手拆ELF32（二，程序头表）

╰+攻爆jí腚メ 2022-12-15 14:21 186阅读 0赞

### 目录 ###

*   *  程序头表
     *   *  p\_type
         *  p\_offset
         *  p\_vaddr
         *  p\_paddr
         *  p\_filesz
     *  p\_memsz
     *   *  p\_flags

## 程序头表 ##

**辨析：程序头表由多个程序头组成**

一个可执行文件或者共享目标文件的程序头表是一个数组，一个数组元素存储一个程序头表条目，每一个程序头表条目描述一个段或者其它信息，这些段或信息为程序运行做准备。

一个文件段包含多个节区，程序头只有在可执行文件或者共享对象文件中有意义。

程序头数据结构如下，其大小为32字节

/* Program segment header. */
    
    typedef struct
    { 
      Elf32_Word	p_type;			/* Segment type */
      Elf32_Off	    p_offset;		/* Segment file offset */
      Elf32_Addr	p_vaddr;		/* Segment virtual address */
      Elf32_Addr	p_paddr;		/* Segment physical address */
      Elf32_Word	p_filesz;		/* Segment size in file */
      Elf32_Word	p_memsz;		/* Segment size in memory */
      Elf32_Word	p_flags;		/* Segment flags */
      Elf32_Word	p_align;		/* Segment alignment */
    } Elf32_Phdr;

上一篇文件中，程序头表的文件偏移为0x0034，且有9个程序头表条目，一共9\*32=0x120=288字节，以数组的形式存储，相当是Elf32\_Phdr\[9\]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70_pic_center]

06 00 00 00 34 00 00 00 34 00 00 00 
    34 00 00 00 20 01 00 00 20 01 00 00 04 00 00 00 
    04 00 00 00 03 00 00 00 54 01 00 00 54 01 00 00 
    54 01 00 00 13 00 00 00 13 00 00 00 04 00 00 00 
    01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 
    00 00 00 00 70 0D 00 00 70 0D 00 00 05 00 00 00 
    00 10 00 00 01 00 00 00 9C 0E 00 00 9C 1E 00 00 
    9C 1E 00 00 6C 01 00 00 70 01 00 00 06 00 00 00 
    00 10 00 00 02 00 00 00 A4 0E 00 00 A4 1E 00 00 
    A4 1E 00 00 08 01 00 00 08 01 00 00 06 00 00 00 
    04 00 00 00 04 00 00 00 68 01 00 00 68 01 00 00 
    68 01 00 00 44 00 00 00 44 00 00 00 04 00 00 00 
    04 00 00 00 50 E5 74 64 94 0B 00 00 94 0B 00 00 
    94 0B 00 00 5C 00 00 00 5C 00 00 00 04 00 00 00 
    04 00 00 00 51 E5 74 64 00 00 00 00 00 00 00 00 
    00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 
    10 00 00 00 52 E5 74 64 9C 0E 00 00 9C 1E 00 00 
    9C 1E 00 00 64 01 00 00 64 01 00 00 04 00 00 00 
    01 00 00 00

用readelf工具解析如下：

young@ubuntu:~/c/elf$ readelf -l elf32
    
    Elf file type is DYN (Shared object file)
    Entry point 0x6c0
    There are 9 program headers, starting at offset 52
    
    Program Headers:
      Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
      PHDR           0x000034 0x00000034 0x00000034 0x00120 0x00120 R   0x4
      INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1
          [Requesting program interpreter: /lib/ld-linux.so.2]
      LOAD           0x000000 0x00000000 0x00000000 0x00d70 0x00d70 R E 0x1000
      LOAD           0x000e9c 0x00001e9c 0x00001e9c 0x0016c 0x00170 RW  0x1000
      DYNAMIC        0x000ea4 0x00001ea4 0x00001ea4 0x00108 0x00108 RW  0x4
      NOTE           0x000168 0x00000168 0x00000168 0x00044 0x00044 R   0x4
      GNU_EH_FRAME   0x000b94 0x00000b94 0x00000b94 0x0005c 0x0005c R   0x4
      GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x10
      GNU_RELRO      0x000e9c 0x00001e9c 0x00001e9c 0x00164 0x00164 R   0x1
    
     Section to Segment mapping:
      Segment Sections...
       00     
       01     .interp 
       02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .plt.got .text .fini .rodata .eh_frame_hdr .eh_frame 
       03     .init_array .fini_array .dynamic .got .data .bss 
       04     .dynamic 
       05     .note.ABI-tag .note.gnu.build-id 
       06     .eh_frame_hdr 
       07     
       08     .init_array .fini_array .dynamic .got

