int printf(const char* format , ...);
int global_init_var = 84 ;
int global_uninit_var ;
void func1(int i)
{
printf("%d\n",i);
}
int main(void)
{
static int static_var = 85;
static int static_var2 ;
int a = 1 ;
int b ;
func1(static_var + static_var2 + a + b);
return a ;
}
编译命令
gcc -c SimpleSection.c
ELF Header
00000000h: 7F 45 4C 46 01 01 01 00 00 00 00 00 00 00 00 00
00000010h: 01 00 03 00 01 00 00 00 00 00 00 00 00 00 00 00
00000020h: 0C 01 00 00 00 00 00 00 34 00 00 00 00 00 28 00
00000030h: 0B 00 08 00解析如下:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: REL (Relocatable file)
Machine: Intel 80386
Version: 0x1
Entry point address: 0x0
Start of program headers: 0 (bytes into file)
Start of section headers: 264 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 0 (bytes)
Number of program headers: 0
Size of section headers: 40 (bytes)
Number of section headers: 11
Section header string table index: 8
说明:
(1) 可重定位文件的Entry point address没有意义,设为0
(2) Start of section headers 段表的文件偏移,Size of section headers 段表条目数,Section header string table index ,段名字符表条目数
Section Headers
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1F 00 00 00 01 00 00 00 06 00 00 00 00 00 00 00 34 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 text
1B 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 18 04 00 00 28 00 00 00 09 00 00 00 01 00 00 00 04 00 00 00 08 00 00 00 rel.text
25 00 00 00 01 00 00 00 03 00 00 00 00 00 00 00 84 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 data
2B 00 00 00 08 00 00 00 03 00 00 00 00 00 00 00 8C 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 bss
30 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 8C 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 rodata
38 00 00 00 01 00 00 00 30 00 00 00 00 00 00 00 90 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 comment
41 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 B6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 note.GNU-stack
11 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 B6 00 00 00 51 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 shstrtab
01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 C0 02 00 00 F0 00 00 00 0A 00 00 00 0A 00 00 00 04 00 00 00 10 00 00 00 symtab
09 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 B0 03 00 00 66 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 strtab
解析如下:
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .text PROGBITS 00000000 000034 000050 00 AX 0 0 4
[ 2] .rel.text REL 00000000 000418 000028 08 9 1 4
[ 3] .data PROGBITS 00000000 000084 000008 00 WA 0 0 4
[ 4] .bss NOBITS 00000000 00008c 000004 00 WA 0 0 4
[ 5] .rodata PROGBITS 00000000 00008c 000004 00 A 0 0 1
[ 6] .comment PROGBITS 00000000 000090 000026 01 MS 0 0 1
[ 7] .note.GNU-stack PROGBITS 00000000 0000b6 000000 00 0 0 1
[ 8] .shstrtab STRTAB 00000000 0000b6 000051 00 0 0 1
[ 9] .symtab SYMTAB 00000000 0002c0 0000f0 10 10 10 4
[10] .strtab STRTAB 00000000 0003b0 000066 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
如图:
说明
(1) 一条section包含40个字节,分为如下字段
Elf32_Word sh_name
Elf32_Word sh_type
Elf32_Word sh_flags
Elf32_Addr sh_addr
Elf32_Off sh_offset
Elf32_Word sh_size
Elf32_Word sh_link
Elf32_Word sh_info
Elf32_Word sh_addralign
Elf32_Word sh_entsize(2) shname :在shstrtab中的索引,可以得到这个setion的string name
(3) sh_addr,在重定位文件中没有意义
(4) sh_offset 这个section在文件中的位置偏移,但如果sh_type为NOBITS,则这个字段无意义,如.bss
(5) sh_addralign 段首地址对齐
.text(000034)
55 89 E5 83 EC 18 8B 45 08 89 44 24
00000040h: 04 C7 04 24 00 00 00 00 E8 FC FF FF FF C9 C3 55
00000050h: 89 E5 83 E4 F0 83 EC 20 C7 44 24 1C 01 00 00 00
00000060h: 8B 15 04 00 00 00 A1 00 00 00 00 8D 04 02 03 44
00000070h: 24 1C 03 44 24 18 89 04 24 E8 FC FF FF FF 8B 44
00000080h: 24 1C C9 C3
Disassembly of section .text:
00000000 :
0: 55 push %ebp
1: 89 e5 mov %esp,%ebp
3: 83 ec 18 sub $0x18,%esp
6: 8b 45 08 mov 0x8(%ebp),%eax
9: 89 44 24 04 mov %eax,0x4(%esp)
d: c7 04 24 00 00 00 00 movl $0x0,(%esp)
14: e8 fc ff ff ff call 15
19: c9 leave
1a: c3 ret
0000001b :
1b: 55 push %ebp
1c: 89 e5 mov %esp,%ebp
1e: 83 e4 f0 and $0xfffffff0,%esp
21: 83 ec 20 sub $0x20,%esp
24: c7 44 24 1c 01 00 00 movl $0x1,0x1c(%esp)
2b: 00
2c: 8b 15 04 00 00 00 mov 0x4,%edx
32: a1 00 00 00 00 mov 0x0,%eax
37: 8d 04 02 lea (%edx,%eax,1),%eax
3a: 03 44 24 1c add 0x1c(%esp),%eax
3e: 03 44 24 18 add 0x18(%esp),%eax
42: 89 04 24 mov %eax,(%esp)
45: e8 fc ff ff ff call 46
4a: 8b 44 24 1c mov 0x1c(%esp),%eax
4e: c9 leave
4f: c3 ret
.data (000084)
54 00 00 00 55 00 00 00 global_init_var ,static_var
.bss.rodata(00008c)
25 64 0A 00 "%d "
.comment (000090)
00000090h: 00 47 43 43 3A 20 28 55 62 75 6E 74 75 20 34 2E ; .GCC: (Ubuntu 4.
