了解小精灵的hexedit [英] understand hexedit of an elf

问题描述

请考虑以下ELF文件的十六进制显示。

Consider the following hexedit display of an ELF file.

00000000   7F 45 4C 46  01 01 01 00  00 00 00 00  .ELF........
0000000C   00 00 00 00  02 00 03 00  01 00 00 00  ............
00000018   30 83 04 08  34 00 00 00  50 14 00 00  0...4...P...
00000024   00 00 00 00  34 00 20 00  08 00 28 00  ....4. ...(.
00000030   24 00 21 00  06 00 00 00  34 00 00 00  $.!.....4...
0000003C   34 80 04 08  34 80 04 08  00 01 00 00  4...4.......
00000048   00 01 00 00  05 00 00 00  04 00 00 00  ............

1. 它有多少节标题？


2. 目标文件还是可执行文件？


3. 它有多少个程序头？


4. 如果有任何程序头，第一个程序头是什么？


5. 如果有任何节标题，则节标题表的偏移量是多少？

1. How many section headers does it have?
2. Is it an object file or an executable file?
3. How many program headers does it have?
4. If there are any program headers, what does the first program header do?
5. If there are any section headers, at what offset is the section header table?

推荐答案

奇怪，此十六进制转储看起来像 您的作业 给我...

Strange, this hexdump looks like your homework to me...

1. 有36个节标题。


2. 它是可执行文件。


3. 它有8个程序标题。


4. 您所知道的通过第一个程序标头中的第一个单词（偏移量0x34：0x0006），它的类型为 PT_PHDR ，它只是告知程序标头表本身的特征。


5. 节头表从字节5200开始（十六进制为0x1450）。

1. There are 36 section headers.
2. It is an executable.
3. It has 8 program headers.
4. As you can tell by the first word (offset 0x34: 0x0006) in the first program header, it is of type PT_PHDR, which just informs about the characteristics of the program header table itself.
5. The section header table begins at byte 5200 (which is 0x1450 in hex).

操作方法我知道这个东西吗？通过将十六进制转储为二进制文件并使用 readelf -a 进行读取（因为我很懒）。除了问题编号。 4，我必须通过阅读 man 5手动找出精灵 。

How do I know this stuff? By dumping the hex into a binary and reading it with readelf -a (because I am lazy). Except for question no. 4, which I had to figure out manually by reading man 5 elf.

这篇关于了解小精灵的hexedit的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！