Shulou(Shulou.com)06/01 Report--

This article mainly explains "how to use the Linux readelf command". The content in the article is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn how to use the Linux readelf command.

The Linux common command readelf command is used to display information about one or more target files in elf format, and you can use its options to control what information is displayed.

Readelf is used to display information about files in elf format

Add that the elf-file (s) here indicates the files that are being checked. It can support 32-bit and 64-bit elf files, as well as documents containing elf files (here, it generally refers to the "static library" files such as lib*.a generated after some elf files are packaged using the ar command).

This program is similar to the function provided by objdump, but it displays more specific information, and it does not rely on the BFD library (the BFD library is a GNU project, its goal is to deal with different object files through a unified interface), so even if there is any bug in the BFD library, it will not affect the readelf program.

When running readelf, one of the other options must be specified except-v and-H.

ELF file types, ELF files of different types:

Relocatable files: users work with other target files to create executable files or share target files, such as lib*.a files.

Executable: used to generate a process image and load memory execution, such as the compiled executable a.out.

Shared object files: used to generate elf object files with other shared object files or relocatable files or to create process images with execution files, such as lib*.so files.

The function of ELF file:

ELF files participate in the connection of programs (establishing a program) and the execution of programs (running a program), so files in elf format can be viewed from different perspectives:

If used for compilation and linking (relocatable files), the compiler and linker treat the elf file as a collection of sections described in the section header table, which is optional.

If used for load execution (executable), the loader treats the elf file as a collection of segments described in the program header table, which may contain multiple sections, and the section header table is optional.

If it is a shared file, it contains both.

The overall composition of the ELF file:

The elf file header describes the overall information of the elf file. Including: system-related, type-related, load-related, link-related.

Related to the system: the number of magic identified by elf files, as well as hardware and platform and other related information, increased the portability of elf files, making cross-compilation possible.

Type correlation is the type mentioned earlier.

Load related: including information about the program header table.

Link related: section header table related information.

The option-a-- all displays all the information, which is equivalent to-h-l-S-s-r-d-V-A-I. -h-- file-header displays the header information at the beginning of the elf file. -l-- program-headers-- segments displays program header (segment header) information, if any. -S-- section-headers-- sections displays section header information, if any. -g-- section-groups displays section group information, if any. -t-- section-details displays the details of the section (of-S). -s-- syms-- symbols displays the items in the symbol table section, if any. -e-- headers displays all the header information, which is equivalent to:-h-l-S-n-- notes displays the information of the note segment (kernel comments). -r-- relocs displays information about relocatable segments. -u-- unwind displays unwind segment information. Currently, only unwind segment information of IA64 ELF is supported. -d-- dynamic displays information about dynamic segments. -V-- version-info displays information about the version segment. -A-- arch-specific displays CPU architecture information. -D-- use-dynamic uses the symbol table in dynamic segments to display symbols instead of using symbol segments. -x-- hex-dump= displays the contents of the specified segment in hexadecimal mode. Number specifies the index of the segment in the segment table, or the string specifies the name of the segment in the file. -w [liaprmfFsoR] or-- debug-dump [= line,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges] displays what is specified in the debug segment. -I-- when histogram displays symbols, displays a bar chart of bucket list length. -v-- version displays the version information of readelf. -H-- help displays the command line options supported by readelf. -W-- wide wide line output. @ file can centralize the options into a file and then load them using the @ file option. An example is given as follows:

1. For elf format files in executable form:

1) View the source code of the executable program as follows:

Root@localhost [test] $cat main.cpp # include using std::cout; using std::endl; void my_print (); int main (int argc, char * argv []) {my_print (); cout "hello!" Return 0;} void my_print () {cout "print!"} 2) is compiled as follows:

[root@localhost test] $main.cpp + main.cpp-o main [root@localhost test] $Gmail +-g main.cpp-o main.debug3) after compilation, view the generated file:

[root@localhost test] $ls-l Total 64-rwxr-xr-x 1 quietheart quietheart 6700 07-07 18:04 main-rw-r--r-- 1 quietheart quietheart 20107-07 18:02 main.cpp-rwxr-xr-x 1 quietheart quietheart 38932 07-07 18:04 main.debug here, main.debug is an executable file with debugging information, main is a general executable file.

two。 For elf files in the form of library files:

1) check the source code of the library as follows:

/ / myfile.h # ifndef _ _ MYFILE_H # define _ _ MYFILE_H void printInfo (); # endif / / myfile.cpp # include "myfile.h" # include using std::cout; using std::endl; void printInfo () {cout "hello"} 2) compiled as follows:

