2022 Developer Survey is open! Take survey.

Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code.

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

ELF symbol: GLOBAL+HIDDEN

Based on eg. this Oracle description: STB_GLOBAL Global symbols. These symbols are visible to all object files being combined. One file's definition of a global symbol will satisfy another file's ...
user avatar
0 votes
1 answer
30 views

How do `nm` choose the character to print for each symbol type?

I'm currently doing a nm like program, to print the symbols of an ELF file with their addresses and their type. The typical output is something like : $ nm ./my_exec 0000000000003d28 d _DYNAMIC ...
user avatar
  • 11
1 vote
1 answer
77 views

ELF: Dump paths to .so files imported by binary

I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls) Using readelf --dyn-syms /usr/bin/ls I get the name of the libraries, but not where they are ...
user avatar
1 vote
0 answers
21 views

Tracking down symbols used by library in binary ELF as listed in memory map

I have an application written in C++ that crashed during exit. The reason for the crash is understood, there are references to different versions of the same library mixed inside the executable. This ...
user avatar
0 votes
0 answers
146 views

Usage of objcopy / elfedit to patchelf symbol (versions) in elf file

The context is as follows: on my o.s. there is (already) liba.so.v2 of "liba" which contains the string 'symbol_version-2' as the symbol version for its functions , e.g. functionX@version-2 ...
user avatar
  • 1
1 vote
1 answer
194 views

Modify a string literal in ELF x86_64 file

I have a ELF x86_64 (basically an executable file) and I'd like to replace a string literal within the file (without corrupting the executable file however)... and I should do that programmatically ...
user avatar
  • 111
0 votes
0 answers
64 views

Qemu permision denied, but using sudo

I tried loading a i386 firmware file and its also distributed as an elf file, but executing sudo qemu-i386 file.elf Error while loading file.elf: Permission denied How do I get more information why ...
user avatar
  • 21
0 votes
0 answers
36 views

how to build arm fdpic toolchain?

I've successfully compiled and ran Linux kernel on stm32H7 board (arm cortex-m7) now I want to write applications on it but unfortunately because it won't have a virtual memory (MMU), it can't run ...
user avatar
1 vote
1 answer
198 views

How to tell whether the p_vaddr in ELF program header is the real memory address or is just an offset from the shared library base address?

I'm trying to locate where the libc program segments are in a program's memory, by reading the program headers. On Centos 6, when I use readelf on the libc.so.6 file, the VirtAddr contains the correct ...
user avatar
11 votes
1 answer
619 views

Can I skip syscalls made by the dynamic loader in strace?

When I use strace to examine a program, I often have a hard time finding where the syscalls from the dynamic loader end and the syscalls from the program begin. The output from strace ./hello where ...
user avatar
  • 147
1 vote
0 answers
20 views

Size of ELF function including called functions

Is there a program which is able to determine the size (in bytes) of some function in an ELF binary recursively including every function called from within that function?
user avatar
  • 186
0 votes
0 answers
18 views

Copy content of .got section

I have built a custom glibc library in order to extract some data and add custom functions to be used later. Since my work has to do with dynamic linking (lazy binding) I am searching for a way to ...
user avatar
0 votes
0 answers
72 views

How to inspect the memory map of the kernel given "root" privileges?

I use pmap <pid> for inspecting the memory map of the user-space process <pid>. How to inspect the memory map of the kernel given "root" privileges (i.e. all capabilities)? The ...
user avatar
  • 3,307
3 votes
1 answer
463 views

ELF Magic meaning of "7f" magic number?

I am studying ELF binary anatomy / structure and there are lots and lots of resources out there that describes what the ELF magic is. I understand the 45 4c 46 = ELF signature thing but what no source ...
user avatar
  • 151
0 votes
1 answer
48 views

the value of system calls are 0 in symbol table

i use the following command to see the symbol table of my binary: readelf -s mybinary you can see part of the output below: as you can see the value of all system calls such as printf and exit are ...
user avatar
  • 1
1 vote
0 answers
1k views

Ptrace: Function Not Implemented in GDB Installed on Multiarch/Qemu-User-Static Arm64v8/Alpine Docker Container

I want to debug an aarch64 ELF using GDB installed on an arm64v8/alpine docker on my x86_64 16.04 Ubuntu VirtualBox, which itself is installed on my Mac. In particular, to set up the docker I use the ...
user avatar
  • 135
2 votes
1 answer
59 views

How does a new process executed in Bash always has the same environment variables?

A while ago I was exploring a simple C program's ELF binary using GDB. I saw that the environment variables that are printed when I run printenv in the terminal are also present at the top of the ...
user avatar
-2 votes
1 answer
183 views

What is necessary and sufficient condition for an ELF object file to be a shared library or a relocatable object file?

