ELF (Executable and Linking Format) UNIX/Linux

AT&T UNIX (UNIX System V) ELF

-System V Application Binary Interface Object Files
UNIX System V Program Loading
and Dynamic Linking
CPU

ELF (object file) (executable file) (share object)
(core dump) ELF
UNIX/Linux
ELF
(Linking View) (Execution View) 4
(Section) 4 (a)
(Segment) 4 (b)

4. ELF

ELF (Program Header Table)

(Segment Header Table)
(Section Header Table)
2 ELF Elf32_Ehdr e_phoff e_shoff

2 : ELF (Elf32_Ehdr)

typedef struct {
unsigned char

e_ident[EI_NIDENT];

// ELF

Elf32_Half

e_type;

//

Elf32_Half

e_machine;

//

Elf32_Word

e_version;

//

Elf32_Addr

e_entry;

//

Elf32_Off

e_phoff;

//

Elf32_Off

e_shoff;

//

Elf32_Word

e_flags;

//

Elf32_Half

e_ehsize;

// ELF

Elf32_Half

e_phentsize;

//

e_phnum;

//

e_shentsize;

//

e_shnum;

//

e_shstrndx;

//

Elf32_Half

Elf32_Half

Elf32_Half

Elf32_Half
.shstrtab
} Elf32_Ehdr;

 ELF ELF
( 16 )
(.text) , (.data), (.rodata) , (.bss),
(.strtab), (.symtab)ELF
1 ELF
1. ELF

.text

.data

.data1

.bss

.rodata

.rodata1

.dynamic

.dynstr

.dynsym

.got

(Global Offset Table)

.plt

(Procedure Linkage Table)

.interp

(program interpreter file)

.ctors

(constructor) (C++)

.dtors

(destructor) (C++)

.hash

.init

.fini

.rel<name>

.rela<name>

rel.text rel.data

.shstrtab

(Section)

.strtab

.symtab

.debug

()

.line

.comment

.note

ELF
5 ELF Elf32_Ehdr
Elf32_Phdr Elf32_Shdr (Elf32_Sym)
(Elf32_RelElf32_Rela) (Elf32_Dyn)

 5. ELF
(Section)
6 3

6. ELF
3 : ELF

typedef struct {

Elf32_Word

sh_name;

//

Elf32_Word

sh_type;

//

Elf32_Word

sh_flags;

//

Elf32_Addr

sh_addr;

// (

sh_offset;

// (

Elf32_Word

sh_size;

//

Elf32_Word

sh_link;

// (

Elf32_Word

sh_info;

//

Elf32_Word

sh_addralign;

//

Elf32_Word

sh_entsize;

//

)
Elf32_Off
)

()
} Elf32_Shdr;
(Segment)

7 4

7. ELF
4. ELF

typedef struct {
Elf32_Word p_type;

//

Elf32_Off p_offset;

// ()

Elf32_Addr p_vaddr;

//

Elf32_Addr p_paddr;

//

Elf32_Word p_filesz;

//

Elf32_Word p_memsz;

//

Elf32_Word p_flags;

//

Elf32_Word p_align;

//

} Elf32_Phdr;
ELF .text, .data, .bss
Elf32_Rel Elf32_Rela
.text, .rodata, .hash, .dynsym, .dynstr, .plt, .rel.got (Text Segment)
.data, .dynamic, .got, .bss (Data Segemnt)
Elf32_Sym (st_name) (st_value) (st_size) (st_info)
(st_other) (st_shndx) st_info
bind type
5. ELF

typedef struct
{
Elf32_Word

st_name;

//

st_value;

//

st_size;

//

Elf32_Addr

Elf32_Word

byte
unsigned char st_info;

//

bind type
unsigned char st_other;

//

0
Elf32_Half

st_shndx;

(Section)
} Elf32_Sym;

//

#define ELF32_ST_BIND(i) ((i) >> 4)

//

st_info bind
#define ELF32_ST_TYPE(i) ((i)&0xf)

//

st_info type
#define ELF32_ST_INFO(b,t) (((b)<<4)+((t)&0xf))

//

bind type info

Elf32_Rel Elf32_Rela ELF (r_offset)
(r_info) byte byte
Elf32_Rela (r_addend)
6. ELF

typedef struct
{
Elf32_Addr

r_offset;

//

r_info;

//

Elf32_Word

r_info sym type

} Elf32_Rel;
typedef struct
{
Elf32_Addr

r_offset;

//

r_info;

//

Elf32_Word

r_info sym type

Elf32_Sword r_addend;

//

} Elf32_Rela;
#define ELF32_R_SYM(i) ((i)>>8)
#define ELF32_R_TYPE(i) ((unsigned char) (i))
#define ELF32_R_INFO(s,t) (((s)<<8) + (unsigned char)
(t))

 Elf32_rel r_info sym

sym Elf32_Sym st_name
st_name sym st_name
8

8. ELF

.text, .data, .data2, .bss .rel.text, .rel.data,

.rel.data2, .rela.text, .rela.data, .rela.data2 ELF
ELF (.interp)
(.dynamic) (Global Offset Table : .got) (Porcedure Linkage
Table : .plt) (.dynstr) (.dynsym) (.hash)
(rel.got)
ELF (PHDR)
(INTERP)(LOAD) (DYNAMIC) (NOTE)
(SHLIB) (TEXT)
(DATA)
2 ELF

Segment

Sections ()

()

PT_PHDR

Program Header

(base
addres
s)

PT_INTERP

.interp

PT_LOAD

.interp .note .hash .dynsym .dynstr .rel.dyn .rel.plt .init .plt .text .fini

.rodata

PT_LOAD

.data .dynamic .ctors .dtors .jcr .got .bss

PT_DYNAM
IC

.dynamic

Linux .o (Object File) .so (Shared

Object) .so ELF INTERP
ELF (ELF Program
Interpreter Dynamic Loader )

(Kernel)
Linux ELF ELF

1. Kernel ELF PT_LOAD

2. Kernel ( linux mmap )

3. Kernel PT_INTERP (Dynamic Linker )
ELF
4. Kernel

5.

ELF CPU ELF CPU

CPU CPU
CPU
7. IA32

extern int var;

pushl var

movl

var@GOT(%ebx)
extern int func(int);

call func

pushl (%eax)
call
func@PLT
int call_func(void) {
return func(var);
}
8. IA32 (Stub)

.PLT0:

pushl 4(%ebx)
Jmp *8(%ebx)
nop
nop

.PLT1:

jmp *name1@GOT(%ebx)
pushl $offset1
jmp .PLT0@PC

.PLT2

jmp *name2@GOT(%ebx)

pushl $offset2
jmp .PLT0@PC
9 ELF Elf32_Dyn
_DYNAMIC[]
9. ELF ()

typedef struct {
Elf32_Sword

d_tag;

//

union {
Elf32_Word

d_val;

// ()

Elf32_Addr

d_ptr;

// ()

} d_un;
} Elf32_Dyn;