官术网_书友最值得收藏!

Chapter 2. The ELF Binary Format

In order to reverse-engineer Linux binaries, you must understand the binary format itself. ELF has become the standard binary format for Unix and Unix-flavor OSes. In Linux, BSD variants, and other OSes, the ELF format is used for executables, shared libraries, object files, coredump files, and even the kernel boot image. This makes ELF very important to learn for those who want to better understand reverse engineering, binary hacking, and program execution. Binary formats such as ELF are not generally a quick study, and to learn ELF requires some degree of application of the different components that you learn as you go. Real, hands-on experience is necessary to achieve proficiency. The ELF format is complicated and dry, but can be learned with some enjoyment when applying your developing knowledge of it in reverse engineering and programming tasks. ELF is really quite an incredible composition of computer science at work, with program loading, dynamic linking, symbol table lookups, and many other tightly orchestrated components.

I believe that this chapter is perhaps the most important in this entire book because it will give the reader a much greater insight into topics pertaining to how a program is actually mapped out on disk and loaded into memory. The inner workings of program execution are complicated, and understanding it is valuable knowledge to the aspiring binary hacker, reverse engineer, or low-level programmer. In Linux, program execution implies the ELF binary format.

My approach to learning ELF is through investigation of the ELF specifications as any Linux reverse engineer should, and then applying each aspect of what we learn in a creative way. Throughout this book, you will visit many facets of ELF and see how knowledge of it is pertinent to viruses, process-memory forensics, binary protection, rootkits, and more.

In this chapter, you will cover the following ELF topics:

  • ELF file types
  • Program headers
  • Section headers
  • Symbols
  • Relocations
  • Dynamic linking
  • Coding an ELF parser
主站蜘蛛池模板: 孙吴县| 耒阳市| 东源县| 汉源县| 绥阳县| 江城| 来凤县| 巴彦淖尔市| 陆丰市| 闽侯县| 绥化市| SHOW| 横山县| 丰顺县| 烟台市| 南皮县| 大竹县| 宁德市| 砚山县| 肥东县| 外汇| 会泽县| 松滋市| 高淳县| 治多县| 嘉鱼县| 靖宇县| 明溪县| 江永县| 宁河县| 方城县| 图木舒克市| 齐河县| 红河县| 罗平县| 酒泉市| 焉耆| 万荣县| 阳山县| 南丹县| 水城县|