elf | 易学教程

Building elf within Eclipse within Windows

阅读更多关于 Building elf within Eclipse within Windows

问题 I'm having trouble building an Elf file within Eclipse within Windows. It seems that everytime I build, a PE / portable executable for windows is created. I've gone into the Binary Parser section and checked Elf Parser while making sure that everything else is unchecked. However, I continue to end up with a PE which I cannot run on Linux. For clarification, I'm using the Linux GCC toolchain within Eclipse. I've attempted a reinstall of Cygwin -- still experiencing the same issues. Any ideas?

memset/memcpy on mmap region fails

阅读更多关于 memset/memcpy on mmap region fails

问题 I'm trying to load a statically linked program from another one and execute it. My steps are: Parse the ELF Parse the segments from the program headers For each PT_LOAD Load it Jump to the starting address If elf_bytes is the mmap'ed ELF file, loading a PT_LOAD segment is load(&p, elf_bytes + p.p_offset) . The load function: int load(const Elf64_Phdr *phdr, const void *elf_bytes_for_phdr) { fprintf(stderr, "loading phdr of type %x from 0x%x to +=%zu bytes\n", phdr->p_type, phdr->p_vaddr, phdr

Friend function access the private members of class defined in static library

阅读更多关于 Friend function access the private members of class defined in static library

问题 I have a static library written in C++. I have also got the header files for the classes defined in the static library. Can I access the private members of the classes defined in the static library introducing a friend function in class declaration ? 回答1: You mean you want to change the headers that are shipped with the library? It's in no way guaranteed that adding friend declarations there will work. You might mess up the linking part, even if your compiler says it's ok. Also, if those

链接过程详解

阅读更多关于链接过程详解

一：链接的基本概念链接（linking）是将各种代码和数据片段收集并组合成为一个单一文件的过程，这个文件可被加载（复制）到内存并执行。链接可以执行于编译时，也可以执行于加载时，甚至执行于运行时。在现代系统中，链接是由叫做链接器（linker）的程序自动执行的。为什么需要链接器呢？一切都是为了简单、为了方便！试想一下，一个巨大的工程有巨大的源文件，包含N多个模块，如果没有链接的存在，那么当你改动某个模块时，不得不重新编译整个工程，消耗巨大的时间和资源。而在链接器的帮助下，你只需要简单编译修改过的模块，之后重新链接生成可执行文件就OK了。下面，我们将基于一个运行Linux的x86-64系统，详细讨论关于链接的各个方面。二：从代码到可执行文件考虑如下的一个c语言程序： code/link/main.c int sun(int *a, int n); int array[2] = {1, 2}; int main() { int val = sum(array, 2); return val; } code/link/sum.c int sum(int *a, int n) { int i, s = 0; for (i = 0; i < n; i++) s += a[i]; return s; } 从源文件到可执行文件需要哪几个步骤呢？ 1：预处理器将C的源程序main

Symbol lookup error undefined symbol, but all symbols seem to be present

阅读更多关于 Symbol lookup error undefined symbol, but all symbols seem to be present

问题 An executable seemingly can't resolve a symbol in a linked library. The relevant output of LD_DEBUG=libs shows that the correct library is loaded: 6557: /usr/lib/libcharon.so.0: error: symbol lookup error: undefined symbol: auth_class_names (fatal) /usr/libexec/ipsec/charon: symbol lookup error: /usr/lib/libcharon.so.0: undefined symbol: auth_class_names nm -D shows that the symbol auth_class_names is defined: nm -D /usr/lib/libcharon.so.0|grep auth_class_names U auth_class_names All clues

How to run program using angr after loading with the elfcore backend?

阅读更多关于 How to run program using angr after loading with the elfcore backend?

问题 I am attempting to write a python script using the angr binary analysis library (http://angr.io/). I have written code that successfully loads a core dump of the process I want to play with by using the ElfCore back end (http://angr.io/api-doc/cle.html#cle.backends.elf.elfcore.ELFCore) passed to the project constructor, doing something like the following: ap = angr.Project("corefile", main_opts={'backend': 'elfcore'}) What I am wondering is, how do I now "run" the program forward from the

ELF-Binary compiled by gcc: What happens from entry point to main?

阅读更多关于 ELF-Binary compiled by gcc: What happens from entry point to main?

问题 I get the entry point with readelf -h: Entry point address: 0x8048400 Debugging with gdb and Intel syntax: (gdb) x/13i 0x8048400 0x8048400 <_start>: xor ebp,ebp 0x8048402 <_start+2>: pop esi 0x8048403 <_start+3>: mov ecx,esp 0x8048405 <_start+5>: and esp,0xfffffff0 0x8048408 <_start+8>: push eax 0x8048409 <_start+9>: push esp 0x804840a <_start+10>: push edx 0x804840b <_start+11>: push 0x8048590 0x8048410 <_start+16>: push 0x8048520 0x8048415 <_start+21>: push ecx 0x8048416 <_start+22>: push

How to interpret the st_info field of elf symbol table section

阅读更多关于 How to interpret the st_info field of elf symbol table section

问题 The man page has this to say: st_info This member specifies the symbol's type and binding attributes: STT_NOTYPE The symbol's type is not defined. STT_OBJECT The symbol is associated with a data object. STT_FUNC The symbol is associated with a function or other executable code. STT_SECTION The symbol is associated with a section. Symbol table entries of this type exist primarily for relocation and normally have STB_LOCAL bindings. STT_FILE By convention, the symbol's name gives the name of

Swap sections in ELF

阅读更多关于 Swap sections in ELF

问题 Is there a way to force gcc or ld place code section at the end of output ELF-format file? Maybe I can force them not to produce any other section except .text if, for example, I dont have anything in .data, .rodata, .bss and other sections? 回答1: The minimal version of script that worked for me looked like: ENTRY(_start) SECTIONS { .data : { *(.data) } .bss : { *(.bss) *(COMMON) } .text : { *(.text) } } But after I've made some more research (docs here) I've replaced this script with default

What does “ENTRY” mean in a linker script?

阅读更多关于 What does “ENTRY” mean in a linker script?

问题 I am beginning to learn to write some low-level software for micro-controllers, and I've started studying linker scripts. I don't really get the meaning of the ENTRY command in this context. Since most micro-controllers start execution at a predetermined address, what difference does it make which entry point we choose in the linker script? 回答1: ENTRY() is an ELF feature that basically just sets the program entry address in the ELF header of your executable. This address may differ from the