linux文件定位,Linux可重定位文件(.o)结构分析

最新推荐文章于 2023-09-12 22:24:18 发布

CyberMasteress

最新推荐文章于 2023-09-12 22:24:18 发布

阅读量252

点赞数

文章标签： linux文件定位

int printf(const char* format , ...);

int global_init_var = 84 ;

int global_uninit_var ;

void func1(int i)

{

printf("%d\n",i);

}

int main(void)

{

static int static_var = 85;

static int static_var2 ;

int a = 1 ;

int b ;

func1(static_var + static_var2 + a + b);

return a ;

}

编译命令

gcc -c SimpleSection.c

ELF Header

00000000h: 7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00

00000010h: 01 00 03 00 01 00 00 00 00 00 00 00 00 00 00 00

00000020h: 0C 01 00 00 00 00 00 00 34 00 00 00 00 00 28 00

00000030h: 0B 00 08 00解析如下:

Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00

Class: ELF32

Data: 2's complement, little endian

Version: 1 (current)

OS/ABI: UNIX - System V

ABI Version: 0

Type: REL (Relocatable file)

Machine: Intel 80386

Version: 0x1

Entry point address: 0x0

Start of program headers: 0 (bytes into file)

Start of section headers: 264 (bytes into file)

Flags: 0x0

Size of this header: 52 (bytes)

Size of program headers: 0 (bytes)

Number of program headers: 0

Size of section headers: 40 (bytes)

Number of section headers: 11

Section header string table index: 8

说明：

(1) 可重定位文件的Entry point address没有意义，设为0

(2) Start of section headers 段表的文件偏移，Size of section headers 段表条目数，Section header string table index ，段名字符表条目数

Section Headers

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

1F 00 00 00 01 00 00 00 06 00 00 00 00 00 00 00 34 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 text

1B 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 18 04 00 00 28 00 00 00 09 00 00 00 01 00 00 00 04 00 00 00 08 00 00 00 rel.text

25 00 00 00 01 00 00 00 03 00 00 00 00 00 00 00 84 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 data

2B 00 00 00 08 00 00 00 03 00 00 00 00 00 00 00 8C 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 bss

30 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 8C 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 rodata

38 00 00 00 01 00 00 00 30 00 00 00 00 00 00 00 90 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 comment

41 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 B6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 note.GNU-stack

11 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 B6 00 00 00 51 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 shstrtab

01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 C0 02 00 00 F0 00 00 00 0A 00 00 00 0A 00 00 00 04 00 00 00 10 00 00 00 symtab

09 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 B0 03 00 00 66 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 strtab

解析如下:

Section Headers:

[Nr] Name Type Addr Off Size ES Flg Lk Inf Al

[ 0] NULL 00000000 000000 000000 00 0 0 0

[ 1] .text PROGBITS 00000000 000034 000050 00 AX 0 0 4

[ 2] .rel.text REL 00000000 000418 000028 08 9 1 4

[ 3] .data PROGBITS 00000000 000084 000008 00 WA 0 0 4

[ 4] .bss NOBITS 00000000 00008c 000004 00 WA 0 0 4

[ 5] .rodata PROGBITS 00000000 00008c 000004 00 A 0 0 1

[ 6] .comment PROGBITS 00000000 000090 000026 01 MS 0 0 1

[ 7] .note.GNU-stack PROGBITS 00000000 0000b6 000000 00 0 0 1

[ 8] .shstrtab STRTAB 00000000 0000b6 000051 00 0 0 1

[ 9] .symtab SYMTAB 00000000 0002c0 0000f0 10 10 10 4

[10] .strtab STRTAB 00000000 0003b0 000066 00 0 0 1

Key to Flags:

W (write), A (alloc), X (execute), M (merge), S (strings)

I (info), L (link order), G (group), x (unknown)

O (extra OS processing required) o (OS specific), p (processor specific)

