Questions tagged [elf]
ELF stands for Executable and Linkable Format, a file format for files containing machine code.
131
questions
1
vote
0
answers
36
views
ELF section to segment mapping and RWX rights
I have a classic "Hello world" C program built on Linux with gcc. The segments and sections in the built binary look like this:
Program Headers:
Type Offset VirtAddr ...
- 149
1
vote
0
answers
27
views
What sets little endian state when launching a ppc64le Linux kernel on POWER CPU?
I've been doing some research on ppc64le Linux and am unclear on how the POWER CPU is set to little endian. As I understand it the machine and CPU state will run as big endian by default in firmware. ...
0
votes
0
answers
37
views
Same binary & different permissions, How can it be?
I was doing a pwn ctf and found a weird situation.
The ctf includes binary file and a server.
There is a given elf 64 bit.
checksec output (same local & server).
Arch: amd64-64-little
RELRO: ...
- 1
1
vote
0
answers
91
views
Convert executable binary to dyamic library
Functionally, a binary (as in ELF binary which can be executed from the shell) is somewhat similar to a library in that both are files containing machine code for a particular target ABI in binary ...
- 1,125
1
vote
0
answers
58
views
What happened to a.out
I just started to wonder what ever happened to the original a.out binary file format and why it was superseded by ELF?
- 111
0
votes
1
answer
350
views
how to make an already compiled elf file execute another command
I have a need for when a ELF file gets executed it will execute a command.
For example:
Running /usr/bin/file which is an already compiled ELF Binary, execute the command touch /tmp/file_is_executed
...
- 105
0
votes
0
answers
165
views
How do I find out which shared object resolved the symbol used in an ELF?
I'm wondering if there's a systematic method I can use to determine which shared object is resolving a specific symbol without running the binary.
Assuming I look at curl, listing all of the shared ...
- 853
2
votes
1
answer
81
views
Why are some instances of the same version string in objdump -T enclosed in paranthesis?
Look at the following output snippet generated by running objdump -T on libc.so.6:
000000000009f8a0 g DF .text 000000000000001d (GLIBC_2.2.5) aio_write64
0000000000119d00 g DF .text ...
- 121
1
vote
1
answer
57
views
How do unix systems call into an application?
I am currently implementing a C runtime library for the Arm64 platform, and I am unsure which assumptions I can make about the environment at the precise point that the application is executed (what ...
- 11
0
votes
1
answer
352
views
What does Base in objdump dynamic symbol table mean?
Consider the following truncated output from running objdump -T (Prints dynamic symbol table entries) on the GNU ls utility.
/usr/bin/ls: file format elf64-x86-64
DYNAMIC SYMBOL TABLE:
...
- 121
1
vote
0
answers
1k
views
Real meaning on "ELF 64-bit LSB shared object"
How can ELF 64-bit LSB shared object be executable that is readilt executed/launched right away, isn't it opposing the word terms "shared object" (Windows equivalent to dynamic link) ?
user536152
1
vote
0
answers
133
views
What's the difference between _init vs _start?
_start runs first, even though _init is pointed to by the DT_INIT dynamic entry as the initialization function.
Could someone explain to me the purpose of DT_INIT if it seems to serve no purpose as ...
0
votes
1
answer
123
views
.got.plt not loaded into memory
I have an aarch64 process (cat) running on an Android (8). I notice this section in /proc/<PID/maps:
746f308000-746f3de000 r-xp 00000000 103:00 5402 /system/lib64/libc++.so
746f3de000-...
- 697
1
vote
1
answer
164
views
LOAD segment not loaded
While examining the /proc/<PID>/maps file for an aarch64 process running on an Android (8), I notice this section:
726048e000-7260564000 r-xp 00000000 103:00 5402 /system/lib64/libc++.so
...
- 697
1
vote
2
answers
684
views
Figuring out location of a loaded shared library
I'm maintaining a C-program, that uses Oracle client libraries. The libraries expect the ORACLE_HOME environment variable to be set, and fail to work without it -- in many cases.
In our situation, the ...
- 814
0
votes
1
answer
216
views
What option provide to CMake to demangle stackframe output?
To print the stackframe this method is used. But it prints mostly executable name with addresses.
0 ./fish(+0xa307b) [0x556c9198c07b]
1 ./fish(+0xb0cf2) [0x556c91999cf2]
2 ./fish(+0xb218a) [...
- 103
1
vote
1
answer
223
views
What purpose does ELF's stack-size metadata have?
