ELF

ELF = Executable and Linkable Format

ELF Object Files

Relocatable file

此種 object file 是 relocatable 的， 可以和其他 relocatable files 產生出 executable binary 或 shared object file

gcc -Wall -c test.c -o test.o   # use -c to avoid linking

Shared object file

用於讓 dynamic linker 結合其他 executable object file 來讓程式可以正確執行

gcc -c -Wall -Werror -fPIC shared.c     # -fPIC for position-independent code
gcc -shared -o libshared.so shared.o

Executable file

gcc -Wall test.c -o test

ELF Header

readelf

readelf -h /bin/ls  # -f for file header

result :

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 09 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - FreeBSD
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x401dc0
  Start of program headers:          64 (bytes into file)
  Start of section headers:          31000 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         8
  Size of section headers:           64 (bytes)
  Number of section headers:         28
  Section header string table index: 27

objdump

可以印出指定 section 的內容

objdump -j .data -s /bin/ls

result:

/bin/ls:     file format elf64-x86-64-freebsd

Contents of section .data:
 607440 39634000 00000000 00000000 00000000  9c@.............
 607450 18706000 00000000 00000000 00000000  .p`.............
 607460 50000000 00000000 00000000 00000000  P...............
 607470 80746000 00000000 00000000 00000000  .t`.............
 607480 2e000000 ffffffff 02000000 ffffffff  ................
 607490 ffffffff ffffffff                    ........

ELF View

assembler 或 linker 處理過後，可以被 CPU 執行的檔案是處於 linking view 的

loader 把程式載到 memory 後，object file 會是 execution view