ELF and ABI Standards | Executable and Linkable Format specification | ELF File Format
Introduction to the ELF Format
- Part I: The ELF Header - https://blog.k3170makan.com/2018/09/introduction-to-elf-format-elf-header.html
- Part II: Understanding Program Headers - https://blog.k3170makan.com/2018/09/introduction-to-elf-format-part-ii.html
- Part III: The Section Headers - https://blog.k3170makan.com/2018/09/introduction-to-elf-file-format-part.html
- Part IV: Exploring Section Types and Special Sections - https://blog.k3170makan.com/2018/10/introduction-to-elf-format-part-iv.html
- Part V: Understanding C start up .init_array and .fini_array sections - https://blog.k3170makan.com/2018/10/introduction-to-elf-format-part-v.html
- Part VI(1): The Symbol Table and Relocations - https://blog.k3170makan.com/2018/10/introduction-to-elf-format-part-vi.html
- Part VI(2): The Symbol Table and Relocations - https://blog.k3170makan.com/2018/10/introduction-to-elf-format-part-vi_18.html
- Part VI(3): More Relocation tricks - r_addend execution - https://blog.k3170makan.com/2018/10/introduction-to-elf-format-part-vi-more.html
- Part VII: Dynamic Linking / Loading and the .dynamic section - https://blog.k3170makan.com/2018/11/introduction-to-elf-format-part-vii.html
The 101 of ELF Binaries on Linux
linux-re-101 -- online
Executable and Linkable Format 101
+ Part 1: Sections and Segments - http://www.intezer.com/executable-linkable-format-101-part1-sections-segments/
+ Part 2: Symbols - http://www.intezer.com/executable-linkable-format-101-part-2-symbols/
+ Part 3: Relocations - https://www.intezer.com/executable-and-linkable-format-101-part-3-relocations/
+ Part 4: Dynamic Linking - https://www.intezer.com/executable-linkable-format-101-part-4-dynamic-linking/
References
Tools/Software
- ABI Dumper - a tool to dump ABI of an ELF object containing DWARF debug info - https://github.com/lvc/abi-dumper
- abidiff - compares the Application Binary Interfaces (ABI) of two shared libraries in ELF format
- binception: Generate hash values for functions within an ELF binary - https://github.com/enferex/binception
- binch: a light BINary patCH tool - https://github.com/tunz/binch
- core2ELF64: Recover 64 bit ELF executables from memory dump
- dnload: Minimal binary generator for *nix operating systems
- dnload.py is a script for generating minimal ELF binaries from C code. It serves no practical real-world use case, but can be utilized to aid in the creation of size-limited demoscene productions.
- https://github.com/faemiyah/dnload
- dress: add symbols back into a stripped ELF binary (~strip)
- dt_infect: ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOAD
- DynELFSymbols: Helps to create backdoor/MitM shared-object files
- dynStruct: a tool using dynamoRio to monitor memory accesses of an ELF binary via a data gatherer, and use this data to recover structures of the original code
- https://github.com/ampotos/dynStruct
- dynStruct: An automatic reverse engineering tool for structure recovery and memory use analysis - Daniel Mercier - Master Thesis (2017)
- dynStruct: An automatic reverse engineering tool for structure recovery and memory use analysis - Mercier, Daniel and Chawdhary, Aziem and Jones, Richard E. (2017), IEEE 24th International Conference on Software Analysis, Evolution and Reengineering (SANER)
- ECFS: extended core file snapshot format
- elf-bf-tools - https://github.com/bx/elf-bf-tools
- This project contains tools that can be used to coerce the gcc's runtime loader into performing interesting operations using only valid relocation entries and symbols.
