Home PC Games Linux Windows Database Network Programming Server Mobile  
  Home \ Linux \ Executable file format Explanation under Linux     - Linux Beginner Guide: Installing packages on Ubuntu and Fedora (Linux)

- Linux Shell Scripting Interview Question (Linux)

- Ubuntu Linux use MAC binding against ARP attacks (Linux)

- Memory leak analysis using Android studio (Programming)

- Oracle Listener can not start (TNS-12555, TNS-12560, TNS-00525) (Database)

- stat - Get more information than ls (Linux)

- C / C ++ language usage summary of const (Programming)

- Linux screen commonly commands (Linux)

- To install Python-Pip and Fabric under CentOS / Ubuntu (Linux)

- Linux network monitoring tools ntopng installation (Linux)

- Use the command line MySQL database backup and recovery (Database)

- Oracle RAC upgrade to problems encountered (Database)

- Hadoop connection failed or stuck processing (Server)

- Install Rubinius testing Ubuntu 14.04 native threads (Linux)

- How to install Virtualbox 4.3.20 in Ubuntu 14.04 (Linux)

- Linux kernel IPv6 protocol closed manner (Linux)

- The most simple drive to write and test procedures under linux (Programming)

- Ubuntu 14.10 installation SecureCRT 7.3 (Linux)

- High-performance JavaScript DOM programming (Programming)

- Two classic macro definition under Linux (Linux)

  Executable file format Explanation under Linux
  Add Date : 2018-11-21      
  Linux Next, the target file, shared object files, executable files are using the ELF file format to store. After compiling the program will output target file, and then through the links can generate an executable file or shared object files. Linux ELF file and PE file using the following Windows operating systems used are from the Unix system to COFF file format evolution.

We start to understand some of the basic ideas.

First and foremost is the idea behind a program from a human-readable format can be converted for use by the operating system to perform a binary format, code and data are stored separately, the reason for this design are a few reasons:

1, then program execution, the code and data may be mapped to different attributes of the virtual memory. Because the code is generally read-only, and the data is readable and writable;

2, there is a strong modern CPU cache system. And code separation can be improved localized program, increasing the probability of a cache hit;

3, and most important reason is that when there are multiple copies of the program running at the time, read-only portion may retain a copy in memory only, thereby greatly saving memory.

In the definition of the ELF in their separate storage areas called a Section, it is a segment.

An ELF file important segments include:

.text segment: read-only program memory

.data segments: storage has initialized global and static variables

.bss segments: storage uninitialized global and static variables, because these variables is 0, so this section of the file which does not occupy space

.rodata paragraph: read-only data storage, such as string constants

We use an example look at the ELF file format in the end is what. First, write a C program in Linux: SimpleSection.c

int printf (const char * format, ...);

int global_init_var = 16;
int global_unint_var;

void func1 (int);

int main ()
    static int static_var = -32;
    static int static_var_uninit;

    int a = 1;
    int b;

    func1 (static_var + global_init_var + a + b);

    return a;

void func1 (int i)
    printf ( "% d \ n", i);

Then, generate the target file:

[Root@www.linuxabc-CentOS Program] # gcc -c SimpleSection.c
[Root@www.linuxabc-centos Program] # file SimpleSection.o
SimpleSection.o: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped

Results file command also tells us that this is a 32-bit ELF file type is relocatable, is relocatable. Therefore, the target file is also called relocatable files.

Beginning elf elf file is a file header information, 32 52 bytes. Readelf tool we can use to check:

[Root@www.linuxabc-centos Program] # readelf -h SimpleSection.o
ELF Header:
  Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  Class: ELF32
  Data: 2's complement, little endian
  Version: 1 (current)
  OS / ABI: UNIX - System V
  ABI Version: 0
  Type: REL (Relocatable file)
  Machine: Intel 80386
  Version: 0x1
  Entry point address: 0x0
  Start of program headers: 0 (bytes into file)
  Start of section headers: 224 (bytes into file)
  Flags: 0x0
  Size of this header: 52 (bytes)
  Size of program headers: 0 (bytes)
  Number of program headers: 0
  Size of section headers: 40 (bytes)
  Number of section headers: 11
  Section header string table index: 8

Entry point address refers to a program entry address, if it is an executable file, this field will have a value;
His previous field are some of the description field;
Start of program headers referring to the starting position of the program header table. Classified information program header table is loaded from the perspective view of each segment elf carried out; and the segment table is similar to the structure;
Start of section headers pointed elf file header except the most important information: the starting position of the segment table. Segment table contains important information about each segment name, attributes, size, location and so on. Operating system first found in the segment table, and then to find the segments based on the information segment table. Segment table is an array-like structure, a segment of information is an element of the array.
Size of this header is the header file refers to the size of 32 is 52 bytes, 0x34 bytes.
Size of program headers refers to the size of each program header table.
Number of program headers refers to the number of the program header table.
Size of sections headers refers to the size of each segment of the table;
Number of section headers refers to the number of the segment table;

