a symbol names a version with that name no version.
+    module VER_NDX
+      VER_NDX_LOCAL = 0 # A symbol of the file itself, which nothing outside it binds to
+      VER_NDX_GLOBAL = 1 # A symbol of no version at all
+      VER_NDX_HIDDEN = 0x8000 # Not an index but a bit of one, marking a version that is not the default
+    end
+    include VER_NDX
+
     # Relocation types, see +elftools/constants/relocation+ for the constants.
     module R
       # Return the name of a relocation type.
@@ -310,6 +327,33 @@ module ELFTools
         names&.fetch(type, nil) || format('<unknown>: 0x%x', type)
       end
 
+      # The type a machine calls a relocation that only adds the load bias,
+      # which every architecture defining one spells +R_<arch>_RELATIVE+.
+      #
+      # A table of them recorded as +DT_RELR+ names no type, because the
+      # format holds nothing but addresses and every one of them relocates
+      # this way, so the type is asked of the machine instead.
+      # @param [Integer?] machine Value of +e_machine+.
+      # @return [Integer, nil]
+      #   The type, +nil+ if the machine names no such relocation.
+      # @example
+      #   relative(Constants::EM_X86_64)
+      #   #=> 8 # R_X86_64_RELATIVE
+      #   relative(Constants::EM_AARCH64)
+      #   #=> 1027 # R_AARCH64_RELATIVE, not the R_AARCH64_P32_RELATIVE of ILP32
+      def self.relative(machine)
+        architecture = MACHINES[machine]
+        return if architecture.nil?
+
+        @relative ||= {}
+        @relative.fetch(architecture) do
+          names = const_get(architecture).constants.grep(/_RELATIVE\z/)
+          # An architecture naming more than one names the other for a second
+          # data model, which spells it out in the name and so is longer.
+          @relative[architecture] = names.min_by(&:length)&.then { |name| const_get(architecture).const_get(name) }
+        end
+      end
+
       # Names of every relocation type an architecture defines.
       # @return [Hash{Integer => String}]
       def self.names_of(architecture)
@@ -422,6 +466,15 @@ module ELFTools
     end
     include SHN
 
+    # The escape value the ELF header records where it cannot hold a count of
+    # the program headers, which is then recorded in the first section header.
+    module PN
+      extend Naming
+
+      PN_XNUM = 0xffff # the number of program headers is too large for the header to hold
+    end
+    include PN
+
     # Section flag mask types, records in +sh_flag+.
     module SHF
       SHF_WRITE = (1 << 0) # Writable

data/lib/elftools/dynamic/hash_table.rb

@@ -24,6 +24,17 @@ module ELFTools
         @endian = endian
       end
 
+      # Whether the table is built over every symbol rather than over a subset
+      # of them.
+      #
+      # Two things follow where it is. How many symbols it is built over is how
+      # many there are, rather than how far it reaches. And a name it does not
+      # lead to is not one the file records, so nothing is left to search.
+      # @return [Boolean] The answer.
+      def covers_every_symbol?
+        false
+      end
+
       private
 
       # The header the table starts with.
@@ -66,6 +77,11 @@ module ELFTools
           header.nchain.to_i
         end
 
+        # (see ELFTools::Dynamic::HashTable#covers_every_symbol?)
+        def covers_every_symbol?
+          true
+        end
+
         # The index a name sits at.
         #
         # A bucket leads to a chain of the indices whose names hash alike, so

data/lib/elftools/dynamic/symbols.rb

@@ -29,26 +29,27 @@ module ELFTools
         return if n.negative?
 
         @symbol_at_map ||= {}
-        @symbol_at_map[n] ||= begin
-          klass = Structs::ELF_sym[header.elf_class]
-          # An entry takes what its structure takes, which is also what
-          # DT_SYMENT records and what a file has no way of disagreeing with.
-          sym = read_struct(klass, sym_offset + (n * struct(klass).num_bytes))
-          Sections::Symbol.new(sym, stream, symstr: method(:string_table), machine: @machine)
-        end
+        @symbol_at_map[n] ||= Sections::Symbol.new(
+          Structs::Fields.new(Structs::ELF_sym[header.elf_class], stream, sym_offset + (n * sym_entsize),
+                              elf_class: header.elf_class, endian: endian),
+          stream, symstr: string_table_reader, machine: @machine, version: -> { version_at(n) }
+        )
       end
 
