Tag Info

Hot answers tagged

26

Right from the man page you reference: elf - format of Executable and Linking Format (ELF) files ELF defines the binary format of executable files used by Linux. When you invoke an executable, the OS must know how to load the executable into memory properly, how to resolve dynamic library dependencies and then where to jump into the loaded executable to ...


19

There isn't a universal way, but you can make an educated guess by looking for things only done by one compiler. GCC is the easiest; it writes a .comment section that contains the GCC version string (the same string you get if you run gcc --version). I don't know if there's a way to display it with readelf, but with objdump it's: objdump -s --section ...


16

glibc has a configure option called --enable-kernel that lets you specify the minimum supported kernel version. When object files are linked with that glibc build, the linker adds a SHT_NOTE section to the resulting executable named .note.ABI-tag that includes that minimum kernel version. The exact format is defined in the LSB, and file knows to look for ...


8

If you want to limit yourself to ELF detection, you can read the ELF header of /proc/$PID/exe yourself. It's quite trivial: if the 5th byte in the file is 1, it's a 32-bit binary. If it's 2, it's 64-bit. For added sanity checking: If the first 5 bytes are 0x7f, "ELF", 1: it's a 32 bit ELF binary. If the first 5 bytes are 0x7f, "ELF", 2: it's a 64 bit ELF ...


8

Bash knows nothing about ELF. It simply sees that you asked it to run an external program, so it passes the name you gave it as-is to execve(2). Knowledge of things like executable file formats, shebang lines, and execute permissions lives behind that syscall, in the kernel. (It is the same for other shells, though they may choose to use another function in ...


7

You can try using the strings command. It will create a lot of text output; by checking it you might guess the compiler. pubuntu@pubuntu:~$ strings -a a.out |grep -i gcc GCC: (Ubuntu 4.4.3-4ubuntu5) 4.4.3 Here I know it's compiled with gcc but you can always redirect strings output to a file and examine it. There is one very good utility called peid ...


7

The following is a really good reference: http://www.ibm.com/developerworks/linux/library/l-dynamic-libraries/. It contains a bibliography at the end of a variety of different references at different levels. If you want to know every gory detail you can go straight to the source: http://www.akkadia.org/drepper/dsohowto.pdf. (Ulrich Drepper wrote the Linux ...


7

"Magic numbers" is the name given to constant sequences of bytes (usually) at the beginning of files, used to mark those files as being of a particular file format. They serve a similar purpose to file extensions. See the jargon file entry for more information. For example, PNG images always start with the same eight bytes: 137 80 78 71 13 10 26 10 Hence ...


6

A user generally encounters three types of ELF files—.o files, regular executables, and shared libraries. While all of these files serve different purposes, their internal structure files are quite similar. One universal concept among all different ELF file types (and also a.out and many other executable file formats) is the notion of a section. A section ...


6

I think that /bin/true has to be the oldest working .. Well, can you call a zero-byte file a binary? touch /tmp/old_true chmod 755 /tmp/old_true /tmp/old_true echo $?


6

You could check for references to function mcount (or possibly _mcount or __mcount according to Implementation of Profiling). This function is necessary for profiling to work, and should be absent for non-profiled binaries. Something like: $ readelf -s someprog | egrep "\s(_+)?mcount\b" && echo "Profiling is on for someprog" The above works on a ...


5

Like in the standard od command or hd, it means all the elided lines are the same as the preceding line. You can pass -v to make it display those lines anyway. From hexdump(1): The -v option causes hexdump to display all input data. Without the -v option, any number of groups of output lines, which would be identical to the immediately preceding group ...


5

Well of course it won't, because you won't have a C library anymore. All prelink does is to try and calculate an optimal load address for each library so that no program will have overlapping libraries, then update the libraries so that they default to loading at that address. Then when a program is run the libraries it uses are unlikely to need to be ...


5

No, it doesn't. It appears to mean that the version of libz you linked against when you compiled your program was built with different tools than the version on the madriva system you're using. The mandriva copy is missing symbol version info which was present in the copy of the libz library your program originally linked against. This has to do with ...


