13. readelf elf文件格式分析¶

这个工具和objdump命令提供的功能类似，但是它显示的信息更为具体，并且它不依赖BFD库(BFD库是一个GNU项目，它的目标就是希望通过一种统一的接口来处理不同的目标文件）；

ELF文件类型
ELF(Executable and Linking Format)是一种对象文件的格式，用于定义不同类型的对象文件(Object files)中都放了什么东西、以及都以什么样的格式去放这些东西。它自最早在 System V 系统上出现后，被 xNIX 世界所广泛接受，作为缺省的二进制文件格式来使用。可以说，ELF是构成众多xNIX系统的基础之一。

ELF文件有三种类型：

    • 可重定位的对象文件(Relocatable file)由汇编器汇编生成的 .o 文件
    • 可执行的对象文件(Executable file)可执行应用程序
    • 可被共享的对象文件(Shared object file)动态库文件，也即 .so 文件
  • .text section 里装载了可执行代码；
  • .data section 里面装载了被初始化的数据；
  • .bss section 里面装载了未被初始化的数据；
  • 以 .rec 打头的 sections 里面装载了重定位条目；
  • .symtab 或者 .dynsym section 里面装载了符号信息；
  • .strtab 或者 .dynstr section 里面装载了字符串信息；

    • 13.1. 参数说明¶

    • -a –all 全部 Equivalent to: -h -l -S -s -r -d -V -A -I

    • -h –file-header 文件头 Display the ELF file header

    • -l –program-headers 程序 Display the program headers

    • –segments An alias for –program-headers

    • -S –section-headers 段头 Display the sections’ header

    • —sections
      An alias for –section-headers

    • -e –headers 全部头 Equivalent to: -h -l -S

    • -s –syms 符号表 Display the symbol table

    • —symbols
      An alias for –syms

    • -n –notes 内核注释 Display the core notes (if present)

    • -r –relocs 重定位 Display the relocations (if present)

    • -u –unwind Display the unwind info (if present)

    • -d –dynamic 动态段 Display the dynamic segment (if present)

    • -V –version-info 版本 Display the version sections (if present)

    • -A –arch-specific CPU构架 Display architecture specific information (if any).

    • -D –use-dynamic 动态段 Use the dynamic section info when displaying symbols

    • -x –hex-dump= 显示 段内内容Dump the contents of section

    • -w[liaprmfFso] or

    • -I –histogram Display histogram of bucket list lengths

    • -W –wide 宽行输出 Allow output width to exceed 80 characters

    • -H –help Display this information

    • -v –version Display the version number of readelf

    13.2. 示例¶

    想知道一个应用程序的可运行的架构平台:

    1. - readelf -h main| grep Machine

    -h选项将显示文件头的概要信息，从里面可以看到，有很多有用的信息：

    1. - readelf -h main
    2. ELF Header:
    3. Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
    4. Class:                             ELF64
    5. Data:                              2 s complement, little endian
    6. Version:                           1 (current)
    7. OS/ABI:                            UNIX - System V
    8. ABI Version:                       0
    9. Type:                              EXEC (Executable file)
    10. Machine:                           Advanced Micro Devices X86-64
    11. Version:                           0x1
    12. Entry point address:               0x400790
    13. Start of program headers:          64 (bytes into file)
    14. Start of section headers:          5224 (bytes into file)
    15. Flags:                             0x0
    16. Size of this header:               64 (bytes)
    17. Size of program headers:           56 (bytes)
    18. Number of program headers:         8
    19. Size of section headers:           64 (bytes)
    20. Number of section headers:         29
    21. Section header string table index: 26

    一个编译好的应用程序，想知道其编译时是否使用了-g选项（加入调试信息）:

    1. - readelf -S main| grep debug

    用-S选项是显示所有段信息；如果编译时使用了-g选项，则会有debug段;

    查看.o文件是否编入了调试信息（编译的时候是否加了-g):

    1. - readelf -S Shpos.o | grep debug

    13.3. 完整输出¶

    readelf输出的完整内容:

