如何解码ELF中的节表？

我分析这个微小的ELF文件：如何解码ELF中的节表？

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 
00000010 02 00 3e 00 01 00 00 00 78 00 40 00 00 00 00 00 |..>[email protected]| 
00000020 40 00 00 00 00 00 00 00 98 00 00 00 00 00 00 00 |@...............| 
00000030 00 00 00 00 40 00 38 00 01 00 40 00 03 00 02 00 |[email protected]@.....| 
00000040 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 |................| 
00000050 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 |[email protected]@.....| 
00000060 7e 00 00 00 00 00 00 00 7e 00 00 00 00 00 00 00 |~.......~.......| 
00000070 00 00 20 00 00 00 00 00 31 c0 ff c0 cd 80 00 2e |.. .....1.......| 
00000080 73 68 73 74 72 74 61 62 00 2e 74 65 78 74 00 00 |shstrtab..text..| 
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 
* 
000000d0 00 00 00 00 00 00 00 00 0b 00 00 00 01 00 00 00 |................| 
000000e0 06 00 00 00 00 00 00 00 78 00 40 00 00 00 00 00 |[email protected]| 
000000f0 78 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 |x...............| 
00000100 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................| 
00000110 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 |................| 
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 
00000130 7e 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 |~...............| 
00000140 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................| 
00000150 00 00 00 00 00 00 00 00       |........| 
00000158

我发现ELF头和程序头文件和解码这两个的，但我有问题解码后这是什么（用31 c0 ff c0 cd 80 00 2e开始）。通过“shstrtab”文本判断，我正在查看节表，但31 c0 ff c0 cd 80 00 2e是什么意思？这部分记录在哪里？

来源

2016-12-25 d33tah

http://stackoverflow.com/a/15993927/968261？ –

我分析这个微小的ELF文件：

为什么不能简单地用readelf --all（即你为什么坚持手工解码文件？）。

如果做要手工对文件进行解码，这很好，但我们不想浪费时间做相同。所以让你的文件在某个地方可用，我们将运行readelf，并且会告诉你在它的偏移量078。

来源

2016-12-27 06:02:06

如何解码ELF中的节表？

回答

相关问题