找出32位ELF Linux二进制文件在哪里结束并开始填充? [英] Find where 32-bit ELF Linux binary ends, and padding begins?

问题描述

如何确定32位ELF Linux二进制文件的结尾处以及附加到文件的其他数据的开头?例如，某些软件会将数据附加到文件的末尾以进行提取或执行，同时将其包含在单个二进制文件中.自解压存档就是此类文件的示例.

我正在尝试做的事情与 询问PE文件是通过PE标头结尾的吗?

请注意，在我的情况下，末尾没有页脚或其他任何数据来指定有效负载的大小.此类数据是在有效负载开始之前在ELF文件结束处指定的，但是我想知道如何以编程方式找到它而不寻找它，并希望它不会出现假阳性.

解决方案

也许您可以获取节标题表的位置并为其加上条目数量和条目大小来计时?不确定，但这是我最好的选择.

How can you determine where a 32-bit ELF Linux binary ends, and additional data appended to the file begins? For example, some software will append data to the end of a file for extraction or execution, while being contained in a single binary. A self-extracting archive would be an example of such a file.

What I'm trying to do is similar to what Find out where PE file ends through PE header? asks, except for Linux ELF binaries, and not Windows PE binaries.

Note that in my case there is not a footer or any other data at the end to specify how large the payload is. Such data is specified where the ELF file end, just before the payload begins, but I would like to know how to programmatically find it without seeking for it and hoping it doesn't get a false-positive.

解决方案

Maybe you could get the position of the section header table and time it with the amount of entries and the entry size? Not entirely sure but that's my best bet.

这篇关于找出32位ELF Linux二进制文件在哪里结束并开始填充?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！