       # How many symbols the tags reach.
       #
-      # Nothing a file is loaded by records how large its symbol table is. The
-      # loader never enumerates it: it looks a name up through a hash table and
-      # jumps straight to an index, so where the table ends is none of its
-      # business. Two things bound it instead, the hash table that indexes the
-      # names a file exports and the relocations that name a symbol by index,
-      # and the answer is how far the further of the two reaches. Only +DT_HASH+
-      # records the number outright.
+      # A hash table that records the number outright is answered with, because
+      # nothing a file records can reach further than the table it counts.
+      #
+      # Where the file records no such table, nothing records how large its
+      # symbol table is. The loader never enumerates it: it looks a name up
+      # through a hash table and jumps straight to an index, so where the table
+      # ends is none of its business. Two things bound it instead, the hash
+      # table that indexes the names a file exports and the relocations that
+      # name a symbol by index, and the answer is how far the further of the two
+      # reaches.
       #
-      # This is therefore a lower bound. A symbol that is neither indexed by the
+      # That answer is a lower bound. A symbol that is neither indexed by the
       # hash table nor named by a relocation is invisible to both, and is
       # missing from the count. {#symbol_at} is exact for any index.
       # @return [Integer] The number.
@@ -56,7 +57,7 @@ module ELFTools
       #   elf.dynamic.num_symbols
       #   #=> 9
       def num_symbols
-        @num_symbols ||= (hash_tables.map(&:num_symbols) + [count_from_relocations]).compact.max || 0
+        @num_symbols ||= counted_num_symbols || bounded_num_symbols
       end
 
       # Iterate all symbols.
@@ -92,9 +93,11 @@ module ELFTools
       # Get symbol by its name.
       #
       # The hash tables answer first, which is the lookup the loader itself
-      # performs and takes no scanning. They do not index every symbol, and a
-      # file need not record one at all, so a name they do not lead to is
-      # searched for among the symbols {#symbols} reaches.
+      # performs and takes no scanning. Where one of them is built over every
+      # symbol its answer is the whole answer, and a name it does not lead to
+      # is not one the file records. Otherwise the name is searched for among
+      # the symbols {#symbols} reaches, because a table need only index the
+      # names a file exports and a file need not record one at all.
       # @param [String] name The name of symbol.
       # @return [ELFTools::Sections::Symbol, nil] The desired symbol.
       # @example
@@ -105,6 +108,9 @@ module ELFTools
         # not led anywhere.
         index = hash_tables.lazy.filter_map { |table| table.index_of(name) { |i| symbol_at(i).name == name } }.first
         return symbol_at(index) if index
+        # A symbol with no name is the one thing such a table leaves out,
+        # having nothing to be indexed by, so it is still searched for.
+        return if !name.empty? && hash_tables.any?(&:covers_every_symbol?)
 
         each_symbol.find { |symbol| symbol.name == name }
       end
@@ -121,6 +127,20 @@ module ELFTools
         end
       end
 
+      # How many symbols a table that counts them says there are.
+      # @return [Integer, nil] The number, +nil+ if the file records no such table.
+      def counted_num_symbols
+        hash_tables.find(&:covers_every_symbol?)&.num_symbols
+      end
+
+      # How far what the file records reaches, for a file that counts its
+      # symbols nowhere. Reading the relocations is what costs, so it is only
+      # done for such a file.
+      # @return [Integer] The number, zero if nothing reaches a symbol.
+      def bounded_num_symbols
+        (hash_tables.map(&:num_symbols) + [count_from_relocations]).compact.max || 0
+      end
+
       # How far the relocations reach, i.e. the highest index they name plus one.
       # They only ever name the symbols something in the file refers to.
       # @return [Integer, nil] The number, +nil+ if none names a symbol.
@@ -129,6 +149,21 @@ module ELFTools
         highest && highest + 1
       end
 
+      # How many bytes an entry of the symbol table takes, which is what its
+      # structure takes, which is also what +DT_SYMENT+ records and what a file
+      # has no way of disagreeing with.
+      # @return [Integer] The number.
+      def sym_entsize
+        @sym_entsize ||= Structs::ELF_sym[header.elf_class].num_bytes(elf_class: header.elf_class, endian: endian)
+      end
+
+      # What reads the table these symbols are named in, kept so that reading
+      # a table of them does not make one for every symbol.
+      # @return [Method] The method.
+      def string_table_reader
+        @string_table_reader ||= method(:string_table)
+      end
+
       # Get the +DT_SYMTAB+'s +d_val+ offset related to file.
       # @return [Integer] The file offset.
       # @raise [ELFTools::ELFError]

data/lib/elftools/dynamic/tag.rb

@@ -1,25 +1,47 @@
 # frozen_string_literal: true
 
 require 'elftools/constants'
+require 'elftools/structs'
 
 module ELFTools
   module Dynamic
     # A tag class.
     class Tag
-      attr_reader :header # @return [ELFTools::Structs::ELF_Dyn] The dynamic tag header.
       attr_reader :stream # @return [#pos=, #read] Streaming object.
 
