ELF File and dynamic library and static library Analysis in linux

Article Title: ELF File, dynamic library, and static library Analysis in linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

This article uses readelf and objdump tools to analyze the ELF executable files under the PPC processor.

First, we will show the objects to be analyzed:

[Ygliu @ publicPC-6 home] $ cat test. c

# Include

Int main (void)

{

Myprintf ();

Return 0;

}

[Ygliu @ publicPC-6 home] $ cat myprintf. c

# Include

Void myprintf (void)

{

Printf ("hello, ferrysnow! \ N ");

}

The compilation is as follows:

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc-c test. c

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc-c myprintf. c

View the generated target code:

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-h test. o | grep Type

Type: REL (relocable file)

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-h myprintf. o | grep Type

Type: REL (relocable file)

Generate an executable file for the target code:

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc-o test. o myprintf. o

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-h test | grep Type

Type: EXEC (Executable File)

Root @ ppc:/home #./test

Hello, ferrysnow!

Create a static Link Library:

[Ygliu @ publicPC-6 home] $ ppc_85xx-ar rcsv libmyprintf. a myprintf. o

A-myprintf. o

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-h libmyprintf. a | grep Type

Type: REL (relocable file)

It can be seen that the static Link Library is also a relocated file, which is actually a collection of multiple relocated files.

Use static Link Library:

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc-o test. o libmyprintf.

Root @ ppc:/home #./test

Hello, ferrysnow!

Create a Dynamic Link Library:

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc myprintf. o-shared-fPIC-o libmyprintf. so

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-h libmyprintf. so | grep Type

Type: DYN (share the target file)

Use Dynamic Link Library:

[Ygliu @ publicPC-6 home] $ ppc_85xx-gcc-o testdyn test. o-lmyprintf-L ./

Root @ ppc:/home # LD_LIBRARY_PATH =././testdyn

Hello, ferrysnow!

LD_LIBRARY_PATH is used to specify the search path for the dynamic link library.

Summary:

Static and dynamic libraries are composed of relocated file links.

The static link library consists of multiple relocated files and is added to the executable file during the link.

When a Dynamic Linked Library is linked, the library file itself is not added to the executable file, but the name and other information of the library are added to the executable file, this allows the dynamic linker to find the addresses of related functions and call them when the executable files reference the functions in the database during running.

The ELF file has great flexibility. It organizes the overall structure of the entire file through the file header, and uses the Section Headers Table and the Program header (Program Headers Table or segment Table) to describe the relocated and executable files respectively. However, no matter which type they are, they all need their subjects, that is, various section. In a relocated file, the section table describes various sections. In an executable file, the program header describes segments composed of different sections ), this allows the dynamic loader to know how to perform a memory image for programs to load and run. Let's take a look at some common sections.

[Ygliu @ publicPC-6 home] $ ppc_85xx-readelf-S myprintf. o

There are a total of 11 node headers starting from the offset 0x114:

Section header:

[Nr] Name Type Addr Off Size ES Flg Lk Inf Al

[0] NULL 00000000 000000 000000 00 0 0 0

[1]. text PROGBITS 00000000 000034 000038 00 AX 0 0 4

[2]. rela. text RELA 00000000 000388 000024 0c 9 1 4

[3]. data PROGBITS 00000000 running 6C 000000 00 WA 0 0 1

[4]. bss NOBITS 00000000 running 6C 000000 00 WA 0 0 1

[5]. rodata PROGBITS 00000000 running 6C 000014 00 A 0 0 4

[6]. note. GNU-stack PROGBITS 00000000 000080 000000 00 0 0 1

[7]. comment PROGBITS 00000000 000080 000040 00 0 0 1

[8]. shstrtab STRTAB 00000000 limit C0 000052 00 0 0 1

[9]. symtab SYMTAB 00000000 0002cc 127a0 10 10 8 4

[10]. strtab STRTAB 00000000 00036c 00001c 00 0 0 1

Key to Flags:

W (write), A (alloc), X (execute), M (merge), S (strings)

I (info), L (link order), G (group), x (unknown)

O (extra OS processing required) o (OS specific), p (processor specific)

[Ygliu @ publicPC-6 home] $ ppc_85xx-objdump-d-j. text myprintf. o

Myprintf: File Format elf32-powerpc

Disassembly. text section:

00000000 :

0: 94 21 ff f0 stwu r1,-16 (r1)

4: 7c 08 02 a6 mflr r0

8: 93 e1 00 0c stw r31, 12 (r1)

C: 90 01 00 14 stw r0, 20 (r1)

10: 7c 3f 0b 78 mr r31, r1

14: 3d 20 00 00 lis r9, 0

18: 38 69 00 00 addi r3, r9, 0

1c: 48 00 00 01 bl 1c

20: 81 61 00 00 lwz r11, 0 (r1)

24: 80 0b 00 04 lwz r0, 4 (r11)

28: 7c 08 03 a6 mtlr r0

2c: 83 eb ff fc lwz r31,-4 (r11)

30: 7d 61 5b 78 mr r1, r11

34: 4e 80 00 20 blr

-D indicates the disassembly result.-j indicates the partition to be viewed.