#include void main()

{

printf("hello,jinxin!");

}

然后執行：

gcc -o jin jin.c

readelf -a jin

ELF Header:

Magic:?? 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00

Class:???????????????????????????? ELF32

Data:????????????????????????????? 2's complement, little endian

Version:?????????????????????????? 1 (current)

OS/ABI:??????????????????????????? UNIX - System V

ABI Version:?????????????????????? 0

Type:????????????????????????????? EXEC (Executable file)

Machine:?????????????????????????? Intel 80386

Version:?????????????????????????? 0x1

Entry point address:?????????????? 0x8048310

Start of program headers:????????? 52 (bytes into file)

Start of section headers:????????? 2096 (bytes into file)

Flags:???????????????????????????? 0x0

Size of this header:?????????????? 52 (bytes)

Size of program headers:?????????? 32 (bytes)

Number of program headers:???????? 8

Size of section headers:?????????? 40 (bytes)

Number of section headers:???????? 30

Section header string table index: 27

Section Headers:

[Nr] Name????????????? Type??????????? Addr???? Off??? Size?? ES Flg Lk Inf Al

[ 0]?????????????????? NULL??????????? 00000000 000000 000000 00????? 0?? 0? 0

[ 1] .interp?????????? PROGBITS??????? 08048134 000134 000013 00?? A? 0?? 0? 1

[ 2] .note.ABI-tag???? NOTE??????????? 08048148 000148 000020 00?? A? 0?? 0? 4

[ 3] .note.gnu.build-i NOTE??????????? 08048168 000168 000024 00?? A? 0?? 0? 4

[ 4] .gnu.hash???????? GNU_HASH??????? 0804818c 00018c 000020 04?? A? 5?? 0? 4

[ 5] .dynsym?????????? DYNSYM????????? 080481ac 0001ac 000050 10?? A? 6?? 1? 4

[ 6] .dynstr?????????? STRTAB????????? 080481fc 0001fc 00004c 00?? A? 0?? 0? 1

[ 7] .gnu.version????? VERSYM????????? 08048248 000248 00000a 02?? A? 5?? 0? 2

[ 8] .gnu.version_r??? VERNEED???????? 08048254 000254 000020 00?? A? 6?? 1? 4

[ 9] .rel.dyn????????? REL???????????? 08048274 000274 000008 08?? A? 5?? 0? 4

[10] .rel.plt????????? REL???????????? 0804827c 00027c 000018 08?? A? 5? 12? 4

[11] .init???????????? PROGBITS??????? 08048294 000294 000030 00? AX? 0?? 0? 4

[12] .plt????????????? PROGBITS??????? 080482c4 0002c4 000040 04? AX? 0?? 0? 4

[13] .text???????????? PROGBITS??????? 08048310 000310 00016c 00? AX? 0?? 0 16

[14] .fini???????????? PROGBITS??????? 0804847c 00047c 00001c 00? AX? 0?? 0? 4

[15] .rodata?????????? PROGBITS??????? 08048498 000498 00001a 00?? A? 0?? 0? 4

[16] .eh_frame_hdr???? PROGBITS??????? 080484b4 0004b4 00001c 00?? A? 0?? 0? 4

[17] .eh_frame???????? PROGBITS??????? 080484d0 0004d0 000058 00?? A? 0?? 0? 4

[18] .ctors??????????? PROGBITS??????? 08049528 000528 000008 00? WA? 0?? 0? 4

[19] .dtors??????????? PROGBITS??????? 08049530 000530 000008 00? WA? 0?? 0? 4

[20] .jcr????????????? PROGBITS??????? 08049538 000538 000004 00? WA? 0?? 0? 4

[21] .dynamic????????? DYNAMIC???????? 0804953c 00053c 0000c8 08? WA? 6?? 0? 4

[22] .got????????????? PROGBITS??????? 08049604 000604 000004 04? WA? 0?? 0? 4

[23] .got.plt????????? PROGBITS??????? 08049608 000608 000018 04? WA? 0?? 0? 4

[24] .data???????????? PROGBITS??????? 08049620 000620 000004 00? WA? 0?? 0? 4

[25] .bss????????????? NOBITS????????? 08049624 000624 000008 00? WA? 0?? 0? 4

[26] .comment????????? PROGBITS??????? 00000000 000624 00010e 00????? 0?? 0? 1

[27] .shstrtab???????? STRTAB????????? 00000000 000732 0000fc 00????? 0?? 0? 1

[28] .symtab?????????? SYMTAB????????? 00000000 000ce0 000410 10???? 29? 45? 4

[29] .strtab?????????? STRTAB????????? 00000000 0010f0 0001fb 00????? 0?? 0? 1

Key to Flags:

