手拆ELF32（一，文件头）

ELF详细指南

持续更新中…

拆解的文件放在百度云盘

百度云盘提取文件

elf.h中的宏定义

下列数据类型使用N比特架构 (N=32,64, ElfN 代表 Elf32 或 Elf64, uintN_t 代表 uint32_t or uint64_t):

ElfN_Addr       Unsigned program address, uintN_t
ElfN_Off        Unsigned file offset, uintN_t
ElfN_Section    Unsigned section index, uint16_t
ElfN_Versym     Unsigned version symbol information, uint16_t
Elf_Byte        unsigned char
ElfN_Half       uint16_t
ElfN_Sword      int32_t
ElfN_Word       uint32_t
ElfN_Sxword     int64_t
ElfN_Xword      uint64_t

且elf.h中的结构体是以4字节对齐

EFL32

拆解的文件是：elf32（可以从百度云盘下载）

ELF头（Elf32_Ehdr）

ELF32文件头定义为Elf32_Ehdr，大小为52字节

#define EI_NIDENT (16)

typedef struct
{
   
  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
  Elf32_Half	e_type;			/* Object file type */
  Elf32_Half	e_machine;		/* Architecture */
  Elf32_Word	e_version;		/* Object file version */
  Elf32_Addr	e_entry;		/* Entry point virtual address */
  Elf32_Off		e_phoff;		/* Program header table file offset */
  Elf32_Off		e_shoff;		/* Section header table file offset */
  Elf32_Word	e_flags;		/* Processor-specific flags */
  Elf32_Half	e_ehsize;		/* ELF header size in bytes */
  Elf32_Half	e_phentsize;		/* Program header table entry size */
  Elf32_Half	e_phnum;		/* Program header table entry count */
  Elf32_Half	e_shentsize;		/* Section header table entry size */
  Elf32_Half	e_shnum;		/* Section header table entry count */
  Elf32_Half	e_shstrndx;		/* Section header string table index */
} Elf32_Ehdr;

7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00 
03 00 03 00 01 00 00 00 C0 06 00 00 34 00 00 00 
A8 19 00 00 00 00 00 00 34 00 20 00 09 00 28 00 
1D 00 1C 00 

使用readelf工具查看elf32文件头如下

young@ubuntu:~/c/elf$ readelf -h elf32
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Shared object file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x6c0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          6568 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         9
  Size of section headers:           40 (bytes)
  Number of section headers:         29
  Section header string table index: 28

e_ident

该成员是大小为16字节的数组，存放ELF的魔数及其它信息
如截图所示，e_ident的值为：
7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00

• EI_MAG
  前四字节为ELFMAG，值为"\x7fELF，用于判断一个文件是否是ELF文件.
  EI_MAG0、EI_MAG1、EI_MAG2、EI_MAG3为e_ident的数组下标
  ELFMAG0、ELFMAG1、ELFMAG2、ELFMAG3为对应的值。

#define EI_MAG0		0		/* File identification byte 0 index */
#define ELFMAG0		0x7f		/* Magic number byte 0 */

#define EI_MAG1		1		/* File identification byte 1 index */
#define ELFMAG1		'E'		/* Magic number byte 1 */

#define EI_MAG2		2		/* File identification byte 2 index */
#define ELFMAG2		'L'		/* Magic number byte 2 */

#define EI_MAG3		3		/* File identification byte 3 index */
#define ELFMAG3		'F'		/* Magic number byte 3 */

/* Conglomeration of the identification bytes, for easy testing as a word.  */
#define	ELFMAG		"\177ELF"

• EI_CLASS
  第五个字节为EI_CLASS，即e_ident[EI_CLASS]，它有四个值。截图中e_ident[EI_CLASS] = 01，表示文件为32 bits的ELF对象

#define EI_CLASS	4		/* File class byte index */
#define ELFCLASSNONE	0		/* Invalid class */
#define ELFCLASS32	1		/* 32-bit objects */
#define ELFCLASS64	2		/* 64-bit objects */
#define ELFCLASSNUM	3

• EI_DATA
  第六个字节为EI_DATA，即e_ident[EI_DATA]，它有四个值，用来表示文件是大端还是小端的，截图中e_ident[EI_DATA] = 01，表示文件数据是以小端方式存储的。

#define EI_DATA		5		/* Data encoding byte index */
#define ELFDATANONE	0		/* Invalid data encoding */
#define ELFDATA2LSB	1		/* 2's complement, little endian */
#define ELFDATA2MSB	2		/* 2's complement, big endian */
#define ELFDATANUM	3

• EI_VERSION
  第七个字节为EI_VERSION，即e_ident[EI_VERSION]，它的值必须为EV_CURRENT，EV_CURRENT被宏定义为1

#define EI_VERSION	6		/* File version byte index */
					        /* Value must be EV_CURRENT */

/* Legal values for e_version (version).  */

#define EV_NONE		0		/* Invalid ELF version */
#define EV_CURRENT	1		/* Current version */
#define EV_NUM		2

• EI_OSABI
  第八个字节为EI_OSABI，即e_ident[EI_OSABI]，用来标识ELF文件的系统类型，截图中e_ident[EI_OSABI] = 0，表示ELF文件可以在UNIX系统上运行
  tips: ABI(application binary interface)

#define EI_OSABI	7		/* OS ABI identification */
#define ELFOSABI_NONE		0	/* UNIX System V ABI */
#