000000a0h: 34 2E 33 2D 34 75 62 75 6E 74 75 35 2E 31 29 20 ; 4.3-4ubuntu5.1)
000000b0h: 34 2E 34 2E 33 00 ; 4.4.3.
.note.GNU-stack .shstrtab((0000bb))
00 2E 73 79 6D 74 61 62 00 2E
000000c0h: 73 74 72 74 61 62 00 2E 73 68 73 74 72 74 61 62
000000d0h: 00 2E 72 65 6C 2E 74 65 78 74 00 2E 64 61 74 61
000000e0h: 00 2E 62 73 73 00 2E 72 6F 64 61 74 61 00 2E 63
000000f0h: 6F 6D 6D 65 6E 74 00 2E 6E 6F 74 65 2E 47 4E 55
00000100h: 2D 73 74 61 63 6B 00 00
解析如下:
00
2E 73 79 6D 74 61 62 00 .symtab(1)
2E 73 74 72 74 61 62 00 .strtab(9)
2E 73 68 73 74 72 74 61 62 00 .shstrtab(11)
2E 72 65 6C 2E 74 65 78 74 00 .rel.text(1B) .text(1F)
2E 64 61 74 61 00 .data(25)
2E 62 73 73 00 .bss(2B)
2E 72 6F 64 61 74 61 00 .rodata(30)
2E 63 6F 6D 6D 65 6E 74 00 .comment(38)
2E 6E 6F 74 65 2E 47 4E 55 2D 73 74 61 63 6B 00 .note.GNU-stack(41)
.symtab 0002c0
name(idx) value(idx) size info other shndx
000002c0h: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000002d0h: 01 00 00 00 00 00 00 00 00 00 00 00 04 00 F1 FF // SimpleSection.c
000002e0h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 01 00
000002f0h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 03 00 // STT_SECTION:data
00000300h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 04 00 // STT_SECTION:bss
00000310h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 05 00 // STT_SECTION:rodata
00000320h: 11 00 00 00 04 00 00 00 04 00 00 00 01 00 03 00 // static_var.1255
00000330h: 21 00 00 00 00 00 00 00 04 00 00 00 01 00 04 00 // static_var2.1236
00000340h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 07 00
00000350h: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 06 00
00000360h: 32 00 00 00 00 00 00 00 04 00 00 00 11 00 03 00 // global_init_var
00000370h: 42 00 00 00 04 00 00 00 04 00 00 00 11 00 F2 FF // global_uninit_var
00000380h: 54 00 00 00 00 00 00 00 1B 00 00 00 12 00 01 00 // func1
00000390h: 5A 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 // printf
000003a0h: 61 00 00 00 1B 00 00 00 35 00 00 00 12 00 01 00 // main
.strtab(0003b4)
000003b0h: 00 53 69 6D 70 6C 65 53 65 63 74 69 6F 6E 2E 63
000003c0h: 00 73 74 61 74 69 63 5F 76 61 72 2E 31 32 35 35
000003d0h: 00 73 74 61 74 69 63 5F 76 61 72 32 2E 31 32 35
000003e0h: 36 00 67 6C 6F 62 61 6C 5F 69 6E 69 74 5F 76 61
000003f0h: 72 00 67 6C 6F 62 61 6C 5F 75 6E 69 6E 69 74 5F
00000400h: 76 61 72 00 66 75 6E 63 31 00 70 72 69 6E 74 66
00000410h: 00 6D 61 69 6E 00 00 00
解析如下:
00
53 69 6D 70 6C 65 53 65 63 74 69 6F 6E 2E 63 00 SimpleSection.c(1)
73 74 61 74 69 63 5F 76 61 72 2E 31 32 35 35 00 static_var.1255(11)
73 74 61 74 69 63 5F 76 61 72 32 2E 31 32 35 36 00 static_var2.1256(21)
67 6C 6F 62 61 6C 5F 69 6E 69 74 5F 76 61 72 00 global_init_var(32)
67 6C 6F 62 61 6C 5F 75 6E 69 6E 69 74 5F 76 61 72 00 global_uninit_var(42)
66 75 6E 63 31 00 func1(54)
70 72 69 6E 74 66 00 printf(5A)
6D 61 69 6E 00 main(61)
00 00
.rel.text(00041c)
10 00 00 00 01 05 00 00 R_386_32 R_386_32 : 绝对地址的重定位
15 00 00 00 02 0D 00 00
2E 00 00 00 01 03 00 00 R_386_32
33 00 00 00 01 04 00 00 R_386_32
46 00 00 00 02 0C 00 00 R_386_PC32 // func1 R_386_PC32 : 相对地址的重定位