elf | 易学教程

C - How To Check If Traced Process Is 32 bits?

阅读更多关于 C - How To Check If Traced Process Is 32 bits?

问题 When using ptrace_attach.How can you know if the process you're attaching is running in 32 or 64 bits ? I'm coding a little strace-like and I need to know if it's 32 or 64 bits because the number of the syscalls in RAX(EAX) will not have the same meaning. When you're tracing a cmd (strace ls) it's quiet simple, you mmap the binary and you perform some checking with Elf. But I cannot find anything regarding an already existing process ? Thank you ! 回答1: This is quite an interesting question.

Is there a way to load a Linux shared library into a specific memory location?

阅读更多关于 Is there a way to load a Linux shared library into a specific memory location?

问题 I have a Linux application which loads in very small (a few small functions) shared libraries at run-time. For various Important Reasons™ I need the shared libraries to be loaded into a certain virtual memory range. However, dlopen() doesn't provide any means (that I can see) to tell it, or hint to it, where to put what it loads. Is there a way to tell dlopen() where it should put the library it loads? Is there some alternative to dlopen() which would provide that functionality? 回答1: I think

Hook and Replace Export Function in the Loaded ELF ( .so shared library )

阅读更多关于 Hook and Replace Export Function in the Loaded ELF ( .so shared library )

问题 I'm writing some C code to hook some function of .so ELF (shared-library) loaded into memory. My C code should be able to re-direct an export function of another .so library that was loaded into the app/program's memory. Here's a bit of elaboration: Android app will have multiple .so files loaded. My C code has to look through export function that belongs to another shared .so library (called target.so in this case) This is not a regular dlsym approach because I don't just want address of a

How to create a executable hex from elf file format

阅读更多关于 How to create a executable hex from elf file format

问题 I am very very new to this, I have elf file input.out and need to create hex executable from it. I am using objcopy to create executable in intel hex format as follows objcopy -O ihex input.out out.hex by this out.hex contains data from all sections (.interp, .note.ABI-tag etc), but i am not sure if all of it is required for executable. Is just .text section enough for creating executable hex so can i just use as below or any more sections are required objcopy -j.text -O ihex input.out out

how to save modified ELF by pyelftools

阅读更多关于 how to save modified ELF by pyelftools

问题 Recently I've been interested in ELF File Structure. Searching on web, I found an awesome script named pyelftools . But in fact I didn't know the way to save the modified ELF; ELFFile class doesn't have any method to do. First of all, I did like below: header = self.elf.header self._emitline("%s" % header['e_shnum']) header['e_shnum'] = 30 self._emitline("%s" % header['e_shnum']) Yeah, that's poor way. But sadly I have no idea getting an offset of e_shnum in the ELF file. Is there anybody

Why does a standalone C hello program crash when used as a dynamic linker

阅读更多关于 Why does a standalone C hello program crash when used as a dynamic linker

问题 The following program: #include <stdio.h> int main(int argc, char *argv[]) { for (int j = 0; j < argc; j++) printf("%d: %s\n", j, argv[j]); return 0; } built into a statically linked PIE: gcc -g -fpie main.c -static-pie -o ld.so works fine: $ ./ld.so foo bar 0: ./ld.so 1: foo 2: bar But when I use that program as an ELF interpreter for another program: $ gcc -g main.c -Wl,-I./ld.so -o a.out it crashes like so: gdb -q ./a.out (gdb) run Starting program: /tmp/a.out Program received signal

Is it possible to replace every instance of a particular function with a dummy in a compiled binary?

阅读更多关于 Is it possible to replace every instance of a particular function with a dummy in a compiled binary?

问题 Is it possible to alter the way that an existing x86-64 binary references and/or calls one particular function. Specifically, is it possible to alter the binary such nothing happens (similar to a nop ) at the times when that function would normally have executed? I realize that there are powerful speciality tools out there (ie decompilers/disassemblers) for just this sort of task, but what I'm really wondering is if the executable formats are human-readable "enough" to be able to do this sort

libxml-ruby failed to load at x86_64

阅读更多关于 libxml-ruby failed to load at x86_64

问题 We are having problem with libxml-ruby gem at the server side Possible because it uses x86_64 architecture: $ uname -a Linux ip-10-228-171-64 2.6.21.7-2.fc8xen-ec2-v1.0 #1 SMP Tue Sep 1 10:25:30 EDT 2009 x86_64 GNU/Linux require 'libxml' LoadError: /usr/local/ruby-enterprise/lib/ruby/gems/1.8/gems/libxml-ruby-1.1.4/lib/libxml_ruby.so: invalid ELF header - /usr/local/ruby-enterprise/lib/ruby/gems/1.8/gems/libxml-ruby-1.1.4/lib/libxml_ruby.so from /usr/local/ruby-enterprise/lib/ruby/gems/1.8

What's the meaning of dylib files?

阅读更多关于 What's the meaning of dylib files?

问题 My C++ compiler creates "dylib" files which contain dynamic libraries. Whats the difference between .dylib and .so files? And what is the difference between files in Mach-O format and files in an ELF format? I have to build files for later use under iOS (static libraries only/Mach-O) and Android (ELF). Thanx! 回答1: I found that: One Mach-O feature that hits many people by surprise is the strict distinction between shared libraries and dynamically loadable modules. On ELF systems both are the

修复/lib/ld-linux.so.2: bad ELF interpreter: No such file or

阅读更多关于修复/lib/ld-linux.so.2: bad ELF interpreter: No such file or

今天在linux里面想解压一下JDK的bin文件，报了下面错： ./jdk-6u33-linux-i586.bin: ./install.sfx.37057: /lib/ld-linux.so.2: bad ELF。。。。。。。。。。。。。。网上查了一下，原来是在64位系统里面执行 32位的程序。。。好吧。。解决方案就是安装 glic 两个方法去安装： 1. 直接运行下面command去下载和安装，网络最好不要太烂了。。只有24M左右的东西而已。 sudo yum install glibc.i686 www.cit.cn 2.去系统光盘里面找（别人说的。。没试过）找到系统光盘里的rpm 包，安装下面 glibc包和nss包：（可能有一些不用也行，但还是把下面的包都装了） glib2-2.22.5-5.el6.i686.rpm glib2-2.22.5-5.el6.x86_64.rpm glib2-devel-2.22.5-5.el6.i686.rpm glib2-devel-2.22.5-5.el6.x86_64.rpm glibc-2.12-1.7.el6.i686.rpm glibc-2.12-1.7.el6.x86_64.rpm glibc-common-2.12-1.7.el6.x86_64.rpm glibc-devel-2.12-1.7.el6.i686