W (write), A (alloc), X (execute), M (merge), S (strings)

I (info), L (link order), G (group), x (unknown)

O (extra OS processing required) o (OS specific), p (processor specific)

There are no section groups in this file.

Program Headers:

Type?????????? Offset?? VirtAddr?? PhysAddr?? FileSiz MemSiz? Flg Align

PHDR?????????? 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4

INTERP???????? 0x000134 0x08048134 0x08048134 0x00013 0x00013 R?? 0x1

[Requesting program interpreter: /lib/ld-linux.so.2]

LOAD?????????? 0x000000 0x08048000 0x08048000 0x00528 0x00528 R E 0x1000

LOAD?????????? 0x000528 0x08049528 0x08049528 0x000fc 0x00104 RW? 0x1000

DYNAMIC??????? 0x00053c 0x0804953c 0x0804953c 0x000c8 0x000c8 RW? 0x4

NOTE?????????? 0x000148 0x08048148 0x08048148 0x00044 0x00044 R?? 0x4

GNU_EH_FRAME?? 0x0004b4 0x080484b4 0x080484b4 0x0001c 0x0001c R?? 0x4

GNU_STACK????? 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW? 0x4

Section to Segment mapping:

Segment Sections...

00

01???? .interp

02???? .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame

03???? .ctors .dtors .jcr .dynamic .got .got.plt .data .bss

04???? .dynamic

05???? .note.ABI-tag .note.gnu.build-id

06???? .eh_frame_hdr

07

Dynamic section at offset 0x53c contains 20 entries:

Tag??????? Type???????????????????????? Name/Value

0x00000001 (NEEDED)???????????????????? Shared library: [libc.so.6]

0x0000000c (INIT)?????????????????????? 0x8048294

0x0000000d (FINI)?????????????????????? 0x804847c

0x6ffffef5 (GNU_HASH)?????????????????? 0x804818c

0x00000005 (STRTAB)???????????????????? 0x80481fc

0x00000006 (SYMTAB)???????????????????? 0x80481ac

0x0000000a (STRSZ)????????????????????? 76 (bytes)

0x0000000b (SYMENT)???????????????????? 16 (bytes)

0x00000015 (DEBUG)????????????????????? 0x0

0x00000003 (PLTGOT)???????????????????? 0x8049608

0x00000002 (PLTRELSZ)?????????????????? 24 (bytes)

0x00000014 (PLTREL)???????????????????? REL

0x00000017 (JMPREL)???????????????????? 0x804827c

0x00000011 (REL)??????????????????????? 0x8048274

0x00000012 (RELSZ)????????????????????? 8 (bytes)

0x00000013 (RELENT)???????????????????? 8 (bytes)

0x6ffffffe (VERNEED)??????????????????? 0x8048254

0x6fffffff (VERNEEDNUM)???????????????? 1

0x6ffffff0 (VERSYM)???????????????????? 0x8048248

0x00000000 (NULL)?????????????????????? 0x0

Relocation section '.rel.dyn' at offset 0x274 contains 1 entries:

Offset???? Info??? Type??????????? Sym.Value? Sym. Name

08049604? 00000106 R_386_GLOB_DAT??? 00000000?? __gmon_start__

Relocation section '.rel.plt' at offset 0x27c contains 3 entries:

Offset???? Info??? Type??????????? Sym.Value? Sym. Name

08049614? 00000107 R_386_JUMP_SLOT?? 00000000?? __gmon_start__

08049618? 00000207 R_386_JUMP_SLOT?? 00000000?? __libc_start_main

0804961c? 00000307 R_386_JUMP_SLOT?? 00000000?? printf

There are no unwind sections in this file.

