An important tool in ELF file analysis

1. file

Simple information for viewing files

BriansdeMacBook-Pro:armeabi-v7a brian$ file libcheckcert.so 
libcheckcert.so: ELF 32-bit LSB shared object, ARM, version 1 (SYSV), dynamically linked (uses shared libs), stripped

2. strip

Remove unnecessary symbols and debugging information in the ELF file.

3. nm

View symbols of ELF files

BriansdeMacBook-Pro:armeabi-v7a brian$ arm-linux-androideabi-nm -D libcheckcert.so 
00004fb4 T JNI_OnLoad
00015da4 T _Unwind_Backtrace
000152a0 T _Unwind_Complete
000152a4 T _Unwind_DeleteException
00015d80 T _Unwind_ForcedUnwind
00015144 T _Unwind_GetCFA
0001623c T _Unwind_GetDataRelBase
00016220 T _Unwind_GetLanguageSpecificData
00016210 T _Unwind_GetRegionStart
........

4. readelf

This is one of the most important tools for analyzing ELF files. You can view the header of the ELF file and detailed information about each section and segment.

5. objdump

Similar to readelf, the difference is that they are implemented differently. Objdump is based on the BFD (Binary Format Descriptor) library, which is more general, and readelf is specifically for ELF format files. In addition, readelf can display debugging information, while objdump does not.

6. ldd

View the details of the shared library that the ELF file depends on.

$ ldd /bin/ls
        linux-gate.so.1 =>  (0xb7711000)
        libselinux.so.1 => /lib/libselinux.so.1 (0xb76e5000)
        librt.so.1 => /lib/i686/cmov/librt.so.1 (0xb76dc000)
        libacl.so.1 => /lib/libacl.so.1 (0xb76d4000)
        libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb758d000)
        libdl.so.2 => /lib/i686/cmov/libdl.so.2 (0xb7589000)
        /lib/ld-linux.so.2 (0xb7712000)
        libpthread.so.0 => /lib/i686/cmov/libpthread.so.0 (0xb7570000)
        libattr.so.1 => /lib/libattr.so.1 (0xb756b000)