资源描述:
《the_ELF_object_file_format_by_dissection》由会员上传分享,免费在线阅读,更多相关内容在学术论文-天天文库。
1、TheELFObjectFileFormatbyDissectionMay01,1995ByEricYoungdaleTheExecutableandLinkingFormathasbeenapopulartopiclately,aspeopleaskwhythekernelconfigurationscriptaskswhetherornottoconfigureloadingELFexecutables.SinceELFwilleventuallybethecommonobjectfileformatforLinuxbinaries,itisappropriate
2、todocumentitabit.Lastmonth,EricintroducedustoELF,andthismonth,hegivesusaguidedtourofrealELFfiles.Lastmonth,wereachedapointwherewerebeginningtodissectsomerealELFfiles.Forthis,IwillusethereadelfutilitywhichIwrotewhenIwasfirsttryingtounderstandtheELFformatitself.Lateron,itbecameavaluableto
3、olfordebuggingthelinkerasIaddedsupportforELF.Thesourcestoreadelfshouldbeontsx-11.mit.eduinpub/linux/packages/GCC/srcorinpub/linux/BETA/ibcs2.Letusstartwithaverysimpleprogram—thehelloworldprogramweusedlastmonth.largo%cathello.cmain(){printf("HelloWorld");}largo%gcc-elf-chello.cOnmylapt
4、op,thegcc-elfcommandinvokestheELFversionofgcc—onceELFbecomesthedefaultformat,youwillbeabletousetheregulargcccommandwhichproducestheELFfilehello.o.EachELFfilestartswithaheader(structelfhdrin/usr/include/linux/elf.h),andthereadelfutilitycandisplaythecontentsofallofthefields:largo%readelf-
5、hhello.oELFmagic:7f454c46010101000000000000000000Type,machine,version=131Entry,phoff,shoff,flags=004400ehsize,phentsize,phnum=5200shentsize,shnum,shstrndx=40118TheELFmagicfieldisjustawayofunambiguouslyidentifyingthisasanELFfile.Ifafiledoesnotcontainthose16bytesinthemagicfield,itisnotanE
6、LFfile.Thetype,machine,andversionfieldsidentifythisasanET_RELfile(i.e.,anobjectfile)forthei386.Theehsizefieldisjustthesizeof(structelfhdr).EachELFfilecontainsatablethatdescribesthesectionswithinthefile.Theshnumfieldindicatesthatthereare11sections;theshofffieldindicatesthatthesectionhead
7、ertablestartsatbyteoffset440withinthefile.Theshentsizefieldindicatesthattheentryforeachsectionis40byteslong.AllthroughoutELF,thesizesofvariousstructuresarealwaysexplicitlystated.Thisallowsforflexibility;thestructurescanbeexpandedasrequiredforsomehardwareplatformsandthestandardE