elf简介

共享库的结构

##linux:

ELF, Executable and Linking Format, 是一种用于可执行文件、目标文件、共享库和核心转储的标准文件格式。 ELF格式是是UNIX系统实验室作为ABI(Application Binary Interface)而开发和发布的。

这里简单介绍一下相关历史:

  • UNIX: 最初采用的格式为a.out,之后被System V中的COFF取代,最后则被SVR4中的ELF格式所取代。
  • Windows: 采用的则是COFF格式的变种PE格式
  • MAC OS X: 采用的是Mach-O格式

ELF有四种不同的类型:

  1. 可重定位文件(Relocatable): 编译器和汇编器产生的.o文件,需要被Linker进一步处理
  2. 可执行文件(Executable): Have all relocation done and all symbol resolved except perhaps shared library symbols that must be resolved at run time
  3. 共享对象文件(Shared Object): 即动态库文件(.so)
  4. 核心转储文件(Core File):

TIP:

  • A single segment usually consist of several sections.
  • Relocatable files have Section header tables. Executable files have Program header tables. Shared object files have both
  • Sections are intended for further processing by a linker, while the segments are intended to be mapped into memory
  • 只有ELF header是固定在文件的首部, 而Program header和Section header的位置则由ELF header指出

ELF数据表示: 六种数据类型(32-bit)

NameSizeAlignmentPurpose
Elf32_Addr 4 4 Unsigned program address Elf32_Off 4 4 Unsigned file offset Elf32_Half 2 2 Unsigned medium interger Elf32_Word 4 4 unsigned interger Elf32_Sword 4 4 Signed interger unsigned char 1 1 Unsigned small interger
#define EI_NIDENT (16)
typedef struct
{
  unsigned char e_ident[EI_NIDENT];   /* Magic number and other info */
  Elf32_Half    e_type;               /* Object file type */
  Elf32_Half    e_machine;            /* Architecture */
  Elf32_Word    e_version;            /* Object file version */
  Elf32_Addr    e_entry;              /* Entry point virtual address */
  Elf32_Off     e_phoff;              /* Program header table file offset */
  Elf32_Off     e_shoff;              /* Section header table file offset */
  Elf32_Word    e_flags;              /* Processor-specific flags */
  Elf32_Half    e_ehsize;             /* ELF header size in bytes */
  Elf32_Half    e_phentsize;          /* Program header table entry size */
  Elf32_Half    e_phnum;              /* Program header table entry count */
  Elf32_Half    e_shentsize;          /* Section header table entry size */
  Elf32_Half    e_shnum;              /* Section header table entry count */
  Elf32_Half    e_shstrndx;           /* Section header string table index */
} Elf32_Ehdr;

		[root@VM_0_9_centos dynamic_lib_text]# ls
		add.c  add.h  add.o  add.s  a.out  libadd.so  main.c  test
		[root@VM_0_9_centos dynamic_lib_text]# readelf -h a.out 
		ELF Header:
		  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
		  Class:                             ELF64
		  Data:                              2's complement, little endian
		  Version:                           1 (current)
		  OS/ABI:                            UNIX - System V
		  ABI Version:                       0
		  Type:                              EXEC (Executable file)
		  Machine:                           Advanced Micro Devices X86-64
		  Version:                           0x1
		  Entry point address:               0x4008e0
		  Start of program headers:          64 (bytes into file)
		  Start of section headers:          7304 (bytes into file)
		  Flags:                             0x0
		  Size of this header:               64 (bytes)
		  Size of program headers:           56 (bytes)
		  Number of program headers:         9
		  Size of section headers:           64 (bytes)
		  Number of section headers:         30
		  Section header string table index: 27
		[root@VM_0_9_centos dynamic_lib_text]# 

typedef struct
{
  elf32_word    sh_name;        /* Section name (string tbl index) */
  elf32_word    sh_type;        /* Section type */
  elf32_word    sh_flags;       /* Section flags */
  elf32_addr    sh_addr;        /* Section virtual addr at execution */
  elf32_off     sh_offset;      /* Section file offset */
  elf32_word    sh_size;        /* Section size in bytes */
  elf32_word    sh_link;        /* Link to another section */
  elf32_word    sh_info;        /* Additional section information */
  elf32_word    sh_addralign;   /* Section alignment */
  elf32_word    sh_entsize;     /* Entry size if section holds table */
} elf32_shdr;

