是否真的需要ELF .notes部分？ [英] Is the ELF .notes section really needed?

问题描述

在Linux上，我试图将静态链接的ELF文件剥离为基本内容。当我运行时：

On Linux, I'm trying to strip a statically linked ELF file to the bare essentials. When I run:

strip --strip-unneeded foo

或

strip --strip-all foo

生成的文件仍然带有一个胖的.notes部分，看起来充满了时髦的字符串。

The resulting file still has a fat .notes section that appears to be full of funky strings.

真的需要.notes部分，还是可以用--remove-section安全地将其删除？

Is the .notes section really needed or can I safely force it out with --remove-section?

感谢您的帮助。

推荐答案

通过经验和查看条纹的手册页，看起来 strip 并不是应该来摆脱不需要的所有部分和字符串；只是符号。关于手册页：

From experience and from looking at the man page for strip, it looks like strip isn't supposed to get rid of any and all sections and strings that aren't needed; just symbols. Quoth the man page:

   GNU strip discards all symbols from object files objfile.

根据经验，即使没有-strip-all 的Strip ，也会删除不需要加载的部分，例如 .symtab 和 .strtab ，您可以注意到，您可以使用删除所需的部分-删除部分。

That being said, from experience, strip, even without --strip-all, removes sections unneeded for loading, such as .symtab and .strtab, and you can, as you note, remove sections you want it with --remove-section.

作为 .notes 部分的示例，我采用了 / bin / ls 从我的Ubuntu 11.10 64位盒中：

As an example of a .notes section, I took /bin/ls from my Ubuntu 11.10 64-bit box:

$ readelf -Wn /bin/ls

Notes at offset 0x00000254 with length 0x00000020:
  Owner                 Data size   Description
  GNU                  0x00000010   NT_GNU_ABI_TAG (ABI version tag)
    OS: Linux, ABI: 2.6.15

Notes at offset 0x00000274 with length 0x00000024:
  Owner                 Data size   Description
  GNU                  0x00000014   NT_GNU_BUILD_ID (unique build ID bitstring)
    Build ID: 3e6f3159144281f709c3c5ffd41e376f53b47952

包含 .note.ABI标签部分和 .note .gnu.build-id 部分。看起来它们包含的数据对于加载程序而言不是必需的，但也不是标准的，并且 strip 不知道对于适当的数据而言不是必需的数据运行该程序，因为ELF可以具有许多其他不安全删除的未知部分。因此，与其使用虚拟白名单（可能会失败），它使用了自己知道可以摆脱的部分黑名单，并且这样做了。

That encompasses the .note.ABI-tag section and the .note.gnu.build-id section. It looks like they contain data that isn't necessary to load the program, but also isn't standard, and isn't known by strip to not be necessary for the proper running of the program, since an ELF can have any number of additional "unknown" sections that aren't safe to remove. So rather using a virtual whitelist (which would fail miserably), it uses a blacklist of sections that it knows it can get rid of, and does so.

简短版本：这些部分似乎不是标准的，可以用于各种用途，因此 strip 不知道删除它们是安全的。但是根据我上面提到的内容，如果它是您自己的程序，则可以肯定将其删除。

Short version: these sections don't seem to be standard and could be used for various things, so strip can't know it's safe to remove them. But based on the info inside the one I took above, if it's your own program, it's almost certainly safe to remove it.

这篇关于是否真的需要ELF .notes部分？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！