Symbol table '.dynsym' contains 5 entries:

Num:??? Value? Size Type??? Bind?? Vis????? Ndx Name

0: 00000000???? 0 NOTYPE? LOCAL? DEFAULT? UND

1: 00000000???? 0 NOTYPE? WEAK?? DEFAULT? UND __gmon_start__

2: 00000000???? 0 FUNC??? GLOBAL DEFAULT? UND __libc_start_main@GLIBC_2.0 (2)

3: 00000000???? 0 FUNC??? GLOBAL DEFAULT? UND printf@GLIBC_2.0 (2)

4: 0804849c???? 4 OBJECT? GLOBAL DEFAULT?? 15 _IO_stdin_used

Symbol table '.symtab' contains 65 entries:

Num:??? Value? Size Type??? Bind?? Vis????? Ndx Name

0: 00000000???? 0 NOTYPE? LOCAL? DEFAULT? UND

1: 08048134???? 0 SECTION LOCAL? DEFAULT??? 1

2: 08048148???? 0 SECTION LOCAL? DEFAULT??? 2

3: 08048168???? 0 SECTION LOCAL? DEFAULT??? 3

4: 0804818c???? 0 SECTION LOCAL? DEFAULT??? 4

5: 080481ac???? 0 SECTION LOCAL? DEFAULT??? 5

6: 080481fc???? 0 SECTION LOCAL? DEFAULT??? 6

7: 08048248???? 0 SECTION LOCAL? DEFAULT??? 7

8: 08048254???? 0 SECTION LOCAL? DEFAULT??? 8

9: 08048274???? 0 SECTION LOCAL? DEFAULT??? 9

10: 0804827c???? 0 SECTION LOCAL? DEFAULT?? 10

11: 08048294???? 0 SECTION LOCAL? DEFAULT?? 11

12: 080482c4???? 0 SECTION LOCAL? DEFAULT?? 12

13: 08048310???? 0 SECTION LOCAL? DEFAULT?? 13

14: 0804847c???? 0 SECTION LOCAL? DEFAULT?? 14

15: 08048498???? 0 SECTION LOCAL? DEFAULT?? 15

16: 080484b4???? 0 SECTION LOCAL? DEFAULT?? 16

17: 080484d0???? 0 SECTION LOCAL? DEFAULT?? 17

18: 08049528???? 0 SECTION LOCAL? DEFAULT?? 18

19: 08049530???? 0 SECTION LOCAL? DEFAULT?? 19

20: 08049538???? 0 SECTION LOCAL? DEFAULT?? 20

21: 0804953c???? 0 SECTION LOCAL? DEFAULT?? 21

22: 08049604???? 0 SECTION LOCAL? DEFAULT?? 22

23: 08049608???? 0 SECTION LOCAL? DEFAULT?? 23

24: 08049620???? 0 SECTION LOCAL? DEFAULT?? 24

25: 08049624???? 0 SECTION LOCAL? DEFAULT?? 25

26: 00000000???? 0 SECTION LOCAL? DEFAULT?? 26

27: 00000000???? 0 FILE??? LOCAL? DEFAULT? ABS crtstuff.c

28: 08049528???? 0 OBJECT? LOCAL? DEFAULT?? 18 __CTOR_LIST__

29: 08049530???? 0 OBJECT? LOCAL? DEFAULT?? 19 __DTOR_LIST__

30: 08049538???? 0 OBJECT? LOCAL? DEFAULT?? 20 __JCR_LIST__

31: 08048340???? 0 FUNC??? LOCAL? DEFAULT?? 13 __do_global_dtors_aux

32: 08049624???? 1 OBJECT? LOCAL? DEFAULT?? 25 completed.5918

33: 08049628???? 4 OBJECT? LOCAL? DEFAULT?? 25 dtor_idx.5920

34: 080483a0???? 0 FUNC??? LOCAL? DEFAULT?? 13 frame_dummy

35: 00000000???? 0 FILE??? LOCAL? DEFAULT? ABS crtstuff.c

36: 0804952c???? 0 OBJECT? LOCAL? DEFAULT?? 18 __CTOR_END__

37: 08048524???? 0 OBJECT? LOCAL? DEFAULT?? 17 __FRAME_END__

38: 08049538???? 0 OBJECT? LOCAL? DEFAULT?? 20 __JCR_END__