[root@localhost test] $root@localhost test +-c myfile.cpp [root@localhost test] $Gmail +-shared-fPCI-o libmy.so myfile.o [root@localhost test] $ar-r libmy.a myfile.o ar: creating libmy.a3) after compilation, view the generated file:

[root@localhost test] $ls-l

Total 44

-rw-r--r-- 1 quietheart quietheart 2154 07-08 16:14 libmy.a-rwxr-xr-x 1 quietheart quietheart 5707 07-08 16:08 libmy.so-rwxr-xr-x 1 quietheart quietheart 117 07-08 16:06 myfile.cpp-rwxr-xr-x 1 quietheart quietheart 63 07-08 16:08 myfile.h-rw-r--r-- 1 quietheart quietheart 2004 07-08 16:08 myfile.o libmy.a libmy.so myfile.cpp myfile.h myfile.o here Generate the object file myfile.o, the shared library file libmy.so, and the static library file libmy.a respectively.

Based on the above executable files and libraries, here are some commonly used commands.

Read elf file header information in the form of an executable file:

[root@localhost test] $readelf-h main ELF Header: Magic: 7f 45 4c 46 01 01 00 00 00 Class: ELF32 Data: 2's complement Little endian Version: 1 (current) OS/ABI: UNIX-System V ABI Version: 0 type: exec (Executable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x8048580 Start of program headers: 52 (bytes into file) Start of section headers: 3232 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 8 Size of section headers: 40 (bytes) Number of section headers: 29 Section header string table index: 26 here The elf file of the executable is visible, and its type is EXEC (executable). In addition, the contents of "main.debug" with debugging information and "main" without debugging information are the same except for some size information. And it can be seen that the architecture of the file is Intel 80386.

Read the elf file header information in the form of the target file:

[root@localhost test] $readelf-h myfile.o ELF Header: Magic: 7f 45 4c 46 01 01 00 00 00 Class: ELF32 Data: 2's complement Little endian Version: 1 (current) OS/ABI: UNIX-System V ABI Version: 0 Type: REL (Relocatable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x0 Start of program headers: 0 (bytes into file) Start of section headers: 516 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 0 (bytes) Number of program headers: 0 Size of section headers: 40 (bytes) Number of section headers: 15 Section header string table index: 12 here The elf file of the visible target file, of type REL (relocatable file).

Read the elf header information in the form of a static library file:

[root@localhost test] $readelf-h libmy.a File: libmy.a (myfile.o) ELF Header: Magic: 7f 45 4c 46 01 01 00 00 00 Class: ELF32 Data: 2's complement Little endian Version: 1 (current) OS/ABI: UNIX-System V ABI Version: 0 Type: REL (Relocatable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x0 Start of program headers: 0 (bytes into file) Start of section headers: 516 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 0 (bytes) Number of program headers: 0 Size of section headers: 40 (bytes) Number of section headers: 15 Section header string table index: 12 here The elf file of the visible static library file, whose type is REL (relocatable file).

Read elf file header information in the form of a dynamic library file:

[root@localhost test] $readelf-h libmy.so ELF Header: Magic: 7f 45 4c 46 01 01 00 00 00 Class: ELF32 Data: 2's complement Little endian Version: 1 (current) OS/ABI: UNIX-System V ABI Version: 0 Type: DYN (Shared object file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x550 Start of program headers: 52 (bytes into file) Start of section headers: 2768 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 5 Size of section headers: 40 (bytes) Number of section headers: 27 Section header string table index: 24 here The elf file of the visible dynamic library file, whose type is DYN (shared object file).

View executable elf file program header table information:

[root@localhost test] $readelf-l main Elf file type is EXEC (Executable file) Entry point 0x8048580 There are 8 program headers Starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align PHDR 0x000034 0x08048034 0x08048034 0x00100 0x00100 R E 0x4 INTERP 0x000134 0x08048134 0x08048134 0x00013 0x00013 R 0x1 Requesting program interpreter: / lib/ [ld-linux.so.2] LOAD 0x000000 0x08048000 0x08048000 0x00970 0x00970 R E 0x1000 LOAD 0x000970 0x08049970 0x08049970 0x00130 0x001c8 RW 0x1000 DYNAMIC 0x000988 0x08049988 0x08049988 0x000e0 0x000e0 RW 0x4 NOTE 0x000148 0x08048148 0x08048148 0x00020 0x00020 R 0x4 GNU_EH_FRAME 0x000820 0x08048820 0x08048820 0x00044 0x00044 R 0x4 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4 Section to Segment mapping: Segment Sections... 00 01 .interp 02 .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version _ r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh _ frame_hdr .eh _ frame 03 .ctors .jcr .dynamic .go t .got.plt .data .bss 04 .dynamic. Note.ABI-tag 06 .eh _ frame_hdr 07 here The content of "main.debug" with debugging information is the same as "main" without debugging information.