如图：

34544137_1

34544137_2

说明

(1) 一条section包含40个字节，分为如下字段

Elf32_Word sh_name

Elf32_Word sh_type

Elf32_Word sh_flags

Elf32_Addr sh_addr

Elf32_Off sh_offset

Elf32_Word sh_size

Elf32_Word sh_link

Elf32_Word sh_info

Elf32_Word sh_addralign

Elf32_Word sh_entsize(2) shname :在shstrtab中的索引，可以得到这个setion的string name

(3) sh_addr,在重定位文件中没有意义

(4) sh_offset 这个section在文件中的位置偏移，但如果sh_type为NOBITS,则这个字段无意义，如.bss

(5) sh_addralign 段首地址对齐

.text(000034)

55 89 E5 83 EC 18 8B 45 08 89 44 24

00000040h: 04 C7 04 24 00 00 00 00 E8 FC FF FF FF C9 C3 55

00000050h: 89 E5 83 E4 F0 83 EC 20 C7 44 24 1C 01 00 00 00

00000060h: 8B 15 04 00 00 00 A1 00 00 00 00 8D 04 02 03 44

00000070h: 24 1C 03 44 24 18 89 04 24 E8 FC FF FF FF 8B 44

00000080h: 24 1C C9 C3

Disassembly of section .text:

00000000 :

0: 55 push %ebp

1: 89 e5 mov %esp,%ebp

3: 83 ec 18 sub $0x18,%esp

6: 8b 45 08 mov 0x8(%ebp),%eax

9: 89 44 24 04 mov %eax,0x4(%esp)

d: c7 04 24 00 00 00 00 movl $0x0,(%esp)

14: e8 fc ff ff ff call 15

19: c9 leave

1a: c3 ret

0000001b :

1b: 55 push %ebp

1c: 89 e5 mov %esp,%ebp

1e: 83 e4 f0 and $0xfffffff0,%esp

21: 83 ec 20 sub $0x20,%esp

24: c7 44 24 1c 01 00 00 movl $0x1,0x1c(%esp)

2b: 00

2c: 8b 15 04 00 00 00 mov 0x4,%edx

32: a1 00 00 00 00 mov 0x0,%eax

37: 8d 04 02 lea (%edx,%eax,1),%eax

3a: 03 44 24 1c add 0x1c(%esp),%eax

3e: 03 44 24 18 add 0x18(%esp),%eax

42: 89 04 24 mov %eax,(%esp)

45: e8 fc ff ff ff call 46

4a: 8b 44 24 1c mov 0x1c(%esp),%eax

4e: c9 leave

4f: c3 ret

.data (000084)

54 00 00 00 55 00 00 00 global_init_var ,static_var

.bss.rodata(00008c)

25 64 0A 00 "%d "

.comment (000090)

00000090h: 00 47 43 43 3A 20 28 55 62 75 6E 74 75 20 34 2E ; .GCC: (Ubuntu 4.

000000a0h: 34 2E 33 2D 34 75 62 75 6E 74 75 35 2E 31 29 20 ; 4.3-4ubuntu5.1)

000000b0h: 34 2E 34 2E 33 00 ; 4.4.3.

.note.GNU-stack .shstrtab((0000bb))

00 2E 73 79 6D 74 61 62 00 2E

000000c0h: 73 74 72 74 61 62 00 2E 73 68 73 74 72 74 61 62

000000d0h: 00 2E 72 65 6C 2E 74 65 78 74 00 2E 64 61 74 61

000000e0h: 00 2E 62 73 73 00 2E 72 6F 64 61 74 61 00 2E 63

000000f0h: 6F 6D 6D 65 6E 74 00 2E 6E 6F 74 65 2E 47 4E 55

00000100h: 2D 73 74 61 63 6B 00 00

解析如下:

2E 73 79 6D 74 61 62 00 .symtab(1)

2E 73 74 72 74 61 62 00 .strtab(9)

2E 73 68 73 74 72 74 61 62 00 .shstrtab(11)

