ELF是Executable and Linkable Format缩写,其官方规范在《Tools Interface Standard Executable and Linkable Format Specification version 1.2》分为三部分:Executable and Linking Format;Processor Specific(Intel Architecture);Operating System Specific(UNIX System V Release 4)。重点关注第一部分通用标准:Object Files和Program Loading and Dynamic Linking。前者可以说是静态,后者是动态,程序加载和动态链接。
Usage: readelf <option(s)> elf-file(s)
Display information about the contents of ELF format files
Options are:
-a --all Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header Display the ELF file header
-l --program-headers Display the program headers
--segments An alias for --program-headers
-S --section-headers Display the sections' header
--sections An alias for --section-headers
-g --section-groups Display the section groups
-t --section-details Display the section details
-e --headers Equivalent to: -h -l -S
-s --syms Display the symbol table
--symbols An alias for --syms
--dyn-syms Display the dynamic symbol table
-n --notes Display the core notes (if present)
-r --relocs Display the relocations (if present)
-u --unwind Display the unwind info (if present)
-d --dynamic Display the dynamic section (if present)
-V --version-info Display the version sections (if present)
-A --arch-specific Display architecture specific information (if any)
-c --archive-index Display the symbol/file index in an archive
-D --use-dynamic Use the dynamic section info when displaying symbols
-x --hex-dump=<number|name>
Dump the contents of section <number|name> as bytes
-p --string-dump=<number|name>
Dump the contents of section <number|name> as strings
-R --relocated-dump=<number|name>
Dump the contents of section <number|name> as relocated bytes
-w[lLiaprmfFsoRt] or
--debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,
=frames-interp,=str,=loc,=Ranges,=pubtypes,
=gdb_index,=trace_info,=trace_abbrev,=trace_aranges,
=addr,=cu_index]
Display the contents of DWARF2 debug sections
--dwarf-depth=N Do not display DIEs at depth N or greater
--dwarf-start=N Display DIEs starting with N, at the same depth
or deeper
-I --histogram Display histogram of bucket list lengths
-W --wide Allow output width to exceed 80 characters
@<file> Read options from <file>
-H --help Display this information
-v --version Display the version number of readelf
使用readelf -a xxxx可以看个全貌,实际的显示的顺序和Linking View稍有不同。首先是ELF Header;然后是Section Headers和Program Headers,再然后是Section to Segment mapping的映射表;最后是一系列Section的详细内容。
typedef struct elf64_sym { Elf64_Word st_name; /* Symbol name, index in string tbl */ unsigned char st_info; /* Type and binding attributes */ unsigned char st_other; /* No defined meaning, 0 */ Elf64_Half st_shndx; /* Associated section index */ Elf64_Addr st_value; /* Value of the symbol */ Elf64_Xword st_size; /* Associated symbol size */
} Elf64_Sym;
st_info包括Type和Bind两部分:
Type:
#define STT_NOTYPE 0------No type specified
#define STT_OBJECT 1------Data object
#define STT_FUNC 2-------Function entry point
#define STT_SECTION 3-----Symbol is associcated with a section
#define STT_FILE 4--------Source file associated with the object file
#define STT_COMMON 5
#define STT_TLS 6
Bind:
#define STB_LOCAL 0------Not visible outside the object file
#define STB_GLOBAL 1-----Global symbol, visible to all object files
#define STB_WEAK 2------Global scope, but with lower precedence than global symbols
readelf –s xxx结果如下:
Symbol table '.dynsym' contains 6 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 FUNC GLOBAL DEFAULT UND free@GLIBC_2.2.5 (2) 2: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail@GLIBC_2.4 (3) 3: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@GLIBC_2.2.5 (2) 4: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 5: 0000000000000000 0 FUNC GLOBAL DEFAULT UND malloc@GLIBC_2.2.5 (2)
