Linux下ELF格式可执行文件及动态链接相关部分的解析

Linux下面的ELF文件主要由ELF头、程序头和各个段组成。

二进制可执行文件结构

本文使用的示例程序如下。首先把它编译为可执行文件，再使用Linux下面的hexdump命令，把可执行文件完全转换为16进制的表示形式，然后分析这样的表示与ELF文件中各部分的对应关系。

示例程序：

#include <stdio.h>

int global_init_var = 84;
int global_uninit_var;

void func1(int i)
{
  printf("%d\n", i);
}
int main(int argc, char **argv)
{
  static int static_var1 = 85;
  static int static_var2;

  int a = 1;
  int b;
  func1(static_var1 + static_var2 + a + b);
  return a;
}

使用gcc编译生成二进制可执行文件之后，

gcc exam.c -o exam.out

可以通过反汇编工具objcump来查看文件中各个部分的信息，例如

objdump –d –x –s exam.out

生成的文件中展示了二进制文件中不同的节的解释和描述。

对于二进制文件，在Linux下面，可以通过hexdump命令来以文本的形式表示二进制可执行文件。以下是对exam.out文件执行hexdump命令之后所生成的文件的注释，指明了各个不同的节的开始位置及含义。

文件头：

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............|

00000010 02 00 3e 00 01 00 00 00 c0 03 40 00 00 00 00 00 |..>.......@.....|

phoffset = 40 sh offset = aa0

00000020 40 00 00 00 00 00 00 00 a0 0a 00 00 00 00 00 00||

ehsize=40,phentsiez=38, shentsize=40,shnum=1d

00000030 00 00 00 00 40 00 38 00 08 00 40 00 1d 00 1a 00|....@.8...@.....|

程序头表，phtable,大小为0x38* 0x8 =

00000040 06 00 00 00 05 00 00 00 40 00 00 00 00 00 00 00 |........@.......|

00000050 40 00 40 00 00 00 00 00 40 00 40 00 00 00 00 00 |@.@.....@.@.....|

00000060 c0 01 00 00 00 00 00 00 c0 01 00 00 00 00 00 00 |................|

00000070 08 00 00 00 00 00 00 0003 00 00 00 04 00 00 00 |................|

00000080 00 02 00 00 00 00 00 00 00 02 40 00 00 00 00 00 |..........@.....|

00000090 00 02 40 00 00 00 00 00 1c 00 00 00 00 00 00 00 |..@.............|

000000a0 1c 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................|

000000b0 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 |................|

000000c0 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 |..@.......@.....|

000000d0 dc 06 00 00 00 00 00 00 dc 06 00 00 00 00 00 00 |................|

000000e0 00 00 20 00 00 00 00 0001 00 00 00 06 00 00 00 |.. .............|

000000f0 e0 06 00 00 00 00 00 00 e0 06 60 00 00 00 00 00 |..........`.....|

00000100 e0 06 60 00 00 00 00 00 30 02 00 00 00 00 00 00 |..`.....0.......|

00000110 40 02 00 00 00 00 00 00 00 00 20 00 00 00 00 00 |@......... .....|

00000120 02 00 00 00 06 00 00 00 f8 06 00 00 00 00 00 00 |................|

00000130 f8 06 60 00 00 00 00 00 f8 06 60 00 00 00 00 00 |..`.......`.....|

00000140 d0 01 00 00 00 00 00 00 d0 01 00 00 00 00 00 00 |................|

00000150 08 00 00 00 00 00 00 0004 00 00 00 04 00 00 00 |................|

00000160 1c 02 00 00 00 00 00 00 1c 02 40 00 00 00 00 00 |..........@.....|

00000170 1c 02 40 00 00 00 00 00 20 00 00 00 00 00 00 00 |..@..... .......|

00000180 20 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 | ...............|

00000190 50 e5 74 64 04 00 00 00 e0 05 00 00 00 00 00 00 |P.td............|

000001a0 e0 05 40 00 00 00 00 00 e0 05 40 00 00 00 00 00 |..@.......@.....|

000001b0 34 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 |4.......4.......|

000001c0 04 00 00 00 00 00 00 0051 e5 74 64 06 00 00 00 |........Q.td....|

000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

000001f0 00 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 |................|

.interp节PROGBITS

00000200 2f 6c 69 62 36 34 2f 6c 64 2d 6c 69 6e 75 78 2d |/lib64/ld-linux-|

.note.ABI-tag节NOTE

00000210 78 38 36 2d 36 34 2e 73 6f 2e 32 000400 00 00 |x86-64.so.2.....|

00000220 10 00 00 00 01 00 00 00 47 4e 55 00 00 00 00 00 |........GNU.....|

00000230 02 00 00 00 06 00 00 00 09 00 00 00 00 00 00 00 |................|

.hashHASH

00000240 03 00 00 00 04 00 00 00 03 00 00 00 02 00 00 00 |................|

00000250 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

00000260 00 00 00 00 00 00 00 00.dynsym

0000 00 00 00 00 00 00 |................|

00000270 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

00000280 0b 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 |................|

00000290 00 00 00 00 00 00 00 00 12 00 00 00 12 00 00 00 |................|

000002a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

000002b0 24 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 |$... ...........|