Stephen Kitt wrote in https://unix.stackexchange.com/a/448943 any ELF object with an entry point can be an executable, regardless of its other properties. and ld.so is both an executable (because of ...
user avatar
  • 89.8k
0 votes
1 answer
175 views

What is "shared executables"?

Stephen Kitt wrote in https://unix.stackexchange.com/a/448943/674 ld.so is a shared ELF object, but it doesn’t require an interpreter (it has no .interp entry); this is typical of libraries (shared ...
user avatar
  • 89.8k
0 votes
1 answer
248 views

In what form of ELF is a core dump file?

https://en.wikipedia.org/wiki/Executable_and_Linkable_Format mentions core dumps. In what form of ELF is a core dump file? Relocatable, executable, or shared? CSAPP says 7.3 Object Files Object files ...
user avatar
  • 89.8k
-1 votes
2 answers
742 views

Where is the linux kernel elf file located?

If the Linux kernel by itself an ELF file, where can I find this file?
user avatar
1 vote
0 answers
770 views

Linux Executable fails to run with error “/usr/bin/strace: exec: No such file or directory” on running strace

I need to analyse linux binary executable file using strace for capturing the system calls. On running the command: /usr/bin/strace ./005f32fffe1da3bc100e7dcd8b2f8f2c I got this error: execve("./...
user avatar
  • 11
1 vote
0 answers
393 views

How to debug the problom? An elf file cannot be run, but the printing from the ldd and file seems no problem

some command printing: $ ./omnetpp ...
user avatar
  • 248
0 votes
0 answers
167 views

Linux: Where and how is ELF object file header used?

Does anyone know where in the shell, fork(), exec() sequence ELF are read and used by the loader? Linux can be used as an example. I ask because it's my understanding ELF has information about ...
user avatar
  • 193
1 vote
1 answer
555 views

How are stack traces reconstructed from a coredump?

The coredumpctl utility displays a stack trace of the program when the coredump has been created. For example, on a firefox coredump: Stack trace of thread 14469: #0 0x00007f0ac652d3bd ...
user avatar
  • 125
3 votes
0 answers
2k views

Disassemble ELF binary without section headers (program headers only) using objdump

I've got an ELF binary that contains nothing but two LOAD segments in the program header table, one for code and one for data. readelf -a tells me there's no section headers. If I attempt do ...
user avatar
  • 199
1 vote
0 answers
235 views

Official ELF reference & ignoring DT_RPATH in shared libraries

What is the official ELF format reference for Linux? There is the ELF 1.2 specification, which is from 1995 and outdated (does not include DT_RUNPATH for instance). But apart from that, it seems ...
user avatar
  • 131
2 votes
0 answers
487 views

Only list direct (resolved) dependency paths with ldd, readelf or objdump

With ldd I can get a flat list of unique, fully resolved paths to all shared libraries that an executable depends on. For a script where I'm bundling a binary, I'm copying over these shared libs. ...
user avatar
  • 131
2 votes
1 answer
75 views

Any automatic way of obtaining the ELF section an address resides in?

Suppose I've the address of some string or symbol in an ELF binary output by e.g. strings -a and want to know what section that address resides in. Normally, I would do objdump -h and manually find ...
user avatar
  • 3,307
0 votes
0 answers
2k views

How to list imported functions (.plt) for an ELF executable without disassembling using objdump?

Currently, I check for imported functions (.plt) using objdump: objdump -D -j .plt myprog | grep '@plt' However, it doesn't seem right to have objdump output annotated disassembly to grep to list ...
user avatar
  • 3,307
1 vote
1 answer
3k views

Why doesn't objdump display any entries for the .got section of the ELF binary?

I know of the relationship between the .plt and .got sections in an ELF binary, i.e. that corresponding entries must exist in each section for each dynamically loaded function (shared library). ...
user avatar
  • 3,307
5 votes
0 answers
433 views

How does linux decide the load address and entry point when execve an ELF?

When linux execve() an ELF, it will mmap that ELF into the process's memory space and start to run code from the entry point. But how does the kernel decide the load address and entry point of the ELF?...
user avatar
10 votes
2 answers
3k views

How does the ELF loader determine the initial stack size?

