Chinaunix

标题: ELF文件解析 [打印本页]

作者: wangling219 时间: 2008-12-17 13:14
标题: ELF文件解析
网上的一个文件解析：
x000~0x034 是 ELF Header; 0x034~0x054 是一项Program Headers; 0x054~0x080 是填充零字节; 0x080~0x086 是 .text 段内容; 0x086~0x098 是 .shstrtab 段内容; 0x098~0x110 是三项Section Headers; 对照 elf.h 文件分析如下：
00000000  7f 45 4c 46 01 01 01 00  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  80 80 04 08 34 00 00 00  |............4...|
00000020  98 00 00 00 00 00 00 00  34 00 20 00 01 00 28 00  |........4. ...(.|
00000030  03 00 02 00                                     |....          |
typedef struct elf32_hdr {
  unsigned char e_ident[EI_NIDENT];
  Elf32_Half e_type;
  Elf32_Half e_machine;
  Elf32_Word e_version;
  Elf32_Addr e_entry;  /* Entry point */
  Elf32_Off    e_phoff;
  Elf32_Off    e_shoff;
  Elf32_Word e_flags;
  Elf32_Half e_ehsize;
  Elf32_Half e_phentsize;
  Elf32_Half e_phnum;
  Elf32_Half e_shentsize;
  Elf32_Half e_shnum;
  Elf32_Half e_shstrndx;
} Elf32_Ehdr;
其中 ELF32_Half 是16位，其余类型 ELF32_Word, ELF32_Addr, ELF32_Off 等都是32位。宏 EI_NIDENT 定义为 16，即 ELF Header 头部有16Bytes特征字节。
00000030             01 00 00 00  00 00 00 00 00 80 04 08  | ............|
00000040  00 80 04 08 86 00 00 00  86 00 00 00 05 00 00 00  |................|
00000050  00 10 00 00                                     |....          |
typedef struct elf32_phdr{
  Elf32_Word p_type;
  Elf32_Off    p_offset;
  Elf32_Addr p_vaddr;
  Elf32_Addr p_paddr;
  Elf32_Word p_filesz;
  Elf32_Word p_memsz;
  Elf32_Word p_flags;
  Elf32_Word p_align;
} Elf32_Phdr;
00000080  0f ff 0f b9 0f 0b                               |......       |
00000080                   00 2e  73 68 73 74 72 74 61 62  |    ..shstrtab|
00000090  00 2e 74 65 78 74 00 00                         |..text..       |
00000090                         00 00 00 00 00 00 00 00  |       ........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000000c0  0b 00 00 00 01 00 00 00  06 00 00 00 80 80 04 08  |................|
000000d0  80 00 00 00 06 00 00 00  00 00 00 00 00 00 00 00  |................|
000000e0  10 00 00 00 00 00 00 00                         |........       |
000000e0                         01 00 00 00 03 00 00 00  |       ........|
000000f0  00 00 00 00 00 00 00 00  86 00 00 00 11 00 00 00  |................|
00000100  00 00 00 00 00 00 00 00  01 00 00 00 00 00 00 00  |................|
typedef struct {
  Elf32_Word sh_name;
  Elf32_Word sh_type;
  Elf32_Word sh_flags;
  Elf32_Addr sh_addr;
  Elf32_Off    sh_offset;
  Elf32_Word sh_size;
  Elf32_Word sh_link;
  Elf32_Word sh_info;
  Elf32_Word sh_addralign;
  Elf32_Word sh_entsize;
} Elf32_Shdr;

本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u1/48954/showart_1724927.html

欢迎光临 Chinaunix (http://bbs.chinaunix.net/)