文章目录linux系统目标文件查看文件头段表内容段其他段符号表可执行文件查看程序头表程序虚拟地址空间分布手动生成目标文件Windowslinux系统# 查看文件格式$filesimpleSection.o simpleSection.o: ELF64-bit LSB relocatable, x86-64, version1(SYSV), not stripped目标文件查看文件头$ readelf-hsimpleSection.o ELF Header: Magic: 7f454c4602 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data:2s complement, little endian Version:1(current)OS/ABI: UNIX - System V ABI Version:0Type: REL(Relocatablefile)Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x0 Start of program headers:0(bytes intofile)Start of section headers:1032(bytes intofile)Flags: 0x0 Size of this header:64(bytes)Size of program headers:0(bytes)Number of program headers:0Size of section headers:64(bytes)Number of section headers:14Section header string table index:13段表$ readelf-SsimpleSection.o There are14section headers, starting at offset 0x408: Section Headers:[Nr]Name Type Address Offset Size EntSize Flags Link Info Align[0]NULL 0000000000000000 00000000 0000000000000000 0000000000000000000[1].text PROGBITS 0000000000000000 00000040 000000000000005a 0000000000000000 AX001[2].rela.text RELA 0000000000000000 000002e8 0000000000000078 0000000000000018 I1118[3].data PROGBITS 0000000000000000 0000009c 0000000000000008 0000000000000000 WA004[4].bss NOBITS 0000000000000000 000000a4 0000000000000008 0000000000000000 WA004[5].rodata PROGBITS 0000000000000000 000000a4 0000000000000004 0000000000000000 A001[6].comment PROGBITS 0000000000000000 000000a8 000000000000001c 0000000000000001 MS001[7].note.GNU-stack PROGBITS 0000000000000000 000000c4 0000000000000000 0000000000000000001[8].note.gnu.pr[...]NOTE 0000000000000000 000000c8 0000000000000030 0000000000000000 A008[9].eh_frame PROGBITS 0000000000000000 000000f8 0000000000000058 0000000000000000 A008[10].rela.eh_frame RELA 0000000000000000 00000360 0000000000000030 0000000000000018 I1198[11].symtab SYMTAB 0000000000000000 00000150 0000000000000138 00000000000000181288[12].strtab STRTAB 0000000000000000 00000288 000000000000005f 0000000000000000001[13].shstrtab STRTAB 0000000000000000 00000390 0000000000000074 0000000000000000001Key to Flags: W(write), A(alloc), X(execute), M(merge), S(strings), I(info), L(link order), O(extra OS processing required), G(group), T(TLS), C(compressed), x(unknown), o(OS specific), E(exclude), D(mbind), l(large), p(processor specific)# 关键的段$ objdump-hsimpleSection.o simpleSection.o:fileformatelf64-x86-64 Sections: Idx Name Size VMA LMA File off Algn0.text 0000005a 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE1.data 00000008 0000000000000000 0000000000000000 0000009c2**2 CONTENTS, ALLOC, LOAD, DATA2.bss 00000008 0000000000000000 0000000000000000 000000a42**2 ALLOC3.rodata 00000004 0000000000000000 0000000000000000 000000a42**0 CONTENTS, ALLOC, LOAD, READONLY, DATA4.comment 0000001c 0000000000000000 0000000000000000 000000a82**0 CONTENTS, READONLY5.note.GNU-stack 00000000 0000000000000000 0000000000000000 000000c42**0 CONTENTS, READONLY6.note.gnu.property 00000030 0000000000000000 0000000000000000 000000c82**3 CONTENTS, ALLOC, LOAD, READONLY, DATA7.eh_frame 00000058 0000000000000000 0000000000000000 000000f82**3 CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA# ELF文件中代码段、数据段和bss段的长度$ size simpleSection.o text data bss dec hex filename23088246f6 simpleSection.o内容段# -s 将所有段的内容以十六进制的形式的打印# -d 将所有包含指令的段反汇编$ objdump-s-dsimpleSection.o simpleSection.o:fileformatelf64-x86-64 Contents of section .text: 0000 554889e5 4883ec10 897dfc8b 45fc89c6 UH..H....