11 ms·
Elf Hello World
- wyldfire 9y agoIt's great, thanks! Thoughts for chapter 2: stuff that often confuses me: PLT, GOT, FDE/CIE.
- rocky1138 9y agoI love the fact that it's all on one page and uses HTML anchors to get around. It makes it super simple to archive and read up later if the site ever goes down.
- cirosantilli 9y agoWell, you can also fork and git clone it: https://github.com/cirosantilli/cirosantilli.github.io/blob/master/elf-hello-world.md https://github.com/cirosantilli/cirosantilli.github.io/blob/... :-)
- rocky1138 9y agoThanks for the article! I'm really enjoying learning this stuff. One thing that came up which doesn't appear very clear is why `ld` continues to set the entrypoint for executables at 0x08048000 when that seems like such an arbitrary number held over from a version of Unix made decades ago. Wouldn't it be better to just get rid of that and start programs at 0x00000001? (leaving 0x0 open for NUL).
- kdunwoody 9y agoDefinitely not. In rough order of importance: 1. Space for NULL should be big enough for at least a medium-sized structure, otherwise (*NULL)->field = blah will overwrite your code. 2. Because of (1), Linux (for example) doesn't even allow processes to map the first page or so of memory. 3. On many platforms the PC needs to be aligned to a word boundary.
- rocky1138 9y agoI see. I've obviously got a lot more to learn. Thanks :) One more question, though: how much space should be safe to leave for NULL? Is 128MB enough? Why not only as much as required? I suppose it doesn't really matter anyway since the entry point location is virtual at this point anyway.
- Ded7xSEoPKYNsDd 9y agoIt's impossible to know how much exactly is required. (While structures are fixed size, arrays indices are not.) Linux allows you to configure the limit at /proc/sys/vm/mmap_min_addr.
- bogomipz 9y agoI know PLT and GOT but am unfamiliar with the acronyms FDE/CIE. Can you say what those are?
- wyldfire 9y agoFDE: Frame Description Entry, CIE: Common Information Entry. AFAIR, they're used to unwind the stack in exceptions. I think it's specified by itanium C++ ABI (which sounds archaic but actually many other processors use the same one). I don't recall if these things are ELF features or if the ELF only knows about the "eh_frame" section. It's interesting and kinda sorta related low-level stuff IMO.
- bogomipz 9y agoInteresting, I wasn't familiar with this standard. It sounds like this has been adopted by some other architectures besides Itanium as well: http://wiki.dwarfstd.org/index.php?title=Exception_Handling http://wiki.dwarfstd.org/index.php?title=Exception_Handling
- cstrahan 9y agoEli Bandersky wrote an excellent series on load-time relocation and position independent code (PIC), including details regarding PLT/GOT: http://eli.thegreenplace.net/2011/08/25/load-time-relocation-of-shared-libraries/ http://eli.thegreenplace.net/2011/08/25/load-time-relocation... http://eli.thegreenplace.net/2011/11/03/position-independent-code-pic-in-shared-libraries/ http://eli.thegreenplace.net/2011/11/03/position-independent...
- CalChris 9y agoThis tutorial should be read alongside his Address Relocation answer from Stack Overflow: http://stackoverflow.com/questions/12122446/how-does-c-linking-work-in-practice/30507725#30507725 http://stackoverflow.com/questions/12122446/how-does-c-linki... And then you might want to skim through An Evil Copy: How the Loader Betrays You: https://www.microsoft.com/en-us/research/publication/evil-copy-loader-betrays https://www.microsoft.com/en-us/research/publication/evil-co...
- theoh 9y agoThat new CoRev paper is interesting. I haven't had time to read it in detail but it sounds like an intriguing case for compiler/linker buffs. Slightly OT, there was a very fun ActionScript exploit published by Mark Dowd of IBM in 2008. I'm reminded of it because it's about memory protection vulnerabilities. "Application-Specific Attacks: Leveraging the ActionScript Virtual Machine" https://www.cs.utexas.edu/~shmat/courses/cs6431/dowd.pdf https://www.cs.utexas.edu/~shmat/courses/cs6431/dowd.pdf
- bogomipz 9y agoIf you enjoyed this you might also like the following article: http://nullprogram.com/blog/2016/11/17/ http://nullprogram.com/blog/2016/11/17/
- muzster 9y agoGreat article... Makes you wonder how ELF's brother (PE) and daughter (WASM) are doing.
