Elf file has an elf header.
All elf files has an elf header.
It has the very important job of conveying basic information about the binary, like looking into the
Elf header, I can find out what processor it is designed to run.
It is designed to run on ARM, or it is designed to run on x86 or risk processor.
So Elf file can contain machine code for different processor types, whether the binary is an executable
or a kernel module, or a core file or an shared library, I can just look into the Elf header.
I can find out what is the entry point of this executable.
So entry point is a memory address pointing to the first machine code instruction in the memory once
the process has been loaded.
So Elf header has the information about which which way to start.
What is the first instruction which I need to start at what location?
An Elf header is always at the start of the file.
El-Fattah also specifies location of the program header table, which is a segment and section header
table which can be anywhere within the file, and this tables in turn point to the data stored elsewhere
in the file.
So the data, the object code, or the data related to sections and the segments are also specified
uh, in the program header table in the section header table, Elf file will not uh, specify uh, the
sections or section or segments.
It will specify the location of the program header table and section header table.
So simple.
Very simple.
Let's see how we can see the Elf header.
Uh this a package Binutils which provides a program called as elf which gives more detailed information
about Elf file.
Uh, the option hyphen h of read elf is used to dump the Elf header on our on the screen.
So I have this file bin ls, which is a common utility in Linux.
This is an Elf file.
I can print the Elf header using read elf hyphen h bin lhs.
So you can see this one.
I am able to print the elf header and it has a lot of information.
We will understand each of this information, but uh, I can also check, uh, this is a dynamic shared
library, so I can check the dependencies of this LD using LD, which will list me the dynamic dependencies.
And it has a lot of dependencies.
One of them is, uh, lib CSO and the loader and other dependencies like this, I can.
So important point is hyphen.
H is for header and read.
Elf is a command which will read the elf file, and if I pass hyphen h, it will print me the elf header,
which has information about the machine for which this is compiled.
The type of the Elf file.
It is a dynamic shared Elf file.
It uses dynamic libraries.
And uh, what is the entry point address where I should start?
So 670 is the starting location.
Where are my program headers present?
How and where are my section headers present?
How many, uh, program headers I have and how many section headers I have?
What is the size of each section header and how?
What is the size of each program header?
And, uh, what is the size of this Elf header?
It is 64.
Write.
All this information is present in the Elf file.
And I can also check the Elf file for a library.
So if I have a library so s if I have this I have it in a different location.
I think I have it, uh, Lib, if you remember we added that in first lecture.
So libc is here.
So read elf hyphen h and it is not a head of.
It is not an Elf file.
It is an Ascii text.
So it may be pointing to some location.
Uh, it is just.
Just as I ask it as text.
And let's see, what is LD giving?
There is a C library present.
It is present here and it is symbolic link to this particular thing.
And so I'll check Lipsy 231.
So so this is the file C library.
And I'll say and this is an Elf file.
Now let's say elf hyphen h on this file.
And this is also a dynamic shared library.
It is compiled for x86 64 and has an entry point address at this particular location, and it has different
program headers and section headers.
So important point Elf file will have Elf header and it will have program headers and section headers.
And the location of the program headers.
And the section headers are present in the Elf header.
But Elf header is present the start of the Elf file.
So if you look into the start of the Elf file, you will be seeing the Elf header, and the size of
this Elf header depends whether it is a 32 bit or 64 bit.
It is a 64 bit.
It is having size of this header as 64 bit.
And I can also.
Use uh, I can compile my C code and see what is the difference.
So I have the simple C code which we used.
I say gcc hyphen c user space dot c and I will also compile into a executable.
So now I can verify elf hyphen h.
I can check the header of this uh using hyphen h command.
And it is saying it is a relocatable file.
And now I will check the this one, uh, actual file executable file.
It says it's a dynamic library because this uses, uh, C library as a C dynamic C library.
So that's the reason it is a dynamic library.
But if I compile this, uh, using static.
Uh, static.
Now I'll say read elf.
Uh h user space static.
It is saying it is an executable file.
So if it is a static executable file and if it is not using any, uh, dynamic libraries, then it will
be the type will be executable.
But if it is using uh, dynamic libraries like C library or the loader, it will be a dynamic library.
And if it is an object file which is before output of assembler, it will be a relocatable file and
there will be no entry point errors.
It is a zero here.
If you see this entry point address is uh, this 1040.
And if it is a static it is a very different entry point address.
And uh, if you see how many program headers is present in the static binary, uh, it has like uh,
ten program headers and 32 section headers, whereas in a dynamic library you have 13 program headers,
and section headers are 29.
So section headers are reduced in compared to dynamic library and static library.
Whereas in a object file you do not have any program headers you only have a section headers.
So program headers are used during a process is when a process is loaded into memory, whereas section
header is used during uh executable linking stage.
To convert this object file into an executable file, I can also convert this code userspace dot c and
I say um, a 32 bit, uh elf file.
Compile this to an 32 bit code, and it is a 32 bit Elf file.
And I can also read, uh, this one.
Now, this is a elf 3232 bit, and this machine has been changed to 80386.
So now using this, we can easily understand what, uh, if I have an Elf file, I can just run a read
elf hyphen h command, and I can find out what kind of machine it is, whether it is a Intel machine,
or compiled for 32 bit or 64 bit, whether it is an executable file or a static executable file, dynamic
executable file or a relocatable file.
And what are the entry point address and how many section headers are there?
How many program headers are there?
What is the size of the header?
So if you see the size of the header is 52 bytes, or if you compile for 32 bit, but if I compile for
64 bit, it was having 64 as the size of this elf header.
So elf header size changes if it is, uh, 32 bit or 64 bit and I can, if I don't have this Elf file,
I can use hex dump and I can just check.
I can use hexdump hyphen n 64 or 56 depending on what.
And I can see, uh, the contents of the Elf file.
I can try to assume the values.
I'm looking into the offset, and then I can assume if I don't have a read elf, uh, on my target,
if you have a 60, then also you can use this one.
So here I am only printing the first four bytes.
So if you see this, first four bytes is the magic which will be discussing in the next video.