Skip to main content
The 2024 Developer Survey results are live! See the results

Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code.

Filter by
Sorted by
Tagged with
0 votes
0 answers
52 views

Calculation of relocation address; ELF

I am learning about the relocation from the ELF reference and this blog, but I can't get my head around calculating the relocation address. Suppose we have two files A and B of type ET_REL, we want ...
Question's user avatar
8 votes
1 answer
2k views

Why can an aarch64 ELF executable be run on an x86_64 machine?

I compiled a simple "Hello World" C program on Raspberry Pi 3, which was then transferred to an AMD64 laptop. Out of curiosity, I executed it, and it runs even though I did not expect it to: ...
pico's user avatar
  • 93
1 vote
0 answers
57 views

Why can't linux use $ORIGIN to find the loader (aka interpreter)

When compiling a binary on Linux there's this thing called the RPATH, which tells the dynamic loader where to look for the shared objects. What I like about the RPATH is that you can vendor a ...
the_the_the's user avatar
1 vote
1 answer
117 views

Why the same offset of two sections in ELF?

Recently I noticed something in several ELF files which looks for me a bit suspicious under Linux. Taking for example "/bin/ls" file and running readelf on it I can see following: There are ...
user2699113's user avatar
1 vote
0 answers
51 views

why some android elf file has interpreter path?

I am learning the elf file format for Android, but I have found that some elf files can specify the loader through the interpreter path in the program header. However, the elf test file I wrote myself ...
金坷垃金银花茶's user avatar
-1 votes
1 answer
84 views

Why do I get different results when running a program with ld-linux.so and when changing the interpreter with patchelf?

What's the difference between running a program with ld + --library-path and with changing the loader with patchelf? To illustrate, here is a binary that wouldn't run as is, presumably because of lack ...
ychaouche's user avatar
  • 998
3 votes
0 answers
97 views

Why is my 32 bit programs load in 3GB address space mode?

I have noticed, that Manjaro Linux (kernel 6.6.8) loads 32 bit executable files with ADDR_LIMIT_3GB set. Or as: setarch -B --3g. But I have a clear memory, that earlier it was not the case and 32 bit ...
johnfound's user avatar
  • 263
2 votes
2 answers
499 views

Why is path to the interpreter hardcoded in ELF executables?

(This is a general question and not a complaint -- there is probably a good explanation for this.) For a compiled executable, why is path to the interpreter hard-coded into the binary as opposed to ...
Cigarette Smoking Man's user avatar
0 votes
0 answers
37 views

Should we boot the FreeBSD kernel in ELF format or in zImage format ? How?

we have just virtualized Debian 12 on our arm (32 bit) Chromebook. As host / dom0 we have chosen Devuan 5,and for guest / domU,Debian 12. It works great. But our goal is different. We want to ...
Marietto's user avatar
  • 549
75 votes
1 answer
10k views

Why is 'H' / 72 / 0x48 the second most common byte in executables?

(If the score of this question is 72, please don't upvote!) I ran this: cat /usr/bin/* | perl -ne 'map {$a{$_}++} split//; END{print map { "$a{$_}\t$_\n" } keys %a}' | grep --text . | ...
Ole Tange's user avatar
  • 35.8k
1 vote
0 answers
277 views

ELF section to segment mapping and RWX rights

I have a classic "Hello world" C program built on Linux with gcc. The segments and sections in the built binary look like this: Program Headers: Type Offset VirtAddr ...
mrn's user avatar
  • 149
1 vote
0 answers
68 views

What sets little endian state when launching a ppc64le Linux kernel on POWER CPU?

I've been doing some research on ppc64le Linux and am unclear on how the POWER CPU is set to little endian. As I understand it the machine and CPU state will run as big endian by default in firmware. ...
Damien Stewart's user avatar
0 votes
0 answers
47 views

Same binary & different permissions, How can it be?

I was doing a pwn ctf and found a weird situation. The ctf includes binary file and a server. There is a given elf 64 bit. checksec output (same local & server). Arch: amd64-64-little RELRO: ...
Ori's user avatar
  • 1
1 vote
0 answers
414 views

Convert executable binary to dyamic library

Functionally, a binary (as in ELF binary which can be executed from the shell) is somewhat similar to a library in that both are files containing machine code for a particular target ABI in binary ...
user149408's user avatar
  • 1,343
1 vote
0 answers
81 views

What happened to a.out

I just started to wonder what ever happened to the original a.out binary file format and why it was superseded by ELF?
Whitequill Riclo's user avatar
0 votes
1 answer
1k views

how to make an already compiled elf file execute another command

I have a need for when a ELF file gets executed it will execute a command. For example: Running /usr/bin/file which is an already compiled ELF Binary, execute the command touch /tmp/file_is_executed ...
Noft's user avatar
  • 105
3 votes
1 answer
111 views

Why are some instances of the same version string in objdump -T enclosed in paranthesis?

