#include
void main()
{
printf("hello,jinxin!");
}
然后执行：
gcc -o jin jin.c
readelf -a jin
ELF Header:
Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Intel 80386
Version: 0x1
Entry point address: 0x8048310
Start of program headers: 52 (bytes into file)
Start of section headers: 2096 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 8
Size of section headers: 40 (bytes)
Number of section headers: 30
Section header string table index: 27
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 08048134 000134 000013 00 A 0 0 1
[ 2] .note.ABI-tag NOTE 08048148 000148 000020 00 A 0 0 4
[ 3] .note.gnu.build-i NOTE 08048168 000168 000024 00 A 0 0 4
[ 4] .gnu.hash GNU_HASH 0804818c 00018c 000020 04 A 5 0 4
[ 5] .dynsym DYNSYM 080481ac 0001ac 000050 10 A 6 1 4
[ 6] .dynstr STRTAB 080481fc 0001fc 00004c 00 A 0 0 1
[ 7] .gnu.version VERSYM 08048248 000248 00000a 02 A 5 0 2
[ 8] .gnu.version_r VERNEED 08048254 000254 000020 00 A 6 1 4
[ 9] .rel.dyn REL 08048274 000274 000008 08 A 5 0 4
[10] .rel.plt REL 0804827c 00027c 000018 08 A 5 12 4
[11] .init PROGBITS 08048294 000294 000030 00 AX 0 0 4
[12] .plt PROGBITS 080482c4 0002c4 000040 04 AX 0 0 4
[13] .text PROGBITS 08048310 000310 00016c 00 AX 0 0 16
[14] .fini PROGBITS 0804847c 00047c 00001c 00 AX 0 0 4
[15] .rodata PROGBITS 08048498 000498 00001a 00 A 0 0 4
[16] .eh_frame_hdr PROGBITS 080484b4 0004b4 00001c 00 A 0 0 4
[17] .eh_frame PROGBITS 080484d0 0004d0 000058 00 A 0 0 4
[18] .ctors PROGBITS 08049528 000528 000008 00 WA 0 0 4
[19] .dtors PROGBITS 08049530 000530 000008 00 WA 0 0 4
[20] .jcr PROGBITS 08049538 000538 000004 00 WA 0 0 4
[21] .dynamic DYNAMIC 0804953c 00053c 0000c8 08 WA 6 0 4
[22] .got PROGBITS 08049604 000604 000004 04 WA 0 0 4
[23] .got.plt PROGBITS 08049608 000608 000018 04 WA 0 0 4
[24] .data PROGBITS 08049620 000620 000004 00 WA 0 0 4
[25] .bss NOBITS 08049624 000624 000008 00 WA 0 0 4
[26] .comment PROGBITS 00000000 000624 00010e 00 0 0 1
[27] .shstrtab STRTAB 00000000 000732 0000fc 00 0 0 1
[28] .symtab SYMTAB 00000000 000ce0 000410 10 29 45 4
[29] .strtab STRTAB 00000000 0010f0 0001fb 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings)
I (info), L (link order), G (group), x (unknown)
O (extra OS processing required) o (OS specific), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x08048134 0x08048134 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x00528 0x00528 R E 0x1000
LOAD 0x000528 0x08049528 0x08049528 0x000fc 0x00104 RW 0x1000
DYNAMIC 0x00053c 0x0804953c 0x0804953c 0x000c8 0x000c8 RW 0x4
NOTE 0x000148 0x08048148 0x08048148 0x00044 0x00044 R 0x4
GNU_EH_FRAME 0x0004b4 0x080484b4 0x080484b4 0x0001c 0x0001c R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
03 .ctors .dtors .jcr .dynamic .got .got.plt .data .bss
04 .dynamic
05 .note.ABI-tag .note.gnu.build-id
06 .eh_frame_hdr
07
Dynamic section at offset 0x53c contains 20 entries:
Tag Type Name/Value
0x00000001 (NEEDED) Shared library: [libc.so.6]
0x0000000c (INIT) 0x8048294
0x0000000d (FINI) 0x804847c
0x6ffffef5 (GNU_HASH) 0x804818c
0x00000005 (STRTAB) 0x80481fc
0x00000006 (SYMTAB) 0x80481ac
0x0000000a (STRSZ) 76 (bytes)
0x0000000b (SYMENT) 16 (bytes)
0x00000015 (DEBUG) 0x0
0x00000003 (PLTGOT) 0x8049608
0x00000002 (PLTRELSZ) 24 (bytes)
0x00000014 (PLTREL) REL
0x00000017 (JMPREL) 0x804827c
0x00000011 (REL) 0x8048274
0x00000012 (RELSZ) 8 (bytes)
0x00000013 (RELENT) 8 (bytes)
0x6ffffffe (VERNEED) 0x8048254
0x6fffffff (VERNEEDNUM) 1
0x6ffffff0 (VERSYM) 0x8048248
0x00000000 (NULL) 0x0
Relocation section '.rel.dyn' at offset 0x274 contains 1 entries:
Offset Info Type Sym.Value Sym. Name
08049604 00000106 R_386_GLOB_DAT 00000000 __gmon_start__
Relocation section '.rel.plt' at offset 0x27c contains 3 entries:
Offset Info Type Sym.Value Sym. Name
08049614 00000107 R_386_JUMP_SLOT 00000000 __gmon_start__
08049618 00000207 R_386_JUMP_SLOT 00000000 __libc_start_main
0804961c 00000307 R_386_JUMP_SLOT 00000000 printf
There are no unwind sections in this file.
