Elf Analysis Practice

Analyze elf Files:

First write A. c file and compile it with Gcc-c xx.c-o XX.O.

I am a elf_1.o file in this practice.

Next enter Ls-l ELF_1.O to look for information on location files.

The file information is then viewed in hexadecimal. Input: Hexdump-x ELF_1.O

The leftmost column of the displayed information represents a 16-binary representation of the offset address.

View the specifications for Elf file header definitions. Open elf.h to see the definition of each part of the content.

We can see that the 32-bit system is roughly the same structure as the ELF head part of a 64-bit system. Only the number of bytes occupied by individual fields is different.

Analyze Elf heads:

The third to fourth byte in the second row is 0x003e, which represents the X86-64 processor. The second four bytes 0x00000001, which represents the current version. The latter eight bytes represent the entry point of the program, which is currently 0.

The first eight bytes of the third row represent the Program Header table, which is currently 0. The last eight bytes are the offset address of the segment table: 0x00000000000003f0.

In line four, the seventh to eighth byte indicates that the segment header size is 64 bytes, and the nineth to tenth byte indicates that there are 13 entries for the segment table. The last two bytes represent the segment name string table (symbol table) in the Segment table with an index number of 10.

Analysis of Cong:

The segment table of a 32-bit system defines that each segment header size is 28H bytes, while a 64-bit system becomes 64 bytes (40H).

The 40h*13=340h,elf file header data structure stores a bitwise offset of 0x0000000000000000-0x0000000000000039, And the segment table is stored between 0x00000000000003f0-0x0000000000000340.

Analysis of the symbol table:

The symbol table structure size of the 32-bit system is 16 bytes, while the 64-bit system symbol table structure has a size of 22 bytes.

The figure shows a total of 15 paragraphs.

Text.section start position, size.

Text.section is a collection of executable instructions, Offset=0x00000040,size =74h.

Data.section is a collection of initialized data, offset=0x000000b4,size=4h.

Symtab.section is a collection of all section names. offset=0x00000140,size=150h.

Strtab.section is a collection of names that hold all symbols. Offset=0x00000290,size=1eh.

Elf Analysis Practice