    1. - readelf -all a.out
    2. ELF Header:
    3.   Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
    4.   Class:                             ELF32
    5.   Data:                              2's complement, little endian
    6.   Version:                           1 (current)
    7.   OS/ABI:                            UNIX - System V
    8.   ABI Version:                       0
    9.   Type:                              EXEC (Executable file)
    10.   Machine:                           Intel 80386
    11.   Version:                           0x1
    12.   Entry point address:               0x8048330
    13.   Start of program headers:          52 (bytes into file)
    14.   Start of section headers:          4412 (bytes into file)
    15.   Flags:                             0x0
    16.   Size of this header:               52 (bytes)
    17.   Size of program headers:           32 (bytes)
    18.   Number of program headers:         9
    19.   Size of section headers:           40 (bytes)
    20.   Number of section headers:         30
    21.   Section header string table index: 27
    22.  
    23. Section Headers:
    24.   [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
    25.   [ 0]                   NULL            00000000 000000 000000 00      0   0  0
    26.   [ 1] .interp           PROGBITS        08048154 000154 000013 00   A  0   0  1
    27.   [ 2] .note.ABI-tag     NOTE            08048168 000168 000020 00   A  0   0  4
    28.   [ 3] .note.gnu.build-i NOTE            08048188 000188 000024 00   A  0   0  4
    29.   [ 4] .gnu.hash         GNU_HASH        080481ac 0001ac 000020 04   A  5   0  4
    30.   [ 5] .dynsym           DYNSYM          080481cc 0001cc 000050 10   A  6   1  4
    31.   [ 6] .dynstr           STRTAB          0804821c 00021c 00004c 00   A  0   0  1
    32.   [ 7] .gnu.version      VERSYM          08048268 000268 00000a 02   A  5   0  2
    33.   [ 8] .gnu.version_r    VERNEED         08048274 000274 000020 00   A  6   1  4
    34.   [ 9] .rel.dyn          REL             08048294 000294 000008 08   A  5   0  4
    35.   [10] .rel.plt          REL             0804829c 00029c 000018 08   A  5  12  4
    36.   [11] .init             PROGBITS        080482b4 0002b4 00002e 00  AX  0   0  4
    37.   [12] .plt              PROGBITS        080482f0 0002f0 000040 04  AX  0   0 16
    38.   [13] .text             PROGBITS        08048330 000330 00018c 00  AX  0   0 16
    39.   [14] .fini             PROGBITS        080484bc 0004bc 00001a 00  AX  0   0  4
    40.   [15] .rodata           PROGBITS        080484d8 0004d8 000011 00   A  0   0  4
    41.   [16] .eh_frame_hdr     PROGBITS        080484ec 0004ec 000034 00   A  0   0  4
    42.   [17] .eh_frame         PROGBITS        08048520 000520 0000c4 00   A  0   0  4
    43.   [18] .ctors            PROGBITS        08049f14 000f14 000008 00  WA  0   0  4
    44.   [19] .dtors            PROGBITS        08049f1c 000f1c 000008 00  WA  0   0  4
    45.   [20] .jcr              PROGBITS        08049f24 000f24 000004 00  WA  0   0  4
    46.   [21] .dynamic          DYNAMIC         08049f28 000f28 0000c8 08  WA  6   0  4
    47.   [22] .got              PROGBITS        08049ff0 000ff0 000004 04  WA  0   0  4
    48.   [23] .got.plt          PROGBITS        08049ff4 000ff4 000018 04  WA  0   0  4
    49.   [24] .data             PROGBITS        0804a00c 00100c 000008 00  WA  0   0  4