View the elf file program header table information for the target file:

[root@localhost test] $readelf-l myfile.o There are no program headers in this file. It can be seen here that the relocatable target file does not have a program header table.

View the elf file program header table information for static library files:

[root@localhost test] $readelf-l libmy.a File: libmy.a (myfile.o) There are no program headers in this file. It can be seen here that the relocatable static library file has no program header table.

View the elf file program header table information for the dynamic library file:

[root@localhost test] $readelf-l libmy.so Elf file type is DYN (Shared object file) Entry point 0x550 There are 5 program headers Starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x00000000 0x00000000 0x007f4 0x007f4 R E 0x1000 LOAD 0x0007f4 0x000017f4 0x000017f4 0x0011c 0x00128 RW 0x1000 DYNAMIC 0x000810 0x00001810 0x00001810 0x000e0 0x000e0 RW 0x4 GNU_EH_FRAME 0x000738 0x00000738 0x00000738 0x0002c 0x0002c R 0x4 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4 Section to Segment mapping: Segment Sections... 00 .gnu.hash .dynsym .dynstr .gnu.version _ r .rel.dyn .rel.plt .init .plt .text .pli .rodata .eh _ frame_hdr .eh _ frame 01 .ctors .dtors .jcr .data.relro .dynamic got .got.plt .bss 02 .dyn amic 03 .eh _ frame_hdr 04 as known here, as a dynamic library for sharing target files, its program header table.

View the section information of an executable elf file:

[root@localhost test] $readelf-S main There are 29 section headers Starting at offset 0xca0: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [0] NULL 00000000 000000 00000000 000 [1] .interp PROGBITS 08048134 000134 000013 00 A 001 [2]. Note.ABI-tag NOTE 08048148 000148 000020 00 A 00 4 [3] .gnu.hash GNU_HASH 08048168 000168 000030 04 A 4 04 [4] .dynsym DYNSYM 08048198 000198 0000d0 10 A 5 1 4 [5] .dynstr STRTAB 08048268 000268 000183 00 A 001 [6] .gnu.version VERSYM 080483ec 0003ec 00001a 02 A 4 02 [7] .gnu.version _ r VERNEED 08048408 000408 000060 00 A 5 2 4 [8] .rel.dyn REL 08048468 000468 000010 08 A 40 4 [9] .rel.plt REL 08048478 000478 000048 08 A 4 11 4 [10] .init PROGBITS 080484c0 0004c0 000017 00 AX 004 [11] .plt PROGBITS 080484d8 0004d8 0000a0 04 AX 004 [12] .text PROGBITS 08048580 000580 000268 00 AX 00 16 [13] .fini PROGBITS 080487e8 0007e8 00001c 00 AX 004 [14] .rodata PROGBITS 08048804 000804 00001a 00 A 004 [15] .eh _ frame_hdr PROGBITS 08048820 000820 000044 00 A 004 [16] .eh _ frame PROGBITS 08048864 000864 00010c 00 A 004 [17] .ctors PROGBITS 08049970 000970 00000c 00 WA 004 [18] .dtors PROGBITS 0804997c 00097c 000008 00 WA 004 [19] .jcr PROGBITS 08049984 000984 000004 00 WA 004 [20] .dynamic DYNAMIC 08049988 000988 0000e0 08 WA 5 04 [21] .got PROGBITS 08049a68 000a68 000004 04 WA 004 [22] .got.plt PROGBITS 08049a6c 000a6c 000030 04 WA 004 [23] .d ata PROGBITS 08049a9c 000a9c 000004 00 WA 004 [24] .bss NOBITS 08049aa0 000aa0 000098 00 WA 00 8 [25] .comment PROGBITS 00000000 000aa0 000114 0000 1 [26] .shstrtab STRTAB 00000000 000bb4 0000e9 0000 1 [27] .symtab SYMTAB 00000000001128000510 28 53 4 [28] .strtab STRTAB 00000000001638 0003f4 0000 1 Key to Flags: W (write) A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) here Main is an executable file that does not contain debugging information.