Section header string table index indicates the segment table were used in the string table index in the segment table.
After the file header, followed by the head of the program, because the target file is not a link, there is no load information. We'll let you ignore this thing, say he later specialized.
After the head is the data for each segment of the program, we look at tools:

[Root@www.linuxidc.com-CentOS Program] # readelf -S SimpleSection.o
There are 11 section headers, starting at offset 0xe0:

Section Headers:
  [Nr] Name Type Addr Off Size ES Flg Lk Inf Al
  [0] NULL 00000000 000000 000000 00 0 0 0
  [1] .text PROGBITS 00000000 000034 000020 00 AX 0 0 4
  [2] .rel.text REL 00000000 0003f4 000010 08 9 1 4
  [3] .data PROGBITS 00000000 000054 000008 00 WA 0 0 4
  [4] .bss NOBITS 00000000 00005c 000004 00 WA 0 0 4
  [5] .rodata PROGBITS 00000000 00005c 000004 00 A 0 0 1
  [6] .comment PROGBITS 00000000 000060 00002d 01 MS 0 0 1
  [7] .note.GNU-stack PROGBITS 00000000 00008d 000000 00 0 0 1
  [8] .shstrtab STRTAB 00000000 00008d 000051 00 0 0 1
  [9] .symtab SYMTAB 00000000 000298 0000f0 10 10 10 4
  [10] .strtab STRTAB 00000000 000388 00006b 00 0 0 1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings)
  I (info), L (link order), G (group), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

Meaning of each field are: section number, section name, segment type, segment virtual address, offset, size, ES, flag, Lk, Inf, alignment.

The columns can not explain is not considered, let's focus on a few other columns.

0 when the segment is to be read without index minus 1.

Is followed by the code segment, offset 0x34, that is immediately after the end of the header is a code segment;

After the code segment, offset 0x54 where is the data segment, accounting for 8 bytes, that is, the program has been assigned a global variable and a static variable;

Followed by .bss segment, where only stores a static variable, because the uninitialized global variables are stored in an optimized mechanism to .common section, where you can not ignore;

Then the read-only data segment .rodata, is used to store inside printf% d \ n of these three characters, plus endings \ 0, a total of four bytes of space

Size according to this column we count the total space occupied by these segments, (bss because they do not take up space, do not count in.):

.text 0x20

.data 0x8

.rodata 0x4

.comment 0x2d

.shstrtab 0x51

.rel.text 0x10

.symtab 0xf0

.strtab 0x6b

Each segment has a segment table here described elements, a total of 11. Scratch file that the size of each element is 40 bytes. That segment table together account 0x1b8 bytes of space. And since the start address of the segment table memory alignment needs, middle empty two bytes. Since the start address of the segment table is the first 224 bytes;

.rel.text Start address is also due to memory alignment requirements, fill an empty byte.

Plus headers 0x34 bytes, add up to a total of 1028 bytes.

[Root @ xuxingwang-centos Program] # ls -al SimpleSection.o
-rw-r - r-- 1 root root 1028 Aug 21 16:09 SimpleSection.o

The target size of the file is exactly 1028 bytes.
- How to troubleshoot Windows and Ubuntu dual system time is not synchronized (Linux)
- How to view the Linux QPS (Linux)
- mysqldump MySQL command-line tool (Database)
- Kali Linux resolve GPG error KEYEXPIRED 1425567400 (Linux)
- Why do I prefer Git (Linux)
- Add your own kernel and ramfs based on an existing Linux LiveCD (Linux)
- Some common regular expressions (Linux)
- Use the Find command to help you find those files that need to be cleaned (Linux)
- Java Access Control (Programming)
- CentOS install Memcached (Server)
- The AWK use Cygwin tools mysql binlog log viewer (Database)
- Create RAID 1 (mirroring) with two disks (Linux)
- Fragment Android developers learning to resolve (Programming)
- Chkconfig command Detailed service is added and shut down the system in two ways to start service under Linux (Linux)
- SSH without password (Linux)
- Easy to install Ubuntu 15.04 and Ubuntu 15.04 GNOME on Wayland trial (Linux)
- Let Linux operating system more secure (Linux)
- AngularJS - Custom instructions (Programming)
- MySQL restart process can not be taken lightly (Database)
- Large computer network security policy Experience (Linux)
  CopyRight 2002-2020 newfreesoft.com, All Rights Reserved.