ELF 文件格式分析

定义: ELF: Executable and Linkable Format ELF文件常见的三种文件类型: relocatable (可重定位) executable(可执行) shared object(共享目标) core dumps (核心转储) [root@centosgpt 10]# file process.oprocess.o: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped[root@centosgpt 10]# file dynamiccreateprocessdynamiccreateprocess: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=d6fa7d670a47b7aaf05d17c92c82508bcabc48dc, not stripped[root@centosgpt 10]# file libdynamicprocess.solibdynamicprocess.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0a9fb4457819ecf54d9762f3aff5eda0c19600fc, not stripped 组成: ELF header program header table section header table binary data 常用的elf文件分析工具, readelf, objdump, nm, hexdump ...

2019-06-11 · 25 min · 5113 words