2E 72 65 6C 2E 74 65 78 74 00 .rel.text(1B) .text(1F)

2E 64 61 74 61 00 .data(25)

2E 62 73 73 00 .bss(2B)

2E 72 6F 64 61 74 61 00 .rodata(30)

2E 63 6F 6D 6D 65 6E 74 00 .comment(38)

2E 6E 6F 74 65 2E 47 4E 55 2D 73 74 61 63 6B 00 .note.GNU-stack(41)

.symtab 0002c0

name(idx) value(idx) size info other shndx

000002c0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

000002d0h: 01 00 00 00 00 00 00 00 00 00 00 00 04 00 F1 FF // SimpleSection.c

000002e0h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 01 00

000002f0h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 03 00 // STT_SECTION:data

00000300h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 04 00 // STT_SECTION:bss

00000310h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 05 00 // STT_SECTION:rodata

00000320h: 11 00 00 00 04 00 00 00 04 00 00 00 01 00 03 00 // static_var.1255

00000330h: 21 00 00 00 00 00 00 00 04 00 00 00 01 00 04 00 // static_var2.1236

00000340h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 07 00

00000350h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 06 00

00000360h: 32 00 00 00 00 00 00 00 04 00 00 00 11 00 03 00 // global_init_var

00000370h: 42 00 00 00 04 00 00 00 04 00 00 00 11 00 F2 FF // global_uninit_var

00000380h: 54 00 00 00 00 00 00 00 1B 00 00 00 12 00 01 00 // func1

00000390h: 5A 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 // printf

000003a0h: 61 00 00 00 1B 00 00 00 35 00 00 00 12 00 01 00 // main

.strtab(0003b4)

000003b0h: 00 53 69 6D 70 6C 65 53 65 63 74 69 6F 6E 2E 63

000003c0h: 00 73 74 61 74 69 63 5F 76 61 72 2E 31 32 35 35

000003d0h: 00 73 74 61 74 69 63 5F 76 61 72 32 2E 31 32 35

000003e0h: 36 00 67 6C 6F 62 61 6C 5F 69 6E 69 74 5F 76 61

000003f0h: 72 00 67 6C 6F 62 61 6C 5F 75 6E 69 6E 69 74 5F

00000400h: 76 61 72 00 66 75 6E 63 31 00 70 72 69 6E 74 66

00000410h: 00 6D 61 69 6E 00 00 00

解析如下:

53 69 6D 70 6C 65 53 65 63 74 69 6F 6E 2E 63 00 SimpleSection.c(1)

73 74 61 74 69 63 5F 76 61 72 2E 31 32 35 35 00 static_var.1255(11)

73 74 61 74 69 63 5F 76 61 72 32 2E 31 32 35 36 00 static_var2.1256(21)

67 6C 6F 62 61 6C 5F 69 6E 69 74 5F 76 61 72 00 global_init_var(32)

67 6C 6F 62 61 6C 5F 75 6E 69 6E 69 74 5F 76 61 72 00 global_uninit_var(42)

66 75 6E 63 31 00 func1(54)

70 72 69 6E 74 66 00 printf(5A)

6D 61 69 6E 00 main(61)

00 00

.rel.text(00041c)

10 00 00 00 01 05 00 00 R_386_32 R_386_32 : 绝对地址的重定位

15 00 00 00 02 0D 00 00

2E 00 00 00 01 03 00 00 R_386_32

33 00 00 00 01 04 00 00 R_386_32

46 00 00 00 02 0C 00 00 R_386_PC32 // func1 R_386_PC32 : 相对地址的重定位

CyberMasteress

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
linux文件定位,Linux可重定位文件(.o)结构分析

intprintf(constchar*format,...);intglobal_init_var=84;intglobal_uninit_var;voidfunc1(inti){printf("%d\n",i);}intmain(void){staticintstatic_var=85;staticintstatic_var2;inta=1;i...
复制链接

扫一扫