从执行文件查看elf文件的各种详细信息
代码如下program8_6.c：
1 #include <stdio.h> 2 3 int a = 0x55555555; 4 int b = 0x66666666; 5 int c = 0x77777777; 6 int d = 0x88888888; 7 8 int main() 9 { 10 a = 0x11111111; 11 b = 0x22222222; 12 c = 0x33333333; 13 d = 0x44444444; 14 15 printf("Variable: \taddresses: \n"); 16 printf("a %x\t%x\n", a, &a); 17 printf("b %x\t%x\n", b, &b); 18 printf("c %x\t%x\n", c, &c); 19 printf("d %x\t%x\n", d, &d); 20 21 printf("Finished!\n"); 22 23 return 0; 24 }
gcc program8_6.c -o program8_6生成可执行文件，查看elf文件的常见部分，使用命令readelf，选项如下：
readelf [-a|--all] [-h|--file-header] [-l|--program-headers|--segments] [-S|--section-headers|--sections] [-g|--section-groups] [-t|--section-details] [-e|--headers] [-s|--syms|--symbols] [--dyn-syms|--lto-syms] [--sym-base=[0|8|10|16]] [--demangle=style|--no-demangle] [--quiet] [--recurse-limit|--no-recurse-limit] [-U method|--unicode=method] [-n|--notes] [-r|--relocs] [-u|--unwind] [-d|--dynamic] [-V|--version-info] [-A|--arch-specific] [-D|--use-dynamic] [-L|--lint|--enable-checks] [-x <number or name>|--hex-dump=<number or name>] [-p <number or name>|--string-dump=<number or name>] [-R <number or name>|--relocated-dump=<number or name>] [-z|--decompress] [-c|--archive-index] [-w[lLiaprmfFsoORtUuTgAck]| --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=arang es,=macro,=frames,=frames-interp,=str,=str-offsets,=loc,=Ranges,=pubtypes,=trace_ info,=trace_abbrev,=trace_aranges,=gdb_index,=addr,=cu_index,=links]] [-wK|--debug-dump=follow-links] [-wN|--debug-dump=no-follow-links] [-P|--process-links] [--dwarf-depth=n] [--dwarf-start=n] [--ctf=section] [--ctf-parent=section] [--ctf-symbols=section] [--ctf-strings=section] [-I|--histogram] [-v|--version] [-W|--wide] [-T|--silent-truncation] [-H|--help]
最常见的有-a：等同于 --file-header = -h , --program-headers = -l , --sections = -S , --symbols = -s , --relocs = -r, --dynamic = -d , --notes = -n, --version-info = -V, --arch-specific = -A, --unwind = -u, --section-groups = -g and --histogram = -I.
根据自行的情况，查看即可。
查看文件头：readelf -h program8_6
ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Position-Independent Executable file) Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x1080 Start of program headers: 64 (bytes into file) Start of section headers: 15056 (bytes into file) Flags: 0x0 Size of this header: 64 (bytes) Size of program headers: 56 (bytes) Number of program headers: 13 Size of section headers: 64 (bytes) Number of section headers: 37 Section header string table index: 36
查看程序头段：readelf -l program8_6
Elf file type is DYN (Position-Independent Executable file) Entry point 0x1080 There are 13 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align PHDR 0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000002d8 0x00000000000002d8 R 0x8 INTERP 0x0000000000000318 0x0000000000000318 0x0000000000000318 0x000000000000001c 0x000000000000001c R 0x1 [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2] LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000660 0x0000000000000660 R 0x1000 LOAD 0x0000000000001000 0x0000000000001000 0x0000000000001000 0x0000000000000259 0x0000000000000259 R E 0x1000 LOAD 0x0000000000002000 0x0000000000002000 0x0000000000002000 0x000000000000012c 0x000000000000012c R 0x1000 LOAD 0x0000000000002db0 0x0000000000003db0 0x0000000000003db0 0x0000000000000270 0x0000000000000278 RW 0x1000 DYNAMIC 0x0000000000002dc0 0x0000000000003dc0 0x0000000000003dc0 0x00000000000001f0 0x00000000000001f0 RW 0x8 NOTE 0x0000000000000338 0x0000000000000338 0x0000000000000338 0x0000000000000030 