目标文件/可执行文件查看-C/C++

linux系统

# 查看文件格式$filesimpleSection.o simpleSection.o: ELF64-bit LSB relocatable, x86-64, version1(SYSV), not stripped

目标文件查看

文件头

$ readelf-hsimpleSection.o ELF Header: Magic: 7f454c4602 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data:2's complement, little endian Version:1(current)OS/ABI: UNIX - System V ABI Version:0Type: REL(Relocatablefile)Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x0 Start of program headers:0(bytes intofile)Start of section headers:1032(bytes intofile)Flags: 0x0 Size of this header:64(bytes)Size of program headers:0(bytes)Number of program headers:0Size of section headers:64(bytes)Number of section headers:14Section header string table index:13

段表

$ readelf-SsimpleSection.o There are14section headers, starting at offset 0x408: Section Headers:[Nr]Name Type Address Offset Size EntSize Flags Link Info Align[0]NULL 0000000000000000 00000000 0000000000000000 0000000000000000000[1].text PROGBITS 0000000000000000 00000040 000000000000005a 0000000000000000 AX001[2].rela.text RELA 0000000000000000 000002e8 0000000000000078 0000000000000018 I1118[3].data PROGBITS 0000000000000000 0000009c 0000000000000008 0000000000000000 WA004[4].bss NOBITS 0000000000000000 000000a4 0000000000000008 0000000000000000 WA004[5].rodata PROGBITS 0000000000000000 000000a4 0000000000000004 0000000000000000 A001[6].comment PROGBITS 0000000000000000 000000a8 000000000000001c 0000000000000001 MS001[7].note.GNU-stack PROGBITS 0000000000000000 000000c4 0000000000000000 0000000000000000001[8].note.gnu.pr[...]NOTE 0000000000000000 000000c8 0000000000000030 0000000000000000 A008[9].eh_frame PROGBITS 0000000000000000 000000f8 0000000000000058 0000000000000000 A008[10].rela.eh_frame RELA 0000000000000000 00000360 0000000000000030 0000000000000018 I1198[11].symtab SYMTAB 0000000000000000 00000150 0000000000000138 00000000000000181288[12].strtab STRTAB 0000000000000000 00000288 000000000000005f 0000000000000000001[13].shstrtab STRTAB 0000000000000000 00000390 0000000000000074 0000000000000000001Key to Flags: W(write), A(alloc), X(execute), M(merge), S(strings), I(info), L(link order), O(extra OS processing required), G(group), T(TLS), C(compressed), x(unknown), o(OS specific), E(exclude), D(mbind), l(large), p(processor specific)

# 关键的段$ objdump-hsimpleSection.o simpleSection.o:fileformatelf64-x86-64 Sections: Idx Name Size VMA LMA File off Algn0.text 0000005a 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE1.data 00000008 0000000000000000 0000000000000000 0000009c2**2 CONTENTS, ALLOC, LOAD, DATA2.bss 00000008 0000000000000000 0000000000000000 000000a42**2 ALLOC3.rodata 00000004 0000000000000000 0000000000000000 000000a42**0 CONTENTS, ALLOC, LOAD, READONLY, DATA4.comment 0000001c 0000000000000000 0000000000000000 000000a82**0 CONTENTS, READONLY5.note.GNU-stack 00000000 0000000000000000 0000000000000000 000000c42**0 CONTENTS, READONLY6.note.gnu.property 00000030 0000000000000000 0000000000000000 000000c82**3 CONTENTS, ALLOC, LOAD, READONLY, DATA7.eh_frame 00000058 0000000000000000 0000000000000000 000000f82**3 CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA# ELF文件中代码段、数据段和bss段的长度$ size simpleSection.o text data bss dec hex filename23088246f6 simpleSection.o

