首页 > 其他 > 详细

ELF解析(part one)

时间:2014-06-01 07:13:37      阅读:504      评论:0      收藏:0      [点我收藏+]

 

 

 

the contents

class elf {
	//date structure
	Elf32_Ehdr	ehdr;
	Elf32_Shdr	shdr;
	Elf32_Phdr	phdr;
	
	//
	void elf( void);
	void ~elf( void);

	void ehdr(void);
	void shdr(void);
	void phdr(void);
	void StringTable(void);
	void SymbolTable(void);
	void Relocation(void);
};


void elf::elf( void)

void elf::elf( void)
{

/**
*	Recently, I read some data about elf ,executable and link format. There are some experiences I hope
*	to share,  record it.And I know work behind closed doors is never a good way, So welcome to your 
*	advice at anytime,both in technique and in ENGLISH.
*	the references is as following:
*		ELF_format.pdf
*		......
*	actually ,read those articles is a better choice than this text.
*	In this article I will not introduce some concepts in detail, but introduce some examples
*	that help me understand its operating principles.
*/
}


void elf::ehdr(void)

void elf::ehdr(void)
{
//what is elf header?
/**
*	Any elf file have a elf header, that represent information about how to analyzing this file.
*	it structure is 
*/
         typedef struct elf32_hdr {
                  unsigned char e_ident[EI_NIDENT];	/* magic + "ELF"*/
                  Elf32_Half e_type;				/* */
                  Elf32_Half e_machine;			/* */
                  Elf32_Word e_version;			/* */
                  Elf32_Addr e_entry; 	/* Entry point of the program.For relocatable object file, it is zero*/
                  Elf32_Off e_phoff;		/* program header tables' offset from the begin of the file to the first byte of this table*/
                  Elf32_Off e_shoff;		/* section header tables' offset from the begin of the file to this table*/
                  Elf32_Word e_flags; 	/* */
                  Elf32_Half e_ehsize;	/* size of the ELF head*/
                  Elf32_Half e_phentsize; /* size of a entry of program header*/
                  Elf32_Half e_phnum; /* number of program header*/
                  Elf32_Half e_shentsize; /* size of the section header entry*/
                  Elf32_Half e_shnum; /* number of section header*/
                  Elf32_Half e_shstrndx;	/* help section header table to find it's section header strings table, */
        } Elf32_Ehdr;
/*
*	now , To help our analysis, we need to create a simply example.
*/
#include <stdio.h>
int main()
{
	printf("aaaaa\n");
	return 0;
}
/*
*	compile it,and check it
*/
[root@localhost blog]# gcc main.c -o main
[root@localhost blog]# readelf -h main
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2 s complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x80482b0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          1912 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         7
  Size of section headers:           40 (bytes)
  Number of section headers:         28
  Section header string table index: 25

/*
*	those informations are all from the structure above.see some interesting part:
*
*	"Type:                    EXEC (Executable file)"
*    --it tell us this file is a excutable file.Actually, elf file include three types :
*		EXEC, DYN( shared object file), and REL(relocatable file).
*
*	"Entry point address:      0x80482b0"
*	--Entry point, gives the virtual address to which the system first transfers control, thus
*		starting the process.
*	
*	"Size of this header:               52 (bytes)"
*	--gives the size of this elf header.
*	
*	"Section header string table index: 25 "
*	--this is a funy member.It tell us 25th section is a string table which contain of the section headers' name.
*
*/

