ELF文件解析

网上的一个文件解析：
x000~0x034 是 ELF Header; 0x034~0x054 是一项Program Headers; 0x054~0x080 是填充零字节; 0x080~0x086 是 .text 段内容; 0x086~0x098 是 .shstrtab 段内容; 0x098~0x110 是三项Section Headers; 对照 elf.h 文件分析如下：

00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  80 80 04 08 34 00 00 00  |............4...|
00000020  98 00 00 00 00 00 00 00  34 00 20 00 01 00 28 00  |........4. ...(.|
00000030  03 00 02 00                                       |....            |

typedef struct elf32_hdr {
  unsigned char e_ident[EI_NIDENT];
  Elf32_Half    e_type;
  Elf32_Half    e_machine;
  Elf32_Word    e_version;
  Elf32_Addr    e_entry;  /* Entry point */
  Elf32_Off     e_phoff;
  Elf32_Off     e_shoff;
  Elf32_Word    e_flags;
  Elf32_Half    e_ehsize;
  Elf32_Half    e_phentsize;
  Elf32_Half    e_phnum;
  Elf32_Half    e_shentsize;
  Elf32_Half    e_shnum;
  Elf32_Half    e_shstrndx;
} Elf32_Ehdr;

其中 ELF32_Half 是16位，其余类型 ELF32_Word, ELF32_Addr, ELF32_Off 等都是32位。 宏 EI_NIDENT 定义为 16，即 ELF Header 头部有16Bytes特征字节。

00000030              01 00 00 00  00 00 00 00 00 80 04 08  |    ............|
00000040  00 80 04 08 86 00 00 00  86 00 00 00 05 00 00 00  |................|
00000050  00 10 00 00                                       |....            |

typedef struct elf32_phdr{
  Elf32_Word    p_type;
  Elf32_Off     p_offset;
  Elf32_Addr    p_vaddr;
  Elf32_Addr    p_paddr;
  Elf32_Word    p_filesz;
  Elf32_Word    p_memsz;
  Elf32_Word    p_flags;
  Elf32_Word    p_align;
} Elf32_Phdr;

00000080  0f ff 0f b9 0f 0b                                 |......          |

00000080                    00 2e  73 68 73 74 72 74 61 62  |      ..shstrtab|
00000090  00 2e 74 65 78 74 00 00                           |..text..        |

00000090                           00 00 00 00 00 00 00 00  |        ........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

000000c0  0b 00 00 00 01 00 00 00  06 00 00 00 80 80 04 08  |................|
000000d0  80 00 00 00 06 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  10 00 00 00 00 00 00 00                           |........        |

000000e0                           01 00 00 00 03 00 00 00  |        ........|
000000f0  00 00 00 00 00 00 00 00  86 00 00 00 11 00 00 00  |................|
00000100  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|

typedef struct {
  Elf32_Word    sh_name;
  Elf32_Word    sh_type;
  Elf32_Word    sh_flags;
  Elf32_Addr    sh_addr;
  Elf32_Off     sh_offset;
  Elf32_Word    sh_size;
  Elf32_Word    sh_link;
  Elf32_Word    sh_info;
  Elf32_Word    sh_addralign;
  Elf32_Word    sh_entsize;
} Elf32_Shdr;