|
ELF 是 object file 文件格式,其主要结构以 section (段)为主,利用 objdump 工具可以列出可执行文件的 section 及其内容。假设当前目录下有一个 hello 的可执行文件,对应源代码为:
[Plain Text] 纯文本查看 复制代码 #include <stdio.h>
int main()
{
char buf [20] = "hello world\n";
printf ("%s",buf);
return 0;
}
现在把此文件的 ELF section 打印出来:beyes@linux-beyes:~/C/ELF> objdump -x hello |more
... ....
Sections:
Idx Name Size VMA LMA File off Algn
0 .interp 00000013 08048154 08048154 00000154 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
1 .note.ABI-tag 00000020 08048168 08048168 00000168 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .note.SuSE 00000018 08048188 08048188 00000188 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
3 .note.gnu.build-id 00000024 080481a0 080481a0 000001a0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 .hash 00000028 080481c4 080481c4 000001c4 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 .gnu.hash 00000020 080481ec 080481ec 000001ec 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .dynsym 00000050 0804820c 0804820c 0000020c 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
7 .dynstr 0000004c 0804825c 0804825c 0000025c 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
8 .gnu.version 0000000a 080482a8 080482a8 000002a8 2**1
CONTENTS, ALLOC, LOAD, READONLY, DATA
9 .gnu.version_r 00000020 080482b4 080482b4 000002b4 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
10 .rel.dyn 00000008 080482d4 080482d4 000002d4 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
11 .rel.plt 00000018 080482dc 080482dc 000002dc 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
12 .init 00000030 080482f4 080482f4 000002f4 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
13 .plt 00000040 08048324 08048324 00000324 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
14 .text 000001ac 08048370 08048370 00000370 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
15 .fini 0000001c 0804851c 0804851c 0000051c 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
16 .rodata 0000000b 08048538 08048538 00000538 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
17 .eh_frame_hdr 0000001c 08048544 08048544 00000544 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
18 .eh_frame 00000058 08048560 08048560 00000560 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
19 .ctors 00000008 08049f0c 08049f0c 00000f0c 2**2
CONTENTS, ALLOC, LOAD, DATA
20 .dtors 00000008 08049f14 08049f14 00000f14 2**2
CONTENTS, ALLOC, LOAD, DATA
21 .jcr 00000004 08049f1c 08049f1c 00000f1c 2**2
CONTENTS, ALLOC, LOAD, DATA
22 .dynamic 000000d0 08049f20 08049f20 00000f20 2**2
CONTENTS, ALLOC, LOAD, DATA
23 .got 00000004 08049ff0 08049ff0 00000ff0 2**2
CONTENTS, ALLOC, LOAD, DATA
24 .got.plt 00000018 08049ff4 08049ff4 00000ff4 2**2
CONTENTS, ALLOC, LOAD, DATA
25 .data 00000008 0804a00c 0804a00c 0000100c 2**2
CONTENTS, ALLOC, LOAD, DATA
26 .bss 00000008 0804a014 0804a014 00001014 2**2
ALLOC
27 .comment 0000015c 00000000 00000000 00001014 2**0
CONTENTS, READONLY
28 .debug_aranges 00000090 00000000 00000000 00001170 2**3
CONTENTS, READONLY, DEBUGGING
29 .debug_pubnames 0000005f 00000000 00000000 00001200 2**0
CONTENTS, READONLY, DEBUGGING
30 .debug_info 000002e4 00000000 00000000 0000125f 2**0
CONTENTS, READONLY, DEBUGGING
31 .debug_abbrev 00000159 00000000 00000000 00001543 2**0
CONTENTS, READONLY, DEBUGGING
32 .debug_line 000001fb 00000000 00000000 0000169c 2**0
CONTENTS, READONLY, DEBUGGING
33 .debug_frame 0000004c 00000000 00000000 00001898 2**2
CONTENTS, READONLY, DEBUGGING
34 .debug_str 0000011c 00000000 00000000 000018e4 2**0
CONTENTS, READONLY, DEBUGGING
35 .debug_loc 0000006b 00000000 00000000 00001a00 2**0
CONTENTS, READONLY, DEBUGGING
36 .debug_ranges 00000040 00000000 00000000 00001a70 2**3
CONTENTS, READONLY, DEBUGGING
37 .comment.SUSE.OPTs 00000006 00000000 00000000 00001ab0 2**0
... ...
如果只希望打印出指定 section 的内容,例如 .text section:beyes@linux-beyes:~/C/ELF> objdump -j .text -s hello
hello: file format elf32-i386
Contents of section .text:
8048370 31ed5e89 e183e4f0 50545268 80840408 1.^.....PTRh....
8048380 68908404 08515668 24840408 e8b3ffff h....QVh$.......
8048390 fff49090 90909090 90909090 90909090 ................
80483a0 5589e553 83ec0480 3d14a004 08007540 U..S....=.....u@
80483b0 8b1518a0 0408b818 9f04082d 149f0408 ...........-....
80483c0 c1f8028d 58ff39da 731f8db6 00000000 ....X.9.s.......
80483d0 8d4201a3 18a00408 ff148514 9f04088b .B..............
80483e0 1518a004 0839da72 e7c60514 a0040801 .....9.r........
80483f0 83c4045b 5dc38d76 008dbc27 00000000 ...[]..v...'....
8048400 5589e583 ec08a11c 9f040885 c07412b8 U............t..
8048410 00000000 85c07409 c704241c 9f0408ff ......t...$.....
8048420 d0c9c390 8d4c2404 83e4f0ff 71fc5589 .....L$.....q.U.
8048430 e55183ec 34c745e8 68656c6c c745ec6f .Q..4.E.hell.E.o
8048440 20776fc7 45f0726c 640ac745 f4000000 wo.E.rld..E....
8048450 00c745f8 00000000 8d45e889 442404c7 ..E......E..D$..
8048460 04244085 0408e8e9 feffffb8 00000000 .$@.............
8048470 83c43459 5d8d61fc c3909090 90909090 ..4Y].a.........
8048480 5589e55d c38d7426 008dbc27 00000000 U..]..t&...'....
8048490 5589e557 5653e84f 00000081 c3591b00 U..WVS.O.....Y..
80484a0 0083ec0c e84bfeff ff8dbb18 ffffff8d .....K..........
80484b0 8318ffff ff29c7c1 ff0285ff 742431f6 .....)......t$1.
80484c0 8b451089 4424088b 450c8944 24048b45 .E..D$..E..D$..E
80484d0 08890424 ff94b318 ffffff83 c60139fe ...$..........9.
80484e0 72de83c4 0c5b5e5f 5dc38b1c 24c39090 r....[^_]...$...
80484f0 5589e553 83ec04a1 0c9f0408 83f8ff74 U..S...........t
8048500 13bb0c9f 04086690 83eb04ff d08b0383 ......f.........
8048510 f8ff75f4 83c4045b 5dc39090 ..u....[]... -j 参数表示要指定一个 section 。
-s 参数表示显示指定 section 的所有内容。
目标文件 Object file 有 3 中类型:
1、relocatable file (可重定位文件)
2、executable file (可执行文件)
3、shared object file (共享目标文件)
上图中,Linking view 指的是经由 assembler 或 linkage editor 编译过,可被 CPU 执行的可执行文件,也就是存储在存储设备(如硬盘)上的程序格式 (stored programs)。
Execution View 指的是经由 loader 载入后,程序执行时的格式,也就是存在内存上的程序格式 (process)。
当加载器(loader) 将程序载入内存后, object file 就会是 execution view 的格式。 |
|