资源描述：
《the_ELF_object_file_format_by_dissection(002)》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、TheELFObjectFileFormatbyDissectionMay01,1995ByEricYoungdaleTheExecutableandLinkingFormathasbeenapopulartopiclately,aspeopleaskwhythekernelconfigurationscriptaskswhetherornottoconfigureloadingELFexecutables.SinceELFwilleventuallybethecommonobjectfileformatforLinuxbinaries,itisappropriatet
2、odocumentitabit.Lastmonth,EricintroducedustoELF,andthismonth,hegivesusaguidedtourofrealELFfiles.Lastmonth,wereachedapointwherewerebeginningtodissectsomerealELFfiles.Forthis,IwillusethereadelfutilitywhichIwrotewhenIwasfirsttryingtounderstandtheELFformatitself.Lateron,itbecameavaluabletool
3、fordebuggingthelinkerasIaddedsupportforELF.Thesourcestoreadelfshouldbeontsx-11.mit.eduinpub/linux/packages/GCC/srcorinpub/linux/BETA/ibcs2.Letusstartwithaverysimpleprogram—thehelloworldprogramweusedlastmonth.largo%cathello.cmain(){printf("HelloWorld");}largo%gcc-elf-chello.cOnmylaptop,
4、thegcc-elfcommandinvokestheELFversionofgcc—onceELFbecomesthedefaultformat,youwillbeabletousetheregulargcccommandwhichproducestheELFfilehello.o.EachELFfilestartswithaheader(structelfhdrin/usr/include/linux/elf.h),andthereadelfutilitycandisplaythecontentsofallofthefields:largo%readelf-hhel
5、lo.oELFmagic:7f454c46010101000000000000000000Type,machine,version=131Entry,phoff,shoff,flags=004400ehsize,phentsize,phnum=5200shentsize,shnum,shstrndx=40118TheELFmagicfieldisjustawayofunambiguouslyidentifyingthisasanELFfile.Ifafiledoesnotcontainthose16bytesinthemagicfield,itisnotanELFfil
6、e.Thetype,machine,andversionfieldsidentifythisasanET_RELfile(i.e.,anobjectfile)forthei386.Theehsizefieldisjustthesizeof(structelfhdr).EachELFfilecontainsatablethatdescribesthesectionswithinthefile.Theshnumfieldindicatesthatthereare11sections;theshofffieldindicatesthatthesectionheadertabl
7、estartsatbyteoffset440withinthefile.Theshentsizefieldindicatesthattheentryforeachsectionis40byteslong.AllthroughoutELF,thesizesofvariousstructuresarealwaysexplicitlystated.Thisallowsforflexibility;thestructurescanbeexpandedasrequiredforsomehardwareplatformsandthestandardE