    50.   [25] .bss              NOBITS          0804a014 001014 000008 00  WA  0   0  4
    51.   [26] .comment          PROGBITS        00000000 001014 00002a 01  MS  0   0  1
    52.   [27] .shstrtab         STRTAB          00000000 00103e 0000fc 00      0   0  1
    53.   [28] .symtab           SYMTAB          00000000 0015ec 000410 10     29  45  4
    54.   [29] .strtab           STRTAB          00000000 0019fc 0001f9 00      0   0  1
    55. Key to Flags:
    56.   W (write), A (alloc), X (execute), M (merge), S (strings)
    57.   I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
    58.   O (extra OS processing required) o (OS specific), p (processor specific)
    59.  
    60. There are no section groups in this file.
    61.  
    62. Program Headers:
    63.   Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
    64.   PHDR           0x000034 0x08048034 0x08048034 0x00120 0x00120 R E 0x4
    65.   INTERP         0x000154 0x08048154 0x08048154 0x00013 0x00013 R   0x1
    66.       [Requesting program interpreter: /lib/ld-linux.so.2]
    67.   LOAD           0x000000 0x08048000 0x08048000 0x005e4 0x005e4 R E 0x1000
    68.   LOAD           0x000f14 0x08049f14 0x08049f14 0x00100 0x00108 RW  0x1000
    69.   DYNAMIC        0x000f28 0x08049f28 0x08049f28 0x000c8 0x000c8 RW  0x4
    70.   NOTE           0x000168 0x08048168 0x08048168 0x00044 0x00044 R   0x4
    71.   GNU_EH_FRAME   0x0004ec 0x080484ec 0x080484ec 0x00034 0x00034 R   0x4
    72.   GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4
    73.   GNU_RELRO      0x000f14 0x08049f14 0x08049f14 0x000ec 0x000ec R   0x1
    74.  
    75.  Section to Segment mapping:
    76.   Segment Sections...
    77.    00
    78.    01     .interp
    79.    02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
    80.    03     .ctors .dtors .jcr .dynamic .got .got.plt .data .bss
    81.    04     .dynamic
    82.    05     .note.ABI-tag .note.gnu.build-id
    83.    06     .eh_frame_hdr
    84.    07
    85.    08     .ctors .dtors .jcr .dynamic .got
    86.  
    87. Dynamic section at offset 0xf28 contains 20 entries:
    88.   Tag        Type                         Name/Value
    89.  0x00000001 (NEEDED)                     Shared library: [libc.so.6]
    90.  0x0000000c (INIT)                       0x80482b4
    91.  0x0000000d (FINI)                       0x80484bc
    92.  0x6ffffef5 (GNU_HASH)                   0x80481ac
    93.  0x00000005 (STRTAB)                     0x804821c
    94.  0x00000006 (SYMTAB)                     0x80481cc
    95.  0x0000000a (STRSZ)                      76 (bytes)
    96.  0x0000000b (SYMENT)                     16 (bytes)
    97.  0x00000015 (DEBUG)                      0x0
    98.  0x00000003 (PLTGOT)                     0x8049ff4
    99.  0x00000002 (PLTRELSZ)                   24 (bytes)
    100.  0x00000014 (PLTREL)                     REL
    101.  0x00000017 (JMPREL)                     0x804829c
    102.  0x00000011 (REL)                        0x8048294
    103.  0x00000012 (RELSZ)                      8 (bytes)
    104.  0x00000013 (RELENT)                     8 (bytes)
    105.  0x6ffffffe (VERNEED)                    0x8048274
    106.  0x6fffffff (VERNEEDNUM)                 1
    107.  0x6ffffff0 (VERSYM)                     0x8048268
    108.  0x00000000 (NULL)                       0x0
    109.  
    110. Relocation section '.rel.dyn' at offset 0x294 contains 1 entries:
    111.  Offset     Info    Type            Sym.Value  Sym. Name