- elf-parser: identifying/extracting various sections of an ELF file
- elf-strings: The better strings utility for the reverse engineer - https://github.com/LloydLabs/elf-strings
- ELF/PaX Utilities - https://github.com/gentoo/pax-utils
- ELF Tailoring (EMSOFT 2019)
- see: ELF: Readings: "Honey, I Shrunk the ELFs: Lightweight Binary Tailoring of Shared Libraries"
- https://gitlab.cs.fau.de/i4/pub/elftailor
- ELF diet: Tool to shrink the tailored ELF files to a smaller size
- remove_from_elf: Tool to remove functions from ELF library interfaces and to overwrite their implementation
- librarytrader: Tool for static and dynamic analysis of dependencies between application(s) and shared libraries which allows us to determine unused functions
- ELF Tool Chain Project - https://sourceforge.net/projects/elftoolchain/
- A BSD-licensed implementation of compilation tools (nm, ar, as, ld, etc.) for the ELF object format.
- ELFbac: runtime intent-level ABI-granular memory protection for Linux - http://elfbac.org/
- ELFen: Extract and spell check read-only strings within ELF binaries - https://github.com/enferex/ELFen
- Elfesteem: Executable file format parser/generator - https://github.com/serpilliere/elfesteem
- ElfFrag: Binary Debloating of ELF binaries
- Elfhack: to optimize ELF binaries for size and cold startup speed - https://github.com/mozilla/positron/tree/master/build/unix/elfhack
- ELFIO - ELF (Executable and Linkable Format) reader and producer implemented as a header only C++ library
- ELFkickers (ebfc, elfls, elftoc, infect, objres, rebind, sstrip) - http://www.muppetlabs.com/~breadbox/software/elfkickers.html
- Elfkit: Rust ELF parsing, manipulation, and (re)linking toolkit - https://github.com/aep/elfkit
- ELFManip: Modify ELF executables - https://github.com/schieb/ELFManip
- elfutils
- a collection of utilities and libraries to read, create and modify ELF binary files, find and handle DWARF debug data, symbols, thread state and stacktraces for processes and core files on GNU/Linux
- https://sourceware.org/elfutils/
- Exodus - a tool that makes it easy to successfully relocate Linux ELF binaries from one system to another
- GNU Binary Utilities - https://sourceware.org/binutils/docs/binutils/
- HoloDec: Decompiler for x86 and x86-64 ELF binaries - https://github.com/cararasu/holodec
- Lepton: a Lightweight ELF Parsing Tool
- Libelf - ELF object file access library - http://www.mr511.de/software/english.html
- Libelfin: C++11 ELF/DWARF parser - a from-scratch C++11 library for reading ELF binaries and DWARFv4 debug information - https://github.com/aclements/libelfin
- libelfmaster: Secure ELF parsing library
- Mandibule: Linux ELF injector for x86 / x86_64 / arm / arm64
- Melkor - An ELF File Format Fuzzer - https://github.com/IOActive/Melkor_ELF_Fuzzer
- objdump beautifier - https://github.com/diouziou/bod
- Supported Targets: elf32-littlearm, elf32-tradlittlemips, elf32-i386, elf64-x86-64
- PatchELF: A small utility to modify the dynamic linker and RPATH of ELF executables
- patchkit - https://github.com/lunixbochs/patchkit
- Patches an ELF binary using one or more simple Python scripts.