	[root@VM_0_9_centos dynamic_lib_text]# readelf -s a.out   
	
	Symbol table '.dynsym' contains 20 entries:
	   Num:    Value          Size Type    Bind   Vis      Ndx Name
	     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
	     1: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSolsEi@GLIBCXX_3.4 (2)
	     2: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
	     3: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
	     4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSt8ios_base4InitC1Ev@GLIBCXX_3.4 (2)
	     5: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.2.5 (3)
	     6: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __cxa_atexit@GLIBC_2.2.5 (3)
	     7: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
	     8: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZStlsISt11char_traitsIcE@GLIBCXX_3.4 (2)
	     9: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
	    10: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _Z3addii
	    11: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSolsEPFRSoS_E@GLIBCXX_3.4 (2)
	    12: 0000000000601198     0 NOTYPE  GLOBAL DEFAULT   25 _end
	    13: 000000000060106c     0 NOTYPE  GLOBAL DEFAULT   24 _edata
	    14: 000000000060106c     0 NOTYPE  GLOBAL DEFAULT   25 __bss_start
	    15: 00000000004008d0     0 FUNC    GLOBAL DEFAULT  UND _ZSt4endlIcSt11char_trait@GLIBCXX_3.4 (2)
	    16: 0000000000400810     0 FUNC    GLOBAL DEFAULT   11 _init
	    17: 0000000000400ae4     0 FUNC    GLOBAL DEFAULT   14 _fini
	    18: 0000000000400890     0 FUNC    GLOBAL DEFAULT  UND _ZNSt8ios_base4InitD1Ev@GLIBCXX_3.4 (2)
	    19: 0000000000601080   272 OBJECT  GLOBAL DEFAULT   25 _ZSt4cout@GLIBCXX_3.4 (2)
	
