Questions tagged [elf]

ELF stands for Executable and Linkable Format, a file format for files containing machine code.

Filter by
Sorted by
Tagged with
0
votes
0answers
48 views

Is .symtab mapped in memory?

I've read various posts, such as this: the .symtab section is not needed for process creation, is not mapped to a loadable segment and therefore is not loaded into memory when the program is ...
2
votes
1answer
1k views

How to make $ORIGIN in RPATH not follow symlinks?

I have an executable app, which depends on a library libbar.so and loads it via RPATH with $ORIGIN like this: $ readelf -d app Dynamic section at offset 0xe08 contains 26 entries: Tag Type ...
1
vote
2answers
472 views

libandroid-shmem showing invalid ELF header in chrooted linux

I have chrooted Debian in android marshmallow (snapdragon 650 [64bit]). I installed iceweasel in chrooted debian. But it showed this error :: (firefox:16210): Gdk-WARNING **: shmget failed: error ...
3
votes
2answers
21k views

How objdump disassemble elf binary

I have a quick question. I have generated a ELF binary from a c code using following code: gcc -o simple simple.c Then I do objdump for that ELF binary: objdump --disassemble-all simple I have ...
1
vote
0answers
37 views
3
votes
1answer
237 views

Are .text sections shared between loaded ELF executables?

If one program, for example grep, is curretly running, and a user executes another instance, do the two instances share the read-only .text sections between them to save memory? Would the sharing of ...
0
votes
0answers
76 views

GLIBC update broke server SSH

One of the users upgraded GLIBC version from 2.12 to 2.14 on a RHEL 6.10. Now the SSH is not working as well as we are not able to log in via vCenter. This message displayed at the console in vCenter ...
0
votes
0answers
57 views

Linux: Where and how is ELF object file header used?

Does anyone know where in the shell, fork(), exec() sequence ELF are read and used by the loader? Linux can be used as an example. I ask because it's my understanding ELF has information about ...
1
vote
1answer
97 views

How are stack traces reconstructed from a coredump?

The coredumpctl utility displays a stack trace of the program when the coredump has been created. For example, on a firefox coredump: Stack trace of thread 14469: #0 0x00007f0ac652d3bd ...
0
votes
0answers
467 views

Disassemble ELF binary without section headers (program headers only) using objdump

I've got an ELF binary that contains nothing but two LOAD segments in the program header table, one for code and one for data. readelf -a tells me there's no section headers. If I attempt do ...
1
vote
0answers
107 views

Official ELF reference & ignoring DT_RPATH in shared libraries

What is the official ELF format reference for Linux? There is the ELF 1.2 specification, which is from 1995 and outdated (does not include DT_RUNPATH for instance). But apart from that, it seems ...
2
votes
1answer
43 views

Any automatic way of obtaining the ELF section an address resides in?

Suppose I've the address of some string or symbol in an ELF binary output by e.g. strings -a and want to know what section that address resides in. Normally, I would do objdump -h and manually find ...
1
vote
0answers
159 views

Only list direct (resolved) dependency paths with ldd, readelf or objdump

With ldd I can get a flat list of unique, fully resolved paths to all shared libraries that an executable depends on. For a script where I'm bundling a binary, I'm copying over these shared libs. ...
2
votes
1answer
352 views

how can I run old programs from a MIPS?

I have an old PC with a program called atomTV, for viewing, and producing movies from molecular trajectory files. I only have a binary, and the platform it ran on was 64-bit MIPS architecture, where I ...
0
votes
0answers
329 views

How to list imported functions (.plt) for an ELF executable without disassembling using objdump?

Currently, I check for imported functions (.plt) using objdump: objdump -D -j .plt myprog | grep '@plt' However, it doesn't seem right to have objdump output annotated disassembly to grep to list ...
1
vote
1answer
589 views

Why doesn't objdump display any entries for the .got section of the ELF binary?

I know of the relationship between the .plt and .got sections in an ELF binary, i.e. that corresponding entries must exist in each section for each dynamically loaded function (shared library). ...
0
votes
0answers
15 views

How to edit function from import table in process with gdb

How can I edit function from import table of process to invoke to another address. For example , my process has fopen function in import table , and has read in import table. I want to edit the ...
3
votes
0answers
96 views

How does linux decide the load address and entry point when execve an ELF?