内容段

# -s 将所有段的内容以十六进制的形式的打印# -d 将所有包含指令的段反汇编$ objdump-s-dsimpleSection.o simpleSection.o:fileformatelf64-x86-64 Contents of section .text: 0000 554889e5 4883ec10 897dfc8b 45fc89c6 UH..H....}..E... 0010 488d0500 00000048 89c7b800 000000e8 H......H........0020 00000000 90c9c355 4889e548 83ec10c7.......UH..H....0030 45f80100 00008b15 00000000 8b050000 E............... 0040 000001c2 8b45f801 c28b45fc 01d089c7.....E....E..... 0050 e8000000 008b45f8 c9c3......E... Contents of section .data: 00005400000055000000T...U... Contents of section .rodata: 0000 25640a00 %d..Contents of section .comment: 0000 00474343 3a202847 4e552920 31342e32 .GCC:(GNU)14.20010 2e3120323032353032303700.120250207. Contents of section .note.gnu.property: 0000 040000002000000005000000 474e5500...........GNU. 0010 020001c0 04000000 01000000 00000000................0020 010001c0 04000000 01000000 00000000................Contents of section .eh_frame: 00001400000000000000 017a5200 01781001.........zR..x..0010 1b0c0708900100001c000000 1c000000................0020 000000002700000000410e10 8602430d....'....A....C. 0030 06620c07 08000000 1c000000 3c000000 .b..........<... 0040 000000003300000000410e10 8602430d....3....A....C. 0050 066e0c07 08000000 .n......Disassembly of section .text: 0000000000000000<func1>:0:55push %rbp1:4889e5 mov %rsp,%rbp4:4883ec10sub$0x10,%rsp8:897d fc mov %edi,-0x4(%rbp)b: 8b45fc mov -0x4(%rbp),%eax e:89c6 mov %eax,%esi10:488d 05 00 00 00 00 lea 0x0(%rip),%rax# 17 <func1+0x17>17:4889c7 mov %rax,%rdi 1a: b8 00 00 00 00 mov$0x0,%eax 1f: e8 00 00 00 00 call24<func1+0x24>24:90nop25: c9 leave26: c3 ret 0000000000000027<main>:27:55push %rbp28:4889e5 mov %rsp,%rbp 2b:4883ec10sub$0x10,%rsp 2f: c745f8 01 00 00 00 movl$0x1,-0x8(%rbp)36: 8b1500 00 00 00 mov 0x0(%rip),%edx# 3c <main+0x15>3c: 8b 05 00 00 00 00 mov 0x0(%rip),%eax# 42 <main+0x1b>42: 01 c2add%eax,%edx44: 8b45f8 mov -0x8(%rbp),%eax47: 01 c2add%eax,%edx49: 8b45fc mov -0x4(%rbp),%eax 4c: 01 d0add%edx,%eax 4e:89c7 mov %eax,%edi50: e8 00 00 00 00 call55<main+0x2e>55: 8b45f8 mov -0x8(%rbp),%eax58: c9 leave59: c3 ret

其他段

# 显示段表、符号表、重定位表等$ objdump-xsimpleSection.o simpleSection.o:fileformatelf64-x86-64 simpleSection.o architecture: i386:x86-64, flags 0x00000011: HAS_RELOC, HAS_SYMS start address 0x0000000000000000 Sections: Idx Name Size VMA LMA File off Algn0.text 0000005a 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, RELOC, READONLY, CODE1.data 00000008 0000000000000000 0000000000000000 0000009c2**2 CONTENTS, ALLOC, LOAD, DATA2.bss 00000008 0000000000000000 0000000000000000 000000a42**2 ALLOC3.rodata 00000004 0000000000000000 0000000000000000 000000a42**0 CONTENTS, ALLOC, LOAD, READONLY, DATA4.comment 0000001c 0000000000000000 0000000000000000 000000a82**0 CONTENTS, READONLY5.note.GNU-stack 00000000 0000000000000000 0000000000000000 000000c42**0 CONTENTS, READONLY6.note.gnu.property 00000030 0000000000000000 0000000000000000 000000c82**3 CONTENTS, ALLOC, LOAD, READONLY, DATA7.eh_frame 00000058 0000000000000000 0000000000000000 000000f82**3 CONTENTS, ALLOC, LOAD, RELOC, READONLY, DATA SYMBOL TABLE: 0000000000000000 ldf*ABS* 0000000000000000 simpleSection.c 0000000000000000 l d .text 0000000000000000 .text 0000000000000000 l d .data 0000000000000000 .data 0000000000000000 l d .bss 0000000000000000 .bss 0000000000000000 l d .rodata 0000000000000000 .rodata 0000000000000004 l O .data 0000000000000004 static_var.1 0000000000000004 l O .bss 0000000000000004 static_var2.0 0000000000000000 g O .data 0000000000000004 global_init_var 0000000000000000 g O .bss 0000000000000004 global_uinit_var 0000000000000000 g F .text 0000000000000027 func1 0000000000000000 *UND* 0000000000000000printf0000000000000027 g F .text 0000000000000033 main RELOCATION RECORDS FOR[.text]: OFFSET TYPE VALUE 0000000000000013 R_X86_64_PC32 .rodata-0x0000000000000004 0000000000000020 R_X86_64_PLT32 printf-0x0000000000000004 0000000000000038 R_X86_64_PC32 .data 000000000000003e R_X86_64_PC32 .bss 0000000000000051 R_X86_64_PLT32 func1-0x0000000000000004 RELOCATION RECORDS FOR[.eh_frame]: OFFSET TYPE VALUE 0000000000000020 R_X86_64_PC32 .text 0000000000000040 R_X86_64_PC32 .text+0x0000000000000027

符号表

$ readelf-ssimpleSection.o Symbol table'.symtab'contains13entries: Num: Value Size Type Bind Vis Ndx Name0: 00000000000000000NOTYPE LOCAL DEFAULT UND1: 00000000000000000FILE LOCAL DEFAULT ABS simpleSection.c2: 00000000000000000SECTION LOCAL DEFAULT1.text3: 00000000000000000SECTION LOCAL DEFAULT3.data4: 00000000000000000SECTION LOCAL DEFAULT4.bss5: 00000000000000000SECTION LOCAL DEFAULT5.rodata6: 00000000000000044OBJECT LOCAL DEFAULT3static_var.17: 00000000000000044OBJECT LOCAL DEFAULT4static_var2.08: 00000000000000004OBJECT GLOBAL DEFAULT3global_init_var9: 00000000000000004OBJECT GLOBAL DEFAULT4global_uinit_var10: 000000000000000039FUNC GLOBAL DEFAULT1func111: 00000000000000000NOTYPE GLOBAL DEFAULT UNDprintf12: 000000000000002751FUNC GLOBAL DEFAULT1main

