使用二进制工具分析Hello World程序

Hello World程序

#include <stdio.h>

int main(int argc, char *argv[])
{
        printf("Hello World\n");
        return 0;
}

 

编译

$ gcc -Wall -g hw.c

 

 

file — determine file type

$ file a.out 
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=0x1930c9696c86fe873a61d00a7b9c2febf013b444, not stripped

 

nm - list symbols from object files

$ nm a.out 
080495a8 d _DYNAMIC
08049694 d _GLOBAL_OFFSET_TABLE_
080484ac R _IO_stdin_used
         w _ITM_deregisterTMCloneTable
         w _ITM_registerTMCloneTable
         w _Jv_RegisterClasses
08048598 r __FRAME_END__
080495a4 d __JCR_END__
080495a4 d __JCR_LIST__
080496b0 D __TMC_END__
080496b0 A __bss_start
080496ac D __data_start
080483a0 t __do_global_dtors_aux
080495a0 t __do_global_dtors_aux_fini_array_entry
080484b0 R __dso_handle
0804959c t __frame_dummy_init_array_entry
         w __gmon_start__
080495a0 t __init_array_end
0804959c t __init_array_start
08048490 T __libc_csu_fini
08048420 T __libc_csu_init
         U __libc_start_main@@GLIBC_2.0
08048324 T __x86.get_pc_thunk.bx
080496b0 A _edata
080496b4 A _end
08048494 T _fini
080484a8 R _fp_hw
08048290 T _init
08048300 T _start
080496b0 b completed.5745
080496ac W data_start
08048330 t deregister_tm_clones
080483d0 t frame_dummy
08048400 T main
         U puts@@GLIBC_2.0
08048360 t register_tm_clones

 

addr2line - convert addresses into file names and line numbers.

$ addr2line 08048400 -e a.out -f
main
/work/disk2/test/hw.c:4

 

 

readelf - Displays information about ELF files.

$ readelf -h a.out 
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x8048300
  Start of program headers:          52 (bytes into file)
  Start of section headers:          2644 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         8
  Size of section headers:           40 (bytes)
  Number of section headers:         35
  Section header string table index: 32

 

$ readelf -S a.out 
There are 35 section headers, starting at offset 0xa54:

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        08048134 000134 000013 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            08048148 000148 000020 00   A  0   0  4
  [ 3] .note.gnu.build-i NOTE            08048168 000168 000024 00   A  0   0  4
  [ 4] .gnu.hash         GNU_HASH        0804818c 00018c 000020 04   A  5   0  4
  [ 5] .dynsym           DYNSYM          080481ac 0001ac 000050 10   A  6   1  4
  [ 6] .dynstr           STRTAB          080481fc 0001fc 00004a 00   A  0   0  1
  [ 7] .gnu.version      VERSYM          08048246 000246 00000a 02   A  5   0  2
  [ 8] .gnu.version_r    VERNEED         08048250 000250 000020 00   A  6   1  4
  [ 9] .rel.dyn          REL             08048270 000270 000008 08   A  5   0  4
  [10] .rel.plt          REL             08048278 000278 000018 08   A  5  12  4
  [11] .init             PROGBITS