When linux execve() an ELF, it will mmap that ELF into the process's memory space and start to run code from the entry point. But how does the kernel decide the load address and entry point of the ELF?...
8
votes
2answers
781 views

How does the ELF loader determine the initial stack size?

I'm studying the ELF specification (http://www.skyfree.org/linux/references/ELF_Format.pdf), and one point that is not clear to me about the program loading process is how the stack is initialized, ...
0
votes
1answer
54 views

Ubuntu - Can't execute binaries unless they reside in /var/lib/php/session/

I noticed this weird issue in a Ubuntu 18.04 (Bionic Beaver) box and a couple of other Debian-based systems -- I will take statically linked netcat binary (a unix networking tool) for the sake of ...
2
votes
2answers
922 views

Extracting the size and origin of all symbols in an ELF

I am trying to estimate the code size of a binary's various components. I have access to the source code and resulting build directory containing all built object files. Of course, I want to include ...
5
votes
2answers
3k views

What is the difference between “LSB executable” (ET_EXEC) and “LSB shared object” (ET_DYN)?

With two files, one compiled and linked with gcc and the other manually with nasm and ld I get ELF 32-bit LSB shared object ... ELF 32-bit LSB executable ... What's the difference between these two ...
1
vote
1answer
2k views

“Illegal instruction” on a static MIPS binary

On my MIPS box I'm trying to run a program. I use a cross compiler for mips. When I run my program, I'm getting Illegal instruction I pulled of one binary from it, called cputest. It basically ...
18
votes
1answer
2k views

Why does the file command say that ELF binaries are for Linux 2.6.9?

Whenever I run file on an ELF binary I get this output: [jonescb@localhost ~]$ file a.out a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.6.9, dynamically linked (...
2
votes
2answers
403 views

Different standards of ELF (SysV vs TIS) and Linux?

There are at least two standards of Executable and Linkable Format (ELF), one of them System V Application Binary Interface AMD64 Architecture Processor Supplement (With LP64 and ILP32 Programming ...
0
votes
2answers
251 views

$LIB variable does not expand to anything in Ubuntu Server 18.10

I have the same exact problem as this question previously posted, where /etc/ld.so.preload does not intercept the right architecture. A little background: I have compiled a shared object (64-bit) that ...
2
votes
0answers
303 views

Is there a standard for the Linux user-space memory map?

I'm contemplating a project where I would use a memory mapped file that is shared between multiple processes, and in order to be able to use pointer values in the mapped region in all those processes*,...
1
vote
1answer
490 views

Wine: Load old Access software - Invalid ELF header

I need to run old software(Based on Access 2.00) over Wine but i have many problems. Can someone give some pointers on this question: warn:module:load_builtin_dll failed to load .so lib for builtin ...
0
votes
1answer
181 views

Understanding the objcopy command in a book [closed]

I am reading a book and it's talking about ELF's. I understand it's a file format for executable files. There's a command that I executed on a VM and I'm having trouble understanding what it does. ...
1
vote
1answer
629 views

What happened to elfsign and elfverify?

In "Uninformed Research -- informative information for the uninformed." 2003 mentions a tool called elfsign and elfverify. This is a tool to checksum and sign an ELF binary. I can't find that tool in ...
1
vote
2answers
286 views

Why do some libc symbols have WEAK binding and others GLOBAL?

Why are different symbols in libc declared with different bindings, 1510 0x0003d200 0xf7d55200 WEAK FUNC 55 system 454 0x00067b40 0xf7d7fb40 WEAK FUNC 474 puts 147 0x000303d0 0xf7d483d0 ...
-2
votes
1answer
679 views

if a global or static C variable is not explicitly initialized, but implicitly initialized, is it in .data or .bss section? [closed]

Computer Systems: A Programmer's Perspective says about two sections in a ELF relocatable object file: .data Initialized global and static C variables. Local C variables are maintained at run ...
1
vote
1answer
220 views

Are the addresses inside a shared library file virtual addresses, or relocatable addresses?