	Symbol table '.symtab' contains 76 entries:
	   Num:    Value          Size Type    Bind   Vis      Ndx Name
	     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
	     1: 0000000000400238     0 SECTION LOCAL  DEFAULT    1 
	     2: 0000000000400254     0 SECTION LOCAL  DEFAULT    2 
	     3: 0000000000400274     0 SECTION LOCAL  DEFAULT    3 
	     4: 0000000000400298     0 SECTION LOCAL  DEFAULT    4 
	     5: 00000000004002e0     0 SECTION LOCAL  DEFAULT    5 
	     6: 00000000004004c0     0 SECTION LOCAL  DEFAULT    6 
	     7: 0000000000400686     0 SECTION LOCAL  DEFAULT    7 
	     8: 00000000004006b0     0 SECTION LOCAL  DEFAULT    8 
	     9: 00000000004006f0     0 SECTION LOCAL  DEFAULT    9 
	    10: 0000000000400720     0 SECTION LOCAL  DEFAULT   10 
	    11: 0000000000400810     0 SECTION LOCAL  DEFAULT   11 
	    12: 0000000000400830     0 SECTION LOCAL  DEFAULT   12 
	    13: 00000000004008e0     0 SECTION LOCAL  DEFAULT   13 
	    14: 0000000000400ae4     0 SECTION LOCAL  DEFAULT   14 
	    15: 0000000000400af0     0 SECTION LOCAL  DEFAULT   15 
	    16: 0000000000400b1c     0 SECTION LOCAL  DEFAULT   16 
	    17: 0000000000400b60     0 SECTION LOCAL  DEFAULT   17 
	    18: 0000000000600db8     0 SECTION LOCAL  DEFAULT   18 
	    19: 0000000000600dc8     0 SECTION LOCAL  DEFAULT   19 
	    20: 0000000000600dd0     0 SECTION LOCAL  DEFAULT   20 
	    21: 0000000000600dd8     0 SECTION LOCAL  DEFAULT   21 
	    22: 0000000000600ff8     0 SECTION LOCAL  DEFAULT   22 
	    23: 0000000000601000     0 SECTION LOCAL  DEFAULT   23 
	    24: 0000000000601068     0 SECTION LOCAL  DEFAULT   24 
	    25: 0000000000601080     0 SECTION LOCAL  DEFAULT   25 
	    26: 0000000000000000     0 SECTION LOCAL  DEFAULT   26 
	    27: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
	    28: 0000000000600dd0     0 OBJECT  LOCAL  DEFAULT   20 __JCR_LIST__
	    29: 0000000000400910     0 FUNC    LOCAL  DEFAULT   13 deregister_tm_clones
	    30: 0000000000400940     0 FUNC    LOCAL  DEFAULT   13 register_tm_clones
	    31: 0000000000400980     0 FUNC    LOCAL  DEFAULT   13 __do_global_dtors_aux
	    32: 0000000000601190     1 OBJECT  LOCAL  DEFAULT   25 completed.6355
	    33: 0000000000600dc8     0 OBJECT  LOCAL  DEFAULT   19 __do_global_dtors_aux_fin
	    34: 00000000004009a0     0 FUNC    LOCAL  DEFAULT   13 frame_dummy
	    35: 0000000000600db8     0 OBJECT  LOCAL  DEFAULT   18 __frame_dummy_init_array_
	    36: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS main.c
	    37: 0000000000601191     1 OBJECT  LOCAL  DEFAULT   25 _ZStL8__ioinit
	    38: 0000000000400a17    61 FUNC    LOCAL  DEFAULT   13 _Z41__static_initializati
	    39: 0000000000400a54    21 FUNC    LOCAL  DEFAULT   13 _GLOBAL__sub_I_main
	    40: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
	    41: 0000000000400c90     0 OBJECT  LOCAL  DEFAULT   17 __FRAME_END__
	    42: 0000000000600dd0     0 OBJECT  LOCAL  DEFAULT   20 __JCR_END__
	    43: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS 
	    44: 0000000000601000     0 OBJECT  LOCAL  DEFAULT   23 _GLOBAL_OFFSET_TABLE_
	    45: 0000000000600dc8     0 NOTYPE  LOCAL  DEFAULT   18 __init_array_end
	    46: 0000000000600db8     0 NOTYPE  LOCAL  DEFAULT   18 __init_array_start
	    47: 0000000000600dd8     0 OBJECT  LOCAL  DEFAULT   21 _DYNAMIC
	    48: 0000000000601068     0 NOTYPE  WEAK   DEFAULT   24 data_start
	    49: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSolsEi@@GLIBCXX_3.4
	    50: 0000000000400ae0     2 FUNC    GLOBAL DEFAULT   13 __libc_csu_fini
	    51: 00000000004008e0     0 FUNC    GLOBAL DEFAULT   13 _start
	    52: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
	    53: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
	    54: 0000000000400ae4     0 FUNC    GLOBAL DEFAULT   14 _fini
	    55: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSt8ios_base4InitC1Ev@@
	    56: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
	    57: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __cxa_atexit@@GLIBC_2.2.5
	    58: 0000000000400890     0 FUNC    GLOBAL DEFAULT  UND _ZNSt8ios_base4InitD1Ev@@
	    59: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
	    60: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZStlsISt11char_traitsIcE
	    61: 0000000000400af0     4 OBJECT  GLOBAL DEFAULT   15 _IO_stdin_used
	    62: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
	    63: 0000000000601068     0 NOTYPE  GLOBAL DEFAULT   24 __data_start
	    64: 0000000000601070     0 OBJECT  GLOBAL HIDDEN    24 __TMC_END__
	    65: 0000000000601080   272 OBJECT  GLOBAL DEFAULT   25 _ZSt4cout@@GLIBCXX_3.4
	    66: 0000000000400af8     0 OBJECT  GLOBAL HIDDEN    15 __dso_handle
	    67: 0000000000400a70   101 FUNC    GLOBAL DEFAULT   13 __libc_csu_init
	    68: 000000000060106c     0 NOTYPE  GLOBAL DEFAULT   25 __bss_start
	    69: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _Z3addii
	    70: 0000000000601198     0 NOTYPE  GLOBAL DEFAULT   25 _end
	    71: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND _ZNSolsEPFRSoS_E@@GLIBCXX
	    72: 00000000004008d0     0 FUNC    GLOBAL DEFAULT  UND _ZSt4endlIcSt11char_trait
	    73: 000000000060106c     0 NOTYPE  GLOBAL DEFAULT   24 _edata
	    74: 00000000004009cd    74 FUNC    GLOBAL DEFAULT   13 main
	    75: 0000000000400810     0 FUNC    GLOBAL DEFAULT   11 _init
	[root@VM_0_9_centos dynamic_lib_text]# 

typedef struct
{
  Elf32_Word    p_type;        /* Segment type */
  Elf32_Off     p_offset;      /* Segment file offset */
  Elf32_Addr    p_vaddr;       /* Segment virtual address */
  Elf32_Addr    p_paddr;       /* Segment physical address */
  Elf32_Word    p_filesz;      /* Segment size in file */
  Elf32_Word    p_memsz;       /* Segment size in memory */
  Elf32_Word    p_flags;       /* Segment flags */
  Elf32_Word    p_align;       /* Segment alignment */
} Elf32_Phdr;