Symbol table '.symtab' contains 81 entries:-----------------------------------可以看到.dynsym中有的符号在.symtab中都可以找到。 Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000400238 0 SECTION LOCAL DEFAULT 1
…… 27: 0000000000000000 0 SECTION LOCAL DEFAULT 27 28: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 29: 0000000000600e20 0 OBJECT LOCAL DEFAULT 21 __JCR_LIST__ 30: 0000000000400510 0 FUNC LOCAL DEFAULT 14 deregister_tm_clones 31: 0000000000400550 0 FUNC LOCAL DEFAULT 14 register_tm_clones 32: 0000000000400590 0 FUNC LOCAL DEFAULT 14 __do_global_dtors_aux 33: 0000000000601660 1 OBJECT LOCAL DEFAULT 26 completed.7585 34: 0000000000600e18 0 OBJECT LOCAL DEFAULT 20 __do_global_dtors_aux_fin 35: 00000000004005b0 0 FUNC LOCAL DEFAULT 14 frame_dummy 36: 0000000000600e10 0 OBJECT LOCAL DEFAULT 19 __frame_dummy_init_array_ 37: 0000000000000000 0 FILE LOCAL DEFAULT ABS sample.c 38: 0000000000601680 256 OBJECT LOCAL DEFAULT 26 buffer_g_s_u 39: 0000000000601260 256 OBJECT LOCAL DEFAULT 25 buffer_g_s_i 40: 0000000000601780 256 OBJECT LOCAL DEFAULT 26 buffer_g_s_u_unuse 41: 0000000000601360 256 OBJECT LOCAL DEFAULT 25 buffer_g_s_i_unuse 42: 0000000000601880 256 OBJECT LOCAL DEFAULT 26 buffer_l_s_u.2801 43: 0000000000601460 256 OBJECT LOCAL DEFAULT 25 buffer_l_s_i.2802 44: 0000000000601560 256 OBJECT LOCAL DEFAULT 25 buffer_l_s_i_unuse.2804 45: 0000000000601980 256 OBJECT LOCAL DEFAULT 26 buffer_l_s_u_unuse.2803 46: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 47: 00000000004008a8 0 OBJECT LOCAL DEFAULT 18 __FRAME_END__ 48: 0000000000600e20 0 OBJECT LOCAL DEFAULT 21 __JCR_END__ 49: 0000000000000000 0 FILE LOCAL DEFAULT ABS 50: 0000000000600e18 0 NOTYPE LOCAL DEFAULT 19 __init_array_end 51: 0000000000600e28 0 OBJECT LOCAL DEFAULT 22 _DYNAMIC 52: 0000000000600e10 0 NOTYPE LOCAL DEFAULT 19 __init_array_start 53: 0000000000400784 0 NOTYPE LOCAL DEFAULT 17 __GNU_EH_FRAME_HDR 54: 0000000000601000 0 OBJECT LOCAL DEFAULT 24 _GLOBAL_OFFSET_TABLE_ 55: 0000000000400770 2 FUNC GLOBAL DEFAULT 14 __libc_csu_fini 56: 0000000000000000 0 FUNC GLOBAL DEFAULT UND free@@GLIBC_2.2.5 57: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_deregisterTMCloneTab 58: 0000000000601040 0 NOTYPE WEAK DEFAULT 25 data_start 59: 0000000000601a80 256 OBJECT GLOBAL DEFAULT 26 buffer_g_u 60: 0000000000601660 0 NOTYPE GLOBAL DEFAULT 25 _edata 61: 0000000000400774 0 FUNC GLOBAL DEFAULT 15 _fini 62: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail@@GLIBC_2 63: 0000000000601060 256 OBJECT GLOBAL DEFAULT 25 buffer_g_i 64: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __libc_start_main@@GLIBC_ 65: 0000000000601040 0 NOTYPE GLOBAL DEFAULT 25 __data_start 66: 0000000000601160 256 OBJECT GLOBAL DEFAULT 25 buffer_g_i_unuse 67: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 68: 0000000000601048 0 OBJECT GLOBAL HIDDEN 25 __dso_handle 69: 0000000000400780 4 OBJECT GLOBAL DEFAULT 16 _IO_stdin_used 70: 0000000000400700 101 FUNC GLOBAL DEFAULT 14 __libc_csu_init 71: 0000000000000000 0 FUNC GLOBAL DEFAULT UND malloc@@GLIBC_2.2.5 72: 0000000000601c80 0 NOTYPE GLOBAL DEFAULT 26 _end 73: 00000000004004e0 42 FUNC GLOBAL DEFAULT 14 _start 74: 0000000000601660 0 NOTYPE GLOBAL DEFAULT 26 __bss_start 75: 00000000004005d6 298 FUNC GLOBAL DEFAULT 14 main 76: 0000000000601b80 256 OBJECT GLOBAL DEFAULT 26 buffer_g_u_unuse 77: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _Jv_RegisterClasses 78: 0000000000601660 0 OBJECT GLOBAL HIDDEN 25 __TMC_END__ 79: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_registerTMCloneTable 80: 0000000000400460 0 FUNC GLOBAL DEFAULT 11 _init
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】博客园社区专享云产品让利特惠,阿里云新客6.5折上折
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步