江苏龙网

  1. 主页 > 生活百科 > >

linux中ELF格式二进制程序( 二 )

ELF格式


linux中ELF格式二进制程序

文章插图
 
e_type：2字节，用来指定ELF目标文件的类型；
// include/uapi/linux/elf-em.h/* These constants define the various ELF target machines */#define EM_NONE     0#define EM_M32    1#define EM_SPARC  2#define EM_386    3#define EM_68K    4#define EM_88K    5#define EM_486    6   /* Perhaps disused */#define EM_860    7#define EM_MIPS     8   /* MIPS R3000 (officially, big-endian only) */                /* Next two are historical and binaries and                   modules of these types will be rejected by                   Linux.*/#define EM_MIPS_RS3_LE10  /* MIPS R3000 little-endian */#define EM_MIPS_RS4_BE10  /* MIPS R4000 big-endian */#define EM_PARISC   15  /* HPPA */#define EM_SPARC32PLUS18  /* Sun's "v8plus" */#define EM_PPC    20  /* PowerPC */...... 
e_machine：2字节，用来描述ELF目标文件的体系结构类型，即要在哪种硬件平台运行；
// include/uapi/linux/elf-em.h/* These constants define the various ELF target machines */#define EM_NONE     0#define EM_M32    1#define EM_SPARC  2#define EM_386    3#define EM_68K    4#define EM_88K    5#define EM_486    6   /* Perhaps disused */#define EM_860    7#define EM_MIPS     8   /* MIPS R3000 (officially, big-endian only) */                /* Next two are historical and binaries and                   modules of these types will be rejected by                   Linux.*/#define EM_MIPS_RS3_LE10  /* MIPS R3000 little-endian */#define EM_MIPS_RS4_BE10  /* MIPS R4000 big-endian */?#define EM_PARISC   15  /* HPPA */#define EM_SPARC32PLUS18  /* Sun's "v8plus" */#define EM_PPC    20  /* PowerPC */...... 
2. 程序头表 
程序头表（也称为段表）是一个描述文件中各个段的数组，程序头表描述了文件中各个段在文件中的偏移位置及段的属性等信息；从程序头表里可以得到每个段的所有信息，包括代码段和数据段等；各个段的内容紧跟ELF文件头保存；程序头表中各个段用Elf32_Phdr或Elf64_Phdr结构体表示；
// include/uapi/linux/elf.htypedef struct elf32_phdr{  Elf32_Word    p_type;  Elf32_Off p_offset;  Elf32_Addr    p_vaddr;  Elf32_Addr    p_paddr;  Elf32_Word    p_filesz;  Elf32_Word    p_memsz;  Elf32_Word    p_flags;  Elf32_Word    p_align;} Elf32_Phdr;?typedef struct elf64_phdr {  Elf64_Word p_type;  Elf64_Word p_flags;  Elf64_Off p_offset;       /* Segment file offset */  Elf64_Addr p_vaddr;       /* Segment virtual address */  Elf64_Addr p_paddr;       /* Segment physical address */  Elf64_Xword p_filesz;     /* Segment size in file */  Elf64_Xword p_memsz;      /* Segment size in memory */  Elf64_Xword p_align;      /* Segment alignment, file & memory */} Elf64_Phdr; 
Elf32_Phdr或Elf64_Phdr结构体用来描述位于磁盘上的程序中的一个段；
linux中ELF格式二进制程序

文章插图
 
p_type：4字节，用来指明程序中该段的类型；
// include/uapi/linux/elf.h/* These constants define the permissions on sections in the program  header, p_flags. */#define PF_R      0x4  // 可读#define PF_W      0x2  // 可写#define PF_X      0x1  // 可执行 
p_flags：4字节，用来指明与本段相关的标志；
// include/uapi/linux/elf.h/* These constants define the permissions on sections in the program  header, p_flags. */#define PF_R      0x4  // 可读#define PF_W      0x2  // 可写#define PF_X      0x1  // 可执行 
3. 节头表 
节头表中各个节用Elf32_Shdr或Elf64_Shdr结构体表示；
// include/uapi/linux/elf.htypedef struct elf32_shdr {  Elf32_Word    sh_name;  Elf32_Word    sh_type;  Elf32_Word    sh_flags;  Elf32_Addr    sh_addr;  Elf32_Off sh_offset;  Elf32_Word    sh_size;  Elf32_Word    sh_link;  Elf32_Word    sh_info;  Elf32_Word    sh_addralign;  Elf32_Word    sh_entsize;} Elf32_Shdr;?typedef struct elf64_shdr {  Elf64_Word sh_name;       /* Section name, index in string tbl */  Elf64_Word sh_type;       /* Type of section */  Elf64_Xword sh_flags;     /* Miscellaneous section attributes */  Elf64_Addr sh_addr;       /* Section virtual addr at execution */  Elf64_Off sh_offset;      /* Section file offset */  Elf64_Xword sh_size;      /* Size of section in bytes */  Elf64_Word sh_link;       /* Index of another section */  Elf64_Word sh_info;       /* Additional section information */  Elf64_Xword sh_addralign; /* Section alignment */  Elf64_Xword sh_entsize;   /* Entry size if section holds table */} Elf64_Shdr;


推荐阅读


上一篇：上海的名酒是什么 上海的地名来历

下一篇：古代四大美男卫玠长什么样 被看死的古代帅哥卫玠