Linux Kernel Series-11. Elf Format for operating system development

The structure of the elf file is as follows:

The elf file consists of 4 parts, namely the Elf header (elf header), the Program Header table, the section (Sections), and the section Header table.

In fact, a file does not necessarily contain all of this content, and their location may not be as shown in this arrangement, only the position of the elf head is fixed, the rest of the parts of the position, size and other information from the elf head of the values to determine.

The format of the ELF header is shown in the following code:

#define Ei_nident  16typedef struct{    unsigned char    e_ident[ei_nident];    Elf32_half          E_type;    Elf32_half          E_machine;    Elf32_word        e_version;    Elf32_addr         e_entry;    Elf32_off           E_phoff;    Elf32_off           E_shoff;    Elf32_word        e_flags;    Elf32_haif          e_ehsize;    Elf32_haif          e_phentsize;    Elf32_haif          E_phnum;    Elf32_haif          e_shentsize;    Elf32_haif          E_shnum;    Elf32_haif          E_shstrndx;} ELF32_EHDR;

The descriptions of each type are shown in the table below, as the Elf files are designed to support processors from 8-bit to 32-bit architectures, so the data types in the following table are defined so that the file format is machine Independent.

Let's take a look at the meanings of the ELF headers. Foobar file:

The first is the 16-byte e_ident, which contains the characters used to represent the elf file, as well as some other machine-independent information.

The beginning of the 4 bytes is fixed, the 1th byte value is 0x7f, followed by the elf three characters, this 4 bytes indicates that the file is an elf file.

1.e_type--identifies the type of the file, and the value is not listed. The e_type of the file Foobar is 2, indicating that it is an executable file.

The value of this entry in 2.e_machine--foobar is 3, indicating that the architecture required to run the program is Intel 80386.

Version of the 3.e_version--file.

The entry address of the 4.e_entry--program. The entry address for file Foobar is 0x80480a0.

5.e_phoff--program Header table offset in the file (in bytes), where the value is 0x34.

6.e_shoff--section Header table offset (in bytes) of the file, where the value is 0x1c0.

7.e_flags--for IA32, this is 0.

8.e_ehsize--elf header Size (in bytes), where the value is 0x34.

9.e_phentsize--program the size of each entry (a program header) in the Header table. The value here is 0x20.

10.e_phnum--program Header table has the number of entries, here are 3.

11.e_shentsize--section the size of each entry (a section header) in the Header table, where the value is 0x28.

12.e_shnum--section Header table has the number of entries, here are 6.

13.e_shstrndx--The string table that contains the section name is the first few sections (zero-based). A value of 5 indicates that the 5th section contains the section name.

We see that the Program Header table's offset in the file (E_phoff) is 0x34, and the ELF header size (e_ehsize) is also a 0x34, so the elf header is immediately followed by the program header. Table The program header data structure is as follows:

typedef struct{    Elf32_word        p_type;    Elf32_off            P_offset;    Elf32_addr         p_vaddr;    Elf32_addr         p_paddr;    Elf32_word        P_filesz;    Elf32_word        P_memsz;    Elf32_word        p_flags;    Elf32_word        p_align;} ELF32_PHDR;

In fact, the program header describes a segment or other information that is required for the system to be ready to run. There are three items (e_phnum=3) in the Program Header table, with offsets of 0x34~0x53, 0x54~0x73, and 0x74~0x93 respectively.

1.p_type--the type of segment described by the current program header.

The offset of the first byte of the 2.p_offset--segment in the file.

The virtual address of the first byte of the 3.p_vaddr--segment in memory.

4.p_paddr--in a system related to physical address positioning, this entry is reserved for the physical address.

The length of the 5.p_filesz--segment in the file.

The length of the 6.p_memsz--segment in memory.

7.p_flags--the flags associated with the segment.

8.p_align--determines how segments are aligned in the file and in memory based on this value.

The program header describes the position and size of a segment in a file, and the location and size of it when it is put into memory. This is exactly what we need if we want to load a file into memory.

There are three program headers in Foobar, which are shown in the following table:

Based on this information, it is easy to know what happens to Foobar after it is loaded into memory, such as:

Linux Kernel Series-11. Elf Format for operating system development