如何解碼ELF中的節表？

我分析這個微小的ELF文件：如何解碼ELF中的節表？

00000000 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 |.ELF............| 
00000010 02 00 3e 00 01 00 00 00 78 00 40 00 00 00 00 00 |..>[email protected]| 
00000020 40 00 00 00 00 00 00 00 98 00 00 00 00 00 00 00 |@...............| 
00000030 00 00 00 00 40 00 38 00 01 00 40 00 03 00 02 00 |[email protected]@.....| 
00000040 01 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 |................| 
00000050 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 |[email protected]@.....| 
00000060 7e 00 00 00 00 00 00 00 7e 00 00 00 00 00 00 00 |~.......~.......| 
00000070 00 00 20 00 00 00 00 00 31 c0 ff c0 cd 80 00 2e |.. .....1.......| 
00000080 73 68 73 74 72 74 61 62 00 2e 74 65 78 74 00 00 |shstrtab..text..| 
00000090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 
* 
000000d0 00 00 00 00 00 00 00 00 0b 00 00 00 01 00 00 00 |................| 
000000e0 06 00 00 00 00 00 00 00 78 00 40 00 00 00 00 00 |[email protected]| 
000000f0 78 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 |x...............| 
00000100 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................| 
00000110 00 00 00 00 00 00 00 00 01 00 00 00 03 00 00 00 |................| 
00000120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 
00000130 7e 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 |~...............| 
00000140 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 |................| 
00000150 00 00 00 00 00 00 00 00       |........| 
00000158

我發現ELF頭和程序頭文件和解碼這兩個的，但我有問題解碼後這是什麼（用31 c0 ff c0 cd 80 00 2e開始）。通過「shstrtab」文本判斷，我正在查看節表，但31 c0 ff c0 cd 80 00 2e是什麼意思？這部分記錄在哪裏？

來源

2016-12-25 d33tah

http://stackoverflow.com/a/15993927/968261？ –

我分析這個微小的ELF文件：

爲什麼不能簡單地用readelf --all（即你爲什麼堅持手工解碼文件？）。

如果做要手工對文件進行解碼，這很好，但我們不想浪費時間做相同。所以讓你的文件在某個地方可用，我們將運行readelf，並且會告訴你在它的偏移量078。

來源

2016-12-27 06:02:06

如何解碼ELF中的節表？

回答

相關問題