Concepts

A seg­ment is a piece of a infor­ma­tion which is mapped into the mem­o­ry (of a process). A ELF bina­ry can have zero or mul­ti­ple seg­ments. It defines also where the OS should put it into the mem­o­ry. Each seg­ment has a Pro­gram Head­er which describes the sec­tions within.

A sec­tion is a dis­tinc­tive part of a seg­ment with a defined pur­pose. A seg­ment can have zero or mul­ti­ple sections.

The ELF header

The ELF file head­er looks like this:

# hexdump /bin/ls -C | head
00000000  7f 45 4c 46 02 01 01 00  00 00 00 00 00 00 00 00
00000010  03 00 3e 00 01 00 00 00  60 61 00 00 00 00 00 00
00000020  40 00 00 00 00 00 00 00  68 37 02 00 00 00 00 00
00000030  00 00 00 00 40 00 38 00  0b 00 40 00 1e 00 1d 00

Expla­na­tion:

Byte#	Byte	Con­tent
1	7F
2	45	E
3	4C	L
4	46	F
5	02	Class: 0 = None 1 = 32 Bit object 2 = 64 Bit object
6	01	Data encod­ing: 0 = None 1 = LSB 2 = MSB
7	01	Ver­sion. There is only ver­sion 1.
8	00	ABI Appli­ca­tion Bina­ry Inter­face: 0 = None/System V (most­ly used) 1 = HP-UX 2 = NetB­SD 3 = Linux
9	00	ABI ver­sion. Nor­mal­ly 0.
10	00	Padding
11	00	Padding
12	00	Padding
13	00	Padding
14	00	Padding
15	00	Padding
16	00	Padding
17 18	03 00	File Type: 0 ET_NONE = None 1 ET_REL = Relo­cat­able file (.o) 2 ET_EXEC = Exe­cutable file 3 ET_DYN = Shared object file (.so) 4 ET_CORE = Core file (mem­o­ry dump file)
19 20	3e 00	Machine Type: 0x03 = x86 0x28 = ARM 0x3E = amd64
21 22 23 24	01 00 00 00	Ver­sion. Always 1.
25 26 27 28 29 30 31 32	60 61 00 00 00 00 00 00	Rel­a­tive address of the main func­tion: 0x6160 (or 0 for libraries)
33 34 35 36 37 38 39 40	40 00 00 00 00 00 00 00	Start of the pro­gram head­ers (from byte 64 on rel­a­tive to the begin­ning of the file.)
41 42 43 44 45 46 47 48	68 37 02 00 00 00 00 00	Start of the sec­tion head­ers (from byte 0x023768 = 145256 on rel­a­tive to the begin­ning of the file.)
49 50 51 52	00 00 00 00	Proces­sor flags
53 54	40 00	Size of this head­er head­er (until byte 64; kind of use­less here)
55 56	38 00	Size of the pro­gram head­ers: 0x38 = 56 byte.
57 58	0b 00	Num­ber of pro­gram head­ers: 11
59 60	40 00	Size of sec­tion head­ers: 0x40 = 64 byte.
61 62	1e 00	Num­ber of sec­tion head­ers: 30
63 64	1d 00	Index of sec­tion head­er string table: 29

This infor­ma­tion can also be obtained with readelf -h /bin/ls.

ELF symbols

A sym­bol is a ref­er­ence to code or data like a vari­able or func­tion. There are usu­al­ly two sec­tions with sym­bol tables:

• .symtab con­tains all sym­bols and
• .dynsym con­tains only the dynam­ic / glob­al symbols.

Note that .symtab con­tains also all sym­bols from .dynsym. The sym­bols in .dynsym are all sym­bols need­ed at run­times. Sym­bols in .symtab can also be sym­bols from func­tions which were nev­er called (e.g. from a library). There­fore, some bina­ries strip the .symtab sec­tion alto­geth­er, which makes debug­ging hard­er but does­n’t affect execution.

ELF relocation

Relo­ca­tion is a tech­nique to resolve sym­bol ref­er­ences. If a ELF object ref­er­ences a func­tion in anoth­er library, the ref­er­ence is com­piled with a place­hold­er. As soon as it is com­piled into an exe­cutable bina­ry, the link­er resolves the place­hold­ers and ref­er­ences the address­es where the shared library is placed in the pro­gram’s memory.

Exam­ple: Com­pile the fol­low­ing C code

_start() {
foo();
}

with gcc -nostdlib -shared ref1.c -o ref1 and dis­sas­sem­ble the binary:

Disassembly of section .plt:

0000000000001000 <.plt>:
    1000:	ff 35 02 30 00 00    	pushq  0x3002(%rip)        # 4008 <_GLOBAL_OFFSET_TABLE_+0x8>
    1006:	ff 25 04 30 00 00    	jmpq   *0x3004(%rip)        # 4010 <_GLOBAL_OFFSET_TABLE_+0x10>
    100c:	0f 1f 40 00          	nopl   0x0(%rax)

0000000000001010 <foo@plt>:
    1010:	ff 25 02 30 00 00    	jmpq   *0x3002(%rip)        # 4018 <foo>
    1016:	68 00 00 00 00       	pushq  $0x0
    101b:	e9 e0 ff ff ff       	jmpq   1000 <.plt>

Disassembly of section .text:

0000000000001020 <_start>:
    1020:	55                   	push   %rbp
    1021:	48 89 e5             	mov    %rsp,%rbp
    1024:	b8 00 00 00 00       	mov    $0x0,%eax
    1029:	e8 e2 ff ff ff       	callq  1010 <foo@plt>
    102e:	90                   	nop
    102f:	5d                   	pop    %rbp
    1030:	c3                   	retq

See also

• Reverse Engi­neer­ing tools for the Lin­ux ELF
• Bina­ry patching
• Bina­ry injection