Symbol table '.dynsym' contains 5 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 00000000 0 NOTYPE LOCAL DEFAULT UND
1: 00000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__
2: 00000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@GLIBC_2.0 (2)
3: 00000000 0 FUNC GLOBAL DEFAULT UND printf@GLIBC_2.0 (2)
4: 0804849c 4 OBJECT GLOBAL DEFAULT 15 _IO_stdin_used
Symbol table '.symtab' contains 65 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 00000000 0 NOTYPE LOCAL DEFAULT UND
1: 08048134 0 SECTION LOCAL DEFAULT 1
2: 08048148 0 SECTION LOCAL DEFAULT 2
3: 08048168 0 SECTION LOCAL DEFAULT 3
4: 0804818c 0 SECTION LOCAL DEFAULT 4
5: 080481ac 0 SECTION LOCAL DEFAULT 5
6: 080481fc 0 SECTION LOCAL DEFAULT 6
7: 08048248 0 SECTION LOCAL DEFAULT 7
8: 08048254 0 SECTION LOCAL DEFAULT 8
9: 08048274 0 SECTION LOCAL DEFAULT 9
10: 0804827c 0 SECTION LOCAL DEFAULT 10
11: 08048294 0 SECTION LOCAL DEFAULT 11
12: 080482c4 0 SECTION LOCAL DEFAULT 12
13: 08048310 0 SECTION LOCAL DEFAULT 13
14: 0804847c 0 SECTION LOCAL DEFAULT 14
15: 08048498 0 SECTION LOCAL DEFAULT 15
16: 080484b4 0 SECTION LOCAL DEFAULT 16
17: 080484d0 0 SECTION LOCAL DEFAULT 17
18: 08049528 0 SECTION LOCAL DEFAULT 18
19: 08049530 0 SECTION LOCAL DEFAULT 19
20: 08049538 0 SECTION LOCAL DEFAULT 20
21: 0804953c 0 SECTION LOCAL DEFAULT 21
22: 08049604 0 SECTION LOCAL DEFAULT 22
23: 08049608 0 SECTION LOCAL DEFAULT 23
24: 08049620 0 SECTION LOCAL DEFAULT 24
25: 08049624 0 SECTION LOCAL DEFAULT 25
26: 00000000 0 SECTION LOCAL DEFAULT 26
27: 00000000 0 FILE LOCAL DEFAULT ABS crtstuff.c
28: 08049528 0 OBJECT LOCAL DEFAULT 18 __CTOR_LIST__
29: 08049530 0 OBJECT LOCAL DEFAULT 19 __DTOR_LIST__
30: 08049538 0 OBJECT LOCAL DEFAULT 20 __JCR_LIST__
31: 08048340 0 FUNC LOCAL DEFAULT 13 __do_global_dtors_aux
32: 08049624 1 OBJECT LOCAL DEFAULT 25 completed.5918
33: 08049628 4 OBJECT LOCAL DEFAULT 25 dtor_idx.5920
34: 080483a0 0 FUNC LOCAL DEFAULT 13 frame_dummy
35: 00000000 0 FILE LOCAL DEFAULT ABS crtstuff.c
36: 0804952c 0 OBJECT LOCAL DEFAULT 18 __CTOR_END__
37: 08048524 0 OBJECT LOCAL DEFAULT 17 __FRAME_END__
38: 08049538 0 OBJECT LOCAL DEFAULT 20 __JCR_END__
39: 08048450 0 FUNC LOCAL DEFAULT 13 __do_global_ctors_aux
40: 00000000 0 FILE LOCAL DEFAULT ABS jin.c
41: 08049608 0 OBJECT LOCAL HIDDEN 23 _GLOBAL_OFFSET_TABLE_
42: 08049528 0 NOTYPE LOCAL HIDDEN 18 __init_array_end
43: 08049528 0 NOTYPE LOCAL HIDDEN 18 __init_array_start
44: 0804953c 0 OBJECT LOCAL HIDDEN 21 _DYNAMIC
45: 08049620 0 NOTYPE WEAK DEFAULT 24 data_start
46: 080483e0 5 FUNC GLOBAL DEFAULT 13 __libc_csu_fini
47: 08048310 0 FUNC GLOBAL DEFAULT 13 _start
48: 00000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__
49: 00000000 0 NOTYPE WEAK DEFAULT UND _Jv_RegisterClasses
50: 08048498 4 OBJECT GLOBAL DEFAULT 15 _fp_hw
51: 0804847c 0 FUNC GLOBAL DEFAULT 14 _fini
52: 00000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@@GLIBC_
53: 0804849c 4 OBJECT GLOBAL DEFAULT 15 _IO_stdin_used
54: 08049620 0 NOTYPE GLOBAL DEFAULT 24 __data_start
55: 080484a0 0 OBJECT GLOBAL HIDDEN 15 __dso_handle
