当我们运行可执行文件时，是否所有部分都立即加载到内存中? [英] When we run an executable, do all the sections get loaded into memory at once?

问题描述

因此，可执行文件包含不同的部分和头.

So an executable contains of different sections and headers.

在 ELF标头中，我们可以看到有关它们的一些元数据，例如不同标头的大小，起点等.

At the ELF Header we can see some metadata about them like the size of different headers, Starting point etc.

可执行文件的不同部分是否一次全部加载到内存中?

Are the different parts of an executable get loaded into memory all at once?

如果是，请如何/何时进行定义，以及在何处可以看到有关此信息的信息，因为 ELF标头在此问题上似乎没有任何参数

If yes, how / when it is defined and where we can see the information about that because the ELF Header doesn't seem to have any parameter in that matter.

先谢谢了.

推荐答案

对于ELF二进制文件，节不是决定二进制文件如何加载到内存中的因素.它们只是调试器和其他工具的有用元数据，各段和各节之间不需要对应，通常一个段下包含多个节.二进制文件根本没有节头，仍然可以正常加载.

With ELF binaries, sections are not what decides how the binary is loaded into memory. They are just useful metadata for debuggers and other tools and there doesn't need to be a correspondence between segments and sections and often multiple sections are subsumed under one segment. A binary can have no section header at all and still load fine.

实际上决定什么加载的内容以及程序头的位置.每个程序头描述一个内存段，并包含以下信息:

What actually decides what is getting loaded and where are the program headers. Each program header describes one memory segment and contains the following information:

• p_type 字段告诉您程序头包含的信息类型.这通常只是 PT_LOAD 来表示可加载的段".
• p_offset 字段告诉您距段所在文件开头的偏移量.请注意，在极少数情况下，这可能会超出文件末尾.
• p_vaddr 字段告诉您段所映射的虚拟地址.还有 p_paddr 用于指定物理地址，但是通常不使用.
• p_filesz 字段告诉您该段在文件中的时间.
• p_memsz 字段告诉您段在内存中的存储时间.如果该长度大于文件中的段长度，则其余部分将用零填充.
• p_flags 字段告诉您该段是否可读( PF_R )，可写( PF_W )，可执行( PF_X )或这三者的某种组合.加载段时，操作系统使用这些标志来设置写保护和可执行保护.
• p_align 字段告诉您段的对齐方式.这里不是很重要.

• the field p_type tells you what kind of information the program header contains. This is typically just PT_LOAD to mean "loadable segment."
• the field p_offset tells you the offset from the beginning of the file where the segment resides. Note that in rare cases, this can lie beyond the end of the file.
• the field p_vaddr tells you the virtual address at which the segment is mapped. There is also p_paddr to specify a physical address, but it's generally unused.
• the field p_filesz tells you how long the segment is in the file.
• the field p_memsz tells you how long the segment is in memory. If this is more than the segment length in the file, the remainder is filled with zeroes.
• the field p_flags tells you if the segment is readable (PF_R), writable (PF_W), executable (PF_X) or some combination of these three. When loading a segment, the operating system uses these flags to set up write and executable protection.
• the field p_align tells you how the segment is aligned. This is not really important here.

当操作系统加载二进制文件或运行时链接编辑器加载共享对象时，它将读取二进制文件的程序头，并按照它们出现的顺序加载或映射每个段.完成此操作后，您的程序将被执行.

When the operating system loads your binary or when the runtime link editor loads a shared object, it reads the program headers of your binary and loads or maps each segment in the order they appear. Once this is done, your program is executed.

您可以通过运行 readelf -l binary 获得有关二进制程序标头的信息.

You can get information about the program headers of a binary by running readelf -l binary.

这篇关于当我们运行可执行文件时，是否所有部分都立即加载到内存中?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！