5

How about: readelf -p .comment a.out


4

You can also use this clever script that counts the numbers of various CPU instructions used by the binary. It is based on parsing objdump output. Beware that it can take quite a long time to finish if you use it on a big binary.


4

This doesn't exactly answer your question, but... First of all, ELF is the specification use by Linux for executable files (programs), shared libraries, and also object files which are the intermediate files found when compiling software. Object files end in .o, shared libraries end with .so followed by zero or more digits separated by periods, and ...


4

Look in /proc/$pid/maps. The address ranges are over 32-bit addresses (8 hexadecimal digits) or 64-bit addresses (16 hexadecimal digits). This works for any kind of executable, no matter what format. You can only get information about processes running as the same user (unless you're root). if ! [ -e /proc/$pid/maps ]; then echo No such process elif grep ...


4

In your ld.so.preload, you want to specify "$LIB" in your path rather than an explicit "lib" or "lib64". Thus, on a Redhat-style distro, "/usr/alternates/$LIB/libfoo.so" becomes "/usr/alternates/lib/libfoo.so" for a 32-bit process and "/usr/alternates/lib64/libfoo.so" for a 64-bit process. On an Debian-style distro, "/usr/alternates/$LIB/libfoo.so" becomes ...


3

Later edit: only this one does what jan needs: thank you huygens; find . -exec file {} \; | grep -i elf


3

ELF is a format and used by many programs of diff architecture. So all diff type of binary program use ELF only and CPU detect the processor/Architecture of the compiled program via e_machine field in ELF format. In ELF file format, different type of architectures have diff flags/value [e_machine field in the header ] to indicate the type.


3

You cannot. A program in binary form can only be executed in a machine with a compatible ISA (Instruction Set Architecture, see Wikipedia article). Intel maintains backward ISA compatibility in each processor generation as a newer ISA is always a superset of older ISA, and a program created for i386 will run on Pentium. However this is not the case between ...


3

There are few differences between ELF executables on different platforms. “UNIX - System V” is the common ground; System V is where the ELF format came from. The corresponding numerical value is 0. This value indicates that the executable doesn't use any OS-specific extension. Debian GNU/Linux, at least, configures GCC/binutils to generate executables with ...


3

That error, "no version information available", means that the version of libz that you linked against when you compiled the library is newer than the version on the mandrivia system you're using.


3

I admit that the following isn't a great answer, but I believe the 0x8048000 value is enshrined in the ELF Specification. See figures A.4, A.5 and A.6 in that doc. The System V ABI Intel 386 Architecture Supplement also standardizes on 0x8048000. See page 3-22, Figue 3-25. 0x804800 is prescribed as the low text segment address/high stack address. And ...


3

Initial research At first sight it would appear that the answer would be "no" the specification for ELF only allows the following sections. C32/kernel/bin/.process.o architecture: i386, flags 0x00000011: HAS_RELOC, HAS_SYMS start address 0x00000000 Sections: Idx Name Size VMA LMA File off Algn 0 .text 00000333 ...


3

The problem is /bin/ls don't just need the shared libraries, which you provided. It also needs the program that loads them; the linux loader. To solve your problem you can copy the loader from your system (usually /lib/ld-linux.so.2) to the location of your chroot (/mnt/foo/lib/ld-linux.so.2).


2

Type ldd ./trid both on the openSuse and Ubuntu system. I suspect you'll find that the latter is missing a library file.


2

The a.out file is still leftover from when compilers were using the a.out format. If you check the file with file a.out you will see it is actually in ELF format. To specify the name of the output file, use cc -o exec_name code.c.


2

What is allowed as section and section names depend on the file format. For ELF, the definition of the format define a bunch of them and their purpose and then says: Section names with a dot (.) prefix are reserved for the system, although applications may use these sections if their existing meanings are satisfactory. Applications may use names without ...



Only top voted, non community-wiki answers of a minimum length are eligible