39: 08048450???? 0 FUNC??? LOCAL? DEFAULT?? 13 __do_global_ctors_aux

40: 00000000???? 0 FILE??? LOCAL? DEFAULT? ABS jin.c

41: 08049608???? 0 OBJECT? LOCAL? HIDDEN?? 23 _GLOBAL_OFFSET_TABLE_

42: 08049528???? 0 NOTYPE? LOCAL? HIDDEN?? 18 __init_array_end

43: 08049528???? 0 NOTYPE? LOCAL? HIDDEN?? 18 __init_array_start

44: 0804953c???? 0 OBJECT? LOCAL? HIDDEN?? 21 _DYNAMIC

45: 08049620???? 0 NOTYPE? WEAK?? DEFAULT?? 24 data_start

46: 080483e0???? 5 FUNC??? GLOBAL DEFAULT?? 13 __libc_csu_fini

47: 08048310???? 0 FUNC??? GLOBAL DEFAULT?? 13 _start

48: 00000000???? 0 NOTYPE? WEAK?? DEFAULT? UND __gmon_start__

49: 00000000???? 0 NOTYPE? WEAK?? DEFAULT? UND _Jv_RegisterClasses

50: 08048498???? 4 OBJECT? GLOBAL DEFAULT?? 15 _fp_hw

51: 0804847c???? 0 FUNC??? GLOBAL DEFAULT?? 14 _fini

52: 00000000???? 0 FUNC??? GLOBAL DEFAULT? UND __libc_start_main@@GLIBC_

53: 0804849c???? 4 OBJECT? GLOBAL DEFAULT?? 15 _IO_stdin_used

54: 08049620???? 0 NOTYPE? GLOBAL DEFAULT?? 24 __data_start

55: 080484a0???? 0 OBJECT? GLOBAL HIDDEN?? 15 __dso_handle

56: 08049534???? 0 OBJECT? GLOBAL HIDDEN?? 19 __DTOR_END__

57: 080483f0??? 90 FUNC??? GLOBAL DEFAULT?? 13 __libc_csu_init

58: 00000000???? 0 FUNC??? GLOBAL DEFAULT? UND printf@@GLIBC_2.0

59: 08049624???? 0 NOTYPE? GLOBAL DEFAULT? ABS __bss_start

60: 0804962c???? 0 NOTYPE? GLOBAL DEFAULT? ABS _end

61: 08049624???? 0 NOTYPE? GLOBAL DEFAULT? ABS _edata

62: 0804844a???? 0 FUNC??? GLOBAL HIDDEN?? 13 __i686.get_pc_thunk.bx

63: 080483c4??? 24 FUNC??? GLOBAL DEFAULT?? 13 main

64: 08048294???? 0 FUNC??? GLOBAL DEFAULT?? 11 _init

Histogram for `.gnu.hash' bucket list length (total of 2 buckets):

Length? Number???? % of total? Coverage

0? 1????????? ( 50.0%)

1? 1????????? ( 50.0%)??? 100.0%

Version symbols section '.gnu.version' contains 5 entries:

Addr: 0000000008048248? Offset: 0x000248? Link: 5 (.dynsym)

000:?? 0 (*local*)?????? 0 (*local*)?????? 2 (GLIBC_2.0)???? 2 (GLIBC_2.0)

004:?? 1 (*global*)

Version needs section '.gnu.version_r' contains 1 entries:

Addr: 0x0000000008048254? Offset: 0x000254? Link: 6 (.dynstr)

000000: Version: 1? File: libc.so.6? Cnt: 1

0x0010:?? Name: GLIBC_2.0? Flags: none? Version: 2

Notes at offset 0x00000148 with length 0x00000020:

Owner?? ??? ?Data size?? ?Description

GNU?? ??? ?0x00000010?? ?NT_GNU_ABI_TAG (ABI version tag)

Notes at offset 0x00000168 with length 0x00000024:

Owner?? ??? ?Data size?? ?Description

GNU?? ??? ?0x00000014?? ?NT_GNU_BUILD_ID (unique build ID bitstring)