       # Instantiate a {ELFTools::Dynamic::Tag} object.
-      # @param [ELF_Dyn] header The dynamic tag header.
+      # @param [ELFTools::Structs::ELF_Dyn, ELFTools::Structs::Fields] header
+      #   The dynamic tag header, or what the file records in one.
+      #   {ELFTools::Structs::Fields} answers what the tag records until
+      #   something asks for {#header} itself, which builds the structure then.
       # @param [#pos=, #read] stream Streaming object.
       # @param [ELFTools::Dynamic::StringTable] strtab
       #   The string table the names of tags are recorded in.
       def initialize(header, stream, strtab)
-        @header = header
+        @fields = header.is_a?(Structs::Fields) ? header : Structs::Fields.of(header)
         @stream = stream
         @strtab = strtab
       end
 
+      # The structure the file records this tag in.
+      #
+      # One is built here for a tag read without it, which is what assigning to
+      # a field of one needs and what {ELFTools::ELFFile#patches} reports the
+      # changes of.
+      # @return [ELFTools::Structs::ELF_Dyn] The structure.
+      def header
+        @fields.struct
+      end
+
+      # What kind of tag this is, which {ELFTools::Constants::DT} names.
+      # @return [Integer] The type.
+      # @example
+      #   dynamic.tag_by_type(:needed).type == ELFTools::Constants::DT_NEEDED
+      #   #=> true
+      def type
+        @fields[:d_tag]
+      end
+
       # Some dynamic have name.
       TYPE_WITH_NAME = [Constants::DT_NEEDED,
                         Constants::DT_SONAME,
@@ -40,7 +62,7 @@ module ELFTools
       #   dynamic.tag_by_type(:needed).value
       #   #=> 'libc.so.6'
       def value
-        name || header.d_val.to_i
+        name || @fields[:d_val]
       end
 
       # Is this tag has a name?
@@ -48,7 +70,7 @@ module ELFTools
       # The criteria here is if this tag's type is in {TYPE_WITH_NAME}.
       # @return [Boolean] Is this tag has a name.
       def name?
-        TYPE_WITH_NAME.include?(header.d_tag)
+        TYPE_WITH_NAME.include?(type)
       end
 
       # Return the name of this tag.
@@ -59,7 +81,7 @@ module ELFTools
       def name
         return nil unless name?
 
-        @strtab.name_at(header.d_val.to_i)
+        @strtab.name_at(@fields[:d_val])
       end
     end
   end