View the section information of an executable elf file that contains debugging information:

[root@localhost test] $readelf-S main.debug There are 37 section headers Starting at offset 0x88c8: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [0] NULL 00000000 000000 00000000 000 [1] .interp PROGBITS 08048134 000134 000013 00 A 001 [2]. Note.ABI-tag NOTE 08048148 000148 000020 00 A 00 4 [3] .gnu.hash GNU_HASH 08048168 000168 000030 04 A 4 04 [4] .dynsym DYNSYM 08048198 000198 0000d0 10 A 5 1 4 [5] .dynstr STRTAB 08048268 000268 000183 00 A 001 [6] .gnu.version VERSYM 080483ec 0003ec 00001a 02 A 4 02 [7] .gnu.version _ r VERNEED 08048408 000408 000060 00 A 5 2 4 [8] .rel.dyn REL 08048468 000468 000010 08 A 40 4 [9] .rel.plt REL 08048478 000478 000048 08 A 4 11 4 [10] .init PROGBITS 080484c0 0004c0 000017 00 AX 004 [11] .plt PROGBITS 080484d8 0004d8 0000a0 04 AX 004 [12] .text PROGBITS 08048580 000580 000268 00 AX 00 16 [13] .fini PROGBITS 080487e8 0007e8 00001c 00 AX 004 [14] .rodata PROGBITS 08048804 000804 00001a 00 A 004 [15] .eh _ frame_hdr PROGBITS 08048820 000820 000044 00 A 004 [16] .eh _ frame PROGBITS 08048864 000864 00010c 00 A 004 [17] .ctors PROGBITS 08049970 000970 00000c 00 WA 004 [18] .dtors PROGBITS 0804997c 00097c 000008 00 WA 004 [19] .jcr PROGBITS 08049984 000984 000004 00 WA 004 [20] .dynamic DYNAMIC 08049988 000988 0000e0 08 WA 5 04 [21] .got PROGBITS 08049a68 000a68 000004 04 WA 004 [22] .got.plt PROGBITS 08049a6c 000a6c 000030 04 WA 004 [23] .d ata PROGBITS 08049a9c 000a9c 000004 00 WA 004 [24] .bss NOBITS 08049aa0 000aa0 000098 00 WA 00 8 [25] .comment PROGBITS 00000000 000aa0 000114 0000 1 [26] .debug _ aranges PROGBITS 00000000 000bb4 000020 0000 1 [27] .debug _ pubnames PROGBITS 00000000 000bd4 000028 0000 1 [28] .debug _ info PROGBITS 00000000 000bfc 0067aa 0000 1 [29 ] .debug _ abbrev PROGBITS 00000000 0073a6 000726 0000 1 [30] .debug _ line PROGBITS 00000000 007acc 0003e1 0000 1 [31] .debug _ frame PROGBITS 00000000 007eb0 00009c 0000 4 [32] .de bug_str PROGBITS 00000000 007f4c 000735 0000 1 [33] .debug _ loc PROGBITS 00000000 008681 0000f3 0000 1 [34] .shstrtab STRTAB 00000000 008774 000151 0000 1 [35] .symtab SYMTAB 00000000 008e90 000590 10 36 61 4 [36] .strtab STRTAB 00000000009420 0003f4 0000 1 Key to Flags: W (write) A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) visible Compared to the non-debug version of the executable, there is more information about the ".debug *" section.

View the section information of the elf file of a target file:

