elf | 易学教程

How do global variables get initialized by the elf loader

阅读更多关于 How do global variables get initialized by the elf loader

问题 For global variables in C like int aglobal = 5; When does the 5 get transferred into aglobal by the loader and how does it know to put 5 in aglobal. Same situation with a static declaration in a function. Like int afunc() { static int astatic = 8; return astatic; } 回答1: An int-sized space is made in a data section, with the value 5 encoded in it and a global non-function symbol named 'aglobal' is added to the symbol table pointing at it. References to aglobal are turned into relocations that

can a program read its own elf section?

阅读更多关于 can a program read its own elf section?

问题 I would like to use ld's --build-id option in order to add build information to my binary. However, I'm not sure how to make this information available inside the program. Assume I want to write a program that writes a backtrace every time an exception occurs, and a script that parses this information. The script reads the symbol table of the program and searches for the addresses printed in the backtrace (I'm forced to use such a script because the program is statically linked and backtrace

Accessing ELF symbol table in C

阅读更多关于 Accessing ELF symbol table in C

问题 I'm writing a program to mimic elfdump -ecps It currently prints out the elf header, program headers, and section headers correctly, but I'm stuck on the last few parts of the symbol table. the desired output is in the format of: Symbol Table Section: .dynsym index value size type bind oth ver shndx name [0] 0x00000000 0x00000000 NOTY LOCL D 0 UNDEF [1] 0x00025c0c 0x00000000 FUNC GLOB D 2 UNDEF .udiv [2] 0x00025e00 0x00000140 OBJT WEAK D 1 .bss _iob [3] 0x00025b24 0x00000000 OBJT GLOB P 1

What does “COM” means in the Ndx column of the .symtab section?

阅读更多关于 What does “COM” means in the Ndx column of the .symtab section?

问题 add2.c: int counter=0; int a=0; int b; int c; int add(int a, int b) { return a+b; } compilation: gcc -c add2.c -o add2.o reading the symbol table: readelf --symbols add2.o Symbol table '.symtab' contains 12 entries: Num: Value Size Type Bind Vis Ndx Name 0: 00000000 0 NOTYPE LOCAL DEFAULT UND 1: 00000000 0 FILE LOCAL DEFAULT ABS add2.c 2: 00000000 0 SECTION LOCAL DEFAULT 1 3: 00000000 0 SECTION LOCAL DEFAULT 2 4: 00000000 0 SECTION LOCAL DEFAULT 3 5: 00000000 0 SECTION LOCAL DEFAULT 5 6:

How can I build for linux 32-bit with go1.6.2

阅读更多关于 How can I build for linux 32-bit with go1.6.2

Is there any combination of GOARCH and GOOS values which I can set in order to build ELF 32-bit binary? GOOS=linux and GOARCH=386 . More examples: architecture: 32-bit -> GOARCH=386 64-bit -> GOARCH=amd64 OS: Windows -> GOOS=windows Linux -> GOOS=linux OS X -> GOOS=darwin FreeBSD -> GOOS=freebsd For the complete list (valid "individual" values) refer to go/build/syslist.go file: const goosList = "android darwin dragonfly freebsd linux nacl netbsd openbsd plan9 solaris windows " const goarchList = "386 amd64 amd64p32 arm armbe arm64 arm64be ppc64 ppc64le mips mipsle mips64 mips64le mips64p32

ELF dynamic symbol table

阅读更多关于 ELF dynamic symbol table

I have a question about ELF dynamic symbol table. For symbols of type FUNC, I have noticed a value of 0 in some binaries. But in other binaries, it has some non-zero value. Both these binaries were generated by gcc, I want to know why is this difference?. Is there any compiler options to control this? EDIT: This is the output of readelf --dyn-syms prog1 Symbol table '.dynsym' contains 5 entries: Num: Value Size Type Bind Vis Ndx Name 0: 00000000 0 NOTYPE LOCAL DEFAULT UND 1: 00000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 2: 000082f0 0 FUNC GLOBAL DEFAULT UND printf@GLIBC_2.4 (2) 3: 00008314

Create and test x86-64 ELF executable shellcode on a Linux machine

阅读更多关于 Create and test x86-64 ELF executable shellcode on a Linux machine

I am creating a training on buffer overflows and stack/heap attacks. I am working on an Ubuntu 12.04 x86_64 machine and want to show some sample buggy programs and the ways you could exploit those vulnerabilities. I am trying to start with the most basic shellcode I have found so far, the simple exit call, which should exit the program being overflowed. Hereby the exitcall.asm : ;exitcall.asm [SECTION .text] global _start _start: xor ebx,ebx ; zero out ebx, same function as mov ebx,0 mov al, 1 ; exit command to kernel int 0x80 I've got this asm file from other tutorials, written for i386

What is “Alignment” field in binary formats? Why is it needed?

阅读更多关于 What is “Alignment” field in binary formats? Why is it needed?

In ELF file format we have an Alignment field in Segment Header Table aka Program Header Table . In case of Windows PE file format they take it to next level the Sections have two alignment values, one within the disk file and the other in memory. The PE file header specifies both of these values. I didn't understand a thing about this alignment. What do we need it for? How & Where is it used? Again, I don't know what is alignment in binary file format context but why do we need it? Well, alignment is usually stretching the storage size of some value to occupy some "round" space, like 32, 64,

What are the differences comparing PIE, PIC code and executable on 64-bit x86 platform?

阅读更多关于 What are the differences comparing PIE, PIC code and executable on 64-bit x86 platform?

问题 The test is on Ubuntu 12.04 64-bit. x86 architecture. I am confused about the concept Position Independent Executable (PIE) and Position Independent code (PIC), and I guess they are not orthogonal. Here is my quick experiment. gcc -fPIC -pie quickSort.c -o a_pie.out gcc -fPIC quickSort.c -o a_pic.out gcc a.out objdump -Dr -j .text a.out > a1.temp objdump -Dr -j .text a_pic.out > a2.temp objdump -Dr -j .text a_pie.out > a3.temp And I have the following findings. A. a.out contains some PIC code

Analyzing an ELF binary to minimize its size

阅读更多关于 Analyzing an ELF binary to minimize its size

I'm cross-compiling a V8 project to an embedded ARM target using the GCC arm-gnueabi cross compiler. I got the V8 library itself cross-compiled successfully, and as a smoke test I wanted to link it to Google's hello world example and run it on the ARM board. The libraries themselves clock in at a bit over 1.2 MB: v8 % find out/arm.release/obj.target/ -name '*.a' -exec du -h {} + 1.2M out/arm.release/obj.target/tools/gyp/libv8_base.a 12K out/arm.release/obj.target/tools/gyp/libv8_libbase.a 4.0K out/arm.release/obj.target/tools/gyp/libv8_libplatform.a 4.0K out/arm.release/obj.target/tools/gyp