可执行文件查看

程序头表

程序头：描述了ELF文件如何被操作系统映射到进程虚拟地址空间。

# 程序头表$ readelf-lsectionMapping.elf Elffiletypeis EXEC(Executablefile)Entry point 0x402d60 There are12program headers, starting at offset64Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000 0x0000000000000518 0x0000000000000518 R 0x1000 LOAD 0x0000000000001000 0x0000000000401000 0x0000000000401000 0x000000000007a7ed 0x000000000007a7ed R E 0x1000 LOAD 0x000000000007c000 0x000000000047c000 0x000000000047c000 0x0000000000031b88 0x0000000000031b88 R 0x1000 LOAD 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000005960 0x000000000000b1a0 RW 0x1000 NOTE 0x00000000000002e0 0x00000000004002e0 0x00000000004002e0 0x0000000000000024 0x0000000000000024 R 0x4 NOTE 0x00000000000adb28 0x00000000004adb28 0x00000000004adb28 0x0000000000000040 0x0000000000000040 R 0x8 NOTE 0x00000000000adb68 0x00000000004adb68 0x00000000004adb68 0x0000000000000020 0x0000000000000020 R 0x4 TLS 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000000038 0x0000000000000050 R 0x8 GNU_PROPERTY 0x00000000000adb28 0x00000000004adb28 0x00000000004adb28 0x0000000000000040 0x0000000000000040 R 0x8 GNU_SFRAME 0x00000000000a18a8 0x00000000004a18a8 0x00000000004a18a8 0x000000000000c18a 0x000000000000c18a R 0x8 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x10 GNU_RELRO 0x00000000000ae0c8 0x00000000004ae0c8 0x00000000004ae0c8 0x0000000000003f38 0x0000000000003f38 R 0x1 Section to Segment mapping: Segment Sections... 00 .note.gnu.build-id .rela.plt 01 .init .plt .text .fini 02 .rodata .stapsdt.base rodata.cst32 .eh_frame .sframe .gcc_except_table .note.gnu.property .note.ABI-tag 03 .tdata .init_array .fini_array .data.rel.ro .got .got.plt .data .bss 04 .note.gnu.build-id 05 .note.gnu.property 06 .note.ABI-tag 07 .tdata .tbss 08 .note.gnu.property 09 .sframe1011.tdata .init_array .fini_array .data.rel.ro .got

程序虚拟地址空间分布

$ gcc-otestsingleton.c-static$ ./test&[1]4869$cat/proc/4869/map map_files/ maps $cat/proc/4869/maps 起始地址-结束地址 权限 偏移量 设备号 inode 路径名/描述 00400000-00401000 r--p 00000000103:0614811163/home/user/.leetcode/test/test 00401000-0047c000 r-xp 00001000103:0614811163/home/user/.leetcode/test/test 0047c000-004a2000 r--p 0007c000103:0614811163/home/user/.leetcode/test/test 004a2000-004a7000 r--p 000a1000103:0614811163/home/user/.leetcode/test/test 004a7000-004a9000 rw-p 000a6000103:0614811163/home/user/.leetcode/test/test 004a9000-004af000 rw-p 00000000 00:00012047000-12069000 rw-p 00000000 00:000[heap]70381afb7000-70381afbb000 r--p 00000000 00:000[vvar]70381afbb000-70381afbd000 r-xp 00000000 00:000[vdso]7fff43702000-7fff43723000 rw-p 00000000 00:000[stack]ffffffffff600000-ffffffffff601000--xp00000000 00:000[vsyscall]

手动生成目标文件

# 二进制文件生成目标文件$ objcopy-Ibinary-Oelf64-x86-641.jpg pic.o $ objdump-htpic.o pic.o:fileformatelf64-x86-64 Sections: Idx Name Size VMA LMA File off Algn0.data 00094bbe 0000000000000000 0000000000000000 000000402**0 CONTENTS, ALLOC, LOAD, DATA SYMBOL TABLE: 0000000000000000 g .data 0000000000000000 _binary_1_jpg_start 0000000000094bbe g .data 0000000000000000 _binary_1_jpg_end 0000000000094bbe g *ABS* 0000000000000000 _binary_1_jpg_size $du-shpic.o 596K pic.o $du-sh1.jpg 596K1.jpg

生成的目标文件有全局符号可用，代码可直接使用这个段处理文件。

Windows

# /ALL打印目标文件的所有相关信息dumpbin/ALL simpleSection.obj > simpleSection.txt# /SUMMARY输出所有段的段名和长度dumpbin/SUMMARY simpleSection.obj