如何查看ELF文件

查看elf文件

以一个简单的C程序为例：

#include <stdio.h>
#include <string.h>

int main(int argc, char**argv)
{
    printf("build date: %s %s\n",  __DATE__, __TIME__);
    return 0;
}

编译、执行

➜  ~ gcc test.c -o test
➜  ~ ./test 
build date: Nov 12 2017 22:07:06
➜  ~ 

查看elf文件头信息–readelf -h

➜  ~ readelf -h test
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x400430
  Start of program headers:          64 (bytes into file)
  Start of section headers:          6624 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         9
  Size of section headers:           64 (bytes)
  Number of section headers:         31
  Section header string table index: 28

查看Sections—readelf -S

➜  ~ readelf -S test
There are 31 section headers, starting at offset 0x19e0:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000</