首页 > 代码库 > ELF解析(part one)

ELF解析(part one)

 

the contents

class elf {
	//date structure
	Elf32_Ehdr	ehdr;
	Elf32_Shdr	shdr;
	Elf32_Phdr	phdr;
	
	//
	void elf( void);
	void ~elf( void);

	void ehdr(void);
	void shdr(void);
	void phdr(void);
	void StringTable(void);
	void SymbolTable(void);
	void Relocation(void);
};


void elf::elf( void)

void elf::elf( void)
{

/**
*	Recently, I read some data about elf ,executable and link format. There are some experiences I hope
*	to share,  record it.And I know work behind closed doors is never a good way, So welcome to your 
*	advice at anytime,both in technique and in ENGLISH.
*	the references is as following:
*		ELF_format.pdf
*		......
*	actually ,read those articles is a better choice than this text.
*	In this article I will not introduce some concepts in detail, but introduce some examples
*	that help me understand its operating principles.
*/
}


void elf::ehdr(void)

void elf::ehdr(void)
{
//what is elf header?
/**
*	Any elf file have a elf header, that represent information about how to analyzing this file.
*	it structure is 
*/
         typedef struct elf32_hdr {
                  unsigned char e_ident[EI_NIDENT];	/* magic + "ELF"*/
                  Elf32_Half e_type;				/* */
                  Elf32_Half e_machine;			/* */
                  Elf32_Word e_version;			/* */
                  Elf32_Addr e_entry; 	/* Entry point of the program.For relocatable object file, it is zero*/
                  Elf32_Off e_phoff;		/* program header tables‘ offset from the begin of the file to the first byte of this table*/
                  Elf32_Off e_shoff;		/* section header tables‘ offset from the begin of the file to this table*/
                  Elf32_Word e_flags; 	/* */
                  Elf32_Half e_ehsize;	/* size of the ELF head*/
                  Elf32_Half e_phentsize; /* size of a entry of program header*/
                  Elf32_Half e_phnum; /* number of program header*/
                  Elf32_Half e_shentsize; /* size of the section header entry*/
                  Elf32_Half e_shnum; /* number of section header*/
                  Elf32_Half e_shstrndx;	/* help section header table to find it‘s section header strings table, */
        } Elf32_Ehdr;
/*
*	now , To help our analysis, we need to create a simply example.
*/
#include <stdio.h>
int main()
{
	printf("aaaaa\n");
	return 0;
}
/*
*	compile it,and check it
*/
[root@localhost blog]# gcc main.c -o main
[root@localhost blog]# readelf -h main
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2 s complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x80482b0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          1912 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         7
  Size of section headers:           40 (bytes)
  Number of section headers:         28
  Section header string table index: 25

/*
*	those informations are all from the structure above.see some interesting part:
*
*	"Type:                    EXEC (Executable file)"
*    --it tell us this file is a excutable file.Actually, elf file include three types :
*		EXEC, DYN( shared object file), and REL(relocatable file).
*
*	"Entry point address:      0x80482b0"
*	--Entry point, gives the virtual address to which the system first transfers control, thus
*		starting the process.
*	
*	"Size of this header:               52 (bytes)"
*	--gives the size of this elf header.
*	
*	"Section header string table index: 25 "
*	--this is a funy member.It tell us 25th section is a string table which contain of the section headers‘ name.
*
*/

}


void elf::shdr(void)

void elf::shdr(void)
{
//what is section header table?