0x0000000000000030 R 0x8 NOTE 0x0000000000000368 0x0000000000000368 0x0000000000000368 0x0000000000000044 0x0000000000000044 R 0x4 GNU_PROPERTY 0x0000000000000338 0x0000000000000338 0x0000000000000338 0x0000000000000030 0x0000000000000030 R 0x8 GNU_EH_FRAME 0x000000000000204c 0x000000000000204c 0x000000000000204c 0x0000000000000034 0x0000000000000034 R 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 GNU_RELRO 0x0000000000002db0 0x0000000000003db0 0x0000000000003db0 0x0000000000000250 0x0000000000000250 R 0x1 Section to Segment mapping: Segment Sections... 00 01 .interp 02 .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt 03 .init .plt .plt.got .plt.sec .text .fini 04 .rodata .eh_frame_hdr .eh_frame 05 .init_array .fini_array .dynamic .got .data .bss 06 .dynamic 07 .note.gnu.property 08 .note.gnu.build-id .note.ABI-tag 09 .note.gnu.property 10 .eh_frame_hdr 11 12 .init_array .fini_array .dynamic .got
查看程序头section：readelf -S program8_6
There are 37 section headers, starting at offset 0x3ad0: Section Headers: [Nr] Name Type Address Offset Size EntSize Flags Link Info Align [ 0] NULL 0000000000000000 00000000 0000000000000000 0000000000000000 0 0 0 [ 1] .interp PROGBITS 0000000000000318 00000318 000000000000001c 0000000000000000 A 0 0 1 [ 2] .note.gnu.pr[...] NOTE 0000000000000338 00000338 0000000000000030 0000000000000000 A 0 0 8 [ 3] .note.gnu.bu[...] NOTE 0000000000000368 00000368 0000000000000024 0000000000000000 A 0 0 4 [ 4] .note.ABI-tag NOTE 000000000000038c 0000038c 0000000000000020 0000000000000000 A 0 0 4 [ 5] .gnu.hash GNU_HASH 00000000000003b0 000003b0 0000000000000024 0000000000000000 A 6 0 8 [ 6] .dynsym DYNSYM 00000000000003d8 000003d8 00000000000000c0 0000000000000018 A 7 1 8 [ 7] .dynstr STRTAB 0000000000000498 00000498 0000000000000094 0000000000000000 A 0 0 1 [ 8] .gnu.version VERSYM 000000000000052c 0000052c 0000000000000010 0000000000000002 A 6 0 2 [ 9] .gnu.version_r VERNEED 0000000000000540 00000540 0000000000000030 0000000000000000 A 7 1 8 [10] .rela.dyn RELA 0000000000000570 00000570 00000000000000c0 0000000000000018 A 6 0 8 [11] .rela.plt RELA 0000000000000630 00000630 0000000000000030 0000000000000018 AI 6 24 8 [12] .init PROGBITS 0000000000001000 00001000 000000000000001b 0000000000000000 AX 0 0 4 [13] .plt PROGBITS 0000000000001020 00001020 0000000000000030 0000000000000010 AX 0 0 16 [14] .plt.got PROGBITS 0000000000001050 00001050 0000000000000010 0000000000000010 AX 0 0 16 [15] .plt.sec PROGBITS 0000000000001060 00001060 0000000000000020 0000000000000010 AX 0 0 16 [16] .text PROGBITS 0000000000001080 00001080 00000000000001ca 0000000000000000 AX 0 0 16 [17] .fini PROGBITS 000000000000124c 0000124c 000000000000000d 0000000000000000 AX 0 0 4 [18] .rodata PROGBITS 0000000000002000 00002000 0000000000000049 0000000000000000 A 0 0 4 [19] .eh_frame_hdr PROGBITS 000000000000204c 0000204c 0000000000000034 0000000000000000 A 0 0 4 [20] .eh_frame PROGBITS 0000000000002080 00002080 00000000000000ac 0000000000000000 A 0 0 8 [21] .init_array INIT_ARRAY 0000000000003db0 00002db0 0000000000000008 0000000000000008 WA 0 0 8 [22] .fini_array FINI_ARRAY 0000000000003db8 00002db8 0000000000000008 0000000000000008 WA 0 0 8 [23] .dynamic DYNAMIC 0000000000003dc0 00002dc0 00000000000001f0 0000000000000010 WA 7 0 8 [24] .got PROGBITS 0000000000003fb0 00002fb0 0000000000000050 0000000000000008 WA 0 0 8 [25] .data PROGBITS 0000000000004000 00003000 0000000000000020 0000000000000000 WA 0 0 8 [26] .bss NOBITS 0000000000004020 00003020 0000000000000008 