[root@localhost test] $readelf-S myfile.o There are 15 section headers Starting at offset 0x204: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [0] NULL 00000000 000000 00000000 000 [1] .text PROGBITS 00000000 000034 00009e 00 AX 00 4 [2] .rel.text REL 00000000 000744 000060 08 13 1 4 [3] .data PROGBITS 00000000 0000d4 00000000 WA 004 [4] .bss NOBITS 00000000 0000d4 000001 00 WA 004 [5] .ctors PROGBITS 00000000 0000d4 000004 00 WA 004 [6] .rel.ctors REL 00000000 0007a4 000008 08 13 5 4 [7] .rodata PROGBITS 00000000 0000d8 000006 00 A 001 [8] .eh _ frame PROGBITS 00000000 0000e0 00008c 00 A 00 4 [9] .rel.eh _ frame REL 00000000 0007ac 000028 08 13 8 4 [10]. Comment PROGBITS 00000000 00016c 00002e 0000 1 [11] .note.GNU -stack PROGBITS 00000000 00019a 00000000 001 [12] .shstrtab STRTAB 00000000 00019a 00006a 0000 1 [13] .symtab SYMTAB 0000000045c 00018010 14 14 4 [14] .strtab STRTAB 00000000 0005dc 000166 0000 1 Key to Flags: W (write) A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) ```shell * * View the section information of the elf file of a static library file: * * ``shell [root@localhost test] $readelf-S libmy.a File: libmy.a (myfile.o) There are 15 section headers Starting at offset 0x204: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [0] NULL 00000000 000000 00000000 000 [1] .text PROGBITS 00000000 000034 00009e 00 AX 00 4 [2] .rel.text REL 00000000 000744 000060 08 13 1 4 [3] .data PROGBITS 00000000 0000d4 00000000 WA 004 [4] .bss NOBITS 00000000 0000d4 000001 00 WA 004 [5] .ctors PROGBITS 00000000 0000d4 000004 00 WA 004 [6] .rel.ctors REL 00000000 0007a4 000008 08 13 5 4 [7] .rodata PROGBITS 00000000 0000d8 000006 00 A 001 [8] .eh _ frame PROGBITS 00000000 0000e0 00008c 00 A 00 4 [9] .rel.eh _ frame REL 00000000 0007ac 000028 08 13 8 4 [10]. Comment PROGBITS 00000000 00016c 00002e 0000 1 [11] .note.GNU -stack PROGBITS 00000000 00019a 00000000 001 [12] .shstrtab STRTAB 00000000 00019a 00006a 0000 1 [13] .symtab SYMTAB 0000000045c 00018010 14 14 4 [14] .strtab STRTAB 00000000 0005dc 000166 0000 1 Key to Flags: W (write) A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) view the section information of a dynamic library file's elf file:

[root@localhost test] $readelf-S libmy.so There are 27 section headers Starting at offset 0xad0: Section Headers: [Nr] Name Type Addr Off Size ES Flg Lk Inf Al [0] NULL 00000000 000000 00000000 000 [1] .gnu.hash GNU_HASH 000000d4 0000d4 00003c 04 A 20 4 [2] .dynsym DYNSYM 00000110 000110 000120 10 A 3 1 4 [3] .dynstr STRTAB 00000230 000230 000199 00 A 001 [4] .gnu.version VERSYM 000003ca 0003ca 000024 02 A 2 02 [5] .gnu.version _ r VERNEED 000003f0 0003f0 000050 00 A 3 24 [6] .rel.dyn REL 00000440 000440 0000b0 08 A 2 0 4 [7] .rel.plt REL 000004f0 0004f0 000010 08 A 2 9 4 [8] .init PROGBITS 00000500 000500 000017 00 AX 004 [9] .plt PROGBITS 00000518 000518 000030 04 AX 004 [10] .te xt PROGBITS 00000550 000550 0001c4 00 AX 00 16 [11]. Fini PROGBITS 00000714 000714 00001c 00 AX 00 4 [12] .rodata PROGBITS 00000730 000730 000006 00 A 001 [13] .eh _ frame_hdr PROGBITS 00000738 000738 00002c 00 A 00 4 [14] .e h_frame PROGBITS 00000764 000764 000090 00 A 00 4 [15] .ctors PROGBITS 000017f4 0007f4 00000c 00 WA 004 [16] .dtors PROGBITS 00001800 000800 000008 00 WA 004 [17] .jcr PROGBITS 00001808 000808 000004 00 WA 004 [18] .data.rel.ro PROGBITS 0000180c 00080c 000004 00 WA 004 [19] .dynamic DYNAMIC 00001810 000810 0000e0 08 WA 3 04 [20] .got PROGBITS 000018f0 0008f0 00000c 04 WA 00 4 [21] .got.plt PROGBITS 000018fc 0008fc 000014 04 WA 00 4 [22] .bss NOBITS 00001910 000910 00000c 00 WA 00 4 [23] .comment PROGBITS 00000000 000910 0000e6 00001 [24] .shstrtab STRTAB 00000000 0009f6 0000da 0000 1 [25] .symtab SYMTAB 00000000 000f08 000410 10 26 48 4 [26] .strtab STRTAB 00000000001318 000333 0000 1 Key to Flags: W (write) A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific) Thank you for reading The above is the content of "how to use the Linux readelf command". After the study of this article, I believe you have a deeper understanding of how to use the Linux readelf command, and the specific use needs to be verified in practice. Here is, the editor will push for you more related knowledge points of the article, welcome to follow!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.