/* * A elf file is consist of many container, called section. In another word, The section is meaning for a container. * It maybe contain text, data and whatever it needed. when necessary, we will use those to * building our process demo, just as build a house with some bricks. * first at all, let me see it structure */ typedef struct { Elf32_Word sh_name; /* the section‘s name, a index into the section header string table section. just "shstrtab"*/ Elf32_Word sh_type; Elf32_Word sh_flags; /* attributes,*/ Elf32_Addr sh_addr; /* address of process‘s memory image*/ Elf32_Off sh_offset; /* section‘s offset in this program file. section postion by bytes*/ Elf32_Word sh_size; /* size of a section*/ Elf32_Word sh_link; /* a index into a section header table section,interpretation depends on the section type. Actually it index into the associated section*/ Elf32_Word sh_info; /* interpretation depends on the section type*/ Elf32_Word sh_addralign; /* some section have address alignment constraint */ Elf32_Word sh_entsize; /* some setction be divided to a smaller entry*/ } Elf32_Shdr; /* * just as we did above, see this */ [root@localhost blog]# readelf main -S There are 28 section headers, starting at offset 0x778: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .interp PROGBITS 08048114 000114 000013 00 A 0 0 1 [ 2] .note.ABI-tag NOTE 08048128 000128 000020 00 A 0 0 4 [ 3] .gnu.hash GNU_HASH 08048148 000148 000020 04 A 4 0 4 [ 4] .dynsym DYNSYM 08048168 000168 000050 10 A 5 1 4 [ 5] .dynstr STRTAB 080481b8 0001b8 00004a 00 A 0 0 1 [ 6] .gnu.version VERSYM 08048202 000202 00000a 02 A 4 0 2 [ 7] .gnu.version_r VERNEED 0804820c 00020c 000020 00 A 5 1 4 [ 8] .rel.dyn REL 0804822c 00022c 000008 08 A 4 0 4 [ 9] .rel.plt REL 08048234 000234 000018 08 A 4 11 4 [10] .init PROGBITS 0804824c 00024c 000017 00 AX 0 0 4 [11] .plt PROGBITS 08048264 000264 000040 04 AX 0 0 4 [12] .text PROGBITS 080482b0 0002b0 0001a8 00 AX 0 0 16 [13] .fini PROGBITS 08048458 000458 00001c 00 AX 0 0 4 [14] .rodata PROGBITS 08048474 000474 000012 00 A 0 0 4 [15] .eh_frame PROGBITS 08048488 000488 000004 00 A 0 0 4 [16] .ctors PROGBITS 0804948c 00048c 000008 00 WA 0 0 4 [17] .dtors PROGBITS 08049494 000494 000008 00 WA 0 0 4 [18] .jcr PROGBITS 0804949c 00049c 000004 00 WA 0 0 4 [19] .dynamic DYNAMIC 080494a0 0004a0 0000c8 08 WA 5 0 4 [20] .got PROGBITS 08049568 000568 000004 04 WA 0 0 4 [21] .got.plt PROGBITS 0804956c 00056c 000018 04 WA 0 0 4 [22] .data PROGBITS 08049584 000584 000004 00 WA 0 0 4 [23] .bss NOBITS 08049588 000588 000008 00 WA 0 0 4 [24] .comment PROGBITS 00000000 000588 000114 00 0 0 1 [25] .shstrtab STRTAB 00000000 00069c 0000db 00 0 0 1 [26] .symtab SYMTAB 00000000 000bd8 000440 10 27 48 4 [27] .strtab STRTAB 00000000 001018 000258 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) /* * there are 28 bricks.See some interesting parts: * "[ 0] NULL 00000000 000000 000000 00 0 0 0" * --this is to section table, just like NULL is to pointer. we use this as a * NULL section to check invalid index of section table. * "[ 1] .interp PROGBITS 08048114 000114 000013 00 A 0 0 1" * --tell system where to find this file‘s loader, which help to link shared library * into process demo. It is normally necessary to those files that use shared * library. * * " * [ 4] .dynsym DYNSYM 