0000000000000000 WA 0 0 1 [27] .comment PROGBITS 0000000000000000 00003020 000000000000002b 0000000000000001 MS 0 0 1 [28] .debug_aranges PROGBITS 0000000000000000 0000304b 0000000000000030 0000000000000000 0 0 1 [29] .debug_info PROGBITS 0000000000000000 0000307b 00000000000000f7 0000000000000000 0 0 1 [30] .debug_abbrev PROGBITS 0000000000000000 00003172 000000000000008b 0000000000000000 0 0 1 [31] .debug_line PROGBITS 0000000000000000 000031fd 000000000000006e 0000000000000000 0 0 1 [32] .debug_str PROGBITS 0000000000000000 0000326b 00000000000000e0 0000000000000001 MS 0 0 1 [33] .debug_line_str PROGBITS 0000000000000000 0000334b 0000000000000046 0000000000000001 MS 0 0 1 [34] .symtab SYMTAB 0000000000000000 00003398 00000000000003d8 0000000000000018 35 18 8 [35] .strtab STRTAB 0000000000000000 00003770 00000000000001f5 0000000000000000 0 0 1 [36] .shstrtab STRTAB 0000000000000000 00003965 000000000000016a 0000000000000000 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings), I (info), L (link order), O (extra OS processing required), G (group), T (TLS), C (compressed), x (unknown), o (OS specific), E (exclude), D (mbind), l (large), p (processor specific)
查看程序头标号：readelf -s program8_6
Symbol table '.dynsym' contains 8 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 FUNC GLOBAL DEFAULT UND _[...]@GLIBC_2.34 (2) 2: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_deregisterT[...] 3: 0000000000000000 0 FUNC GLOBAL DEFAULT UND puts@GLIBC_2.2.5 (3) 4: 0000000000000000 0 FUNC GLOBAL DEFAULT UND [...]@GLIBC_2.2.5 (3) 5: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 6: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_registerTMC[...] 7: 0000000000000000 0 FUNC WEAK DEFAULT UND [...]@GLIBC_2.2.5 (3) Symbol table '.symtab' contains 41 entries: Num: Value Size Type Bind Vis Ndx Name 0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND 1: 0000000000000000 0 FILE LOCAL DEFAULT ABS Scrt1.o 2: 000000000000038c 32 OBJECT LOCAL DEFAULT 4 __abi_tag 3: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 4: 00000000000010b0 0 FUNC LOCAL DEFAULT 16 deregister_tm_clones 5: 00000000000010e0 0 FUNC LOCAL DEFAULT 16 register_tm_clones 6: 0000000000001120 0 FUNC LOCAL DEFAULT 16 __do_global_dtors_aux 7: 0000000000004020 1 OBJECT LOCAL DEFAULT 26 completed.0 8: 0000000000003db8 0 OBJECT LOCAL DEFAULT 22 __do_global_dtor[...] 9: 0000000000001160 0 FUNC LOCAL DEFAULT 16 frame_dummy 10: 0000000000003db0 0 OBJECT LOCAL DEFAULT 21 __frame_dummy_in[...] 11: 0000000000000000 0 FILE LOCAL DEFAULT ABS program8_6.c 12: 0000000000000000 0 FILE LOCAL DEFAULT ABS crtstuff.c 13: 0000000000002128 0 OBJECT LOCAL DEFAULT 20 __FRAME_END__ 14: 0000000000000000 0 FILE LOCAL DEFAULT ABS 15: 0000000000003dc0 0 OBJECT LOCAL DEFAULT 23 _DYNAMIC 16: 000000000000204c 0 NOTYPE LOCAL DEFAULT 19 __GNU_EH_FRAME_HDR 17: 0000000000003fb0 0 OBJECT LOCAL DEFAULT 24 _GLOBAL_OFFSET_TABLE_ 18: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __libc_start_mai[...] 19: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_deregisterT[...] 