I was reading the Rust Unstable Book, and I saw a new feature for emit-stack-sizes,
The rustc flag -Z emit-stack-sizes makes LLVM emit stack size metadata.
It goes on to say
NOTE: This LLVM feature ...
- 29k
3
votes
1
answer
1k
views
ELF symbol: GLOBAL+HIDDEN
Based on eg. this Oracle description:
STB_GLOBAL
Global symbols. These symbols are visible to all object files being combined. One file's definition of a global symbol will satisfy another file's ...
1
vote
1
answer
435
views
How do `nm` choose the character to print for each symbol type?
I'm currently doing a nm like program, to print the symbols of an ELF file with their addresses and their type.
The typical output is something like :
$ nm ./my_exec
0000000000003d28 d _DYNAMIC
...
- 21
1
vote
1
answer
1k
views
ELF: Dump paths to .so files imported by binary
I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls)
Using readelf --dyn-syms /usr/bin/ls I get the name of the libraries, but not where they are ...
- 663
1
vote
0
answers
66
views
Tracking down symbols used by library in binary ELF as listed in memory map
I have an application written in C++ that crashed during exit. The reason for the crash is understood, there are references to different versions of the same library mixed inside the executable. This ...
- 11
0
votes
0
answers
873
views
Usage of objcopy / elfedit to patchelf symbol (versions) in elf file
The context is as follows: on my o.s. there is (already) liba.so.v2 of "liba" which contains the string 'symbol_version-2' as the symbol version for its functions , e.g. functionX@version-2 ...
- 11
1
vote
1
answer
967
views
Modify a string literal in ELF x86_64 file
I have a ELF x86_64 (basically an executable file) and I'd like to replace a string literal within the file (without corrupting the executable file however)... and I should do that programmatically ...
- 133
1
vote
0
answers
458
views
Qemu permision denied, but using sudo
I tried loading a i386 firmware file and its also distributed as an elf file,
but executing
sudo qemu-i386 file.elf
Error while loading file.elf: Permission denied
How do I get more information why ...
- 51
1
vote
1
answer
1k
views
How to tell whether the p_vaddr in ELF program header is the real memory address or is just an offset from the shared library base address?
I'm trying to locate where the libc program segments are in a program's memory, by reading the program headers.
On Centos 6, when I use readelf on the libc.so.6 file, the VirtAddr contains the correct ...
- 21
10
votes
1
answer
776
views
Can I skip syscalls made by the dynamic loader in strace?
When I use strace to examine a program, I often have a hard time finding where the syscalls from the dynamic loader end and the syscalls from the program begin.
The output from strace ./hello where ...
- 327
1
vote
0
answers
168
views
Size of ELF function including called functions
Is there a program which is able to determine the size (in bytes) of some function in an ELF binary recursively including every function called from within that function?
- 195
1
vote
0
answers
184
views
How to inspect the memory map of the kernel given "root" privileges?
I use pmap <pid> for inspecting the memory map of the user-space process <pid>.
How to inspect the memory map of the kernel given "root" privileges (i.e. all capabilities)?
The ...
- 4,073
3
votes
1
answer
1k
views
ELF Magic meaning of "7f" magic number?
I am studying ELF binary anatomy / structure and there are lots and lots of resources out there that describes what the ELF magic is. I understand the 45 4c 46 = ELF signature thing but what no source ...
- 153
0
votes
1
answer
199
views
the value of system calls are 0 in symbol table
i use the following command to see the symbol table of my binary:
readelf -s mybinary
you can see part of the output below:
as you can see the value of all system calls such as printf and exit are ...
- 1
1
vote
0
answers
2k
views
Ptrace: Function Not Implemented in GDB Installed on Multiarch/Qemu-User-Static Arm64v8/Alpine Docker Container
I want to debug an aarch64 ELF using GDB installed on an arm64v8/alpine docker on my x86_64 16.04 Ubuntu VirtualBox, which itself is installed on my Mac. In particular, to set up the docker I use the ...
- 135
2
votes
1
answer
151
views
How does a new process executed in Bash always has the same environment variables?
A while ago I was exploring a simple C program's ELF binary using GDB.
I saw that the environment variables that are printed when I run printenv in the terminal are also present at the top of the ...
- 23
-1
votes
1
answer
453
views
What is necessary and sufficient condition for an ELF object file to be a shared library or a relocatable object file?
Stephen Kitt wrote in https://unix.stackexchange.com/a/448943
any ELF object with an entry point can be an executable, regardless of its other properties.
and ld.so is both an executable (because of ...
- 99k
0
votes
1
answer
453
views
What is "shared executables"?