}


void elf::shdr(void)

void elf::shdr(void)
{
//what is section header table?
/*
*	A elf file is consist of many container, called section. In another word, The section is meaning for a container.
*	It maybe contain text, data and whatever it needed. when necessary, we will use those to
*	building our process demo, just as build a house with some bricks. 
*	first at all, let me see it structure
*/
typedef struct {
	  Elf32_Word	sh_name;	/* the section's name, a index into the section header string table section. just "shstrtab"*/
	  Elf32_Word	sh_type;
	  Elf32_Word	sh_flags;		/* attributes,*/
	  Elf32_Addr	sh_addr;		/* address of process's memory image*/
	  Elf32_Off sh_offset;	/* section's offset in this program file. section postion by bytes*/
	  Elf32_Word	sh_size;		/* size of a section*/
	  Elf32_Word	sh_link;		/* a index into a section header table section,interpretation depends on the section type. Actually it index into the associated section*/
	  Elf32_Word	sh_info;		/* interpretation depends on the section type*/
	  Elf32_Word	sh_addralign;	/* some section have address alignment constraint */
	  Elf32_Word	sh_entsize; /* some setction be divided to a smaller entry*/
} Elf32_Shdr;
/*
*	just as we did above, see this
*/
[root@localhost blog]# readelf main -S
There are 28 section headers, starting at offset 0x778:

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        08048114 000114 000013 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            08048128 000128 000020 00   A  0   0  4
  [ 3] .gnu.hash         GNU_HASH        08048148 000148 000020 04   A  4   0  4
  [ 4] .dynsym           DYNSYM          08048168 000168 000050 10   A  5   1  4
  [ 5] .dynstr           STRTAB          080481b8 0001b8 00004a 00   A  0   0  1
  [ 6] .gnu.version      VERSYM          08048202 000202 00000a 02   A  4   0  2
  [ 7] .gnu.version_r    VERNEED         0804820c 00020c 000020 00   A  5   1  4
  [ 8] .rel.dyn          REL             0804822c 00022c 000008 08   A  4   0  4
  [ 9] .rel.plt          REL             08048234 000234 000018 08   A  4  11  4
  [10] .init             PROGBITS        0804824c 00024c 000017 00  AX  0   0  4
  [11] .plt              PROGBITS        08048264 000264 000040 04  AX  0   0  4
  [12] .text             PROGBITS        080482b0 0002b0 0001a8 00  AX  0   0 16
  [13] .fini             PROGBITS        08048458 000458 00001c 00  AX  0   0  4
  [14] .rodata           PROGBITS        08048474 000474 000012 00   A  0   0  4
  [15] .eh_frame         PROGBITS        08048488 000488 000004 00   A  0   0  4
  [16] .ctors            PROGBITS        0804948c 00048c 000008 00  WA  0   0  4
  [17] .dtors            PROGBITS        08049494 000494 000008 00  WA  0   0  4
  [18] .jcr              PROGBITS        0804949c 00049c 000004 00  WA  0   0  4
  [19] .dynamic          DYNAMIC         080494a0 0004a0 0000c8 08  WA  5   0  4
  [20] .got              PROGBITS        08049568 000568 000004 04  WA  0   0  4
  [21] .got.plt          PROGBITS        0804956c 00056c 000018 04  WA  0   0  4
  [22] .data             PROGBITS        08049584 000584 000004 00  WA  0   0  4
  [23] .bss              NOBITS          08049588 000588 000008 00  WA  0   0  4
  [24] .comment          PROGBITS        00000000 000588 000114 00      0   0  1
  [25] .shstrtab         STRTAB          00000000 00069c 0000db 00      0   0  1
  [26] .symtab           SYMTAB          00000000 000bd8 000440 10     27  48  4
  [27] .strtab           STRTAB          00000000 001018 000258 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings)
  I (info), L (link order), G (group), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