56: 08049534 0 OBJECT GLOBAL HIDDEN 19 __DTOR_END__
57: 080483f0 90 FUNC GLOBAL DEFAULT 13 __libc_csu_init
58: 00000000 0 FUNC GLOBAL DEFAULT UND printf@@GLIBC_2.0
59: 08049624 0 NOTYPE GLOBAL DEFAULT ABS __bss_start
60: 0804962c 0 NOTYPE GLOBAL DEFAULT ABS _end
61: 08049624 0 NOTYPE GLOBAL DEFAULT ABS _edata
62: 0804844a 0 FUNC GLOBAL HIDDEN 13 __i686.get_pc_thunk.bx
63: 080483c4 24 FUNC GLOBAL DEFAULT 13 main
64: 08048294 0 FUNC GLOBAL DEFAULT 11 _init
Histogram for `.gnu.hash' bucket list length (total of 2 buckets):
Length Number % of total Coverage
0 1 ( 50.0%)
1 1 ( 50.0%) 100.0%
Version symbols section '.gnu.version' contains 5 entries:
Addr: 0000000008048248 Offset: 0x000248 Link: 5 (.dynsym)
000: 0 (*local*) 0 (*local*) 2 (GLIBC_2.0) 2 (GLIBC_2.0)
004: 1 (*global*)
Version needs section '.gnu.version_r' contains 1 entries:
Addr: 0x0000000008048254 Offset: 0x000254 Link: 6 (.dynstr)
000000: Version: 1 File: libc.so.6 Cnt: 1
0x0010: Name: GLIBC_2.0 Flags: none Version: 2
Notes at offset 0x00000148 with length 0x00000020:
Owner Data size Description
GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag)
Notes at offset 0x00000168 with length 0x00000024:
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
总结：
1.文件大小：
[root@localhost mnt]# ls -l jin
-rwxrwxr-x 1 root root 4843 09-17 18:52 jin
2.文件内容分布图：
文件偏移量 十六进制 大小 说明
0~51 / 52 elf文件头
52~307 / 32*8 程序头(描述了section如何映射到
Segment)占用的空间
308~2094 134~82e / section信息（0~27）
2096~3295 830~cdf 40*30 section头部信息
3296~4842 ce0~12eb / section信息 (28~29)
注：
[ 1] .interp PROGBITS 08048134 000134 000013 00 A 0 0 1
[27] .shstrtab STRTAB 00000000 000732 0000fc 00 0 0 1
[28] .symtab SYMTAB 00000000 000ce0 000410 10 29 45 4
[29] .strtab STRTAB 00000000 0010f0 0001fb 00 0 0 1
0x732+0xfc=0x82e,而0x82e到0xce0之间的大片空间保存了什么？
0x830~0xce0保存了section信息！
3.程序头分析
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4
INTERP 0x000134 0x08048134 0x08048134 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x00528 0x00528 R E 0x1000
LOAD 0x000528 0x08049528 0x08049528 0x000fc 0x00104 RW 0x1000
DYNAMIC 0x00053c 0x0804953c 0x0804953c 0x000c8 0x000c8 RW 0x4
NOTE 0x000148 0x08048148 0x08048148 0x00044 0x00044 R 0x4
GNU_EH_FRAME 0x0004b4 0x080484b4 0x080484b4 0x0001c 0x0001c R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
03 .ctors .dtors .jcr .dynamic .got .got.plt .data .bss
04 .dynamic
05 .note.ABI-tag .note.gnu.build-id
06 .eh_frame_hdr
07
从链接的角度来看，elf文件是按照"section"来划分的。
但从装载的角度看，elf文件是按照"Segment"来划分的。
程序头描述了系统如何以装载的角度来描述elf文件。装载时所有的section将会以程序头描述的方式
映射到虚拟内存中。但是装载时，我们只关心类型为"LOAD"的Segment,因为只有它是需要映射的，其他的
请如NOTE、GNU_EH_FRAME、GNU_STACK都是在装载时起辅助作用的。有时会仅仅有两个类型为"LOAD"的
Segment（代码段和数据段），那是因为bss段合并到了数据段中。
4.验证文件大小：
[29] .strtab STRTAB 00000000 0010f0 0001fb 00 0 0 1
而最后一个section信息如上所示，可见此section信息的文件偏移量为0x10f0,大小为0x1fb .
0x10f0+0x1fb=0x12eb,而0x12eb换作十进制数刚好就是4843!
5.节信息分析：
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 1] .interp PROGBITS 08048134 000134 000013 00 A 0 0 1
此section保存了动态链接器的路径信息，在此例中，此section内容为：/lib/ld-linux.so.2，共18个字符，加上最后的
空格，共19个字符，刚好等于Size字段的0x000013.
阅读(1988) | 评论(0) | 转发(0) |
