Menu
Where does the ELF format stores the names of imported functions? Is it always possible to enumerate all import names, like for PE executables?
For example, if a binary is using printf is it possible to tell it does, just by static analysis of the binary itself?
743
asked May 07 '12 10:05
Another example is shared libraries or even core dumps (those core or a.out files). The ELF specification is also used on Linux for the kernel itself and Linux kernel modules. Due to the extensible design of ELF files, the structure differs per file.
The magic shows a 02, which is translated by the readelf command as an ELF64 file. In other words, an ELF file using the 64-bit architecture.
executable ( bool) – Search only executable sections. An iterator for each virtual address that matches. An ELF header starts with the bytes \x7fELF, so we sould be able to find it easily. We can also search for string the binary. It is also possible to search for instructions in executable sections.
Let’s show the ELF header details for /bin/ps. We can see that the value pairs are different, which is caused by the right interpretation of the byte order. Next in line is another “01” in the magic, which is the version number. Currently, there is only 1 version type: currently, which is the value “01”.
In ELF they're called undefined symbols. You can view the list of undefined symbols by:
nm -D <file>|grep -w U
objdump -T <file>|grep "\*UND\*"
ELF files don't specify which symbols come from which libraries; it just adds a list of shared libraries to link to into the ELF binary, and lets the linker find the symbols in the libraries.
98
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