I'm studying the ELF specification (http://www.skyfree.org/linux/references/ELF_Format.pdf), and one point that is not clear to me about the program loading process is how the stack is initialized, ...
user avatar
0 votes
1 answer
285 views

Ubuntu - Can't execute binaries unless they reside in /var/lib/php/session/

I noticed this weird issue in a Ubuntu 18.04 (Bionic Beaver) box and a couple of other Debian-based systems -- I will take statically linked netcat binary (a unix networking tool) for the sake of ...
user avatar
  • 371
0 votes
2 answers
758 views

$LIB variable does not expand to anything in Ubuntu Server 18.10

I have the same exact problem as this question previously posted, where /etc/ld.so.preload does not intercept the right architecture. A little background: I have compiled a shared object (64-bit) that ...
user avatar
  • 371
5 votes
1 answer
530 views

Are .text sections shared between loaded ELF executables?

If one program, for example grep, is curretly running, and a user executes another instance, do the two instances share the read-only .text sections between them to save memory? Would the sharing of ...
user avatar
  • 419
2 votes
0 answers
557 views

Is there a standard for the Linux user-space memory map?

I'm contemplating a project where I would use a memory mapped file that is shared between multiple processes, and in order to be able to use pointer values in the mapped region in all those processes*,...
user avatar
  • 273
2 votes
2 answers
1k views

Different standards of ELF (SysV vs TIS) and Linux?

There are at least two standards of Executable and Linkable Format (ELF), one of them System V Application Binary Interface AMD64 Architecture Processor Supplement (With LP64 and ILP32 Programming ...
user avatar
  • 22.5k
0 votes
1 answer
466 views

Understanding the objcopy command in a book [closed]

I am reading a book and it's talking about ELF's. I understand it's a file format for executable files. There's a command that I executed on a VM and I'm having trouble understanding what it does. ...
user avatar
1 vote
1 answer
2k views

What happened to elfsign and elfverify?

In "Uninformed Research -- informative information for the uninformed." 2003 mentions a tool called elfsign and elfverify. This is a tool to checksum and sign an ELF binary. I can't find that tool in ...
user avatar
  • 22.5k
1 vote
2 answers
1k views

Why do some libc symbols have WEAK binding and others GLOBAL?

Why are different symbols in libc declared with different bindings, 1510 0x0003d200 0xf7d55200 WEAK FUNC 55 system 454 0x00067b40 0xf7d7fb40 WEAK FUNC 474 puts 147 0x000303d0 0xf7d483d0 ...
user avatar
  • 22.5k
-2 votes
1 answer
1k views

if a global or static C variable is not explicitly initialized, but implicitly initialized, is it in .data or .bss section? [closed]

Computer Systems: A Programmer's Perspective says about two sections in a ELF relocatable object file: .data Initialized global and static C variables. Local C variables are maintained at run ...
user avatar
  • 89.8k
1 vote
1 answer
671 views

Are the addresses inside a shared library file virtual addresses, or relocatable addresses?

Are the addresses inside a shared library file virtual addresses, or relocatable addresses? Does the answer depend on whether the shared library file was built with GCC’s -fPIC option? Originated ...
user avatar
  • 89.8k
4 votes
2 answers
4k views

What is the difference between Shared object file and Relocatable file?

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says The type field tells us what the purpose of the file is. There are a few common file types. CORE (value 4) DYN (...
user avatar
  • 89.8k
2 votes
2 answers
2k views

What ELF types do kernel itself and kernel modules have?

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says The type field tells us what the purpose of the file is. There are a few common file types. CORE (value 4) DYN (...
user avatar
  • 89.8k
4 votes
1 answer
3k views

What are difference between the ELF symbol visibility levels?

The NASM docs on "elf Extensions to the GLOBAL Directive" say, Optionally, you can control the ELF visibility of the symbol. Just add one of the visibility keywords: default, internal, hidden, or ...
user avatar
  • 22.5k
9 votes
2 answers
10k views

What is the difference between "LSB executable" (ET_EXEC) and "LSB shared object" (ET_DYN)?

With two files, one compiled and linked with gcc and the other manually with nasm and ld I get ELF 32-bit LSB shared object ... ELF 32-bit LSB executable ... What's the difference between these two ...
user avatar
  • 22.5k
1 vote
1 answer
1k views

What is the number in readelf symbol table name?

I have a local static variable, something like this: void function(void) { static unsigned char myVariable = 0; ... I dump the symbol table using readelf as follows: readelf -s myprogram....
user avatar
  • 113
0 votes
1 answer
594 views

Determine kernel symbol offset from elf file

i have extracted the ELF file(stripped) from an bzImage using extract-vmlinux and extracted the __ksymtab and __ksymtab_strings sections afterwards. How can i calculate the offset of an arbitrary ...
user avatar
0 votes
1 answer
216 views

is uboot.bin location-independent?

ubootgenerate uboot.bin and uboot.elf. uboot.bin is used to burn to flash, at the start address of the CPU. uboot.elf is not very useful. NOTE: I think uboot.bin/uboot.elf are all location-...
user avatar
  • 101