Linux Medium Elf Format file introduction __linux

The ELF (executable and linkable format) executes the connection file format, which is a more complex file format, but is widely used. Compared to other executable files under Linux (A.OUT,COF), its definition of the section and its support for the GNU tool chain make it flexible enough to preserve the system-related information that enables it to support cross compilation and cross linking on different platforms, and is highly portable. It also supports dynamic link shared libraries in execution.

In this article, you can get a general idea of the classification, composition, role, and content of the ELF format files in the Linux system. In addition, several commonly used tools for Elf files are introduced, and simple examples are used to facilitate the intuitive understanding of elf files.

Main content:

Description

1 Introduction to Elf Files

2 elf file format

3 Characteristics of the ELF

Example

1 Readelf Tools

2 Objcopy Tools

3 Objdump Tools

4 NM Tool

5 LDD Tools

Other

Description

1 Introduction to Elf Files

The ELF (executable and linkable format) performs the connection file format, which is Linux, SVR4 and Solaris2.0 default target file formats, currently standard Interface committee TIS has transformed the ELF standard into a portable target file format that runs on the 32-bit Intel System computer and is compatible with a variety of operating systems. Analyzing the Elf files helps to understand some important system concepts, such as compiling and linking programs, loading and running programs, and so on.

(1) Elf File type:

Types of elf files:

A relocatable file: Users and other target files create executable files or share target files, such as lib*.a files.

b executable file: Used to generate the process image, load memory execution, such as the compiled executable file a.out.

c) Shared destination file: Used to generate Elf target files with other shared target files or relocatable files or create process images, such as lib*.so files, along with the execution files.

(2) Elf file function:

The elf file participates in the program's connection (establishing a program) and the execution of the program (running a program), so you can view the files in the ELF format from different perspectives:

A if used for compilation and linking (relocatable files), the compiler and linker will think of the elf file as a collection of sections described in the section Header table, optional for the Program Header table.

b if used to load execution (executable), the loader will think of the elf file as a collection of segments described in the Program Header table, one segment may contain multiple sections, and a section header table optional.

c If the file is shared, both are included.

(3) Elf Files Overall Composition:

The elf file header describes the overall information for the elf file. Including:

System-related, type-related, load-related, link-related.

System-related representations: The magic number of elf file identification, as well as hardware and platform-related information, the increase of the Elf file portability, so that the possibility of cross compilation.

Type correlation is the type mentioned earlier.

Load Related: Includes information about the Header table of the program.

Link Related: section Header table related information.

The following is a detailed introduction to it.

2 elf file format

Types of 2.1 elf files

There are three main types of elf files:

(1) relocatable file: Contains code and data. Can create an executable or shared file with other Elf files:

(2) Executable: is a program that can be executed directly:

(3) Share target files: including code and data, can be linked in two places. First, the connector can process it with other relocatable files and shared files to create another elf file; second, the dynamic linker combines it with an executable file and other shared files to create a process image.

Organization of 2.2 elf files

The elf file participates in the program's connection (establishing a program) and the execution of the program (running a program), which the compiler and linker treat as a collection of sections (section) as described by the section Header table, and the loader treats it as a Header table (program Header table) is a collection of segments (segment) that are described, usually one segment can contain multiple sections. A relocatable file contains a section Header table, and the executable contains a single program Header table. Shared files are both included. To this end, the elf file format provides two ways to look at the contents of a file, reflecting the different requirements of different behaviors.

From the point of view of the link, the elf file can be viewed from the beginning to the end as follows:

A) Elf file headers

b) The first table of the program (optional)

c) 1th, section 2nd, ..., sect. N, ...

d) Section Head table

From the execution point of view, the Elf file can be viewed from the beginning to the end as follows:

A) Elf file headers

b) The first table of the program

c) 1th, 2nd paragraph, ...,

d) section Head table (optional)

2.3 File Header (ELF header)

Elf head at the beginning of the program, as a guide to describe the entire ELF file structure, the information is roughly divided into four parts: first, the system-related information, the second is the target file type, the third is to load the relevant information, four links related information.

The system related information includes Elf file magic number (identify Elf file), platform bits, data encoding mode, ELF head version, hardware platform E_machine, target file version e_version, processor specific flag e_ Ftags: The introduction of this information greatly enhances the portability of elf files, making it possible to cross compile. The target file type is represented by the value of E_type, the relocatable file is 1, the executable file is 2, the shared file is 3; loading related information is: The program enters Point E_entry. The Program Header table offset e_phoff,elf head length e_ehsize, the length of an entry in the Program Header table is e_phentsize, the number of entries in the Program Header table E_phnum; the link-Header table offset E_shoff, the length of an entry in the section Header table E_ Shentsize, the number of entries in the section Header table E_shnum, and the section header field index e shstmdx. You can use the command "readelf-h filename" to view the contents of the file header.

The data structure of the file header is as follows:

typedef struct elf32_hdr{

unsigned char e_ident[ei_nident];

Elf32_half e_type;//target file type

Elf32_half e_machine;//Hardware Platform

Elf32_word e_version;//elf Head Version

ELF32_ADDR e_entry;//Program Entry point

Elf32_off e_phoff;//Program Header table offset

Elf32_off e_shoff;//section Header table offset

Elf32_word e_flags;/Processor Specific flags

Elf32_half e_ehsize;//elf Head length

Elf32_half the length of an entry in the E_PHENTSIZE;//Program Header table

Number of Elf32_half e_phnum;//Header table Entries

Elf32_half the length of an entry in the e_shentsize;//section Header table

Number of entries in Elf32_half e_shnum;//section Header table

Elf32_half e_shstrmdx;//node Header table character index

}ELF32_EHDR;

2.4 Procedure Header table (Program headers table)

The Program Header table tells the system how to create a process image. It looks at the elf file from the point of view of load execution. From its point of view. The elf files are divided into sections, and the code, link information, and comments in the elf file are stored as paragraphs. Each segment has a table item description in the Program Header table that contains the following properties: The type of segment, the offset of the segment's location relative to the beginning of the file, the first byte address in memory, the physical address of the segment, and the number of bytes in the file image of the segment. The number of bytes in the memory image of the segment, and the alignment mark of the segment in memory and in the file. Use "Readelf-l filename" to view the contents of the program's Header table. The structure of the Program Header table is as follows:

typedef struct elf32_phdr{

Elf32_word P_type; Type of segment

Elf32_off P_offset; The offset of the position of the segment relative to the beginning of the file

Elf32_addr p_vaddr; The first byte address of a segment in memory

Physical Address of Elf32_addr p_paddr;//segment

Number of bytes in the file image of the Elf32_word p_filesz;//segment

Number of bytes in the memory image of the Elf32_word p_memsz;//segment