data/lib/elftools/dynamic/versions.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'elftools/constants'
+require 'elftools/version_tables'
+
+module ELFTools
+  module Dynamic
+    # The versions a file binds its symbols to.
+    #
+    # Two tables record them, the versions the file needs of the files it is
+    # loaded with and the versions it defines for what it exports, and a symbol
+    # names one of either by the same index.
+    #
+    # @note
+    #   This module is included by {ELFTools::Dynamic} and reads through the
+    #   methods there, so it cannot be included on its own.
+    module Versions
+      # The versions this file needs of the files it is loaded with.
+      # @return [Array<ELFTools::VersionTables::Requirement>]
+      #   The requirements, in the order the table records them.
+      # @example
+      #   elf.dynamic.version_requirements.map { |need| [need.file, need.versions.map(&:name)] }
+      #   #=> [['libc.so.6', ['GLIBC_2.4', 'GLIBC_2.2.5']]]
+      def version_requirements
+        @version_requirements ||= read_table(:verneed, :verneednum) { |at, count| tables.requirements(at, count) }
+      end
+
+      # The versions this file defines for what it exports.
+      #
+      # The first of them is the file itself rather than a version of it, which
+      # {ELFTools::VersionTables::Definition#base?} tells apart.
+      # @return [Array<ELFTools::VersionTables::Definition>]
+      #   The definitions, in the order the table records them.
+      # @example
+      #   elf.dynamic.version_definitions.map(&:name).first(3)
+      #   #=> ['libc.so.6', 'GLIBC_2.2.5', 'GLIBC_2.2.6']
+      def version_definitions
+        @version_definitions ||= read_table(:verdef, :verdefnum) { |at, count| tables.definitions(at, count) }
+      end
+
+      private
+
+      # The version the +n+-th symbol binds to.
+      # @param [Integer] n The symbol index.
+      # @return [ELFTools::VersionTables::Version, nil]
+      #   The version, +nil+ if the file records none, or if the symbol is one
+      #   of the file's own or of no version at all.
+      def version_at(n)
+        VersionTables.version(versym_at(n), versions_by_index)
+      end
+
+      # What the +n+-th symbol records as its version.
+      # @return [Integer, nil] The index, +nil+ if the file records none.
+      def versym_at(n)
+        @versym_offset ||= begin
+          tag = tag_by_type(:versym)
+          tag && offset_of(tag)
+        end
+        return if @versym_offset.nil?
+
+        stream.pos = @versym_offset + (n * 2)
+        stream.read(2).to_s.unpack1(endian == :big ? 'S>' : 'S<')
+      end
+
+      # The tables the tags point at.
+      # @return [ELFTools::VersionTables] The tables.
+      def tables
+        @tables ||= VersionTables.new(stream, string_table, endian:)
+      end
+
+      # Reads a table the tags point at, as many entries as a tag counts.
+      # @return [Array] What the block makes of it, empty without the tags.
+      def read_table(address, count)
+        tag = tag_by_type(address)
+        return [] if tag.nil?
+
+        yield(offset_of(tag), tag_by_type(count).header.d_val.to_i)
+      end
+
+      # The name each index names, of either table.
+      # @return [Hash{Integer => String}] The names.
+      def versions_by_index
+        @versions_by_index ||= VersionTables.names(version_requirements, version_definitions)
+      end
+    end
+  end
+end

data/lib/elftools/dynamic.rb

@@ -3,8 +3,10 @@
 require 'elftools/constants'
 require 'elftools/dynamic/string_table'
 require 'elftools/dynamic/symbols'
+require 'elftools/dynamic/versions'
 require 'elftools/dynamic/tag'
 require 'elftools/exceptions'
+require 'elftools/relative_relocations'
 require 'elftools/relocation'
 require 'elftools/structs'
 
@@ -17,6 +19,7 @@ module ELFTools
   #   attributes exist.
   module Dynamic
     include Symbols
+    include Versions
 
     # Iterate all tags.
     #
@@ -35,7 +38,7 @@ module ELFTools
       0.step do |i|
         tag = tag_at(i).tap(&block)
         arr << tag
-        break if tag.header.d_tag == ELFTools::Constants::DT_NULL
+        break if tag.type == ELFTools::Constants::DT_NULL
       end
       arr
     end
@@ -76,7 +79,7 @@ module ELFTools
     #   #=> #<ELFTools::Dynamic::Tag:0x0055d3d2d91b28 @header={:d_tag=>3, :d_val=>6295552}>
     def tag_by_type(type)
       type = Util.to_constant(Constants::DT, type)
-      each_tag.find { |tag| tag.header.d_tag == type }
+      each_tag.find { |tag| tag.type == type }
     end
 
     # Get tags of specific type.
@@ -88,7 +91,7 @@ module ELFTools
     # @see #tag_by_type
     def tags_by_type(type)
       type = Util.to_constant(Constants::DT, type)
-      each_tag.select { |tag| tag.header.d_tag == type }
+      each_tag.select { |tag| tag.type == type }
     end
 
     # Get the +n+-th tag.
@@ -109,26 +112,28 @@ module ELFTools
       @tag_at_map ||= {}
       return @tag_at_map[n] if @tag_at_map[n]
 
-      dyn = Structs::ELF_Dyn.new(endian:)
-      dyn.elf_class = header.elf_class
-      stream.pos = tag_start + n * dyn.num_bytes
-      dyn.offset = stream.pos
-      @tag_at_map[n] = Tag.new(dyn.read(stream), stream, string_table)
+      elf_class = header.elf_class
+      offset = tag_start + (n * Structs::ELF_Dyn.num_bytes(elf_class: elf_class, endian: endian))
+      fields = Structs::Fields.new(Structs::ELF_Dyn, stream, offset, elf_class: elf_class, endian: endian)
+      @tag_at_map[n] = Tag.new(fields, stream, string_table)
     end
 