/*
*	there are 28 bricks.See some interesting parts:
*	"[ 0]                   NULL            00000000 000000 000000 00      0   0  0"
*	--this is to section table, just like NULL is to pointer. we use this as a 
*		NULL section to check invalid index of section table.
*	"[ 1] .interp		   PROGBITS 	   08048114 000114 000013 00   A  0   0  1"
*	--tell system where to find this file's loader, which help to link shared library 
*		into process demo. It is normally necessary to those files that use shared 
*		library.
*
*	"
*	[ 4] .dynsym		   DYNSYM		   08048168 000168 000050 10   A  5   1  4
*	[ 5] .dynstr		   STRTAB		   080481b8 0001b8 00004a 00   A  0   0  1
*	[ 8] .rel.dyn		   REL			   0804822c 00022c 000008 08   A  4   0  4
*	[ 9] .rel.plt		   REL			   08048234 000234 000018 08   A  4  11  4
*	[11] .plt			   PROGBITS 	   08048264 000264 000040 04  AX  0   0  4
*	[20] .got			   PROGBITS 	   08049568 000568 000004 04  WA  0   0  4
*	[21] .got.plt		   PROGBITS 	   0804956c 00056c 000018 04  WA  0   0  4
*	"
*	--about dynamic link, they will tell a very funny story. if possible, I will try to 
*		explain it in next part.
*	"[12] .text			   PROGBITS 	   080482b0 0002b0 0001a8 00  AX  0   0 16"
*	--your program, (instruction).
*
*	"[23] .bss              NOBITS          08049588 000588 000008 00  WA  0   0  4"
*	--this section holds uninitialized data, and occupies no file space.
*
*	"[24] .comment          PROGBITS        00000000 000588 000114 00      0   0  1"
*	--this section holds version control information.see this
*/
[root@localhost blog]# hexdump main -C  -s 0x588  -n 276
00000588  00 47 43 43 3a 20 28 47  4e 55 29 20 34 2e 31 2e  |.GCC: (GNU) 4.1.|
00000598  32 20 32 30 30 38 30 37  30 34 20 28 52 65 64 20  |2 20080704 (Red |
000005a8  48 61 74 20 34 2e 31 2e  32 2d 34 34 29 00 00 47  |Hat 4.1.2-44)..G|
000005b8  43 43 3a 20 28 47 4e 55  29 20 34 2e 31 2e 32 20  |CC: (GNU) 4.1.2 |
000005c8  32 30 30 38 30 37 30 34  20 28 52 65 64 20 48 61  |20080704 (Red Ha|
000005d8  74 20 34 2e 31 2e 32 2d  34 34 29 00 00 47 43 43  |t 4.1.2-44)..GCC|
000005e8  3a 20 28 47 4e 55 29 20  34 2e 31 2e 32 20 32 30  |: (GNU) 4.1.2 20|
000005f8  30 38 30 37 30 34 20 28  52 65 64 20 48 61 74 20  |080704 (Red Hat |
00000608  34 2e 31 2e 32 2d 34 34  29 00 00 47 43 43 3a 20  |4.1.2-44)..GCC: |
00000618  28 47 4e 55 29 20 34 2e  31 2e 32 20 32 30 30 38  |(GNU) 4.1.2 2008|
00000628  30 37 30 34 20 28 52 65  64 20 48 61 74 20 34 2e  |0704 (Red Hat 4.|
00000638  31 2e 32 2d 34 34 29 00  00 47 43 43 3a 20 28 47  |1.2-44)..GCC: (G|
00000648  4e 55 29 20 34 2e 31 2e  32 20 32 30 30 38 30 37  |NU) 4.1.2 200807|
00000658  30 34 20 28 52 65 64 20  48 61 74 20 34 2e 31 2e  |04 (Red Hat 4.1.|
00000668  32 2d 34 34 29 00 00 47  43 43 3a 20 28 47 4e 55  |2-44)..GCC: (GNU|
00000678  29 20 34 2e 31 2e 32 20  32 30 30 38 30 37 30 34  |) 4.1.2 20080704|
00000688  20 28 52 65 64 20 48 61  74 20 34 2e 31 2e 32 2d  | (Red Hat 4.1.2-|
00000698  34 34 29 00                                       |44).|

