ELF Format note (2) -- ELF Header, elfheader

ELF Format note (2) -- ELF Header, elfheader

Take the 32-bit ELF header data structure as an example:

 1 #define EI_NIDENT 16 2 typedef struct { 3     unsigned char e_ident[EI_NIDENT]; 4     Elf32_Half e_type; 5     Elf32_Half e_machine; 6     Elf32_Word e_version; 7     Elf32_Addr e_entry; 8     Elf32_Off e_phoff; 9     Elf32_Off e_shoff;10     Elf32_Word e_flags;11     Elf32_Half e_ehsize;12     Elf32_Half e_phentsize;13     Elf32_Half e_phnum;14     Elf32_Half e_shentsize;15     Elf32_Half e_shnum;16     Elf32_Half e_shstrndx;17 } Elf32_Ehdr;

1. e_ident

Elf id. It is a 16-byte array, and the byte data at each index position has a fixed meaning.

 

First 4 bytes e_ident [EI_MAG0] ~ The content of e_ident [EI_MAG3] is fixed to 0x7f, 'E', 'l', and 'F', which identifies an ELF file.

E_ident [EI_CLASS] specifies the file category: 0 (invalid target file); 1 (32-bit target file); 2 (64-bit target file ).

E_ident [EI_DATA] indicates whether the file is in the large or small order: 0 (invalid encoding format); 1 (Small End); 2 (large end ).

E_ident [EI_VERSION] indicates the version of the ELF file header.

9 bytes from e_ident [EI_PAD] To e_ident [EI_NIDENT-1] are retained.

2. e_type

File type. Common: 1 (relocated file: ". o file"); 2 (Executable File); 3 (shared library file: ". so file ").

 

3. e_machine

Specifies the platform on which the program is used. For example, EM_386 indicates that the program is used on the Inter x86 machine.

4. e_version

The version number of the ELF File.

5. e_entry

The virtual address of the program entry. For executable files, when the ELF file is loaded, it will start from this address. For other files, the value is 0.

6. e_phoff/e_shoff

Specify the byte offset of the Program Header Table and Section Header Table in the file respectively. If not, the value is 0.

7. e_flags

The specific Identifier of the processor, which is usually not very concerned.

8. e_ehsize

Specifies the size (52 bytes) of the ELF file header ).

9. e_phentsize/e_phnum

E_phentsize indicates the size of each item in the Program Header Table, and e_phnum indicates the total number of items.

10. e_shentsize/e_shnum

E_shentsize indicates the size of each item in Section Header Table, and e_shnum indicates the total number of items.

11. e_shstrndx

In Section Header Table, store the index corresponding to Section (that is, Section. shstrtab) of "Section name Table.