    112. 08049ff0  00000206 R_386_GLOB_DAT    00000000   __gmon_start__
    113.  
    114. Relocation section '.rel.plt' at offset 0x29c contains 3 entries:
    115.  Offset     Info    Type            Sym.Value  Sym. Name
    116. 0804a000  00000107 R_386_JUMP_SLOT   00000000   printf
    117. 0804a004  00000207 R_386_JUMP_SLOT   00000000   __gmon_start__
    118. 0804a008  00000307 R_386_JUMP_SLOT   00000000   __libc_start_main
    119.  
    120. There are no unwind sections in this file.
    121.  
    122. Symbol table '.dynsym' contains 5 entries:
    123.    Num:    Value  Size Type    Bind   Vis      Ndx Name
    124.      0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND
    125.      1: 00000000     0 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.0 (2)
    126.      2: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    127.      3: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)
    128.      4: 080484dc     4 OBJECT  GLOBAL DEFAULT   15 _IO_stdin_used
    129.  
    130. Symbol table '.symtab' contains 65 entries:
    131.    Num:    Value  Size Type    Bind   Vis      Ndx Name
    132.      0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND
    133.      1: 08048154     0 SECTION LOCAL  DEFAULT    1
    134.      2: 08048168     0 SECTION LOCAL  DEFAULT    2
    135.      3: 08048188     0 SECTION LOCAL  DEFAULT    3
    136.      4: 080481ac     0 SECTION LOCAL  DEFAULT    4
    137.      5: 080481cc     0 SECTION LOCAL  DEFAULT    5
    138.      6: 0804821c     0 SECTION LOCAL  DEFAULT    6
    139.      7: 08048268     0 SECTION LOCAL  DEFAULT    7
    140.      8: 08048274     0 SECTION LOCAL  DEFAULT    8
    141.      9: 08048294     0 SECTION LOCAL  DEFAULT    9
    142.     10: 0804829c     0 SECTION LOCAL  DEFAULT   10
    143.     11: 080482b4     0 SECTION LOCAL  DEFAULT   11
    144.     12: 080482f0     0 SECTION LOCAL  DEFAULT   12
    145.     13: 08048330     0 SECTION LOCAL  DEFAULT   13
    146.     14: 080484bc     0 SECTION LOCAL  DEFAULT   14
    147.     15: 080484d8     0 SECTION LOCAL  DEFAULT   15
    148.     16: 080484ec     0 SECTION LOCAL  DEFAULT   16
    149.     17: 08048520     0 SECTION LOCAL  DEFAULT   17
    150.     18: 08049f14     0 SECTION LOCAL  DEFAULT   18
    151.     19: 08049f1c     0 SECTION LOCAL  DEFAULT   19
    152.     20: 08049f24     0 SECTION LOCAL  DEFAULT   20
    153.     21: 08049f28     0 SECTION LOCAL  DEFAULT   21
    154.     22: 08049ff0     0 SECTION LOCAL  DEFAULT   22
    155.     23: 08049ff4     0 SECTION LOCAL  DEFAULT   23
    156.     24: 0804a00c     0 SECTION LOCAL  DEFAULT   24
    157.     25: 0804a014     0 SECTION LOCAL  DEFAULT   25
    158.     26: 00000000     0 SECTION LOCAL  DEFAULT   26
    159.     27: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    160.     28: 08049f14     0 OBJECT  LOCAL  DEFAULT   18 __CTOR_LIST__
    161.     29: 08049f1c     0 OBJECT  LOCAL  DEFAULT   19 __DTOR_LIST__
    162.     30: 08049f24     0 OBJECT  LOCAL  DEFAULT   20 __JCR_LIST__
    163.     31: 08048360     0 FUNC    LOCAL  DEFAULT   13 __do_global_dtors_aux
    164.     32: 0804a014     1 OBJECT  LOCAL  DEFAULT   25 completed.6086
    165.     33: 0804a018     4 OBJECT  LOCAL  DEFAULT   25 dtor_idx.6088
    166.     34: 080483c0     0 FUNC    LOCAL  DEFAULT   13 frame_dummy
    167.     35: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    168.     36: 08049f18     0 OBJECT  LOCAL  DEFAULT   18 __CTOR_END__