/*	
*
*	" [25] .shstrtab         STRTAB          00000000 00069c 0000db 00      0   0  1"
*	--a string table for section header. 
*/
[root@localhost blog]# hexdump main -C  -s 0x69c  -n 219
0000069c  00 2e 73 79 6d 74 61 62  00 2e 73 74 72 74 61 62  |..symtab..strtab|
000006ac  00 2e 73 68 73 74 72 74  61 62 00 2e 69 6e 74 65  |..shstrtab..inte|
000006bc  72 70 00 2e 6e 6f 74 65  2e 41 42 49 2d 74 61 67  |rp..note.ABI-tag|
000006cc  00 2e 67 6e 75 2e 68 61  73 68 00 2e 64 79 6e 73  |..gnu.hash..dyns|
000006dc  79 6d 00 2e 64 79 6e 73  74 72 00 2e 67 6e 75 2e  |ym..dynstr..gnu.|
000006ec  76 65 72 73 69 6f 6e 00  2e 67 6e 75 2e 76 65 72  |version..gnu.ver|
000006fc  73 69 6f 6e 5f 72 00 2e  72 65 6c 2e 64 79 6e 00  |sion_r..rel.dyn.|
0000070c  2e 72 65 6c 2e 70 6c 74  00 2e 69 6e 69 74 00 2e  |.rel.plt..init..|
0000071c  74 65 78 74 00 2e 66 69  6e 69 00 2e 72 6f 64 61  |text..fini..roda|
0000072c  74 61 00 2e 65 68 5f 66  72 61 6d 65 00 2e 63 74  |ta..eh_frame..ct|
0000073c  6f 72 73 00 2e 64 74 6f  72 73 00 2e 6a 63 72 00  |ors..dtors..jcr.|
0000074c  2e 64 79 6e 61 6d 69 63  00 2e 67 6f 74 00 2e 67  |.dynamic..got..g|
0000075c  6f 74 2e 70 6c 74 00 2e  64 61 74 61 00 2e 62 73  |ot.plt..data..bs|
0000076c  73 00 2e 63 6f 6d 6d 65  6e 74 00                 |s..comment.|
00000777