總結：

1.文件大小：

[root@localhost mnt]# ls -l jin

-rwxrwxr-x 1 root root 4843 09-17 18:52 jin

2.文件內容分布圖：

文件偏移量??? 十六進制?????? 大小????????????????? 說明

0~51?????????? /?????????? 52?????????????? elf文件頭

52~307???????? /????????? 32*8???????????????? 程序頭(描述了section如何映射到

Segment)占用的空間

308~2094???? 134~82e?????? /?????????????? section信息(0~27)

2096~3295??? 830~cdf???? 40*30???????????? section頭部信息

3296~4842??? ce0~12eb????? /??????????????? section信息 (28~29)

注：

[ 1] .interp?????????? PROGBITS??????? 08048134 000134 000013 00?? A? 0?? 0? 1

[27] .shstrtab???????? STRTAB????????? 00000000 000732 0000fc 00????? 0?? 0? 1

[28] .symtab?????????? SYMTAB????????? 00000000 000ce0 000410 10???? 29? 45? 4

[29] .strtab?????????? STRTAB????????? 00000000 0010f0 0001fb 00????? 0?? 0? 1

0x732+0xfc=0x82e,而0x82e到0xce0之間的大片空間保存了什么？

0x830~0xce0保存了section信息！

3.程序頭分析

Program Headers:

Type?????????? Offset?? VirtAddr?? PhysAddr?? FileSiz MemSiz? Flg Align

PHDR?????????? 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4

INTERP???????? 0x000134 0x08048134 0x08048134 0x00013 0x00013 R?? 0x1

[Requesting program interpreter: /lib/ld-linux.so.2]

LOAD?????????? 0x000000 0x08048000 0x08048000 0x00528 0x00528 R E 0x1000

LOAD?????????? 0x000528 0x08049528 0x08049528 0x000fc 0x00104 RW? 0x1000

DYNAMIC??????? 0x00053c 0x0804953c 0x0804953c 0x000c8 0x000c8 RW? 0x4

NOTE?????????? 0x000148 0x08048148 0x08048148 0x00044 0x00044 R?? 0x4

GNU_EH_FRAME?? 0x0004b4 0x080484b4 0x080484b4 0x0001c 0x0001c R?? 0x4

GNU_STACK????? 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW? 0x4

Section to Segment mapping:

Segment Sections...

00

01???? .interp

02???? .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame

03???? .ctors .dtors .jcr .dynamic .got .got.plt .data .bss

04???? .dynamic

05???? .note.ABI-tag .note.gnu.build-id

06???? .eh_frame_hdr

07

從鏈接的角度來看，elf文件是按照"section"來劃分的。

但從裝載的角度看，elf文件是按照"Segment"來劃分的。

程序頭描述了系統如何以裝載的角度來描述elf文件。裝載時所有的section將會以程序頭描述的方式

映射到虛擬內存中。但是裝載時，我們只關心類型為"LOAD"的Segment,因為只有它是需要映射的，其他的

請如NOTE、GNU_EH_FRAME、GNU_STACK都是在裝載時起輔助作用的。有時會僅僅有兩個類型為"LOAD"的

Segment(代碼段和數據段)，那是因為bss段合并到了數據段中。

4.驗證文件大小：

[29] .strtab?????????? STRTAB????????? 00000000 0010f0 0001fb 00????? 0?? 0? 1

而最后一個section信息如上所示，可見此section信息的文件偏移量為0x10f0,大小為0x1fb .

0x10f0+0x1fb=0x12eb,而0x12eb換作十進制數剛好就是4843!

5.節信息分析：

[Nr] Name????????????? Type??????????? Addr???? Off??? Size?? ES Flg Lk Inf Al

[ 1] .interp?????????? PROGBITS??????? 08048134 000134 000013 00?? A? 0?? 0? 1

此section保存了動態鏈接器的路徑信息，在此例中，此section內容為：/lib/ld-linux.so.2，共18個字符，加上最后的

空格，共19個字符，剛好等于Size字段的0x000013.

總結

以上是生活随笔為你收集整理的linux分析文件格式,linux elf文件格式分析的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。