08048168 000168 000050 10 A 5 1 4 * [ 5] .dynstr STRTAB 080481b8 0001b8 00004a 00 A 0 0 1 * [ 8] .rel.dyn REL 0804822c 00022c 000008 08 A 4 0 4 * [ 9] .rel.plt REL 08048234 000234 000018 08 A 4 11 4 * [11] .plt PROGBITS 08048264 000264 000040 04 AX 0 0 4 * [20] .got PROGBITS 08049568 000568 000004 04 WA 0 0 4 * [21] .got.plt PROGBITS 0804956c 00056c 000018 04 WA 0 0 4 * " * --about dynamic link, they will tell a very funny story. if possible, I will try to * explain it in next part. * "[12] .text PROGBITS 080482b0 0002b0 0001a8 00 AX 0 0 16" * --your program, (instruction). * * "[23] .bss NOBITS 08049588 000588 000008 00 WA 0 0 4" * --this section holds uninitialized data, and occupies no file space. * * "[24] .comment PROGBITS 00000000 000588 000114 00 0 0 1" * --this section holds version control information.see this */ [root@localhost blog]# hexdump main -C -s 0x588 -n 276 00000588 00 47 43 43 3a 20 28 47 4e 55 29 20 34 2e 31 2e |.GCC: (GNU) 4.1.| 00000598 32 20 32 30 30 38 30 37 30 34 20 28 52 65 64 20 |2 20080704 (Red | 000005a8 48 61 74 20 34 2e 31 2e 32 2d 34 34 29 00 00 47 |Hat 4.1.2-44)..G| 000005b8 43 43 3a 20 28 47 4e 55 29 20 34 2e 31 2e 32 20 |CC: (GNU) 4.1.2 | 000005c8 32 30 30 38 30 37 30 34 20 28 52 65 64 20 48 61 |20080704 (Red Ha| 000005d8 74 20 34 2e 31 2e 32 2d 34 34 29 00 00 47 43 43 |t 4.1.2-44)..GCC| 000005e8 3a 20 28 47 4e 55 29 20 34 2e 31 2e 32 20 32 30 |: (GNU) 4.1.2 20| 000005f8 30 38 30 37 30 34 20 28 52 65 64 20 48 61 74 20 |080704 (Red Hat | 00000608 34 2e 31 2e 32 2d 34 34 29 00 00 47 43 43 3a 20 |4.1.2-44)..GCC: | 00000618 28 47 4e 55 29 20 34 2e 31 2e 32 20 32 30 30 38 |(GNU) 4.1.2 2008| 00000628 30 37 30 34 20 28 52 65 64 20 48 61 74 20 34 2e |0704 (Red Hat 4.| 00000638 31 2e 32 2d 34 34 29 00 00 47 43 43 3a 20 28 47 |1.2-44)..GCC: (G| 00000648 4e 55 29 20 34 2e 31 2e 32 20 32 30 30 38 30 37 |NU) 4.1.2 200807| 00000658 30 34 20 28 52 65 64 20 48 61 74 20 34 2e 31 2e |04 (Red Hat 4.1.| 00000668 32 2d 34 34 29 00 00 47 43 43 3a 20 28 47 4e 55 |2-44)..GCC: (GNU| 00000678 29 20 34 2e 31 2e 32 20 32 30 30 38 30 37 30 34 |) 4.1.2 20080704| 00000688 20 28 52 65 64 20 48 61 74 20 34 2e 31 2e 32 2d | (Red Hat 4.1.2-| 00000698 34 34 29 00 |44).| /* * * " [25] .shstrtab STRTAB 00000000 00069c 0000db 00 0 0 1" * --a string table for section header. */ [root@localhost blog]# hexdump main -C -s 0x69c -n 219 0000069c 00 2e 73 79 6d 74 61 62 00 2e 73 74 72 74 61 62 |..symtab..strtab| 000006ac 00 2e 73 68 73 74 72 74 61 62 00 2e 69 6e 74 65 |..shstrtab..inte| 000006bc 72 70 00 2e 6e 6f 74 65 2e 41 42 49 2d 74 61 67 |rp..note.ABI-tag| 000006cc 00 2e 67 6e 75 2e 68 61 73 68 00 2e 64 79 6e 73 |..gnu.hash..dyns| 000006dc 79 6d 00 2e 64 79 6e 73 74 72 00 2e 67 6e 75 2e |ym..dynstr..gnu.| 000006ec 76 65 72 73 69 6f 6e 00 2e 67 6e 75 2e 76 65 72 |version..gnu.ver| 000006fc 73 69 6f 6e 5f 72 00 2e 72 65 6c 2e 64 79 6e 00 |sion_r..rel.dyn.| 0000070c 2e 72 65 6c 2e 70 6c 74 00 2e 69 6e 69 74 00 2e |.rel.plt..init..| 0000071c 74 65 78 74 00 2e 66 69 6e 69 00 2e 72 6f 64 61 |text..fini..roda| 0000072c 74 61 00 2e 65 68 5f 66 72 61 6d 65 00 2e 63 74 |ta..eh_frame..ct| 0000073c 6f 72 73 00 2e 64 74 6f 72 73 00 2e 6a 63 72 00 |ors..dtors..jcr.| 0000074c 2e 64 79 6e 61 6d 69 63 00 2e 67 6f 74 00 2e 67 |.dynamic..got..g| 0000075c 6f 74 2e 70 6c 74 00 2e 64 61 74 61 00 2e 62 73 |ot.plt..data..bs| 0000076c 73 00 2e 63 6f 6d 6d 65 6e 74 00 |s..comment.