官术网_书友最值得收藏!

Chapter 2. The ELF Binary Format

In order to reverse-engineer Linux binaries, you must understand the binary format itself. ELF has become the standard binary format for Unix and Unix-flavor OSes. In Linux, BSD variants, and other OSes, the ELF format is used for executables, shared libraries, object files, coredump files, and even the kernel boot image. This makes ELF very important to learn for those who want to better understand reverse engineering, binary hacking, and program execution. Binary formats such as ELF are not generally a quick study, and to learn ELF requires some degree of application of the different components that you learn as you go. Real, hands-on experience is necessary to achieve proficiency. The ELF format is complicated and dry, but can be learned with some enjoyment when applying your developing knowledge of it in reverse engineering and programming tasks. ELF is really quite an incredible composition of computer science at work, with program loading, dynamic linking, symbol table lookups, and many other tightly orchestrated components.

I believe that this chapter is perhaps the most important in this entire book because it will give the reader a much greater insight into topics pertaining to how a program is actually mapped out on disk and loaded into memory. The inner workings of program execution are complicated, and understanding it is valuable knowledge to the aspiring binary hacker, reverse engineer, or low-level programmer. In Linux, program execution implies the ELF binary format.

My approach to learning ELF is through investigation of the ELF specifications as any Linux reverse engineer should, and then applying each aspect of what we learn in a creative way. Throughout this book, you will visit many facets of ELF and see how knowledge of it is pertinent to viruses, process-memory forensics, binary protection, rootkits, and more.

In this chapter, you will cover the following ELF topics:

  • ELF file types
  • Program headers
  • Section headers
  • Symbols
  • Relocations
  • Dynamic linking
  • Coding an ELF parser
主站蜘蛛池模板: 长子县| 伊通| 开鲁县| 澎湖县| 称多县| 买车| 安丘市| 黔江区| 隆安县| 东海县| 台南县| 东方市| 长乐市| 旬邑县| 泰和县| 安龙县| 新野县| 宜君县| 鄂州市| 灵丘县| 延川县| 万山特区| 松溪县| 东源县| 赫章县| 涞源县| 万年县| 平江县| 汉源县| 高尔夫| 普洱| 开原市| 广饶县| 公安县| 唐河县| 连江县| 嫩江县| 澳门| 布尔津县| 瑞金市| 哈尔滨市|