     # The relocations the tags point at.
     #
-    # Two tables record them: the one +DT_REL+ or +DT_RELA+ names, and the one
-    # +DT_JMPREL+ names, whose entries are of the kind +DT_PLTREL+ names.
+    # Three tables record them: the one +DT_REL+ or +DT_RELA+ names, the one
+    # +DT_JMPREL+ names, whose entries are of the kind +DT_PLTREL+ names, and
+    # the one +DT_RELR+ names, which packs the relocations that only add the
+    # load bias into a bitmap and so records no type of its own.
     # @return [Array<ELFTools::Relocation>] The relocations, in the order the
-    #   tags record them.
+    #   tags record them, the packed ones last.
     # @raise [ELFTools::ELFError]
     #   If a table is not in any loadable segment.
     # @example
     #   elf.dynamic.relocations.map(&:type_name).uniq
     #   #=> ['R_X86_64_GLOB_DAT', 'R_X86_64_JUMP_SLOT']
     def relocations
-      @relocations ||= relocation_tables.flat_map { |start, size, rela| read_relocations(start, size, rela) }
+      @relocations ||= relocation_tables.flat_map { |start, size, rela| read_relocations(start, size, rela) } +
+                       packed_relocations
     end
 
     private
@@ -151,6 +156,17 @@ module ELFTools
       tables << [jmprel, tag_by_type(:pltrelsz), tag_by_type(:pltrel).header.d_val.to_i == Constants::DT_RELA]
     end
 
+    # Reads the table +DT_RELR+ names, which is absent from most files.
+    # @return [Array<ELFTools::Relocation>] The relocations, empty without it.
+    def packed_relocations
+      start = tag_by_type(:relr)
+      return [] if start.nil?
+
+      offset = offset_of(start)
+      RelativeRelocations.new(stream, offset...(offset + tag_by_type(:relrsz).header.d_val.to_i),
+                              elf_class: header.elf_class, endian:, machine: @machine).to_a
+    end
+
     # Reads one table of relocations.
     # @return [Array<ELFTools::Relocation>] The relocations.
     def read_relocations(start, size, rela)
@@ -159,32 +175,14 @@ module ELFTools
       # An entry takes what its structure takes. DT_RELAENT and DT_RELENT
       # record the same number, which a file has no way of disagreeing with
       # and every file here agrees with.
-      entsize = struct(klass).num_bytes
+      elf_class = header.elf_class
+      entsize = klass.num_bytes(elf_class: elf_class, endian: endian)
       Array.new(size.header.d_val.to_i / entsize) do |i|
-        Relocation.new(read_struct(klass, offset + (i * entsize)), stream, machine: @machine)
+        fields = Structs::Fields.new(klass, stream, offset + (i * entsize), elf_class: elf_class, endian: endian)
+        Relocation.new(fields, stream, machine: @machine)
       end
     end
 
-    # A structure of the endianness and the class the file records it in.
-    # @param [Class] klass The structure class.
-    # @return [ELFTools::Structs::ELFStruct] The structure, before it is read.
-    def struct(klass)
-      struct = klass.new(endian:)
-      struct.elf_class = header.elf_class
-      struct
-    end
-
-    # Reads a structure the file records at a file offset.
-    # @param [Class] klass The structure class.
-    # @param [Integer] offset The file offset.
-    # @return [ELFTools::Structs::ELFStruct] The structure.
-    def read_struct(klass, offset)
-      struct = struct(klass)
-      struct.offset = offset
-      stream.pos = offset
-      struct.read(stream)
-    end
-
     # The file offset the address a tag records points at.
     # @param [ELFTools::Dynamic::Tag] tag The tag.
     # @return [Integer] The file offset.
@@ -193,7 +191,7 @@ module ELFTools
     def offset_of(tag)
       vma = tag.header.d_val.to_i
       @offset_from_vma.call(vma) ||
-        raise(ELFError, format('Invalid %s address 0x%x', Constants::DT.mapping(@machine, tag.header.d_tag.to_i), vma))
+        raise(ELFError, format('Invalid %s address 0x%x', Constants::DT.mapping(@machine, tag.type), vma))
     end
 
     # The names the tags and the symbols point at.