/*
*	"[27] .strtab           STRTAB          00000000 001018 000258 00      0   0  1"
*	--a string table for other string.
*	--may be see this will useful. From our 
*/
[root@localhost blog]# hexdump main -C  -s 0x1018  -n 600
00001018  00 63 61 6c 6c 5f 67 6d  6f 6e 5f 73 74 61 72 74  |.call_gmon_start|
00001028  00 63 72 74 73 74 75 66  66 2e 63 00 5f 5f 43 54  |.crtstuff.c.__CT|
00001038  4f 52 5f 4c 49 53 54 5f  5f 00 5f 5f 44 54 4f 52  |OR_LIST__.__DTOR|
00001048  5f 4c 49 53 54 5f 5f 00  5f 5f 4a 43 52 5f 4c 49  |_LIST__.__JCR_LI|
00001058  53 54 5f 5f 00 64 74 6f  72 5f 69 64 78 2e 35 37  |ST__.dtor_idx.57|
00001068  39 30 00 63 6f 6d 70 6c  65 74 65 64 2e 35 37 38  |90.completed.578|
00001078  38 00 5f 5f 64 6f 5f 67  6c 6f 62 61 6c 5f 64 74  |8.__do_global_dt|
00001088  6f 72 73 5f 61 75 78 00  66 72 61 6d 65 5f 64 75  |ors_aux.frame_du|
00001098  6d 6d 79 00 5f 5f 43 54  4f 52 5f 45 4e 44 5f 5f  |mmy.__CTOR_END__|
000010a8  00 5f 5f 46 52 41 4d 45  5f 45 4e 44 5f 5f 00 5f  |.__FRAME_END__._|
000010b8  5f 4a 43 52 5f 45 4e 44  5f 5f 00 5f 5f 64 6f 5f  |_JCR_END__.__do_|
000010c8  67 6c 6f 62 61 6c 5f 63  74 6f 72 73 5f 61 75 78  |global_ctors_aux|
000010d8  00 6d 61 69 6e 2e 63 00  5f 5f 70 72 65 69 6e 69  |.main.c.__preini|
000010e8  74 5f 61 72 72 61 79 5f  73 74 61 72 74 00 5f 5f  |t_array_start.__|
000010f8  66 69 6e 69 5f 61 72 72  61 79 5f 65 6e 64 00 5f  |fini_array_end._|
00001108  47 4c 4f 42 41 4c 5f 4f  46 46 53 45 54 5f 54 41  |GLOBAL_OFFSET_TA|
00001118  42 4c 45 5f 00 5f 5f 70  72 65 69 6e 69 74 5f 61  |BLE_.__preinit_a|
00001128  72 72 61 79 5f 65 6e 64  00 5f 5f 66 69 6e 69 5f  |rray_end.__fini_|
00001138  61 72 72 61 79 5f 73 74  61 72 74 00 5f 5f 69 6e  |array_start.__in|
00001148  69 74 5f 61 72 72 61 79  5f 65 6e 64 00 5f 5f 69  |it_array_end.__i|
00001158  6e 69 74 5f 61 72 72 61  79 5f 73 74 61 72 74 00  |nit_array_start.|
00001168  5f 44 59 4e 41 4d 49 43  00 64 61 74 61 5f 73 74  |_DYNAMIC.data_st|
00001178  61 72 74 00 5f 5f 6c 69  62 63 5f 63 73 75 5f 66  |art.__libc_csu_f|
00001188  69 6e 69 00 5f 73 74 61  72 74 00 5f 5f 67 6d 6f  |ini._start.__gmo|
00001198  6e 5f 73 74 61 72 74 5f  5f 00 5f 4a 76 5f 52 65  |n_start__._Jv_Re|
000011a8  67 69 73 74 65 72 43 6c  61 73 73 65 73 00 5f 66  |gisterClasses._f|
000011b8  70 5f 68 77 00 5f 66 69  6e 69 00 5f 5f 6c 69 62  |p_hw._fini.__lib|
000011c8  63 5f 73 74 61 72 74 5f  6d 61 69 6e 40 40 47 4c  |c_start_main@@GL|
000011d8  49 42 43 5f 32 2e 30 00  5f 49 4f 5f 73 74 64 69  |IBC_2.0._IO_stdi|
000011e8  6e 5f 75 73 65 64 00 5f  5f 64 61 74 61 5f 73 74  |n_used.__data_st|
000011f8  61 72 74 00 5f 5f 64 73  6f 5f 68 61 6e 64 6c 65  |art.__dso_handle|
00001208  00 5f 5f 44 54 4f 52 5f  45 4e 44 5f 5f 00 5f 5f  |.__DTOR_END__.__|
00001218  6c 69 62 63 5f 63 73 75  5f 69 6e 69 74 00 5f 5f  |libc_csu_init.__|
00001228  62 73 73 5f 73 74 61 72  74 00 5f 65 6e 64 00 70  |bss_start._end.p|
00001238  75 74 73 40 40 47 4c 49  42 43 5f 32 2e 30 00 5f  |uts@@GLIBC_2.0._|
00001248  65 64 61 74 61 00 5f 5f  69 36 38 36 2e 67 65 74  |edata.__i686.get|
00001258  5f 70 63 5f 74 68 75 6e  6b 2e 62 78 00 6d 61 69  |_pc_thunk.bx.mai|
00001268  6e 00 5f 69 6e 69 74 00                           |n._init.|