- pyelftools: Pure-python library for parsing ELF and DWARF - https://github.com/eliben/pyelftools
- smol: Shoddy minsize-oriented linker
- Stasis: build static position-independant-executables without any runtime requirements (no libc or ldso)
- syms2elf: a plugin to export the symbols recognized to the ELF symbol table
- The ERESI Reverse Engineering Software Interface: ELFsh (ELF shell), Embedded ELF Debugger (e2dbg)
- Vtable-Dumper - a tool to list content of virtual tables in a C++ shared library - https://github.com/lvc/vtable-dumper
Readings
- ELF101 a Linux executable walkthrough
- A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux
- About ELF Auxiliary Vectors - http://articles.manugarg.com/aboutelfauxiliaryvectors
- Analyzing ELF Binaries with Malformed Headers
- Part 1 - Emulating Tiny Programs
- Part 2 - Mapping Program Logic with Qiling and Graphviz
- Part 3 - Automatically Solving a Corrupted Keygenme with angr
- Anatomy of an ELF core file - https://www.gabriel.urdhr.fr/2015/05/29/core-file/
- Armouring the ELF: Binary encryption on the UNIX platform - scut & grugq - Phrack Magazine #58 (2001-12-28) - http://www.phrack.org/issues/58/5.html
- Building an ELF Parser with Frida - https://versprite.com/og/frida/
- Cheating the ELF: Subversive Dynamic Linking to Libraries - https://grugq.github.io/docs/subversiveld.pdf
- Computer Science from the Bottom Up - https://www.bottomupcs.com/
- Constructing the ELF - A Magnetized Needle and a Steady Hand - http://nullprogram.com/blog/2016/11/17/
- Custom ELF program headers—what, why and how - http://www.cl.cam.ac.uk/~srk31/blog/2017/02/14/
- Dynamic Linking in ELF - http://dandylife.net/blog/archives/660
- ELF - No Section Header? No Problem - https://em386.blogspot.com/2006/10/elf-no-section-header-no-problem.html
- ELF Binary Mangling
- ELF Hello World Tutorial
- ELF introspection, robustly and portably - http://www.cl.cam.ac.uk/~srk31/blog/devel/elf-introspection.html
- ELF loading and dynamic linking - https://www.gabriel.urdhr.fr/2015/01/22/elf-linking/
- ELF Parsing Bugs by Example with Melkor Fuzzer
- ELF shared library injection forensics - https://backtrace.io/blog/elf-shared-library-injection-forensics/
- ELF symbol lookup
- ELF symbol visibility and the perils of name clashing
- ELFs are dorky, Elves are cool - Sergey Bratus and Julian Bangert - PoC||GTFO 00 - https://greatscottgadgets.com/pocorgtfo/pocorgtfo00.pdf
- ELF: From The Programmer's Perspective (1995) - http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.37.8698
- ELF, libelf, compressed sections and elfutils - https://gnu.wildebeest.org/blog/mjw/2016/01/13/elf-libelf-compressed-sections-and-elfutils/
- Eli Bendersky - Linkers and loaders - http://eli.thegreenplace.net/tag/linkers-and-loaders
- Exploiting ELF Expansion Variables - https://backtrace.io/blog/exploiting-elf-expansion-variables/
- Generating executable files from scratch - https://github.com/cameronswinoga/yabfc/wiki/Generating-executable-files-from-scratch
- GNU Hash ELF Sections
- Good Practices in Library Design, Implementation, and Maintenance - https://www.akkadia.org/drepper/goodpractice.pdf
- Have fun with LIEF and Executable Formats - Play with ELF symbols - Part 2 (renaming dynamic symbols) - https://blog.quarkslab.com/have-fun-with-lief-and-executable-formats.html#elf
- How is a binary executable organized? Let's explore it! - https://jvns.ca/blog/2014/09/06/how-to-read-an-executable/
- How programs get run: ELF binaries - https://lwn.net/Articles/631631/
- How To Write Shared Libraries - https://www.akkadia.org/drepper/dsohowto.pdf
- I/O patterns on ELF binary initialization - https://glandium.org/blog/?p=1016
- Improving binary layout for progressive decompression (2011) - https://glandium.org/blog/?p=2320
- In-Memory-Only ELF Execution (Without tmpfs) - https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
- In the lands of corrupted elves: Breaking ELF software with Melkor fuzzer - https://www.blackhat.com/docs/us-14/materials/arsenal/us-14-Hernandez-Melkor-Slides.pdf