Stephen Kitt wrote in https://unix.stackexchange.com/a/448943/674
ld.so is a shared ELF object, but it doesn’t require an interpreter (it
has no .interp entry); this is typical of libraries (shared
...
- 99k
0
votes
1
answer
535
views
In what form of ELF is a core dump file?
https://en.wikipedia.org/wiki/Executable_and_Linkable_Format mentions core dumps.
In what form of ELF is a core dump file? Relocatable, executable, or shared?
CSAPP says
7.3 Object Files
Object files ...
- 99k
0
votes
2
answers
2k
views
Where is the linux kernel elf file located?
If the Linux kernel by itself is an ELF file, where can I find its ELF file?
- 11
1
vote
0
answers
1k
views
Linux Executable fails to run with error “/usr/bin/strace: exec: No such file or directory” on running strace
I need to analyse linux binary executable file using strace for capturing the system calls. On running the command:
/usr/bin/strace ./005f32fffe1da3bc100e7dcd8b2f8f2c
I got this error:
execve("./...
- 11
1
vote
0
answers
477
views
How to debug the problom? An elf file cannot be run, but the printing from the ldd and file seems no problem
some command printing:
$ ./omnetpp ...
- 248
0
votes
0
answers
218
views
Linux: Where and how is ELF object file header used?
Does anyone know where in the shell, fork(), exec() sequence ELF are read and used by the loader? Linux can be used as an example.
I ask because it's my understanding ELF has information about ...
- 195
1
vote
1
answer
1k
views
How are stack traces reconstructed from a coredump?
The coredumpctl utility displays a stack trace of the program when the coredump has been created.
For example, on a firefox coredump:
Stack trace of thread 14469:
#0 0x00007f0ac652d3bd ...
- 135
5
votes
0
answers
3k
views
Disassemble ELF binary without section headers (program headers only) using objdump
I've got an ELF binary that contains nothing but two LOAD segments in the program header table, one for code and one for data. readelf -a tells me there's no section headers.
If I attempt do ...
- 219
1
vote
0
answers
326
views
Official ELF reference & ignoring DT_RPATH in shared libraries
What is the official ELF format reference for Linux?
There is the ELF 1.2 specification, which is from 1995 and outdated (does not include DT_RUNPATH for instance).
But apart from that, it seems ...
- 131
2
votes
0
answers
791
views
Only list direct (resolved) dependency paths with ldd, readelf or objdump
With ldd I can get a flat list of unique, fully resolved paths to all shared libraries that an executable depends on.
For a script where I'm bundling a binary, I'm copying over these shared libs. ...
- 131
2
votes
1
answer
685
views
Any automatic way of obtaining the ELF section an address resides in?
Suppose I've the address of some string or symbol in an ELF binary output by e.g. strings -a and want to know what section that address resides in.
Normally, I would do objdump -h and manually find ...
- 4,073
0
votes
0
answers
3k
views
How to list imported functions (.plt) for an ELF executable without disassembling using objdump?
Currently, I check for imported functions (.plt) using objdump:
objdump -D -j .plt myprog | grep '@plt'
However, it doesn't seem right to have objdump output annotated disassembly to grep to list ...
- 4,073
2
votes
1
answer
4k
views
Why doesn't objdump display any entries for the .got section of the ELF binary?
I know of the relationship between the .plt and .got sections in an ELF binary, i.e. that corresponding entries must exist in each section for each dynamically loaded function (shared library).
...
- 4,073
5
votes
0
answers
791
views
How does linux decide the load address and entry point when execve an ELF?
When linux execve() an ELF, it will mmap that ELF into the process's memory space and start to run code from the entry point. But how does the kernel decide the load address and entry point of the ELF?...
- 1,337
10
votes
2
answers
4k
views
How does the ELF loader determine the initial stack size?
I'm studying the ELF specification (http://www.skyfree.org/linux/references/ELF_Format.pdf), and one point that is not clear to me about the program loading process is how the stack is initialized, ...
- 225
0
votes
1
answer
589
views
Ubuntu - Can't execute binaries unless they reside in /var/lib/php/session/
I noticed this weird issue in a Ubuntu 18.04 (Bionic Beaver) box and a couple of other Debian-based systems -- I will take statically linked netcat binary (a unix networking tool) for the sake of ...
- 431
0
votes
2
answers
894
views
$LIB variable does not expand to anything in Ubuntu Server 18.10
I have the same exact problem as this question previously posted, where /etc/ld.so.preload does not intercept the right architecture. A little background: I have compiled a shared object (64-bit) that ...
- 431