/*
*
*	"[26] .symtab           SYMTAB          00000000 000bd8 000440 10     27  48  4"
*	--full name is symbol table, it is just like a identity card for elf file's object.
*/
}


void elf::phdr(void)

void elf::phdr(void)
{
//next part
}


void elf::StringTable(void)

void elf::StringTable(void)
{
//what is a string table? How come we need it?
/*
*	normally, if we want to create a identity card for a people, we maybe need to restore some attributes
*	about it. For examples: name, sex, age, and the like. To sex and age, it is easy to assess it's size and 
*	allocate some space. But for name, we are in trouble, because we couldn't know it's size.
*/
/*
*	Let me see a trick for deal this problem. if there are three object to store.
*		1:  zhang Mr.  , man, 24
*		2:  Li Mrs. , woman, 30
*		3:  Dr. loooooooooooooooooong, man, 35
*	you may be create a struct like this
*/
	struct IDCard{
		char name[ the_longest_name];
		int	sex;
		int	age;
	};
/*
*	That's awful, we will waste many memory space.
*	Ok, the second way, you create the following struct:
*/
	struct IDCard {
		char *name_index;
		int sex;
		int age;
	};
	struct String {
		char[ len1+ len2 + len3]; //all strings are stored  in this.
	};
/*
*	this is a funny way. That's the reason why we need a section called by StringTable.
*/
}


void elf::SymbolTable(void)

void elf::SymbolTable(void)
{
//What is symbol Table ?How come we need it?
/*
*	Image this, there are many functions in a program and they call each other.
*	some of them have been used by other function, some of them are waiting 
*	for use( for example: relocatable file, dynamic link file),How can we describe it?
*/

/*
*	struct, struct is good for this.we could define object to record its's information.
*	Actually , the symbol table is more useful. It not only working for describe some functions,
*	but also other object. The follow is its struct:
*/
typedef struct elf32_sym{
	  Elf32_Word	st_name;		/* a index into string table*/
	  Elf32_Addr	st_value;		/* point the position of this symbol's define*/
	  Elf32_Word	st_size;		
	  unsigned char st_info;		/* bind(global/local) and type( function, file, ....),*/
	  unsigned char st_other;		/* reserved*/
	  Elf32_Half	st_shndx;	/* */
} Elf32_Sym;

/*
*	see a examples:
*/
[root@localhost blog]# readelf -s main

Symbol table '.dynsym' contains 5 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
     2: 00000000   415 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)
     3: 00000000   399 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.0 (2)
     4: 08048478     4 OBJECT  GLOBAL DEFAULT   14 _IO_stdin_used

