1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
| #include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <iostream>
#include <elf.h>
int fd;
void ParseELFHeader(const Elf64_Ehdr &elf_header);
void ParseSectionHeader(const Elf64_Ehdr &elf_header, Elf64_Shdr *section_header);
void ParseELF(const char * filepath) {
fd = open(filepath, O_RDONLY);
if (fd < 0) {
std::cerr << "Error opening file " << filepath << "\n";
exit(1);
}
Elf64_Ehdr elf_header;
int read_elf_header_size = read(fd, &elf_header, sizeof(Elf64_Ehdr));
if (read_elf_header_size < sizeof(Elf64_Ehdr)) {
std::cerr << "ELF file is not complete\n";
exit(1);
}
ParseELFHeader(elf_header);
Elf64_Shdr *section_header = new Elf64_Shdr[elf_header.e_shnum];
lseek(fd, elf_header.e_shoff, SEEK_SET);
read(fd, section_header, sizeof(Elf64_Shdr) * elf_header.e_shnum);
ParseSectionHeader(elf_header, section_header);
delete[] section_header;
}
void ParseELFHeader(const Elf64_Ehdr &elf_header) {
printf("ELF文件头格式如下：\n");
printf("Magic(e_ident):");
for (int i = 0; i < EI_NIDENT; i++) {
printf("%.2x ", elf_header.e_ident[i]);
}
printf("\n");
printf("Section header table的文件内偏移地址：0x%lx\n", elf_header.e_shoff);
printf("一共有多少个段：%d\n", elf_header.e_shnum);
printf("Section header string table的下标: %d\n", elf_header.e_shstrndx);
}
void ParseSectionHeader(const Elf64_Ehdr &elf_header, Elf64_Shdr *section_header) {
printf("%x", section_header[1].sh_name);
Elf64_Shdr *shstrtab_header = §ion_header[elf_header.e_shstrndx];
printf("shstrtab的文件内偏移地址：0x%lx\n", shstrtab_header->sh_offset);
printf("shstrtab段的总字节大小：%ld\n", shstrtab_header->sh_size);
char *shstrtab = new char[shstrtab_header->sh_size];
lseek(fd, shstrtab_header->sh_offset, SEEK_SET);
read(fd, shstrtab, shstrtab_header->sh_size);
printf("所有的段段名如下：\n");
int symtable_idx = 0;
int strtab_idx = 0;
int text_idx = 0;
for (int i = 0; i < elf_header.e_shnum; i++) {
printf("%s\n", shstrtab + section_header[i].sh_name);
if (strcmp(".symtab", shstrtab + section_header[i].sh_name) == 0) {
symtable_idx = i;
} else if (strcmp(".strtab", shstrtab + section_header[i].sh_name) == 0) {
strtab_idx = i;
} else if (strcmp(".text", shstrtab + section_header[i].sh_name) == 0) {
text_idx = i;
}
}
printf("符号表的数组下标：%d\n", symtable_idx);
printf("字符串表的数组下标：%d\n", strtab_idx);
printf("VMA: %lx\n", section_header[text_idx].sh_addr);
char *strtab = new char[section_header[strtab_idx].sh_size];
lseek(fd, section_header[strtab_idx].sh_offset, SEEK_SET);
read(fd, strtab, section_header[strtab_idx].sh_size);
printf(".symtab的文件内偏移地址：0x%lx\n", section_header[symtable_idx].sh_offset);
printf(".symtab的段大小：%ld\n", section_header[symtable_idx].sh_size);
Elf64_Sym *symtab = reinterpret_cast<Elf64_Sym *>(new char[section_header[symtable_idx].sh_size]);
lseek(fd, section_header[symtable_idx].sh_offset, SEEK_SET);
read(fd, symtab, section_header[symtable_idx].sh_size);
int sym_num = section_header[symtable_idx].sh_size / sizeof(Elf64_Sym);
for (int i = 0; i < sym_num; i++) {
printf("%s\n", strtab + symtab[i].st_name);
}
delete []strtab;
delete []shstrtab;
delete []symtab;
}
int main() {
ParseELF("../ab");
return 0;
}
|