ELF header file

A .4 kind ELF file types

 

ELF file types	Explanation	Examples
Relocatable File	Examples comprise code and data, it may be linked into an executable file or shared object file	.o files under Linux
Executable File	It includes direct implementation of the program, ELF executable file, usually with no extension	/ Bin / bash file
Shared Object File	It contains code and data, and other object files into a new object files, executable files and links as part of the process to allow image	.so files in Linux
Core Dump File	Files can be generated when the process unexpectedly terminated, the process of storing the memory contents and other information	core dump on Linux

 

Two documents constitute .ELF

 

III. Both views

 

 IV. Structure Figure

V. Precautions

1. Apart from ELF header table, region and other sections are not predetermined sequence segments
2. Each section area of ​​the target file has a corresponding section area of ​​the head described it, in turn, nodding the head area does not mean that there are ganglia
3. Each file section occupied by a continuous byte area (the area of ​​possible length 0).
4. File section area not overlap, in the present situation does not allow a two-byte section region occurs.
5. Destination file may contain inactive space (INACTIVE SPACE). These regions do not belong to any area of ​​the head section and its contents not specified.
6. "." At the beginning of the festival area name is reserved for the system. An application can use the name of the festival area without a prefix to avoid conflicts with the System section area.
7. Target file can contain multiple names the same section area.
8. Section and Segment differences and connections
   executable file, the contents of a program header describing is called a segment (segment). Segment section contains one or more
9. Executable program in several segments:

name	content
Snippet	Executable code string constants
Data segment	Initialized global variables, initialized global static variables, static local variable, constant data
BSS segment	Uninitialized global variables, uninitialized global static variables
Stack	Local variables, function arguments
stack	Dynamic memory allocation

Six types .section

name	Types of	Attributes	meaning
.bss	SHT_NOBITS	SHF_ALLOC SHF_WRITE	Included will appear in the memory image of the program is initialized data. By definition, when the program is started, the system will be initialized to 0 data. This section area not occupied by the file space.
.data	SHT_PROGBITS	(no)	It includes version control information.
.data1	SHT_PROGBITS	SHF_ALLOC SHF_WRITE	These ganglia contain initialized data will appear in the memory image of the program.
.debug	SHT_PROGBITS	(no)	This section contains information area for symbolic debugging.
.dynamic	SHT_DYNAMIC		This section area contains dynamic linking information. Section area of ​​the property will contain SHF_ALLOC bit. Whether SHF_WRITE bit is set depends on the processor.
.dynstr	SHT_STRTAB	SHF_ALLOC	This area contains a string section for dynamically linked, in most cases these strings represent the names associated with symbol table entries.
.dynsym	SHT_DYNSYM	SHF_ALLOC	This section contains the dynamic link area symbol table.
.fini	SHT_PROGBITS	SHF_ALLOCSHF_EXECINSTR	This section contains instructions executable region, is part of the process termination code. When the program exits normally, the system will be arranged to execute code here.
.got	SHT_PROGBITS		This region contains the global offset table section.
.hash	SHT_HASH	SHF_ALLOC	This area contains a section symbol hash table.
.init	SHT_PROGBITS	SHF_ALLOCSHF_EXECINSTR	This section contains the executable instructions district, is part of the process initialization code. When the program begins execution, the system starts to be called before the main inlet SHF_EXECINSTR (usually refers to the main function of the C language) code execution.
.interp	SHT_PROGBITS		This section contains the path area program interpreter name. If the program contains a loadable segment, the segment that contains this festival area, the area of ​​the property section will contain SHF_ALLOC bit, the bit is 0 otherwise.
.line	SHT_PROGBITS		This section region contains symbolic debugging line number information, which describes the correspondence between source code and machine instructions. Its content is undefined.
.note	SHT_NOTE		This section contains the comments area information, independent of format.
.plt	SHT_PROGBITS		This section contains the procedure linkage table area (procedure linkage table).
.relname	Sःt_hriala		这些节区中包含了重定位信息。如果文件中包含可加载的段,段中有重定位内容,节区的属性将包含 SHF_ALLOC 位,否则该位 置 0。传统上 name 根据重定位所适用的节区给定。例如 .text 节区的重定位节区名字将是:.rel.text 或者 .rela.text。
.rela name	SHT_RELA
.rodata	SHT_PROGBITS	SHF_ALLOC	这些节区包含只读数据,这些数据通常参与进程映像的不可写段。
.rodata1	SHT_PROGBITS	SHF_ALLOC
.shstrtab	SHT_STRTAB		此节区包含节区名称。
.strtab	SHT_STRTAB		此节区包含字符串,通常是代表与符号表项相关的名称。如果文件拥有一个可加载的段,段中包含符号串表,节区的属性将包含 SHF_ALLOC 位,否则该位为 0。
.symtab	SHT_SYMTAB		此节区包含一个符号表。如果文件中包含一个可加载的段,并且该段中包含符号表,那么节区的属性中包含SHF_ALLOC 位,否则该位置为 0。
.text	SHT_PROGBITS		此节区包含程序的可执行指令。

七.segment类型

 

 

程序段类型	取值	说明
PT_NULL	0	此数组元素未用。结构中其他成员都是未定义的。
PT_LOAD	1	此数组元素给出一个可加载的段,段的大小由 p_filesz 和 p_memsz描述。文件中的字节被映射到内存段开始处。如果 p_memsz 大于p_filesz,“剩余”的字节要清零。p_filesz 不能大于 p_memsz。可加载的段在程序头部表格中根据 p_vaddr 成员按升序排列。
PT_DYNAMIC	2	数组元素给出动态链接信息。Dynamic Segment 是很重要的一个程序头，里面存储着函数名、使用过的动态库名、重定位表、函数代码偏移等重要信息，不过不是直接记录，而是通过一定的方法查询得到，这个查询过程是elf设计中巧妙且关键的核心所在。
PT_INTERP	3	该记录的是链接器linker的路径.数组元素给出一个 NULL 结尾的字符串的位置和长度,该字符串将被当作解释器调用。这种段类型仅对与可执行文件有意义(尽管也可能在共享目标文件上发生)。在一个文件中不能出现一次以上。如果存在这种类型的段,它必须在所有可加载段项目的前面。
PT_NOTE	4	此数组元素给出附加信息的位置和大小。
PT_SHLIB	5	此段类型被保留,不过语义未指定。包含这种类型的段的程序与 ABI 不符。
PT_PHDR	6	此类型的数组元素如果存在,则给出了程序头部表自身的大小和位置,既包括在文件中也包括在内存中的信息。此类型的段在文件中不能出现一次以上。并且只有程序头部表是程序的内存映像的一部分时才起作用。如果存在此类型段,则必须在所有可加载段项目的前面。
PT_LOPROC	0x70000000	此范围的类型保留给处理器专用语义。
PT_HIPROC	0x7ffffffff