Symbol table '.symtab' contains 68 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 08048114     0 SECTION LOCAL  DEFAULT    1 
     2: 08048128     0 SECTION LOCAL  DEFAULT    2 
     3: 08048148     0 SECTION LOCAL  DEFAULT    3 
     4: 08048168     0 SECTION LOCAL  DEFAULT    4 
     5: 080481b8     0 SECTION LOCAL  DEFAULT    5 
     6: 08048202     0 SECTION LOCAL  DEFAULT    6 
     7: 0804820c     0 SECTION LOCAL  DEFAULT    7 
     8: 0804822c     0 SECTION LOCAL  DEFAULT    8 
     9: 08048234     0 SECTION LOCAL  DEFAULT    9 
    10: 0804824c     0 SECTION LOCAL  DEFAULT   10 
    11: 08048264     0 SECTION LOCAL  DEFAULT   11 
    12: 080482b0     0 SECTION LOCAL  DEFAULT   12 
    13: 08048458     0 SECTION LOCAL  DEFAULT   13 
    14: 08048474     0 SECTION LOCAL  DEFAULT   14 
    15: 08048488     0 SECTION LOCAL  DEFAULT   15 
    16: 0804948c     0 SECTION LOCAL  DEFAULT   16 
    17: 08049494     0 SECTION LOCAL  DEFAULT   17 
    18: 0804949c     0 SECTION LOCAL  DEFAULT   18 
    19: 080494a0     0 SECTION LOCAL  DEFAULT   19 
    20: 08049568     0 SECTION LOCAL  DEFAULT   20 
    21: 0804956c     0 SECTION LOCAL  DEFAULT   21 
    22: 08049584     0 SECTION LOCAL  DEFAULT   22 
    23: 08049588     0 SECTION LOCAL  DEFAULT   23 
    24: 00000000     0 SECTION LOCAL  DEFAULT   24 
    25: 080482d4     0 FUNC    LOCAL  DEFAULT   12 call_gmon_start
    26: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    27: 0804948c     0 OBJECT  LOCAL  DEFAULT   16 __CTOR_LIST__
    28: 08049494     0 OBJECT  LOCAL  DEFAULT   17 __DTOR_LIST__
    29: 0804949c     0 OBJECT  LOCAL  DEFAULT   18 __JCR_LIST__
    30: 08049588     4 OBJECT  LOCAL  DEFAULT   23 dtor_idx.5790
    31: 0804958c     1 OBJECT  LOCAL  DEFAULT   23 completed.5788
    32: 08048300     0 FUNC    LOCAL  DEFAULT   12 __do_global_dtors_aux
    33: 08048360     0 FUNC    LOCAL  DEFAULT   12 frame_dummy
    34: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    35: 08049490     0 OBJECT  LOCAL  DEFAULT   16 __CTOR_END__
    36: 08048488     0 OBJECT  LOCAL  DEFAULT   15 __FRAME_END__
    37: 0804949c     0 OBJECT  LOCAL  DEFAULT   18 __JCR_END__
    38: 08048430     0 FUNC    LOCAL  DEFAULT   12 __do_global_ctors_aux
    39: 00000000     0 FILE    LOCAL  DEFAULT  ABS main.c
    40: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __preinit_array_start
    41: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __fini_array_end
    42: 0804956c     0 OBJECT  LOCAL  HIDDEN   21 _GLOBAL_OFFSET_TABLE_
    43: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __preinit_array_end
    44: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __fini_array_start
    45: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __init_array_end
    46: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __init_array_start
    47: 080494a0     0 OBJECT  LOCAL  HIDDEN   19 _DYNAMIC
    48: 08049584     0 NOTYPE  WEAK   DEFAULT   22 data_start
    49: 080483b0     5 FUNC    GLOBAL DEFAULT   12 __libc_csu_fini
    50: 080482b0     0 FUNC    GLOBAL DEFAULT   12 _start
    51: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    52: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
    53: 08048474     4 OBJECT  GLOBAL DEFAULT   14 _fp_hw
    54: 08048458     0 FUNC    GLOBAL DEFAULT   13 _fini
    55: 00000000   415 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
    56: 08048478     4 OBJECT  GLOBAL DEFAULT   14 _IO_stdin_used
    57: 08049584     0 NOTYPE  GLOBAL DEFAULT   22 __data_start
    58: 0804847c     0 OBJECT  GLOBAL HIDDEN   14 __dso_handle
    59: 08049498     0 OBJECT  GLOBAL HIDDEN   17 __DTOR_END__
    60: 080483c0   105 FUNC    GLOBAL DEFAULT   12 __libc_csu_init
    61: 08049588     0 NOTYPE  GLOBAL DEFAULT  ABS __bss_start
    62: 08049590     0 NOTYPE  GLOBAL DEFAULT  ABS _end
    63: 00000000   399 FUNC    GLOBAL DEFAULT  UND puts@@GLIBC_2.0
    64: 08049588     0 NOTYPE  GLOBAL DEFAULT  ABS _edata
    65: 08048429     0 FUNC    GLOBAL HIDDEN   12 __i686.get_pc_thunk.bx
    66: 08048384    43 FUNC    GLOBAL DEFAULT   12 main
    67: 0804824c     0 FUNC    GLOBAL DEFAULT   10 _init

}

 

void elf::Relocation(void)

void elf::Relocation(void)
{
//next part
}

 

ELF解析(part one),布布扣,bubuko.com

ELF解析(part one)

原文:http://blog.csdn.net/u012301943/article/details/27379175

(0)
(0)
   
举报
评论 一句话评论(0
关于我们 - 联系我们 - 留言反馈 - 联系我们:wmxa8@hotmail.com
© 2014 bubuko.com 版权所有
打开技术之扣,分享程序人生!