程序头表结构体成员解释：

### p\_type ###

这个成员告诉程序头描述哪种类型的段。有如下类型

/* Legal values for p_type (segment type). */
    
    #define PT_NULL 0 /* Program header table entry unused */
    #define PT_LOAD 1 /* Loadable program segment */
    #define PT_DYNAMIC 2 /* Dynamic linking information */
    #define PT_INTERP 3 /* Program interpreter */
    #define PT_NOTE 4 /* Auxiliary information */
    #define PT_SHLIB 5 /* Reserved */
    #define PT_PHDR 6 /* Entry for header table itself */
    #define PT_TLS 7 /* Thread-local storage segment */
    #define PT_NUM 8 /* Number of defined types */
    #define PT_LOOS 0x60000000 /* Start of OS-specific */
    #define PT_GNU_EH_FRAME 0x6474e550 /* GCC .eh_frame_hdr segment */
    #define PT_GNU_STACK 0x6474e551 /* Indicates stack executability */
    #define PT_GNU_RELRO 0x6474e552 /* Read-only after relocation */
    #define PT_LOSUNW 0x6ffffffa
    #define PT_SUNWBSS 0x6ffffffa /* Sun Specific segment */
    #define PT_SUNWSTACK 0x6ffffffb /* Stack segment */
    #define PT_HISUNW 0x6fffffff
    #define PT_HIOS 0x6fffffff /* End of OS-specific */
    #define PT_LOPROC 0x70000000 /* Start of processor-specific */
    #define PT_HIPROC 0x7fffffff /* End of processor-specific */

<table> 
 <thead> 
  <tr> 
   <th>p_type</th> 
   <th align="left">description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>PT_NULL</td> 
   <td align="left">表示程序头未使用，且程序头其他成员未定义。程序可以忽略该程序头</td> 
  </tr> 
  <tr> 
   <td>PT_LOAD</td> 
   <td align="left">标有这是一个可加载的段，段由p_filesz 和 p_memsz描述。文件中的字节被映射到内存段的起始位置。如果段的内存大小p_memsz大于文件大小p_filesz，多出的内存内容用0填充，其紧接着内存的初始化区域。文件大小不应该大于内存大小。 程序头表中的可加载段条目按p_vaddr成员排序升序出现。</td> 
  </tr> 
  <tr> 
   <td>PT_DYNAMIC</td> 
   <td align="left">标明动态链接信息</td> 
  </tr> 
  <tr> 
   <td>PT_INTERP</td> 
   <td align="left">The array element specifies the location and size of a null-terminated pathname to invoke as an interpreter. This segment type is meaningful only for executable files (though it may occur for shared objects). However it may not occur more than once in a file. If it is present, it must precede any loadable segment entry.</td> 
  </tr> 
  <tr> 
   <td>PT_NOTE</td> 
   <td align="left">The array element specifies the location and size for auxiliary information.</td> 
  </tr> 
  <tr> 
   <td>PT_SHLIB</td> 
   <td align="left">This segment type is reserved but has unspecified semantics. Programs that contain an array element of this type do not conform to the ABI.</td> 
  </tr> 
  <tr> 
   <td>PT_PHDR</td> 
   <td align="left">The array element, if present, specifies the location and size of the program header table itself, both in the file and in the memory image of the program. This segment type may not occur more than once in a file. Moreover, it may only occur if the program header table is part of the memory image of the program. If it is present, it must precede any loadable segment entry.</td> 
  </tr> 
  <tr> 
   <td>PT_LOPROC</td> 
   <td align="left">Values greater than or equal to PT_HIPROC are reserved for processor-specific semantics.</td> 
  </tr> 
  <tr> 
   <td>PT_HIPROC</td> 
   <td align="left">Values less than or equal to PT_LOPROC are reserved for processor-specific semantics.</td> 
  </tr> 
  <tr> 
   <td>PT_GNU_STACK</td> 
   <td align="left">GNU extension which is used by the Linux kernel to control the state of the stack via the flags set in the p_flags member.</td> 
  </tr> 
 </tbody> 
</table>

### p\_offset ###

This member holds the offset from the beginning of the file at which the first byte of the segment resides.  
该成员保存从段的第一个字节所在的文件开始的偏移量。

### p\_vaddr ###

This member holds the virtual address at which the first byte of the segment resides in memory.

### p\_paddr ###

On systems for which physical addressing is relevant, this member is reserved for the segment’s physical address. Under BSD this member is not used and must be zero.

### p\_filesz ###

This member holds the number of bytes in the file image of the segment. It may be zero.

## p\_memsz ##

This member holds the number of bytes in the memory image of the segment. It may be zero.

### p\_flags ###

This member holds a bit mask of flags relevant to the segment:

<table> 
 <thead> 
  <tr> 
   <th>macro</th> 
   <th>description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>PF_X</td> 
   <td>An executable segment.</td> 
  </tr> 
  <tr> 
   <td>PF_W</td> 
   <td>A writable segment.</td> 
  </tr> 
  <tr> 
   <td>PF_R</td> 
   <td>A readable segment.</td> 
  </tr> 
 </tbody> 
</table>

A text segment commonly has the flags PF\_X and PF\_R.  
A data segment commonly has PF\_X, PF\_W and PF\_R.

/* Legal values for p_flags (segment flags).  */
    
    #define PF_X		(1 << 0)	/* Segment is executable */
    #define PF_W		(1 << 1)	/* Segment is writable */
    #define PF_R		(1 << 2)	/* Segment is readable */
    #define PF_MASKOS	0x0ff00000	/* OS-specific */
    #define PF_MASKPROC	0xf0000000	/* Processor-specific */

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2OTYzMjE0_size_16_color_FFFFFF_t_70_pic_center]: /images/20221123/a8bb45cbff294ef7a10bd7f774417e04.png