Look at the following output snippet generated by running objdump -T on libc.so.6: 000000000009f8a0 g DF .text 000000000000001d (GLIBC_2.2.5) aio_write64 0000000000119d00 g DF .text ...
Harsh's user avatar
  • 151
1 vote
1 answer
67 views

How do unix systems call into an application?

I am currently implementing a C runtime library for the Arm64 platform, and I am unsure which assumptions I can make about the environment at the precise point that the application is executed (what ...
lte678's user avatar
  • 11
1 vote
1 answer
713 views

What does Base in objdump dynamic symbol table mean?

Consider the following truncated output from running objdump -T (Prints dynamic symbol table entries) on the GNU ls utility. /usr/bin/ls: file format elf64-x86-64 DYNAMIC SYMBOL TABLE: ...
Harsh's user avatar
  • 151
1 vote
0 answers
2k views

Real meaning on "ELF 64-bit LSB shared object"

How can ELF 64-bit LSB shared object be executable that is readilt executed/launched right away, isn't it opposing the word terms "shared object" (Windows equivalent to dynamic link) ?
user avatar
1 vote
0 answers
257 views

What's the difference between _init vs _start?

_start runs first, even though _init is pointed to by the DT_INIT dynamic entry as the initialization function. Could someone explain to me the purpose of DT_INIT if it seems to serve no purpose as ...
RabidProgrammer555's user avatar
0 votes
1 answer
150 views

.got.plt not loaded into memory

I have an aarch64 process (cat) running on an Android (8). I notice this section in /proc/<PID/maps: 746f308000-746f3de000 r-xp 00000000 103:00 5402 /system/lib64/libc++.so 746f3de000-...
Daniel Walker's user avatar
1 vote
1 answer
227 views

LOAD segment not loaded

While examining the /proc/<PID>/maps file for an aarch64 process running on an Android (8), I notice this section: 726048e000-7260564000 r-xp 00000000 103:00 5402 /system/lib64/libc++.so ...
Daniel Walker's user avatar
1 vote
2 answers
1k views

Figuring out location of a loaded shared library

I'm maintaining a C-program, that uses Oracle client libraries. The libraries expect the ORACLE_HOME environment variable to be set, and fail to work without it -- in many cases. In our situation, the ...
Mikhail T.'s user avatar
0 votes
1 answer
317 views

What option provide to CMake to demangle stackframe output?

To print the stackframe this method is used. But it prints mostly executable name with addresses. 0 ./fish(+0xa307b) [0x556c9198c07b] 1 ./fish(+0xb0cf2) [0x556c91999cf2] 2 ./fish(+0xb218a) [...
amordo's user avatar
  • 113
1 vote
1 answer
377 views

What purpose does ELF's stack-size metadata have?

I was reading the Rust Unstable Book, and I saw a new feature for emit-stack-sizes, The rustc flag -Z emit-stack-sizes makes LLVM emit stack size metadata. It goes on to say NOTE: This LLVM feature ...
Evan Carroll's user avatar
  • 31.8k
3 votes
1 answer
2k views

ELF symbol: GLOBAL+HIDDEN

Based on eg. this Oracle description: STB_GLOBAL Global symbols. These symbols are visible to all object files being combined. One file's definition of a global symbol will satisfy another file's ...
Moutaineer of Mariana trench's user avatar
1 vote
1 answer
719 views

How do `nm` choose the character to print for each symbol type?

I'm currently doing a nm like program, to print the symbols of an ELF file with their addresses and their type. The typical output is something like : $ nm ./my_exec 0000000000003d28 d _DYNAMIC ...
hollow's user avatar
  • 21
2 votes
1 answer
2k views

ELF: Dump paths to .so files imported by binary

I am trying to dump the full paths of the shared libraries that are imported by an ELF file (/usr/bin/ls) Using readelf --dyn-syms /usr/bin/ls I get the name of the libraries, but not where they are ...
dcom-launch's user avatar
1 vote
0 answers
87 views

Tracking down symbols used by library in binary ELF as listed in memory map

I have an application written in C++ that crashed during exit. The reason for the crash is understood, there are references to different versions of the same library mixed inside the executable. This ...
codeZonkey's user avatar
0 votes
0 answers
1k views

Usage of objcopy / elfedit to patchelf symbol (versions) in elf file

The context is as follows: on my o.s. there is (already) liba.so.v2 of "liba" which contains the string 'symbol_version-2' as the symbol version for its functions , e.g. functionX@version-2 ...
cg79's user avatar
  • 21
1 vote
1 answer
2k views

Modify a string literal in ELF x86_64 file

I have a ELF x86_64 (basically an executable file) and I'd like to replace a string literal within the file (without corrupting the executable file however)... and I should do that programmatically ...
Morix Dev's user avatar
  • 133
1 vote
0 answers
752 views

Qemu permision denied, but using sudo

I tried loading a i386 firmware file and its also distributed as an elf file, but executing sudo qemu-i386 file.elf Error while loading file.elf: Permission denied How do I get more information why ...
CodeAsm's user avatar
  • 51
1 vote
1 answer
2k views

How to tell whether the p_vaddr in ELF program header is the real memory address or is just an offset from the shared library base address?