20: 0000000000004000 0 NOTYPE WEAK DEFAULT 25 data_start 21: 0000000000000000 0 FUNC GLOBAL DEFAULT UND puts@GLIBC_2.2.5 22: 000000000000401c 4 OBJECT GLOBAL DEFAULT 25 d 23: 0000000000004014 4 OBJECT GLOBAL DEFAULT 25 b 24: 0000000000004020 0 NOTYPE GLOBAL DEFAULT 25 _edata 25: 000000000000124c 0 FUNC GLOBAL HIDDEN 17 _fini 26: 0000000000000000 0 FUNC GLOBAL DEFAULT UND printf@GLIBC_2.2.5 27: 0000000000004000 0 NOTYPE GLOBAL DEFAULT 25 __data_start 28: 0000000000000000 0 NOTYPE WEAK DEFAULT UND __gmon_start__ 29: 0000000000004008 0 OBJECT GLOBAL HIDDEN 25 __dso_handle 30: 0000000000002000 4 OBJECT GLOBAL DEFAULT 18 _IO_stdin_used 31: 0000000000004028 0 NOTYPE GLOBAL DEFAULT 26 _end 32: 0000000000001080 38 FUNC GLOBAL DEFAULT 16 _start 33: 0000000000004018 4 OBJECT GLOBAL DEFAULT 25 c 34: 0000000000004010 4 OBJECT GLOBAL DEFAULT 25 a 35: 0000000000004020 0 NOTYPE GLOBAL DEFAULT 26 __bss_start 36: 0000000000001169 225 FUNC GLOBAL DEFAULT 16 main 37: 0000000000004020 0 OBJECT GLOBAL HIDDEN 25 __TMC_END__ 38: 0000000000000000 0 NOTYPE WEAK DEFAULT UND _ITM_registerTMC[...] 39: 0000000000000000 0 FUNC WEAK DEFAULT UND __cxa_finalize@G[...] 40: 0000000000001000 0 FUNC GLOBAL HIDDEN 12 _init
查看程序relocation信息：readelf -r program8_6
Relocation section '.rela.dyn' at offset 0x570 contains 8 entries: Offset Info Type Sym. Value Sym. Name + Addend 000000003db0 000000000008 R_X86_64_RELATIVE 1160 000000003db8 000000000008 R_X86_64_RELATIVE 1120 000000004008 000000000008 R_X86_64_RELATIVE 4008 000000003fd8 000100000006 R_X86_64_GLOB_DAT 0000000000000000 __libc_start_main@GLIBC_2.34 + 0 000000003fe0 000200000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_deregisterTM[...] + 0 000000003fe8 000500000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0 000000003ff0 000600000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_registerTMCl[...] + 0 000000003ff8 000700000006 R_X86_64_GLOB_DAT 0000000000000000 __cxa_finalize@GLIBC_2.2.5 + 0 Relocation section '.rela.plt' at offset 0x630 contains 2 entries: Offset Info Type Sym. Value Sym. Name + Addend 000000003fc8 000300000007 R_X86_64_JUMP_SLO 0000000000000000 puts@GLIBC_2.2.5 + 0 000000003fd0 000400000007 R_X86_64_JUMP_SLO 0000000000000000 printf@GLIBC_2.2.5 + 0
查看程序note信息：readelf -n program8_6
Displaying notes found in: .note.gnu.property Owner Data size Description GNU 0x00000020 NT_GNU_PROPERTY_TYPE_0 Properties: x86 feature: IBT, SHSTK x86 ISA needed: x86-64-baseline Displaying notes found in: .note.gnu.build-id Owner Data size Description GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring) Build ID: 0245ec8d557a2b7776c6c869521b41ba0ae10249 Displaying notes found in: .note.ABI-tag Owner Data size Description GNU 0x00000010 NT_GNU_ABI_TAG (ABI version tag) OS: Linux, ABI: 3.2.0
查看程序动态信息：readelf -d program8_6
Dynamic section at offset 0x2dc0 contains 27 entries: Tag Type Name/Value 0x0000000000000001 (NEEDED) Shared library: [libc.so.6] 0x000000000000000c (INIT) 0x1000 0x000000000000000d (FINI) 0x124c 0x0000000000000019 (INIT_ARRAY) 0x3db0 0x000000000000001b (INIT_ARRAYSZ) 8 (bytes) 0x000000000000001a (FINI_ARRAY) 0x3db8 0x000000000000001c (FINI_ARRAYSZ) 8 (bytes) 0x000000006ffffef5 (GNU_HASH) 0x3b0 0x0000000000000005 (STRTAB) 0x498 0x0000000000000006 (SYMTAB) 0x3d8 0x000000000000000a (STRSZ) 148 (bytes) 0x000000000000000b (SYMENT) 24 (bytes) 0x0000000000000015 (DEBUG) 0x0 0x0000000000000003 (PLTGOT) 0x3fb0 0x0000000000000002 (PLTRELSZ) 48 (bytes) 0x0000000000000014 (PLTREL) RELA 0x0000000000000017 (JMPREL) 0x630 0x0000000000000007 (RELA) 0x570 0x0000000000000008 (RELASZ) 192 (bytes) 0x0000000000000009 (RELAENT) 24 (bytes) 0x000000000000001e (FLAGS) BIND_NOW 0x000000006ffffffb (FLAGS_1) Flags: NOW PIE 0x000000006ffffffe (VERNEED) 0x540 0x000000006fffffff (VERNEEDNUM) 1 0x000000006ffffff0 (VERSYM) 0x52c 0x000000006ffffff9 (RELACOUNT) 3 0x0000000000000000 (NULL) 0x0
其他的应该是极少数人需要的吧，elf中的数据结构包含在elf.h中，可以使用man 5 elf查看
人就像是被蒙着眼推磨的驴子，生活就像一条鞭子；当鞭子抽到你背上时，你就只能一直往前走，虽然连你也不知道要走到什么时候为止，便一直这么坚持着。
