ELF文件头部分析

#include <stdio.h>
#include <elf.h>

/**/
int parse_elf_header(Elf32_Ehdr *pElf_header)
{
    /*文件标志*/
    if((pElf_header->e_ident[EI_MAG0] != 0x7f) || (pElf_header->e_ident[EI_MAG1] != 'E') || (pElf_header->e_ident[EI_MAG2] != 'L') || (pElf_header->e_ident[EI_MAG3] != 'F'))
    {
        printf("This not elf file\n");
        return -1;
    }

    /*File class byte*/
    if(pElf_header->e_ident[EI_CLASS] == ELFCLASSNONE)
    {
        printf("File class:Invalid class\n");
    }
    else if(pElf_header->e_ident[EI_CLASS] == ELFCLASS32)
    {
        printf("File class:32-bit objects\n");
    }
    else if(pElf_header->e_ident[EI_CLASS] == ELFCLASS64)
    {
        printf("File class:64-bit objects\n");
    }

    /*Data encoding byte*/
    if(pElf_header->e_ident[EI_DATA] == ELFDATANONE)
    {
        printf("Data encoding:Invalid data encoding\n");
    }
    else if(pElf_header->e_ident[EI_DATA] == ELFDATA2LSB)
    {
        printf("Data encoding:little endian\n");
    }
    else if(pElf_header->e_ident[EI_DATA] == ELFDATA2MSB)
    {
        printf("Data encoding:big endian\n");
    }

    /**/
    printf("version:%d\n", pElf_header->e_ident[EI_VERSION]);

    /*OS ABI identification*/
    printf("OS ABI identification:%d\n", pElf_header->e_ident[EI_OSABI]);

    /*ABI version*/
    printf("ABI version:%d\n", pElf_header->e_ident[EI_ABIVERSION]);

    /*Legal values for e_type (object file type)*/
    if(pElf_header->e_type == ET_REL)
    {
        printf("object file type:Relocatable file\n");
    }
    else if(pElf_header->e_type == ET_EXEC)
    {
        printf("object file type:Executable file\n");
    }
    else if(pElf_header->e_type == ET_DYN)
    {
        printf("object file type:Shared object file\n");
    }
    else if(pElf_header->e_type == ET_CORE)
    {
        printf("object file type:Core file\n");
    }

    /* Legal values for e_machine (architecture). */
    if(pElf_header->e_machine == EM_M32)
    {
        printf("machine:AT&T WE 32100\n");
    }
    else if(pElf_header->e_machine == EM_SPARC)
    {
        printf("machine:SUN SPARC\n");
    }
    else if(pElf_header->e_machine == EM_386)
    {
        printf("machine:Intel 80386\n");
    }
    else if(pElf_header->e_machine == EM_68K)
    {
        printf("machine:Motorola m68k family\n");
    }
    else if(pElf_header->e_machine == EM_88K)
    {
        printf("machine:Motorola m88k family\n");
    }
    else if(pElf_header->e_machine == EM_860)
    {
        printf("machine:Intel 80860\n");
    }
    else if(pElf_header->e_machine == EM_MIPS)
    {
        printf("machine:MIPS R3000 big-endian\n");
    }
    else if(pElf_header->e_machine == EM_S370)
    {
        printf("machine:IBM System/370\n");
    }
    else if(pElf_header->e_machine == EM_MIPS_RS3_LE)
    {
        printf("machine:MIPS R3000 little-endian\n");
    }

    /*e_version*/
    printf("version:%d\n", pElf_header->e_version);

    /*e_entry*/
    printf("Entry point virtual address:0x%08x\n", pElf_header->e_entry);

    /*e_phoff*/
    printf("Program header table file offset:0x%08x\n", pElf_header->e_phoff);

    /*e_shoff*/
    printf("Section header table file offset:0x%08x\n", pElf_header->e_shoff);

    /*e_flags*/
    printf("Processor-specific flags:%d\n", pElf_header->e_flags);
    /*e_ehsize*/
    printf("ELF header size in bytes:%d\n", pElf_header->e_ehsize);
    /*e_phentsize*/
    printf("Program header table entry size:%d\n", pElf_header->e_phentsize);
    /*e_phnum*/
    printf("Program header table entry count:%d\n", pElf_header->e_phnum);
    /*e_shentsize*/
    printf("Section header table entry size :%d\n", pElf_header->e_shentsize);
    /*e_shnum*/
    printf("Section header table entry count:%d\n", pElf_header->e_shnum);
    /*e_shstrndx*/
    printf("Section header string table index:%d\n", pElf_header->e_shstrndx);

    return 0;
}

/**/
int main(int argc, char **argv)
{
    int ret_val = -1;
    FILE *fp = NULL;
    Elf32_Ehdr elf_header;


    if(argc != 2)
    {
        printf("usage:%s elf_file\n", argv[0]);
        return -1;
    }

    /**/
    fp = fopen(argv[1], "r");
    if(fp == NULL)
    {
        printf("fopen Failed\n");
        goto _OVER_;
    }


    /**/
    ret_val = fread((void *)&elf_header, 1, sizeof(Elf32_Ehdr), fp);
    if(ret_val != sizeof(Elf32_Ehdr))
    {
        printf("fread Failed(%d)\n", ret_val);
        goto _OVER_;
    }

    /**/
    parse_elf_header(&elf_header);

_OVER_:
    if(fp != NULL)
    {
        fclose(fp);
    }
    return ret_val;

}

分析可重定位目标文件：
root@tay-virtual-machine:/home/tay/workspace/parase_elf_file# ./parse_elf_file parse_elf_file.o 
parse_elf_header
File class:32-bit objects
Data encoding:little endian
version:1
OS ABI identification:0
ABI version:0
object file type:Relocatable file
machine:Intel 80386
version:1
Entry point virtual address:0x00000000
Program header table file offset:0x00000000
Section header table file offset:0x00000e48
Processor-specific flags:0
ELF header size in bytes:52
Program header table entry size:0
Program header table entry count:0
Section header table entry size :40
Section header table entry count:13
Section header string table index:10

分析可执行目标文件：
root@tay-virtual-machine:/home/tay/workspace/parase_elf_file# ./parse_elf_file parse_elf_file
parse_elf_header
File class:32-bit objects
Data encoding:little endian
version:1
OS ABI identification:0
ABI version:0
object file type:Executable file
machine:Intel 80386
version:1
Entry point virtual address:0x08048450
Program header table file offset:0x00000034
Section header table file offset:0x000028e0
Processor-specific flags:0
ELF header size in bytes:52
Program header table entry size:32
Program header table entry count:9
Section header table entry size :40
Section header table entry count:30
Section header string table index:27