- Inside ELF Symbol Tables
- Learning Linux Binary Analysis (2016) - Ryan O'Neill - http://www.bitlackeys.org/#research
- Linux Internals - Dynamic Linking Wizardry - https://0x00sec.org/t/linux-internals-dynamic-linking-wizardry/1082
- Linux Internals - The Art Of Symbol Resolution - https://0x00sec.org/t/linux-internals-the-art-of-symbol-resolution/1488
- Linux x86 Program Start Up (dynamically loaded x86 ELF files) - http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html
- Making our own executable packer
- Position Independent Executables - https://blog.fpmurphy.com/2008/06/position-independent-executables.html
- Programming With Ones and Zeros
- RE a 64bit ELF binary - Devil’s swapper write-up - https://0x00sec.org/t/re-a-64bit-elf-binary-devils-swapper-write-up/2379
- Relocations in ELF Toolchains - https://www.sifive.com/blog/2017/08/21/all-aboard-part-2-relocations/
- Resolving ELF Relocation Name / Symbols - https://em386.blogspot.com/2006/10/resolving-elf-relocation-name-symbols.html
- Secure Code Partitioning With ELF binaries (SCOP) - http://bitlackeys.org/papers/secure_code_partitioning_2018.txt
- Smallest x86 ELF Hello World - http://timelessname.com/elfbin/
- Special sections in Linux binaries - https://lwn.net/Articles/531148/
- Targeting File Parsers with S2E and Kaitai Struct - targeted symbolic execution of readelf - https://adrianherrera.github.io/post/kaitai-s2e/
- The Anatomy of an Executable - dissection of a simple "hello world" ELF binary - https://github.com/mewrev/dissection
- The Cerberus ELF Interface - http://phrack.org/issues/61/8.html
- The Cost Of ELF Symbol Hashing
- The ELF Object File Format by Dissection (1995) - http://www.linuxjournal.com/article/1060
- The Executable and Linkable Format (ELF)
- The missing link: explaining ELF static linking, semantically - Stephen Kell, Dominic P. Mulligan, Peter Sewell - OOPSLA 2016
- Uncovering a few SIGSEGVs in binutils' BFD and GLIBC
- Understanding Linux ELF RTLD internals - http://s.eresi-project.org/inc/articles/elf-rtld.txt
- Understanding the Memory Layout of Linux Executables - https://gist.github.com/CMCDragonkai/10ab53654b2aa6ce55c11cfc5b2432a4
- 'Weird Machine' patterns - https://www.researchgate.net/publication/283630248_%27Weird_Machine%27_patterns
- Writing shared libraries - http://plan99.net/~mike/writing-shared-libraries.html
Thread Local Storage (TLS)
- A Deep dive into (implicit) Thread Local Storage
- Android ELF TLS
- ELF Handling For Thread-Local Storage
- Thread Local Storage (ELF Thread Local Storage ABI)
- TLS Examples
Transformation
- A Technique for Hooking Internal Functions of Dynamically-Linked ELF Binaries
- Honey, I Shrunk the ELFs: Lightweight Binary Tailoring of Shared Libraries
- How To Strip An ELF Object Without Fully Understanding It
- Inserting Debugging Instrumentation into an Internal Function Using Redirect-to-PLT
- Tweaking binaries with elfedit
ELF: Talks
ELF: Talks (2019)
- ELF Crafting: Uncovering Advanced Anti-analysis techniques for the Linux Platform
- Executable Code Golf: Making Tiny Binaries for Constrained Systems
- Objtool: A Hidden Gem of Executable Parsing
ELF: Talks (2018)
- C++ in Elvenland
- The Bits Between the Bits: How We Get to main()
ELF: Talks (2017)
- ELF linking: what it means and why it matters
- Everything You Always Wanted to Know About "Hello, World"* (*But Were Afraid To Ask)
- LLD from a user's perspective
ELF: Talks (2016)
- Intra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
- New LLD linker for ELF
ELF: Talks (2015)
- Dark Side of the ELF
- How the ELF Ruined Christmas
ELF: Talks (2014)
- ABIs, linkers and other animals
ELF: Talks (2013)
- ELF Eccentricities
- Any Input Is a Program Weird Machines in ABI
- "Weird Machines" in ELF: A Spotlight on the Underappreciated Metadata
ELF: Talks (2012)
- Programming Weird Machines with ELF Metadata
- The Care and Feeding of Weird Machines Found in Executable Metadata
Tags:
format
linux
elf
dwarf
Last modified 07 October 2024