elf

问题 I have a static library libfoo.a , which is just a compression of multiple .o files. I am looking for a way to list all symbols that appear in the static library as UND have no definition in this static library So that I can find out all external symbol dependencies of this library. 回答1: You can use this method: ld -r -o deleteme.o --whole-archive libfoo.a nm -C --undefined-only deleteme.o # `-C` if you might have C++ archive members rm deleteme.o Demo : one.c extern void two(void); void one(

问题 I'm compiling a very simple hello-world one-liner statically on Debian 7 system on x86_64 machine with gcc version 4.8.2 (Debian 4.8.2-21): gcc test.c -static -o test and I get an executable ELF file that includes the following sections: [17] .tdata PROGBITS 00000000006b4000 000b4000 0000000000000020 0000000000000000 WAT 0 0 8 [18] .tbss NOBITS 00000000006b4020 000b4020 0000000000000030 0000000000000000 WAT 0 0 8 [19] .init_array INIT_ARRAY 00000000006b4020 000b4020 0000000000000010

问题 I want to add my C++ source code to the corresponding elf binary file and I'm looking for the best way to do this. (I'm using several versions of my code and not every version should be committed into svn). Can I just append the source code without destroying the elf file using bash's >> operator? Or is objcopy --add-section a way to do this? By the way, is there a better idea that just grep 'ing all #include lines recursively from the source code files to determine ALL source code files that

问题 What is the purpose of the SHT_NULL section in ELF ? Is it referenced by the OS or the loader? What is the size of this section? Does it have anything to do with the NULL pointer ? Additionally, why does this section not have an entry in the section-segments mapping? From the ELF specification: SHT_NULL : This value marks the section header as inactive; it does not have an associated section. Other members of the section header have undefined values. 回答1: What is the purpose of the SHT_NULL

问题 What is the purpose of the SHT_NULL section in ELF ? Is it referenced by the OS or the loader? What is the size of this section? Does it have anything to do with the NULL pointer ? Additionally, why does this section not have an entry in the section-segments mapping? From the ELF specification: SHT_NULL : This value marks the section header as inactive; it does not have an associated section. Other members of the section header have undefined values. 回答1: What is the purpose of the SHT_NULL

问题 Where does the ELF format stores the names of imported functions? Is it always possible to enumerate all import names, like for PE executables? For example, if a binary is using printf is it possible to tell it does, just by static analysis of the binary itself? 回答1: In ELF they're called undefined symbols. You can view the list of undefined symbols by: nm -D <file>|grep -w U objdump -T <file>|grep "\*UND\*" ELF files don't specify which symbols come from which libraries; it just adds a list

问题 I know the relationship between the two: virtual address mod page alignment == file offset mod page alignment But can someone tell me in which direction are these two numbers computed? Is virtual address computed from file offset according to the relationship above, or vice versa? Update Here is some more detail: when the linker writes the ELF file header, it sets the virtual address and file offset of the program headers.(segments) For example there's the output of readelf -l someELFfile :

问题 I now understand how dynamic functions are referenced, by procedure linkage table like below: Dump of assembler code for function foo@plt: 0x0000000000400528 <foo@plt+0>: jmpq *0x2004d2(%rip) # 0x600a00 <_GLOBAL_OFFSET_TABLE_+40> 0x000000000040052e <foo@plt+6>: pushq $0x2 0x0000000000400533 <foo@plt+11>: jmpq 0x4004f8 (gdb) disas 0x4004f8 No function contains specified address. But I don't know how dynamic variables are referenced,though I found the values are populated in the GOT once

问题 I now understand how dynamic functions are referenced, by procedure linkage table like below: Dump of assembler code for function foo@plt: 0x0000000000400528 <foo@plt+0>: jmpq *0x2004d2(%rip) # 0x600a00 <_GLOBAL_OFFSET_TABLE_+40> 0x000000000040052e <foo@plt+6>: pushq $0x2 0x0000000000400533 <foo@plt+11>: jmpq 0x4004f8 (gdb) disas 0x4004f8 No function contains specified address. But I don't know how dynamic variables are referenced,though I found the values are populated in the GOT once

问题 Is there any tool that reading the headers prints the name of the dynamic libraries required by a Linux executable to run? I need it to know if there are some weird dependencies (i.e. not very standard) in a binary that I've just built from the source (it's the Python branch of GDB) or it's mostly statically linked. I think that would be easier than reading the makefiles... 回答1: /usr/bin/ldd is your friend. Usage: ldd /bin/ls Sample output: linux-vdso.so.1 => (0x00007ffd14f79000) libselinux