    169.     37: 080485e0     0 OBJECT  LOCAL  DEFAULT   17 __FRAME_END__
    170.     38: 08049f24     0 OBJECT  LOCAL  DEFAULT   20 __JCR_END__
    171.     39: 08048490     0 FUNC    LOCAL  DEFAULT   13 __do_global_ctors_aux
    172.     40: 00000000     0 FILE    LOCAL  DEFAULT  ABS a.c
    173.     41: 08049f14     0 NOTYPE  LOCAL  DEFAULT   18 __init_array_end
    174.     42: 08049f28     0 OBJECT  LOCAL  DEFAULT   21 _DYNAMIC
    175.     43: 08049f14     0 NOTYPE  LOCAL  DEFAULT   18 __init_array_start
    176.     44: 08049ff4     0 OBJECT  LOCAL  DEFAULT   23 _GLOBAL_OFFSET_TABLE_
    177.     45: 08048480     2 FUNC    GLOBAL DEFAULT   13 __libc_csu_fini
    178.     46: 08048482     0 FUNC    GLOBAL HIDDEN    13 __i686.get_pc_thunk.bx
    179.     47: 0804a00c     0 NOTYPE  WEAK   DEFAULT   24 data_start
    180.     48: 00000000     0 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.0
    181.     49: 0804a014     0 NOTYPE  GLOBAL DEFAULT  ABS _edata
    182.     50: 080484bc     0 FUNC    GLOBAL DEFAULT   14 _fini
    183.     51: 08049f20     0 OBJECT  GLOBAL HIDDEN    19 __DTOR_END__
    184.     52: 0804a00c     0 NOTYPE  GLOBAL DEFAULT   24 __data_start
    185.     53: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    186.     54: 0804a010     0 OBJECT  GLOBAL HIDDEN    24 __dso_handle
    187.     55: 080484dc     4 OBJECT  GLOBAL DEFAULT   15 _IO_stdin_used
    188.     56: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
    189.     57: 08048410    97 FUNC    GLOBAL DEFAULT   13 __libc_csu_init
    190.     58: 0804a01c     0 NOTYPE  GLOBAL DEFAULT  ABS _end
    191.     59: 08048330     0 FUNC    GLOBAL DEFAULT   13 _start
    192.     60: 080484d8     4 OBJECT  GLOBAL DEFAULT   15 _fp_hw
    193.     61: 0804a014     0 NOTYPE  GLOBAL DEFAULT  ABS __bss_start
    194.     62: 080483e4    40 FUNC    GLOBAL DEFAULT   13 main
    195.     63: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
    196.     64: 080482b4     0 FUNC    GLOBAL DEFAULT   11 _init
    197.  
    198. Histogram for `.gnu.hash' bucket list length (total of 2 buckets):
    199.  Length  Number     % of total  Coverage
    200.       0  1          ( 50.0%)
    201.       1  1          ( 50.0%)    100.0%
    202.  
    203. Version symbols section '.gnu.version' contains 5 entries:
    204.  Addr: 0000000008048268  Offset: 0x000268  Link: 5 (.dynsym)
    205.   000:   0 (*local*)       2 (GLIBC_2.0)     0 (*local*)       2 (GLIBC_2.0)
    206.   004:   1 (*global*)
    207.  
    208. Version needs section '.gnu.version_r' contains 1 entries:
    209.  Addr: 0x0000000008048274  Offset: 0x000274  Link: 6 (.dynstr)
    210.   000000: Version: 1  File: libc.so.6  Cnt: 1
    211.   0x0010:   Name: GLIBC_2.0  Flags: none  Version: 2
    212.  
    213. Notes at offset 0x00000168 with length 0x00000020:
    214.   Owner                 Data size   Description
    215.   GNU                  0x00000010   NT_GNU_ABI_TAG (ABI version tag)
    216.     OS: Linux, ABI: 2.6.15
    217.  
    218. Notes at offset 0x00000188 with length 0x00000024:
    219.   Owner                 Data size   Description
    220.   GNU                  0x00000014   NT_GNU_BUILD_ID (unique build ID bitstring)
    221.     Build ID: 17fb9651029b6a8543bfafec9eea23bd16454e65

    关于ELF文件格式的参考：http://www.cnblogs.com/xmphoenix/archive/2011/10/23/2221879.html

    原文:

    http://linuxtools-rst.readthedocs.io/zh_CN/latest/tool/readelf.html