| 00000777 /* * "[27] .strtab STRTAB 00000000 001018 000258 00 0 0 1" * --a string table for other string. * --may be see this will useful. From our */ [root@localhost blog]# hexdump main -C -s 0x1018 -n 600 00001018 00 63 61 6c 6c 5f 67 6d 6f 6e 5f 73 74 61 72 74 |.call_gmon_start| 00001028 00 63 72 74 73 74 75 66 66 2e 63 00 5f 5f 43 54 |.crtstuff.c.__CT| 00001038 4f 52 5f 4c 49 53 54 5f 5f 00 5f 5f 44 54 4f 52 |OR_LIST__.__DTOR| 00001048 5f 4c 49 53 54 5f 5f 00 5f 5f 4a 43 52 5f 4c 49 |_LIST__.__JCR_LI| 00001058 53 54 5f 5f 00 64 74 6f 72 5f 69 64 78 2e 35 37 |ST__.dtor_idx.57| 00001068 39 30 00 63 6f 6d 70 6c 65 74 65 64 2e 35 37 38 |90.completed.578| 00001078 38 00 5f 5f 64 6f 5f 67 6c 6f 62 61 6c 5f 64 74 |8.__do_global_dt| 00001088 6f 72 73 5f 61 75 78 00 66 72 61 6d 65 5f 64 75 |ors_aux.frame_du| 00001098 6d 6d 79 00 5f 5f 43 54 4f 52 5f 45 4e 44 5f 5f |mmy.__CTOR_END__| 000010a8 00 5f 5f 46 52 41 4d 45 5f 45 4e 44 5f 5f 00 5f |.__FRAME_END__._| 000010b8 5f 4a 43 52 5f 45 4e 44 5f 5f 00 5f 5f 64 6f 5f |_JCR_END__.__do_| 000010c8 67 6c 6f 62 61 6c 5f 63 74 6f 72 73 5f 61 75 78 |global_ctors_aux| 000010d8 00 6d 61 69 6e 2e 63 00 5f 5f 70 72 65 69 6e 69 |.main.c.__preini| 000010e8 74 5f 61 72 72 61 79 5f 73 74 61 72 74 00 5f 5f |t_array_start.__| 000010f8 66 69 6e 69 5f 61 72 72 61 79 5f 65 6e 64 00 5f |fini_array_end._| 00001108 47 4c 4f 42 41 4c 5f 4f 46 46 53 45 54 5f 54 41 |GLOBAL_OFFSET_TA| 00001118 42 4c 45 5f 00 5f 5f 70 72 65 69 6e 69 74 5f 61 |BLE_.__preinit_a| 00001128 72 72 61 79 5f 65 6e 64 00 5f 5f 66 69 6e 69 5f |rray_end.__fini_| 00001138 61 72 72 61 79 5f 73 74 61 72 74 00 5f 5f 69 6e |array_start.__in| 00001148 69 74 5f 61 72 72 61 79 5f 65 6e 64 00 5f 5f 69 |it_array_end.__i| 00001158 6e 69 74 5f 61 72 72 61 79 5f 73 74 61 72 74 00 |nit_array_start.| 00001168 5f 44 59 4e 41 4d 49 43 00 64 61 74 61 5f 73 74 |_DYNAMIC.data_st| 00001178 61 72 74 00 5f 5f 6c 69 62 63 5f 63 73 75 5f 66 |art.__libc_csu_f| 00001188 69 6e 69 00 5f 73 74 61 72 74 00 5f 5f 67 6d 6f |ini._start.__gmo| 00001198 6e 5f 73 74 61 72 74 5f 5f 00 5f 4a 76 5f 52 65 |n_start__._Jv_Re| 000011a8 67 69 73 74 65 72 43 6c 61 73 73 65 73 00 5f 66 |gisterClasses._f| 000011b8 70 5f 68 77 00 5f 66 69 6e 69 00 5f 5f 6c 69 62 |p_hw._fini.__lib| 000011c8 63 5f 73 74 61 72 74 5f 6d 61 69 6e 40 40 47 4c |c_start_main@@GL| 000011d8 49 42 43 5f 32 2e 30 00 5f 49 4f 5f 73 74 64 69 |IBC_2.0._IO_stdi| 000011e8 6e 5f 75 73 65 64 00 5f 5f 64 61 74 61 5f 73 74 |n_used.__data_st| 000011f8 61 72 74 00 5f 5f 64 73 6f 5f 68 61 6e 64 6c 65 |art.__dso_handle| 00001208 00 5f 5f 44 54 4f 52 5f 45 4e 44 5f 5f 00 5f 5f |.__DTOR_END__.__| 00001218 6c 69 62 63 5f 63 73 75 5f 69 6e 69 74 00 5f 5f |libc_csu_init.__| 00001228 62 73 73 5f 73 74 61 72 74 00 5f 65 6e 64 00 70 |bss_start._end.p| 00001238 75 74 73 40 40 47 4c 49 42 43 5f 32 2e 30 00 5f |uts@@GLIBC_2.0._| 00001248 65 64 61 74 61 00 5f 5f 69 36 38 36 2e 67 65 74 |edata.__i686.get| 00001258 5f 70 63 5f 74 68 75 6e 6b 2e 62 78 00 6d 61 69 |_pc_thunk.bx.mai| 00001268 6e 00 5f 69 6e 69 74 00 |n._init.| /* * * "[26] .symtab SYMTAB 00000000 000bd8 000440 10 27 48 4" * --full name is symbol table, it is just like a identity card for elf file‘s object. */ }


