Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
1
vote
0answers
537 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
2
votes
1answer
394 views

possible to rebase an ELF file?

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base) I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it'...
1
vote
2answers
100 views

ELF File format Two terminating null dword towards 0xc0000000?

While I was reversing an elf binary, I tried to manually compute my environment variable's address. Therefore I found this documentation and we're said that there is one NULL DWORD at the end of the ...
3
votes
1answer
2k views

ELF link_map when linked as RELRO

When linking a binary with -Wl,-z,relro,-z,now, all relocations are performed at start-up before passing control to the binary. Because of this, there is no need for the .got.plt segment. Normally, ...
2
votes
2answers
1k views

Making ELF's .data section Executable at static time

Is it possible to make the .data section of an ELF file executable? I've tried to make the .data section executable by changing the flags of the .data section, but it simply doesn't work. Is it not ...
4
votes
1answer
677 views

Associating Symbol Names with .PLT Entries

Doing some messing around with ELF (of both the x86 and ARM varieties). Associating symbol names with entries in the .got section is straightforward. Find the .got section, find the relocation ...
0
votes
1answer
2k views

Why ELF headers are included in the process memory

The running process has nothing to do with the program headers but when we print the address(0x08048000) we can see the ELF header starting with "\x7fELF..". It looks like so much of page memory is ...
1
vote
0answers
1k views

How to change the export function name of android so file (ELF format)

Here are my .so files: libJlcVideoEncoder.so java_so_change.exe Below are export functions inside .so files: Java_com_jlc_BubbleChat_libJlcVideoEncoder_JNIJlcInit ...
4
votes
1answer
545 views

ELF counterpart for IDA Pro PE utilities

I'm interested in patching ELF files using IDA and the following PE utilities have proven very useful for patching PEs. Does anyone know if there are some publicly available IDA scripts similar to ...
4
votes
4answers
1k views

Is it possible to (heuristic) identify the begin addr of main function in a stripped ELF?

So basically I am working on some tripped dynamic linked ELF binaries (32 bit Linux x86), using objdump to disassemble them, modifying and trying to reassemble them. In the unstripped binary, we can ...
1
vote
1answer
711 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
1
vote
1answer
1k views

ldd showing absolute path only

Under what circumstances does the output of ldd have only the absolute path? In the below eg, /usr/lib/arm-linux-gnueabihf/libcofi_rpi.so and /lib/ld-linux-armhf.so.3. pi@raspberrypi ~ $ uname -a ...
6
votes
3answers
3k views

No dynamic symbol table but resolution of method from shared libraries is working

I want to find how can I identify calls to shared libraries in GDB only. On a stripped binary, I cannot found the dynamic symbol table: $> objdump -tT crackme-01 crackme-01: file format elf32-...
3
votes
1answer
472 views

How to reuse symbol/data defined in .bss section?

So basically I am trying to re-use some assembly code/data dumped by objdump from 32 bit ELF binary on Linux. So basically, in the disassembled binary, I found some symbol referring to .bss section ...
11
votes
2answers
8k views

Why I can not directly get the content of `.bss` section?

Test is on Linux 32bit. I use this command to get the context of .text .rodata and .data section: objdump -s -j .text elf_binary objdump -s -j .rodata elf_binary objdump -s -j .data elf_binary But ...
3
votes
1answer
3k views

Why ther are some many padding/leading nop instructions in my binary code?

The test platform is on Linux 32bit, x86. So basically I wrote a simple C program like this: void main() { double a = 10.0; printf("hello world %f\n", a); } I use gcc to compile to ...
5
votes
2answers
9k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
2
votes
0answers
439 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
4
votes
1answer
2k views

Merging elf shared-objects

Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?
3
votes
1answer
809 views

Known publicly available modified UPX ELF packer [closed]

Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
4
votes
1answer
556 views

Changing parameter of function call in ELF executable

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY. ...
11
votes
1answer
4k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
10
votes
2answers
4k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
9
votes
2answers
2k views

Fixing the checksum of a modified Android ELF

I've hex-edited a string in an Android ELF binary. Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum. Does anybody have a tool to fix the ...