}..E... 0010 488d0500 00000048 89c7b800 000000e8 H......H........0020 00000000 90c9c355 4889e548 83ec10c7.......UH..H....0030 45f80100 00008b15 00000000 8b050000 E............... 0040 000001c2 8b45f801 c28b45fc 01d089c7.....E....E..... 0050 e8000000 008b45f8 c9c3......E... Contents of section .data: 00005400000055000000T...U... Contents of section .rodata: 0000 25640a00 %d..Contents of section .comment: 0000 00474343 3a202847 4e552920 31342e32 .GCC:(GNU)14.20010 2e3120323032353032303700.120250207. Contents of section .note.gnu.property: 0000 040000002000000005000000 474e5500...........GNU. 0010 020001c0 04000000 01000000 00000000................0020 010001c0 04000000 01000000 00000000................Contents of section .eh_frame: 00001400000000000000 017a5200 01781001.........zR..x..0010 1b0c0708900100001c000000 1c000000................0020 000000002700000000410e10 8602430d........A....C. 0030 06620c07 08000000 1c000000 3c000000 .b............. 0040 000000003300000000410e10 8602430d....3....A....C. 0050 066e0c07 08000000 .n......Disassembly of section .text: 0000000000000000func1:0:55push %rbp1:4889e5 mov %rsp,%rbp4:4883ec10sub$0x10,%rsp8:897d fc mov %edi,-0x4(%rbp)b: 8b45fc mov -0x4(%rbp),%eax e:89c6 mov %eax,%esi10:488d 05 00 00 00 00 lea 0x0(%rip),%rax# 17 func10x1717:4889c7 mov %rax,%rdi 1a: b8 00 00 00 00 mov$0x0,%eax 1f: e8 00 00 00 00 call24func10x2424:90nop25: c9 leave26: c3 ret 0000000000000027main:27:55push %rbp28:4889e5 mov %rsp,%rbp 2b:4883ec10sub$0x10,%rsp 2f: c745f8 01 00 00 00 movl$0x1,-0x8(%rbp)36: 8b1500 00 00 00 mov 0x0(%rip),%edx# 3c main0x153c: 8b 05 00 00 00 00 mov 0x0(%rip),%eax# 42 main0x1b42: 01 c2add%eax,%edx44: 8b45f8 mov -0x8(%rbp),%eax47: 01 c2add%eax,%edx49: 8b45fc mov -0x4(%rbp),%eax 4c: 01 d0add%edx,%eax 4e:89c7 mov %eax,%edi50: e8 00 00 00 00 call55main0x2e55: 8b45f8 mov -0x8(%rbp),%eax58: c9 leave59: c3 ret其他段# 显示段表、符号表、重定位表等$ objdump-xsimpleSection.o simpleSection.o:fileformatelf64-x86-64 simpleSection.o architecture: i386:x86-64, flags 0x00000011: HAS_RELOC, HAS_SYMS start address 0x0000000000000000 Sections: Idx Name Size VMA LMA File off Algn0.text 0000005a 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE1.data 00000008 0000000000000000 0000000000000000 0000009c2**2 CONTENTS, ALLOC, LOAD, DATA2.bss 00000008 0000000000000000 0000000000000000 000000a42**2 ALLOC3.rodata 00000004 0000000000000000 0000000000000000 000000a42**0 CONTENTS, ALLOC, LOAD, READONLY, DATA4.comment 0000001c 0000000000000000 0000000000000000 000000a82**0 CONTENTS, READONLY5.note.GNU-stack 00000000 0000000000000000 0000000000000000 000000c42**0 CONTENTS, READONLY6.note.gnu.property 00000030 0000000000000000 0000000000000000 000000c82**3 CONTENTS, ALLOC, LOAD, READONLY, DATA7.eh_frame 00000058 0000000000000000 0000000000000000 000000f82**3 CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA SYMBOL TABLE: 0000000000000000 ldf*ABS* 0000000000000000 simpleSection.c 0000000000000000 l d .text 0000000000000000 .text 0000000000000000 l d .data 0000000000000000 .data 0000000000000000 l d .bss 0000000000000000 .bss 0000000000000000 l d .rodata 0000000000000000 .rodata 0000000000000004 l O .data 0000000000000004 static_var.1 0000000000000004 l O .bss 0000000000000004 static_var2.0 0000000000000000 g O .data 0000000000000004 global_init_var 0000000000000000 g O .bss 0000000000000004 global_uinit_var 0000000000000000 g F .text 0000000000000027 func1 0000000000000000 *UND* 0000000000000000printf0000000000000027 g F .text 0000000000000033 main RELOCATION RECORDS FOR[.text]: OFFSET TYPE VALUE 0000000000000013 R_X86_64_PC32 .rodata-0x0000000000000004 0000000000000020 R_X86_64_PLT32 printf-0x0000000000000004 0000000000000038 R_X86_64_PC32 .data 000000000000003e R_X86_64_PC32 .bss 0000000000000051 R_X86_64_PLT32 func1-0x0000000000000004 RELOCATION RECORDS FOR[.eh_frame]: OFFSET TYPE VALUE 0000000000000020 R_X86_64_PC32 .text 0000000000000040 R_X86_64_PC32 .text0x0000000000000027符号表$ readelf-ssimpleSection.o Symbol table.symtabcontains13entries: Num: Value Size Type Bind Vis Ndx Name0: 00000000000000000NOTYPE LOCAL DEFAULT UND1: 00000000000000000FILE LOCAL DEFAULT ABS simpleSection.c2: 00000000000000000SECTION