void elf::phdr(void)

void elf::phdr(void)
{
//next part
}


void elf::StringTable(void)

void elf::StringTable(void)
{
//what is a string table? How come we need it?

/* * normally, if we want to create a identity card for a people, we maybe need to restore some attributes * about it. For examples: name, sex, age, and the like. To sex and age, it is easy to assess it‘s size and * allocate some space. But for name, we are in trouble, because we couldn‘t know it‘s size. */ /* * Let me see a trick for deal this problem. if there are three object to store. * 1: zhang Mr. , man, 24 * 2: Li Mrs. , woman, 30 * 3: Dr. loooooooooooooooooong, man, 35 * you may be create a struct like this */ struct IDCard{ char name[ the_longest_name]; int sex; int age; }; /* * That‘s awful, we will waste many memory space. * Ok, the second way, you create the following struct: */ struct IDCard { char *name_index; int sex; int age; }; struct String { char[ len1+ len2 + len3]; //all strings are stored in this. }; /* * this is a funny way. That‘s the reason why we need a section called by StringTable. */ }


void elf::SymbolTable(void)

void elf::SymbolTable(void)
{
//What is symbol Table ?How come we need it?
/*
*	Image this, there are many functions in a program and they call each other.
*	some of them have been used by other function, some of them are waiting 
*	for use( for example: relocatable file, dynamic link file),How can we describe it?
*/

/*
*	struct, struct is good for this.we could define object to record its‘s information.
*	Actually , the symbol table is more useful. It not only working for describe some functions,
*	but also other object. The follow is its struct:
*/
typedef struct elf32_sym{
	  Elf32_Word	st_name;		/* a index into string table*/
	  Elf32_Addr	st_value;		/* point the position of this symbol‘s define*/
	  Elf32_Word	st_size;		
	  unsigned char st_info;		/* bind(global/local) and type( function, file, ....),*/
	  unsigned char st_other;		/* reserved*/
	  Elf32_Half	st_shndx;	/* */
} Elf32_Sym;

/*
*	see a examples:
*/
[root@localhost blog]# readelf -s main

Symbol table ‘.dynsym‘ contains 5 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
     2: 00000000   415 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)
     3: 00000000   399 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.0 (2)
     4: 08048478     4 OBJECT  GLOBAL DEFAULT   14 _IO_stdin_used