	[root@VM_0_9_centos dynamic_lib_text]# readelf -l a.out  
	
	Elf file type is EXEC (Executable file)
	Entry point 0x4008e0
	There are 9 program headers, starting at offset 64
	
	Program Headers:
	  Type           Offset             VirtAddr           PhysAddr
	                 FileSiz            MemSiz              Flags  Align
	  PHDR           0x0000000000000040 0x0000000000400040 0x0000000000400040
	                 0x00000000000001f8 0x00000000000001f8  R E    8
	  INTERP         0x0000000000000238 0x0000000000400238 0x0000000000400238
	                 0x000000000000001c 0x000000000000001c  R      1
	      [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
	  LOAD           0x0000000000000000 0x0000000000400000 0x0000000000400000
	                 0x0000000000000c94 0x0000000000000c94  R E    200000
	  LOAD           0x0000000000000db8 0x0000000000600db8 0x0000000000600db8
	                 0x00000000000002b4 0x00000000000003e0  RW     200000
	  DYNAMIC        0x0000000000000dd8 0x0000000000600dd8 0x0000000000600dd8
	                 0x0000000000000220 0x0000000000000220  RW     8
	  NOTE           0x0000000000000254 0x0000000000400254 0x0000000000400254
	                 0x0000000000000044 0x0000000000000044  R      4
	  GNU_EH_FRAME   0x0000000000000b1c 0x0000000000400b1c 0x0000000000400b1c
	                 0x0000000000000044 0x0000000000000044  R      4
	  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
	                 0x0000000000000000 0x0000000000000000  RW     10
	  GNU_RELRO      0x0000000000000db8 0x0000000000600db8 0x0000000000600db8
	                 0x0000000000000248 0x0000000000000248  R      1
	
	 Section to Segment mapping:
	  Segment Sections...
	   00     
	   01     .interp 
	   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame 
	   03     .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss 
	   04     .dynamic 
	   05     .note.ABI-tag .note.gnu.build-id 
	   06     .eh_frame_hdr 
	   07     
	   08     .init_array .fini_array .jcr .dynamic .got 
	[root@VM_0_9_centos dynamic_lib_text]# 
  • 0
    点赞
  • 1
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
要使用Python读取ELF文件,可以使用pyelftools库。首先,需要安装pyelftools库。然后,可以按照以下步骤进行操作: 1. 导入pyelftools库中的ELFFile类。 2. 打开要解析的ELF文件,可以使用open函数打开文件并以二进制读取模式打开。 3. 创建一个ELFFile对象,将打开的文件对象传入该对象。 4. 可以通过访问ELFFile对象的属性或使用迭代器遍历ELF文件的不同部分。 5. 最后,记得关闭打开的文件。 下面是一个示例代码,用于读取ELF文件并打印一些信息: ```python from elftools.elf.elffile import ELFFile def main(): # 要解析的ELF文件路径 elf_path = 'test.elf' # 打开ELF文件 file = open(elf_path, 'rb') # 创建ELFFile对象 elf_file = ELFFile(file) # 打印ELF文件头 print(elf_file.header) # 打印程序头入口个数 print(elf_file.num_segments()) # 打印节区头入口个数 print(elf_file.num_sections()) # 遍历打印程序头入口 for segment in elf_file.iter_segments(): print(segment.header) print(segment.header['p_align']) # 遍历打印节区头入口 for section in elf_file.iter_sections(): print('name:', section.name) print('header:', section.header) # 关闭文件 file.close() if __name__ == '__main__': main() ``` 请注意,您需要将`elf_path`变量设置为您要读取的ELF文件的路径。<span class="em">1</span><span class="em">2</span><span class="em">3</span> #### 引用[.reference_title] - *1* [Python解析ELF文件获取全局变量的的地址和长度,用以替换XCP和freemaster的方案](https://blog.csdn.net/weixin_43153912/article/details/129269689)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v92^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"] - *2* *3* [【Android 逆向】使用 Python 代码解析 ELF 文件 ( PyCharm 中进行断点调试 | ELFFile 实例对象分析 )](https://blog.csdn.net/han1202012/article/details/121007497)[target="_blank" data-report-click={"spm":"1018.2226.3001.9630","extra":{"utm_source":"vip_chatgpt_common_search_pc_result","utm_medium":"distribute.pc_search_result.none-task-cask-2~all~insert_cask~default-1-null.142^v92^chatsearchT3_1"}}] [.reference_item style="max-width: 50%"] [ .reference_list ]
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值