ELF详细指南
持续更新中…
拆解的文件放在百度云盘
elf.h中的宏定义
下列数据类型使用N比特架构 (N=32,64, ElfN 代表 Elf32 或 Elf64, uintN_t 代表 uint32_t or uint64_t):
ElfN_Addr Unsigned program address, uintN_t
ElfN_Off Unsigned file offset, uintN_t
ElfN_Section Unsigned section index, uint16_t
ElfN_Versym Unsigned version symbol information, uint16_t
Elf_Byte unsigned char
ElfN_Half uint16_t
ElfN_Sword int32_t
ElfN_Word uint32_t
ElfN_Sxword int64_t
ElfN_Xword uint64_t
且elf.h中的结构体是以4字节对齐
EFL32
拆解的文件是:elf32(可以从百度云盘下载)
ELF头(Elf32_Ehdr)
ELF32文件头定义为Elf32_Ehdr,大小为52字节
#define EI_NIDENT (16)
typedef struct
{
unsigned char e_ident[EI_NIDENT]; /* Magic number and other info */
Elf32_Half e_type; /* Object file type */
Elf32_Half e_machine; /* Architecture */
Elf32_Word e_version; /* Object file version */
Elf32_Addr e_entry; /* Entry point virtual address */
Elf32_Off e_phoff; /* Program header table file offset */
Elf32_Off e_shoff; /* Section header table file offset */
Elf32_Word e_flags; /* Processor-specific flags */
Elf32_Half e_ehsize; /* ELF header size in bytes */
Elf32_Half e_phentsize; /* Program header table entry size */
Elf32_Half e_phnum; /* Program header table entry count */
Elf32_Half e_shentsize; /* Section header table entry size */
Elf32_Half e_shnum; /* Section header table entry count */
Elf32_Half e_shstrndx; /* Section header string table index */
} Elf32_Ehdr;
7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00
03 00 03 00 01 00 00 00 C0 06 00 00 34 00 00 00
A8 19 00 00 00 00 00 00 34 00 20 00 09 00 28 00
1D 00 1C 00
使用readelf工具查看elf32文件头如下
young@ubuntu:~/c/elf$ readelf -h elf32
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: DYN (Shared object file)
Machine: Intel 80386
Version: 0x1
Entry point address: 0x6c0
Start of program headers: 52 (bytes into file)
Start of section headers: 6568 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 9
Size of section headers: 40 (bytes)
Number of section headers: 29
Section header string table index: 28
e_ident
该成员是大小为16字节的数组,存放ELF的魔数及其它信息
如截图所示,e_ident的值为:
7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00
- EI_MAG
前四字节为ELFMAG,值为"\x7fELF
,用于判断一个文件是否是ELF文件.
EI_MAG0、EI_MAG1、EI_MAG2、EI_MAG3为e_ident的数组下标
ELFMAG0、ELFMAG1、ELFMAG2、ELFMAG3为对应的值。
#define EI_MAG0 0 /* File identification byte 0 index */
#define ELFMAG0 0x7f /* Magic number byte 0 */
#define EI_MAG1 1 /* File identification byte 1 index */
#define ELFMAG1 'E' /* Magic number byte 1 */
#define EI_MAG2 2 /* File identification byte 2 index */
#define ELFMAG2 'L' /* Magic number byte 2 */
#define EI_MAG3 3 /* File identification byte 3 index */
#define ELFMAG3 'F' /* Magic number byte 3 */
/* Conglomeration of the identification bytes, for easy testing as a word. */
#define ELFMAG "\177ELF"
- EI_CLASS
第五个字节为EI_CLASS,即e_ident[EI_CLASS],它有四个值。截图中e_ident[EI_CLASS] = 01,表示文件为32 bits的ELF对象
#define EI_CLASS 4 /* File class byte index */
#define ELFCLASSNONE 0 /* Invalid class */
#define ELFCLASS32 1 /* 32-bit objects */
#define ELFCLASS64 2 /* 64-bit objects */
#define ELFCLASSNUM 3
- EI_DATA
第六个字节为EI_DATA,即e_ident[EI_DATA],它有四个值,用来表示文件是大端还是小端的,截图中e_ident[EI_DATA] = 01,表示文件数据是以小端方式存储的。
#define EI_DATA 5 /* Data encoding byte index */
#define ELFDATANONE 0 /* Invalid data encoding */
#define ELFDATA2LSB 1 /* 2's complement, little endian */
#define ELFDATA2MSB 2 /* 2's complement, big endian */
#define ELFDATANUM 3
- EI_VERSION
第七个字节为EI_VERSION,即e_ident[EI_VERSION],它的值必须为EV_CURRENT,EV_CURRENT被宏定义为1
#define EI_VERSION 6 /* File version byte index */
/* Value must be EV_CURRENT */
/* Legal values for e_version (version). */
#define EV_NONE 0 /* Invalid ELF version */
#define EV_CURRENT 1 /* Current version */
#define EV_NUM 2
- EI_OSABI
第八个字节为EI_OSABI,即e_ident[EI_OSABI],用来标识ELF文件的系统类型,截图中e_ident[EI_OSABI] = 0,表示ELF文件可以在UNIX系统上运行
tips: ABI(application binary interface)
#define EI_OSABI 7 /* OS ABI identification */
#define ELFOSABI_NONE 0 /* UNIX System V ABI */
#