- laser 9y agoIs it just me, or are the author's ears slightly pointed?
- pinum 9y agoI don't know about that, but I did notice the author's photo looks like a passport pic (strict, formal). An unusual thing to include on a personal site, maybe.
- cirosantilli 9y agoYeah, standard booth pic for document format. I don't think I used it in any documents however.
- cirosantilli 9y agoYou've uncovered my secret: I'm an ELF!!! :-)
- laser 9y agoI knew it!! :P
- hackjam600 9y ago+ University grades changing + Facebook hack + Email interception hack + Email accounts hack + Grade Changes hack + Website crashed hack + Word Press Blogs hack + Retrieval of lost file/documents + Erase criminal records hack + Databases hack + Sales of Dumps cards of all kinds + Untraceable Ip + Bank accounts hack + Individual computers hack + Websites hack + Control devices remotely hack + Burner Numbers hack + Verified Paypal Accounts hack + Any social media account hack + Android & iPhone Hack + server crashed hack + Text message interception hack + Twitters hack + Skype hack + Credit cards hacker + We can drop money into bank accounts. + credit score hack + blank credit card sale + Hack and use Credit Card to shop online + Monitor any phone and email address + Tap into anybody's call and monitor their conversation CONTACT:hackjam600@gmail.com
- tonyg 9y agoMy favourite page on ELF executables of all time: http://www.muppetlabs.com/~breadbox/software/tiny/teensy.html http://www.muppetlabs.com/~breadbox/software/tiny/teensy.htm..., "A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (or, 'Size Is Everything')"
- caust1c 9y agoHeya! I followed a long and made a 64 bit version a while back. Great resource for learning ELF. https://github.com/abraithwaite/teensy https://github.com/abraithwaite/teensy
- znpy 9y agoAn interesting read, thanks a lot!
- zmodem 9y agoThat one is awesome and inspired me to write http://www.hanshq.net/making-executables.html http://www.hanshq.net/making-executables.html
- 10165 9y agoI like your page about making Android executables, especially the quote from Carmac and comment about the vurtues of being control freak. Have you tried to do the same thing for iOS? What is the current file and directory count for Xcode?
- binarycrusader 9y agoELF is pretty generally applicable to all NIX and NIX-like platforms, so I often refer to the Solaris Libraries and Linkers guide which has a lot of generally useful information and guidance: https://docs.oracle.com/cd/E53394_01/html/E54813/glcfv.html#scrolltoc https://docs.oracle.com/cd/E53394_01/html/E54813/glcfv.html#...
- sigjuice 9y agoImpressive work. Anyone know of something equivalent for Mach-o?
- sgmansfield 9y agoFantastic article. I noticed a couple of TODO's around, though. Does this hint at a second installment? :)
- cirosantilli 9y agoIf I need it for work at some point :-) Not in forseeable future :-( But you can send PRs or fork it: https://github.com/cirosantilli/cirosantilli.github.io/blob/master/elf-hello-world.md https://github.com/cirosantilli/cirosantilli.github.io/blob/...
- molticrystal 9y agoIn elftoolchain you'll see some elfs having a size of 52 instead of 64 https://github.com/sergev/elftoolchain/search?utf8=%E2%9C%93&q=e_ehsize&type= https://github.com/sergev/elftoolchain/search?utf8=%E2%9C%93... Also it is interesting that the powerpc elf loader verifies that the e_ehsize is the same size as the allocated buffer, perhaps they had an issue at one point. https://github.com/torvalds/linux/blob/ba6d973f78eb62ffebb32f6ef3334fc9a3b33d22/arch/powerpc/kernel/kexec_elf_64.c#L175 https://github.com/torvalds/linux/blob/ba6d973f78eb62ffebb32...