ELF目标文件格式
【1】最前部是ELF文件头(ELF Header)。
【2】ELF文件各个段。
【3】段表:段的段名,段的长度,在文件中的偏移,读写权限。
(1)
查看ELF文件头:readelf -h demo.o
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 //ELF魔数
Class: ELF32 <span style="white-space:pre"> </span>//机器字节长度
Data: 2's complement, little endian<span style="white-space:pre"> </span>//数据存储方式
Version: 1 (current) <span style="white-space:pre"> </span>//版本
OS/ABI: UNIX - System V<span style="white-space:pre"> </span>//运行平台
ABI Version: 0 <span style="white-space:pre"> </span>//ABI版本
Type: EXEC (Executable file)<span style="white-space:pre"> </span>//ELF重定位类型
Machine: Intel 80386 <span style="white-space:pre"> </span>//硬件平台
Version: 0x1 <span style="white-space:pre"> </span>//硬件平台版本
Entry point address: 0x80482b0 <span style="white-space:pre"> </span>//入口地址
Start of program headers: 52 (bytes into file)<span style="white-space:pre"> </span>//程序头入口
Start of section headers: 1984 (bytes into file)<span style="white-space:pre"> </span>//段入口
Flags: 0x0
Size of this header: 52 (bytes) <span style="white-space:pre"> </span>//这个头的大小
Size of program headers: 32 (bytes) <span style="white-space:pre"> </span>//程序的大小
Number of program headers: 7 <span style="white-space:pre"> </span>//程序入口的数量
Size of section headers: 40 (bytes) <span style="white-space:pre"> </span>//段的大小
Number of section headers: 28 <span style="white-space:pre"> </span>//段的数量
Section header string table index: 25 <span style="white-space:pre"> </span>//节头字符串表索引
ELF魔数:7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
0x7f :ASCII的DEL控制符
0x45 :E
0x4c :L
0x46 :F
0x01 :32位,0x02:64位
0x01 :小端,0x01:大端,0x00:无效
0x01 :ELF版本号
(2)段表结构
执行操作:readelf -S demo.o
There are 11 section headers, starting at offset 0x120:
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .text PROGBITS 00000000 000034 00005e 00 AX 0 0 4
[ 2] .rel.text REL 00000000 0003f4 000038 08 9 1 4
[ 3] .data PROGBITS 00000000 000094 000008 00 WA 0 0 4
[ 4] .bss NOBITS 00000000 00009c 000004 00 WA 0 0 4
[ 5] .rodata PROGBITS 00000000 00009c 000003 00 A 0 0 1
[ 6] .comment PROGBITS 00000000 00009f 00002e 00 0 0 1
[ 7] .note.GNU-stack PROGBITS 00000000 0000cd 000000 00 0 0 1
[ 8] .shstrtab STRTAB 00000000 0000cd 000051 00 0 0 1
[ 9] .symtab SYMTAB 00000000 0002d8 0000f0 10 10 10 4
[10] .strtab STRTAB 00000000 0003c8 00002a 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)