Symbol table ‘.symtab‘ contains 68 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 08048114     0 SECTION LOCAL  DEFAULT    1 
     2: 08048128     0 SECTION LOCAL  DEFAULT    2 
     3: 08048148     0 SECTION LOCAL  DEFAULT    3 
     4: 08048168     0 SECTION LOCAL  DEFAULT    4 
     5: 080481b8     0 SECTION LOCAL  DEFAULT    5 
     6: 08048202     0 SECTION LOCAL  DEFAULT    6 
     7: 0804820c     0 SECTION LOCAL  DEFAULT    7 
     8: 0804822c     0 SECTION LOCAL  DEFAULT    8 
     9: 08048234     0 SECTION LOCAL  DEFAULT    9 
    10: 0804824c     0 SECTION LOCAL  DEFAULT   10 
    11: 08048264     0 SECTION LOCAL  DEFAULT   11 
    12: 080482b0     0 SECTION LOCAL  DEFAULT   12 
    13: 08048458     0 SECTION LOCAL  DEFAULT   13 
    14: 08048474     0 SECTION LOCAL  DEFAULT   14 
    15: 08048488     0 SECTION LOCAL  DEFAULT   15 
    16: 0804948c     0 SECTION LOCAL  DEFAULT   16 
    17: 08049494     0 SECTION LOCAL  DEFAULT   17 
    18: 0804949c     0 SECTION LOCAL  DEFAULT   18 
    19: 080494a0     0 SECTION LOCAL  DEFAULT   19 
    20: 08049568     0 SECTION LOCAL  DEFAULT   20 
    21: 0804956c     0 SECTION LOCAL  DEFAULT   21 
    22: 08049584     0 SECTION LOCAL  DEFAULT   22 
    23: 08049588     0 SECTION LOCAL  DEFAULT   23 
    24: 00000000     0 SECTION LOCAL  DEFAULT   24 
    25: 080482d4     0 FUNC    LOCAL  DEFAULT   12 call_gmon_start
    26: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    27: 0804948c     0 OBJECT  LOCAL  DEFAULT   16 __CTOR_LIST__
    28: 08049494     0 OBJECT  LOCAL  DEFAULT   17 __DTOR_LIST__
    29: 0804949c     0 OBJECT  LOCAL  DEFAULT   18 __JCR_LIST__
    30: 08049588     4 OBJECT  LOCAL  DEFAULT   23 dtor_idx.5790
    31: 0804958c     1 OBJECT  LOCAL  DEFAULT   23 completed.5788
    32: 08048300     0 FUNC    LOCAL  DEFAULT   12 __do_global_dtors_aux
    33: 08048360     0 FUNC    LOCAL  DEFAULT   12 frame_dummy
    34: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    35: 08049490     0 OBJECT  LOCAL  DEFAULT   16 __CTOR_END__
    36: 08048488     0 OBJECT  LOCAL  DEFAULT   15 __FRAME_END__
    37: 0804949c     0 OBJECT  LOCAL  DEFAULT   18 __JCR_END__
    38: 08048430     0 FUNC    LOCAL  DEFAULT   12 __do_global_ctors_aux
    39: 00000000     0 FILE    LOCAL  DEFAULT  ABS main.c
    40: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __preinit_array_start
    41: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __fini_array_end
    42: 0804956c     0 OBJECT  LOCAL  HIDDEN   21 _GLOBAL_OFFSET_TABLE_
    43: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __preinit_array_end
    44: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __fini_array_start
    45: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __init_array_end
    46: 0804948c     0 NOTYPE  LOCAL  HIDDEN   16 __init_array_start
    47: 080494a0     0 OBJECT  LOCAL  HIDDEN   19 _DYNAMIC
    48: 08049584     0 NOTYPE  WEAK   DEFAULT   22 data_start
    49: 080483b0     5 FUNC    GLOBAL DEFAULT   12 __libc_csu_fini
    50: 080482b0     0 FUNC    GLOBAL DEFAULT   12 _start
    51: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    52: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
    53: 08048474     4 OBJECT  GLOBAL DEFAULT   14 _fp_hw
    54: 08048458     0 FUNC    GLOBAL DEFAULT   13 _fini
    55: 00000000   415 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
    56: 08048478     4 OBJECT  GLOBAL DEFAULT   14 _IO_stdin_used
    57: 08049584     0 NOTYPE  GLOBAL DEFAULT   22 __data_start
    58: 0804847c     0 OBJECT  GLOBAL HIDDEN   14 __dso_handle
    59: 08049498     0 OBJECT  GLOBAL HIDDEN   17 __DTOR_END__
    60: 080483c0   105 FUNC    GLOBAL DEFAULT   12 __libc_csu_init
    61: 08049588     0 NOTYPE  GLOBAL DEFAULT  ABS __bss_start
    62: 08049590     0 NOTYPE  GLOBAL DEFAULT  ABS _end
    63: 00000000   399 FUNC    GLOBAL DEFAULT  UND puts@@GLIBC_2.0
    64: 08049588     0 NOTYPE  GLOBAL DEFAULT  ABS _edata
    65: 08048429     0 FUNC    GLOBAL HIDDEN   12 __i686.get_pc_thunk.bx
    66: 08048384    43 FUNC    GLOBAL DEFAULT   12 main
    67: 0804824c     0 FUNC    GLOBAL DEFAULT   10 _init

}

 

void elf::Relocation(void)

void elf::Relocation(void)
{
//next part
}

 

ELF解析(part one)