000002c0 00 00 00 00 00 00 00 00

.dynstr，字符串表1STRTAB

006c 69 62 63 2e 73 6f |.........libc.so|

000002d0 2e 36 00 70 72 69 6e 74 66 00 5f 5f 6c 69 62 63 |.6.printf.__libc|

000002e0 5f 73 74 61 72 74 5f 6d 61 69 6e 00 5f 5f 67 6d |_start_main.__gm|

000002f0 6f 6e 5f 73 74 61 72 74 5f 5f 00 47 4c 49 42 43 |on_start__.GLIBC|

00000300 5f 32 2e 32 2e 35 00 00.gnu.versionVERSYM

0000 02 00 02 00 00 00 |_2.2.5..........|

.gnu.version_rVERNEED

00000310 01 00 01 00 01 00 00 00 10 00 00 00 00 00 00 00 |................|

00000320 75 1a 69 09 00 00 02 00 33 00 00 00 00 00 00 00 |u.i.....3.......|

.rela.dynRELA

00000330 c8 08 60 00 00 00 00 00 06 00 00 00 03 00 00 00 |..`.............|

00000340 00 00 00 00 00 00 00 00

.rela.pltRELA

e808 60 00 00 00 00 00 |..........`.....|

00000350 07 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 |................|

00000360 f0 08 60 00 00 00 00 00 07 00 00 00 02 00 00 00 |..`.............|

00000370 00 00 00 00 00 00 00 00

.initPROGBITS

4883 ec 08 e8 6b 00 00 |........H....k..|

00000380 00 48 83 c4 08 c3 00 00 00 00 00 00 00 00 00 00 |.H..............|

.pltPROGBITS

00000390 ff 35 42 05 20 00 ff 25 44 05 20 00 0f 1f 40 00 |.5B. ..%D. ...@.|

000003a0 ff 25 42 05 20 00 68 00 00 00 00 e9 e0 ff ff ff |.%B. .h.........|

000003b0 ff 25 3a 05 20 00 68 01 00 00 00 e9 d0 ff ff ff |.%:. .h.........|

.textPROGBITS

000003c0 31 ed 49 89 d1 5e 48 89 e2 48 83 e4 f0 50 54 49 |1.I..^H..H...PTI|

000003d0 c7 c0 30 05 40 00 48 c7 c1 40 05 40 00 48 c7 c7 |..0.@.H..@.@.H..|

000003e0 f1 04 40 00 e8 c7 ff ff ff f4 90 90 48 83 ec 08 |..@.........H...|

000003f0 48 8b 05 d1 04 20 00 48 85 c0 74 02 ff d0 48 83 |H.... .H..t...H.|

00000400 c4 08 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 |...f............|

00000410 b8 17 09 60 00 55 48 2d 10 09 60 00 48 83 f8 0e |...`.UH-..`.H...|

00000420 48 89 e5 77 02 5d c3 b8 00 00 00 00 48 85 c0 74 |H..w.]......H..t|

00000430 f4 5d bf 10 09 60 00 ff e0 0f 1f 80 00 00 00 00 |.]...`..........|

00000440 b8 10 09 60 00 55 48 2d 10 09 60 00 48 c1 f8 03 |...`.UH-..`.H...|

00000450 48 89 e5 48 89 c2 48 c1 ea 3f 48 01 d0 48 d1 f8 |H..H..H..?H..H..|

00000460 75 02 5d c3 ba 00 00 00 00 48 85 d2 74 f4 5d 48 |u.]......H..t.]H|

00000470 89 c6 bf 10 09 60 00 ff e2 0f 1f 80 00 00 00 00 |.....`..........|

00000480 80 3d 89 04 20 00 00 75 11 55 48 89 e5 e8 7e ff |.=.. ..u.UH...~.|

00000490 ff ff 5d c6 05 76 04 20 00 01 f3 c3 0f 1f 40 00 |..]..v. ......@.|

000004a0 48 83 3d 48 02 20 00 00 74 1e b8 00 00 00 00 48 |H.=H. ..t......H|

000004b0 85 c0 74 14 55 bf f0 06 60 00 48 89 e5 ff d0 5d |..t.U...`.H....]|

000004c0 e9 7b ff ff ff 0f 1f 00 e9 73 ff ff ff 0f 1f 00 |.{.......s......|

000004d0 55 48 89 e5 48 83 ec 10 89 7d fc 8b 45 fc 89 c6 |UH..H....}..E...|

000004e0 bf dc 05 40 00 b8 00 00 00 00 e8 b1 fe ff ff c9 |...@............|

000004f0 c3 55 48 89 e5 48 83 ec 20 89 7d ec 48 89 75 e0 |.UH..H.. .}.H.u.|

00000500 c7 45 fc 01 00 00 00 8b 15 ff 03 20 00 8b 05 01 |.E......... ....|

00000510 04 20 00 01 c2 8b 45 fc 01 c2 8b 45 f8 01 d0 89 |. ....E....E....|

00000520 c7 e8 aa ff ff ff 8b 45 fc c9 c3 0f 1f 44 00 00 |.......E.....D..|

00000530 f3 c3 0f 1f 80 00 00 00 00 0f 1f 80 00 00 00 00 |................|

00000540 4c 89 64 24 e0 4c 89 6c 24 e8 4c 8d 25 97 01 20 |L.d$.L.l$.L.%.. |

00000550 00 4c 89 74 24 f0 4c 89 7c 24 f8 49 89 f6 48 89 |.L.t$.L.|$.I..H.|

00000560 5c 24 d0 48 89 6c 24 d8 48 83 ec 38 41 89 ff 49 |\$.H.l$.H..8A..I|

00000570 89 d5 e8 01 fe ff ff 48 8d 05 62 01 20 00 49 29 |.......H..b. .I)|

00000580 c4 49 c1 fc 03 4d 85 e4 74 1e 31 ed 48 89 c3 90 |.I...M..t.1.H...|

00000590 48 83 c5 01 4c 89 ea 4c 89 f6 44 89 ff ff 13 48 |H...L..L..D....H|

000005a0 83 c3 08 49 39 ec 75 e8 48 8b 5c 24 08 48 8b 6c |...I9.u.H.\$.H.l|