Questions tagged [elf]

the Executable and Linkable Format is the main executable and object format for Linux, Solaris, *BSD, and many other OSes...

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

ldd showing absolute path only

Under what circumstances does the output of ldd have only the absolute path? In the below eg, /usr/lib/arm-linux-gnueabihf/libcofi_rpi.so and /lib/ld-linux-armhf.so.3. pi@raspberrypi ~ $ uname -a ...
1
vote
1answer
699 views

Kernel dealing with the section headers in an ELF

I recently read that the kernel and the dynamic loader mostly deal with the program header tables in an ELF file and that assemblers, compilers and linkers deal with the section header tables. The ...
4
votes
4answers
1k views

Is it possible to (heuristic) identify the begin addr of main function in a stripped ELF?

So basically I am working on some tripped dynamic linked ELF binaries (32 bit Linux x86), using objdump to disassemble them, modifying and trying to reassemble them. In the unstripped binary, we can ...
3
votes
1answer
464 views

How to reuse symbol/data defined in .bss section?

So basically I am trying to re-use some assembly code/data dumped by objdump from 32 bit ELF binary on Linux. So basically, in the disassembled binary, I found some symbol referring to .bss section ...
3
votes
1answer
278 views

How to deal with this “error” instructions generated by objdump?

So basically I am using objdump to disassemble a binary from GNU Coreutils, on 32-bit Linux x86. In the disassembled code, I found one "broken" instruction like this: 804b4db: ff 24 85 e4 09 ...
10
votes
2answers
7k views

Why I can not directly get the content of `.bss` section?

Test is on Linux 32bit. I use this command to get the context of .text .rodata and .data section: objdump -s -j .text elf_binary objdump -s -j .rodata elf_binary objdump -s -j .data elf_binary But ...
3
votes
1answer
3k views

Why ther are some many padding/leading nop instructions in my binary code?

The test platform is on Linux 32bit, x86. So basically I wrote a simple C program like this: void main() { double a = 10.0; printf("hello world %f\n", a); } I use gcc to compile to ...
6
votes
3answers
3k views

No dynamic symbol table but resolution of method from shared libraries is working

I want to find how can I identify calls to shared libraries in GDB only. On a stripped binary, I cannot found the dynamic symbol table: $> objdump -tT crackme-01 crackme-01: file format elf32-...
24
votes
1answer
59k views

Reversing ELF 64-bit LSB executable, x86-64 ,gdb

I'm a newbie and just got into RE. I got a ELF 64-bit LSB executable, x86-64. I'm trying to reverse it. First I tried to set a break point on line 1 using gdb ./filename break 1 The gdb says No ...
2
votes
0answers
438 views

Patch ELF (arm): remove constructor segment

I got an ELF shared library with a constructor function that is executed every time the library is loaded: .init_array:00005E5C ; ===================================================================== ...
5
votes
2answers
8k views

Decoding the UPX ELF header file

Still on my way to understand how to prevent the usage of the -d (decompress) option of UPX (see this question), I try to identify the header file of UPX in ELF executable files. Looking at the code, ...
4
votes
1answer
2k views

Merging elf shared-objects

Let say I have libA.so and libB.so, is there any way for me to combine them into a single shared library libC.so that contains all exported symbols of both libA.so and libB.so?
5
votes
3answers
6k views

Packers/Protectors for Linux

I was wondering if anyone had come across a packer/protector which could be used for ELF binaries. There seem to be quite a few articles on writing packers and protectors for the PE format -- however, ...
3
votes
1answer
792 views

Known publicly available modified UPX ELF packer [closed]

Anyone know of any publicly available modified versions of UPX for ELF? I.e. one that is not able to be unpacked using upx -d. The unpacking stub in the binary is slightly obfuscated. I am looking to ...
4
votes
1answer
544 views

Changing parameter of function call in ELF executable

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY. ...
24
votes
1answer
20k views

What symbol tables stay after a strip In ELF format?

I am currently looking at the ELF format, and especially at stripped ELF executable program files. I know that, when stripped, the symbol table is removed, but some information are always needed to ...
15
votes
2answers
3k views

Why are GOT and PLT still present in Linux static stripped binaries?

I am looking at statically linked linux x86 stripped binary. I noticed that there are .got and .plt sections. I wonder what does a statically linked binary need got and plt sections for ? Anyone ?
11
votes
1answer
4k views

How are stripped shared libraries linked against?

Lately I've been reversing the Android framework for the Nexus S mobile phone. 99% of the source code is of course open, but there are few propriety shared libraries which needs to be downloaded in ...
83
votes
2answers
63k views

What is PLT/GOT?

From time to time, when disassembling x86 binaries, I stumble on reference to PLT and GOT, especially when calling procedures from a dynamic library. For example, when running a program in gdb: (gdb)...
10
votes
2answers
4k views

What are the available libraries to statically modify ELF executables?

I would like to be able to rewrite or reorganize an ELF binary program directly from the executable format (not at compile-time). The only library I know to do this is elfesteem (used in Miasm). But,...
9
votes
2answers
2k views

Fixing the checksum of a modified Android ELF

I've hex-edited a string in an Android ELF binary. Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum. Does anybody have a tool to fix the ...