dd とか bvi elfデータ構造解析
hexdump elfデータ構造解析からのつづき
セクションヘッダと.shstrtabセクションをけずっちまえw
で最終的にできたのがhello5
[hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ hexdump -C hello5 00000000 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 00000010 02 00 03 00 01 00 00 00 cc 80 04 08 34 00 00 00 |............4...| 00000020 18 01 00 00 00 00 00 00 34 00 20 00 03 00 28 00 |........4. ...(.| 00000030 04 00 03 00 01 00 00 00 00 00 00 00 00 80 04 08 |................| 00000040 00 80 04 08 fd 00 00 00 fd 00 00 00 05 00 00 00 |................| 00000050 00 10 00 00 01 00 00 00 fd 00 00 00 00 00 00 00 |................| 00000060 00 91 04 08 00 00 00 00 00 00 00 00 06 00 00 00 |................| 00000070 00 10 00 00 51 e5 74 64 00 00 00 00 00 00 00 00 |....Q.td........| 00000080 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 |................| 00000090 04 00 00 00 55 89 e5 53 83 ec 10 b8 04 00 00 00 |....U..S........| 000000a0 bb 01 00 00 00 8b 4d 08 8b 55 0c cd 80 89 45 f8 |......M..U....E.| 000000b0 8b 45 f8 83 c4 10 5b 5d c3 55 89 e5 53 b8 01 00 |.E....[].U..S...| 000000c0 00 00 8b 55 08 89 d3 cd 80 5b 5d c3 55 89 e5 83 |...U.....[].U...| 000000d0 ec 18 c7 44 24 04 07 00 00 00 c7 04 24 f6 80 04 |...D$.......$...| 000000e0 08 e8 ae ff ff ff 89 45 fc 8b 45 fc 89 04 24 e8 |.......E..E...$.| 000000f0 c5 ff ff ff c9 c3 68 65 6c 6c 6f 0a 00 |......hello..| 000000fd [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ ./hello5; echo $? hello 7 [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$
ファイルの大きさを比較すると
[hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ ls -ltr hello[12345] -rwxr-xr-x 1 500 500 771 2012-02-04 18:35 hello3 -rwxr-xr-x 1 500 500 440 2012-02-04 19:33 hello4 -rwxr-xr-x 1 500 500 253 2012-02-04 21:43 hello5 [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$
最後には253バイトになりましたとさ
たいしたもんだ
ここまでやっちまうと、readelf -h -l -Sはほとんど意味のない
(というか間違った）情報を出力することになるわね。
[hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ readelf -h hello5 readelf: Error: Unable to read in 0x28 bytes of section headers ELF Header: Magic: 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 Class: ELF32 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) Machine: Intel 80386 Version: 0x1 Entry point address: 0x80480cc Start of program headers: 52 (bytes into file) Start of section headers: 280 (bytes into file) Flags: 0x0 Size of this header: 52 (bytes) Size of program headers: 32 (bytes) Number of program headers: 3 Size of section headers: 40 (bytes) Number of section headers: 4 Section header string table index: 3 readelf: Error: Unable to read in 0xa0 bytes of section headers [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ readelf -l hello5 readelf: Error: Unable to read in 0x28 bytes of section headers readelf: Error: Unable to read in 0xa0 bytes of section headers Elf file type is EXEC (Executable file) Entry point 0x80480cc There are 3 program headers, starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align LOAD 0x000000 0x08048000 0x08048000 0x000fd 0x000fd R E 0x1000 LOAD 0x0000fd 0x00000000 0x08049100 0x00000 0x00000 RW 0x1000 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4 [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$ readelf -S hello5 readelf: Error: Unable to read in 0x28 bytes of section headers There are 4 section headers, starting at offset 0x118: readelf: Error: Unable to read in 0xa0 bytes of section headers [hirasawa@ubunt1004-32-2 gcc-Programming-Kobo]$
