Tag Info

Hot answers tagged

16

glibc has a configure option called --enable-kernel that lets you specify the minimum supported kernel version. When object files are linked with that glibc build, the linker adds a SHT_NOTE section to the resulting executable named .note.ABI-tag that includes that minimum kernel version. The exact format is defined in the LSB, and file knows to look for ...


16

There isn't a universal way, but you can make an educated guess by looking for things only done by one compiler. GCC is the easiest; it writes a .comment section that contains the GCC version string (the same string you get if you run gcc --version). I don't know if there's a way to display it with readelf, but with objdump it's: objdump -s --section ...


8

If you want to limit yourself to ELF detection, you can read the ELF header of /proc/$PID/exe yourself. It's quite trivial: if the 5th byte in the file is 1, it's a 32-bit binary. If it's 2, it's 64-bit. For added sanity checking: If the first 5 bytes are 0x7f, "ELF", 1: it's a 32 bit ELF binary. If the first 5 bytes are 0x7f, "ELF", 2: it's a 64 bit ELF ...


7

The following is a really good reference: http://www.ibm.com/developerworks/linux/library/l-dynamic-libraries/. It contains a bibliography at the end of a variety of different references at different levels. If you want to know every gory detail you can go straight to the source: http://www.akkadia.org/drepper/dsohowto.pdf. (Ulrich Drepper wrote the Linux ...


6

A user generally encounters three types of ELF files—.o files, regular executables, and shared libraries. While all of these files serve different purposes, their internal structure files are quite similar. One universal concept among all different ELF file types (and also a.out and many other executable file formats) is the notion of a section. A section ...


6

You could check for references to function mcount (or possibly _mcount or __mcount according to Implementation of Profiling). This function is necessary for profiling to work, and should be absent for non-profiled binaries. Something like: $ readelf -s someprog | egrep "\s(_+)?mcount\b" && echo "Profiling is on for someprog" The above works on a ...


5

No, it doesn't. It appears to mean that the version of libz you linked against when you compiled your program was built with different tools than the version on the madriva system you're using. The mandriva copy is missing symbol version info which was present in the copy of the libz library your program originally linked against. This has to do with ...


5

Well of course it won't, because you won't have a C library anymore. All prelink does is to try and calculate an optimal load address for each library so that no program will have overlapping libraries, then update the libraries so that they default to loading at that address. Then when a program is run the libraries it uses are unlikely to need to be ...


4

Look in /proc/$pid/maps. The address ranges are over 32-bit addresses (8 hexadecimal digits) or 64-bit addresses (16 hexadecimal digits). This works for any kind of executable, no matter what format. You can only get information about processes running as the same user (unless you're root). if ! [ -e /proc/$pid/maps ]; then echo No such process elif grep ...


4

This doesn't exactly answer your question, but... First of all, ELF is the specification use by Linux for executable files (programs), shared libraries, and also object files which are the intermediate files found when compiling software. Object files end in .o, shared libraries end with .so followed by zero or more digits separated by periods, and ...


4

You can try using the strings command. It will create a lot of text output; by checking it you might guess the compiler. pubuntu@pubuntu:~$ strings -a a.out |grep -i gcc GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3 Here I know it's compiled with gcc but you can always redirect strings output to a file and examine it. There is one very good utility called peid ...


4

Like in the standard od command or hd, it means all the elided lines are the same as the preceding line. You can pass -v to make it display those lines anyway. From hexdump(1): The -v option causes hexdump to display all input data. Without the -v option, any number of groups of output lines, which would be identical to the immediately preceding group ...


3

I admit that the following isn't a great answer, but I believe the 0x8048000 value is enshrined in the ELF Specification. See figures A.4, A.5 and A.6 in that doc. The System V ABI Intel 386 Architecture Supplement also standardizes on 0x8048000. See page 3-22, Figue 3-25. 0x804800 is prescribed as the low text segment address/high stack address. And ...


3

ELF is a format and used by many programs of diff architecture. So all diff type of binary program use ELF only and CPU detect the processor/Architecture of the compiled program via e_machine field in ELF format. In ELF file format, different type of architectures have diff flags/value [e_machine field in the header ] to indicate the type.


2

You cannot. A program in binary form can only be executed in a machine with a compatible ISA (Instruction Set Architecture, see Wikipedia article). Intel maintains backward ISA compatibility in each processor generation as a newer ISA is always a superset of older ISA, and a program created for i386 will run on Pentium. However this is not the case between ...


2

You can also use this clever script that counts the numbers of various CPU instructions used by the binary. It is based on parsing objdump output. Beware that it can take quite a long time to finish if you use it on a big binary.


1

When you run prelink on an ELF binary it will only inspect the binary itself and its dependencies (as referenced in the ELF .dynamic and .dynstr sections). You should be able to use: prelink --libs-only libone.so libtwo.so [...] If one library is dependent on another you may need to specify these together on the same command line (i.e. if they are not in ...


1

The flags in the output are BFD - Binary File Descriptors. They're part of the binutils package, you can read what the flags mean if you look in the bfd header file /usr/include/bfd.h for their meaning or here. The reference to the "flags" 0x00000112 is what's called a flag field. It's binary and each bit represents a particular feature, a one means the ...


1

I would look for regular files first as binary executable are belonging to that type of files. Then I would request for each regular file the mime type and if it matches application/x-executable then it is a binary executable files (that should match Linux executable files, Windows one for instance match application/x-dosexec). find . -type f -print0 | ...


1

Core dumps are also object files, of a sort, and usually in ELF format, too. Running this program will probably produce a file named "core": int main(int ac, char **av) { char *p = 0; *p = 'a'; return 0; } My file command says: core: ELF 32-bit LSB core file Intel 80386, version 1 (SYSV), SVR4-style, from './dump'


1

There are two methods . Both will give the same result objdump -s --section .comment path/to/binary Using readelf command, readelf -S binary will display the 40 section headers in the binary . Note the serial number of .comment section header. In my system , it showed as 27 (may be different for your case) readelf -x 30 path/to/binary -> which ...



Only top voted, non community-wiki answers of a minimum length are eligible