Are the addresses inside a shared library file virtual addresses, or relocatable addresses? Does the answer depend on whether the shared library file was built with GCC’s -fPIC option? Originated ...
3
votes
2answers
1k views

What is the difference between Shared object file and Relocatable file?

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says The type field tells us what the purpose of the file is. There are a few common file types. CORE (value 4) DYN (...
1
vote
2answers
374 views

What ELF types do kernel itself and kernel modules have?

https://linux-audit.com/elf-binaries-on-linux-understanding-and-analysis/ says The type field tells us what the purpose of the file is. There are a few common file types. CORE (value 4) DYN (...
1
vote
1answer
959 views

What are difference between the ELF symbol visibility levels?

The NASM docs on "elf Extensions to the GLOBAL Directive" say, Optionally, you can control the ELF visibility of the symbol. Just add one of the visibility keywords: default, internal, hidden, or ...
24
votes
1answer
12k views

What does “LSB” mean when referring to executable files in the output of /bin/file?

I have found the term "LSB executable" or "LSB shared object" in the output of the file command in Linux. For example: $ file /bin/ls /bin/ls: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
1
vote
1answer
564 views

What is the number in readelf symbol table name?

I have a local static variable, something like this: void function(void) { static unsigned char myVariable = 0; ... I dump the symbol table using readelf as follows: readelf -s myprogram....
7
votes
7answers
23k views

How to find executable filetypes?

I want to find file types that are executable from the kernel's point of view. As far as I know all the executable files on Linux are ELF files. Thus I tried the following: find * | file | grep ELF ...
3
votes
3answers
60 views

Differentiate between ELFves and scripts quickly

How do I use file to differentiate between ELFves and scripts as quickly as possible? I don't need any further details, just ELF, script (/plaintext), or other/error.
1
vote
1answer
2k views

How to Cross Compile elfutils

My system (uname --all) Linux shyamdaramubtnb 3.2.0-23-generic #36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux My target ARM Cortex A7 I am in the process of cross ...
0
votes
1answer
354 views

Determine kernel symbol offset from elf file

i have extracted the ELF file(stripped) from an bzImage using extract-vmlinux and extracted the __ksymtab and __ksymtab_strings sections afterwards. How can i calculate the offset of an arbitrary ...
7
votes
2answers
929 views

Repack the filesystem image from vmlinux.bin (embedded initramfs) without rebuilding?

In How do I extract the filesystem image from vmlinux.bin? and https://wiki.gentoo.org/wiki/Custom_Initramfs#Salvaging methods are presented for getting and unpacking an embedded initramfs/initrd ...
0
votes
1answer
113 views

is uboot.bin location-independent?

ubootgenerate uboot.bin and uboot.elf. uboot.bin is used to burn to flash, at the start address of the CPU. uboot.elf is not very useful. NOTE: I think uboot.bin/uboot.elf are all location-...
53
votes
8answers
67k views

Can we get compiler information from an elf binary?

Is there some chance to know how a binary was built, under Linux? (and or other Unix) Compiler, version, time, flags etc... I looked at readelf and couldn't find much, but there might be other ways ...
1
vote
1answer
756 views

Remove .shstrtab with strip

I've noticed that strip removes ELF sections, such as .symtab and .strtab, but is there a way to force it to remove the .shstrtab section as well? I already tried the -R option but it didn't work. ...
2
votes
0answers
592 views

Extract a running ELF from a memory dump

Our teacher gave us as homework a memory dump from a VBox (Ubuntu 16.04.9) and said that the message we need to get is printed by an ELF currently running in the VM. This is my what I get after ...
2
votes
1answer
3k views

Symbol table in the .data section of ELF

I'm trying to understand how does symbol tables relate to the .data section in ELF. First some assumptions that I'm using as ground to start with. A symbol is a human readable (or "as written in ...
2
votes
1answer
583 views

Generate bootable ELF from bootloader, kernel, device tree, ramdisk

I'm new to Linux Kernel programming, and am pretty stuck with (what I think is) the last step in building my bootable image. For some background, we are trying to upload a complete OS image onto the ...
0
votes
1answer
66 views

Section .shstrtab not having flag for containing null-terminated strings

readelf -S a.out outputs: [Nr] Name Type Addr Off Size ES Flg Lk Inf Ar [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .text ...