So this is a very simple C code which is using Elf dot h.
And it is filling the Elf header.
So it is filling the E underscore ident field where the magic numbers are defined.
I mean magic zero is 77F and elf and it is a 64 bit, uh.
Uh, this is 64 bit, uh, executable.
It uses, uh, little endian and only one version and Abi and remaining are padded to zeros.
And then it is a type of executable.
And for now, I'm keeping this as entry point.
And this is x86 64 AMD for AMD 64.
And there are no program headers.
Offset is zero.
Number of program headers are zero.
Number of section headers are zero.
For now we kept section headers.
Entry size is 64, and from the.
Whatever we have seen in the previous Elf files, we gave the same value.
And the size of the Elf header is 64.
And this is undefined.
So there is this is a simple uh uh elf header which is not having program headers and section section
headers.
It is only having elf header.
And let's write this as a binary on a file.
So I will open a binary file in write mode.
And I will call this f write header.
And I will write this that binary file.
And I will close this file.
So I'm compiling this one.
And when I run this one, it will create me a file known as bin.
I can do an hexdump on this.
It is only having like 64 bytes.
Uh.
It is like if you see, the first one is the magic number, and then you have the elf class and a little
Indian or big Indian and the version and then the other information which Elf is providing, like the
Amd64 and all.
Let's do a file on this one and is an Elf 64 bit LSB executable.
It is saying invalid version of Abi.
So our objective was not to make perfect Elf file.
Our objective was like if I have a binary file, the Elf header, will it be detected by the file command
or will it be detected by the.
Radialis.
So radialis is also detecting this a binary, this binary file as an Elf file.
And it has it is displaying the whatever we have provided Elf64 executable and uh Advanced Micro Devices
x86 64.
This is what we gave in the this thing uh, the code the entry point address.
And then there are no start of parameters.
And section headers are zero because number of program headers and number of section headers are zero.
So we can just for our uh learning we can change the code instead of uh, this 1XI can say.
Whatever I want, I can go into the user include elf dot h.
I can look into the various orders, the various available things, so you can change the class 32 from
64 and it should work.
Okay, now I will compile this again.
And if I see now really a f hyphen h user space.
Is still showing l f 64.
Let me delete this binary and let this run it again.
I am looking to the wrong file.
I should look into the bin file.
Yeah.
So the class, whatever we have kept in the elf header is elf.
Class 32 is now also visible.
So you can, uh, do some, I mean, engineering and reverse engineering and understand what happens
if I change each and every field and see and understand more about elf.