LOCAL DEFAULT1.text3: 00000000000000000SECTION LOCAL DEFAULT3.data4: 00000000000000000SECTION LOCAL DEFAULT4.bss5: 00000000000000000SECTION LOCAL DEFAULT5.rodata6: 00000000000000044OBJECT LOCAL DEFAULT3static_var.17: 00000000000000044OBJECT LOCAL DEFAULT4static_var2.08: 00000000000000004OBJECT GLOBAL DEFAULT3global_init_var9: 00000000000000004OBJECT GLOBAL DEFAULT4global_uinit_var10: 000000000000000039FUNC GLOBAL DEFAULT1func111: 00000000000000000NOTYPE GLOBAL DEFAULT UNDprintf12: 000000000000002751FUNC GLOBAL DEFAULT1main可执行文件查看程序头表程序头描述了ELF文件如何被操作系统映射到进程虚拟地址空间。# 程序头表$ readelf-lsectionMapping.elf Elffiletypeis EXEC(Executablefile)Entry point 0x402d60 There are12program headers, starting at offset64Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000 0x0000000000000518 0x0000000000000518 R 0x1000 LOAD 0x0000000000001000 0x0000000000401000 0x0000000000401000 0x000000000007a7ed 0x000000000007a7ed R E 0x1000 LOAD 0x000000000007c000 0x000000000047c000 0x000000000047c000 0x0000000000031b88 0x0000000000031b88 R 0x1000 LOAD 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000005960 0x000000000000b1a0 RW 0x1000 NOTE 0x00000000000002e0 0x00000000004002e0 0x00000000004002e0 0x0000000000000024 0x0000000000000024 R 0x4 NOTE 0x00000000000adb28 0x00000000004adb28 0x00000000004adb28 0x0000000000000040 0x0000000000000040 R 0x8 NOTE 0x00000000000adb68 0x00000000004adb68 0x00000000004adb68 0x0000000000000020 0x0000000000000020 R 0x4 TLS 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000000038 0x0000000000000050 R 0x8 GNU_PROPERTY 0x00000000000adb28 0x00000000004adb28 0x00000000004adb28 0x0000000000000040 0x0000000000000040 R 0x8 GNU_SFRAME 0x00000000000a18a8 0x00000000004a18a8 0x00000000004a18a8 0x000000000000c18a 0x000000000000c18a R 0x8 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 GNU_RELRO 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000003f38 0x0000000000003f38 R 0x1 Section to Segment mapping: Segment Sections... 00 .note.gnu.build-id .rela.plt 01 .init .plt .text .fini 02 .rodata .stapsdt.base rodata.cst32 .eh_frame .sframe .gcc_except_table .note.gnu.property .note.ABI-tag 03 .tdata .init_array .fini_array .data.rel.ro .got .got.plt .data .bss 04 .note.gnu.build-id 05 .note.gnu.property 06 .note.ABI-tag 07 .tdata .tbss 08 .note.gnu.property 09 .sframe1011.tdata .init_array .fini_array .data.rel.ro .got程序虚拟地址空间分布$ gcc-otestsingleton.c-static$ ./test[1]4869$cat/proc/4869/map map_files/ maps $cat/proc/4869/maps 起始地址-结束地址 权限 偏移量 设备号 inode 路径名/描述 00400000-00401000 r--p 00000000103:0614811163/home/user/.leetcode/test/test 00401000-0047c000 r-xp 00001000103:0614811163/home/user/.leetcode/test/test 0047c000-004a2000 r--p 0007c000103:0614811163/home/user/.leetcode/test/test 004a2000-004a7000 r--p 000a1000103:0614811163/home/user/.leetcode/test/test 004a7000-004a9000 rw-p 000a6000103:0614811163/home/user/.leetcode/test/test 004a9000-004af000 rw-p 00000000 00:00012047000-12069000 rw-p 00000000 00:000[heap]70381afb7000-70381afbb000 r--p 00000000 00:000[vvar]70381afbb000-70381afbd000 r-xp 00000000 00:000[vdso]7fff43702000-7fff43723000 rw-p 00000000 00:000[stack]ffffffffff600000-ffffffffff601000--xp00000000 00:000[vsyscall]手动生成目标文件# 二进制文件生成目标文件$ objcopy-Ibinary-Oelf64-x86-641.jpg pic.o $ objdump-htpic.o pic.o:fileformatelf64-x86-64 Sections: Idx Name Size VMA LMA File off Algn0.data 00094bbe 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, DATA SYMBOL TABLE: 0000000000000000 g .data 0000000000000000 _binary_1_jpg_start 0000000000094bbe g .data 0000000000000000 _binary_1_jpg_end 0000000000094bbe g *ABS* 0000000000000000 _binary_1_jpg_size $du-shpic.o 596K pic.o $du-sh1.jpg 596K1.jpg生成的目标文件有全局符号可用代码可直接使用这个段处理文件。Windows# /ALL打印目标文件的所有相关信息dumpbin/ALL simpleSection.obj simpleSection.txt# /SUMMARY输出所有段的段名和长度dumpbin/SUMMARY simpleSection.obj