5 ms·

The dissection of a simple “hello world” ELF file

109 points by giuscri 11y ago

jasode 11y ago
Another ELF diagram also made the rounds a few years ago: https://code.google.com/p/corkami/wiki/ELF101 https://code.google.com/p/corkami/wiki/ELF101 It's more of a 1-page poster and doesn't have the longer explanations in the submitted github article.
- qwerty_asdf 11y ago
  I was hoping someone would post this, because I had lost the bookmark! Thanks!
bgilroy26 11y ago
The last sentence of the first paragraph really struck me >In general, no single section has both write and execute permissions as this could compromise the security of the system.
- 0xdada 11y ago
  You can read more about it here: https://en.wikipedia.org/wiki/W%5EX https://en.wikipedia.org/wiki/W%5EX
  - bgilroy26 11y ago
    Thank you!
- ant6n 11y ago
  Is that actually enforced in modern linux kernels? I thought it would be possible to call mmap(..., PROT_READ | PROT_WRITE | PROT_EXEC, ...)
  - ant6n 11y ago
    If this ever gets enforced it could be annoying for software that generates code at runtime, which may require quick access to some run-time data for particular instructions. It may be useful to force huge pages for dynamically generated code to improve pressure on the TLB. It can slow down code generation if the pages with code in it have to be converted to write and then converted back to execute every time a new bit of dynamic code gets added. Additionally, if the generated code instructions require access to a bit of dynamic data, it may not be able to actually reach a separate data page using immediate offsets to pc on some architectures (e.g. ARM).
  - Hydraulix989 11y ago
    OpenBSD kernel enforces it (even inside the kernel, not just user mode processes): http://marc.info/?l=openbsd-tech&m=142120787308107&w=2 http://marc.info/?l=openbsd-tech&m=142120787308107&w=2
    - bgilroy26 11y ago
      Mike Larkin re:W^X a few days ago: https://youtu.be/A7vtAAeW6zo https://youtu.be/A7vtAAeW6zo
danieleggert 11y ago
Here's a similar write up I did about Mach-O (iOS / OS X): https://www.objc.io/issues/6-build-tools/mach-o-executables/ https://www.objc.io/issues/6-build-tools/mach-o-executables/
- landr0id 11y ago
  Awesome, thanks for sharing this.

109 points by giuscri 11y ago

Another ELF diagram also made the rounds a few years ago: https://code.google.com/p/corkami/wiki/ELF101 https://code.google.com/p/corkami/wiki/ELF101 It's more of a 1-page poster and doesn't have the longer explanations in the submitted github article.

qwerty_asdf 11y ago
I was hoping someone would post this, because I had lost the bookmark! Thanks!

bgilroy26 11y ago

The last sentence of the first paragraph really struck me >In general, no single section has both write and execute permissions as this could compromise the security of the system.

0xdada 11y ago
You can read more about it here: https://en.wikipedia.org/wiki/W%5EX https://en.wikipedia.org/wiki/W%5EX
- bgilroy26 11y ago
  Thank you!
ant6n 11y ago
Is that actually enforced in modern linux kernels? I thought it would be possible to call mmap(..., PROT_READ | PROT_WRITE | PROT_EXEC, ...)
- ant6n 11y ago
  If this ever gets enforced it could be annoying for software that generates code at runtime, which may require quick access to some run-time data for particular instructions. It may be useful to force huge pages for dynamically generated code to improve pressure on the TLB. It can slow down code generation if the pages with code in it have to be converted to write and then converted back to execute every time a new bit of dynamic code gets added. Additionally, if the generated code instructions require access to a bit of dynamic data, it may not be able to actually reach a separate data page using immediate offsets to pc on some architectures (e.g. ARM).
- Hydraulix989 11y ago
  OpenBSD kernel enforces it (even inside the kernel, not just user mode processes): http://marc.info/?l=openbsd-tech&m=142120787308107&w=2 http://marc.info/?l=openbsd-tech&m=142120787308107&w=2
  - bgilroy26 11y ago
    Mike Larkin re:W^X a few days ago: https://youtu.be/A7vtAAeW6zo https://youtu.be/A7vtAAeW6zo

danieleggert 11y ago

Here's a similar write up I did about Mach-O (iOS / OS X): https://www.objc.io/issues/6-build-tools/mach-o-executables/ https://www.objc.io/issues/6-build-tools/mach-o-executables/

landr0id 11y ago
Awesome, thanks for sharing this.