I'm trying to locate where the libc program segments are in a program's memory, by reading the program headers. On Centos 6, when I use readelf on the libc.so.6 file, the VirtAddr contains the correct ...
jdkleuver's user avatar
10 votes
1 answer
883 views

Can I skip syscalls made by the dynamic loader in strace?

When I use strace to examine a program, I often have a hard time finding where the syscalls from the dynamic loader end and the syscalls from the program begin. The output from strace ./hello where ...
jrpear's user avatar
  • 444
1 vote
0 answers
191 views

Size of ELF function including called functions

Is there a program which is able to determine the size (in bytes) of some function in an ELF binary recursively including every function called from within that function?
Peter's user avatar
  • 205
2 votes
0 answers
371 views

How to inspect the memory map of the kernel given "root" privileges?

I use pmap <pid> for inspecting the memory map of the user-space process <pid>. How to inspect the memory map of the kernel given "root" privileges (i.e. all capabilities)? The ...
Shuzheng's user avatar
  • 4,611
3 votes
1 answer
2k views

ELF Magic meaning of "7f" magic number?

I am studying ELF binary anatomy / structure and there are lots and lots of resources out there that describes what the ELF magic is. I understand the 45 4c 46 = ELF signature thing but what no source ...
linker's user avatar
  • 153
0 votes
1 answer
282 views

the value of system calls are 0 in symbol table

i use the following command to see the symbol table of my binary: readelf -s mybinary you can see part of the output below: as you can see the value of all system calls such as printf and exit are ...
sarahh's user avatar
  • 1
1 vote
0 answers
3k views

Ptrace: Function Not Implemented in GDB Installed on Multiarch/Qemu-User-Static Arm64v8/Alpine Docker Container

I want to debug an aarch64 ELF using GDB installed on an arm64v8/alpine docker on my x86_64 16.04 Ubuntu VirtualBox, which itself is installed on my Mac. In particular, to set up the docker I use the ...
Newbie's user avatar
  • 135
2 votes
1 answer
214 views

How does a new process executed in Bash always has the same environment variables?

A while ago I was exploring a simple C program's ELF binary using GDB. I saw that the environment variables that are printed when I run printenv in the terminal are also present at the top of the ...
sweetpoision's user avatar
-1 votes
1 answer
725 views

What is necessary and sufficient condition for an ELF object file to be a shared library or a relocatable object file?

Stephen Kitt wrote in https://unix.stackexchange.com/a/448943 any ELF object with an entry point can be an executable, regardless of its other properties. and ld.so is both an executable (because of ...
Tim's user avatar
  • 103k
0 votes
1 answer
552 views

What is "shared executables"?

Stephen Kitt wrote in https://unix.stackexchange.com/a/448943/674 ld.so is a shared ELF object, but it doesn’t require an interpreter (it has no .interp entry); this is typical of libraries (shared ...
Tim's user avatar
  • 103k
0 votes
1 answer
770 views

In what form of ELF is a core dump file?

https://en.wikipedia.org/wiki/Executable_and_Linkable_Format mentions core dumps. In what form of ELF is a core dump file? Relocatable, executable, or shared? CSAPP says 7.3 Object Files Object files ...
Tim's user avatar
  • 103k
1 vote
2 answers
3k views

Where is the linux kernel elf file located?

If the Linux kernel by itself is an ELF file, where can I find its ELF file?
user14189198's user avatar
1 vote
0 answers
1k views

Linux Executable fails to run with error “/usr/bin/strace: exec: No such file or directory” on running strace

I need to analyse linux binary executable file using strace for capturing the system calls. On running the command: /usr/bin/strace ./005f32fffe1da3bc100e7dcd8b2f8f2c I got this error: execve("./...
mmg's user avatar
  • 11
1 vote
0 answers
500 views

How to debug the problom? An elf file cannot be run, but the printing from the ldd and file seems no problem

some command printing: $ ./omnetpp ...
Vonfry's user avatar
  • 248
0 votes
0 answers
243 views

Linux: Where and how is ELF object file header used?

Does anyone know where in the shell, fork(), exec() sequence ELF are read and used by the loader? Linux can be used as an example. I ask because it's my understanding ELF has information about ...
Nick's user avatar
  • 195
2 votes
1 answer
1k views

How are stack traces reconstructed from a coredump?

The coredumpctl utility displays a stack trace of the program when the coredump has been created. For example, on a firefox coredump: Stack trace of thread 14469: #0 0x00007f0ac652d3bd ...
Phylliade's user avatar
  • 145
5 votes
0 answers
3k views

Disassemble ELF binary without section headers (program headers only) using objdump

I've got an ELF binary that contains nothing but two LOAD segments in the program header table, one for code and one for data. readelf -a tells me there's no section headers. If I attempt do ...
ulmer-a's user avatar
  • 219