Now that you have gained a high level understanding of the inner workings of binaries, it's time to
delve into a specific binary format.
In this section, we will explore the executable and linkable format Elf, which serves as the default
binary format for Linux based systems.
Elf executable and linkable format finds its utility in various types of files, including executables,
object files, shared libraries and code dams.
While our primary focus will be on Elf executables in this section, it's important to note that the
concepts we discuss apply to other types of Elf files as well.
Given that we will primarily work with 64 bit binaries through this section and our discussion will
revolve around the intricacies of 64 bit files.
However, it's worth mentioning that 32 bit format is similar, differing mainly in the size of the
size and the order of certain header files and other data structures, but they are basically similar
here and therefore you will have no trouble extrapolating the concepts discussed here to 32 bit binaries.
And in this diagram I created an illustration of the format and contents typically found in a 64 bit
Elf executable file here.
So at first glance, the complexity of analyzing Elf binaries may appear overwhelming.
However, in a sense, Elf binaries consist of four primary components an executable header.
A series of program heater.
A number of sections and series of section headers.
Now let's explore each of these components in detail.
So as we see in this diagram, standard Elf rivalries begin with an executable heater.
Followed by the program headers and conclude with the sections and section headers.
Uh, to facilitate a more coherent discussion.
I will deviate slightly from this order and first delve into the sections and sections leaders before
addressing the program itself here.
So let's begin with the executable header for now.
So the executable header marks the beginning of every file.
So it consists of a structured sequence of bytes that provides essential information about the file,
such as its status as an Elf file, the specific type of file it represents, and the locations within
the file where you can find the remaining contents to gain a comprehensive understanding of the executable
header format, you can refer to the type definition and related definitions of other elf type elf related
types and constants which can be found in our Linux distro here.
So we will jump back to Linux here.
Open this here.
And what we're going to do here is.
Sorry.
We will now.
Had the terminal.
And what we're going to do is we will read the user mouse pad user include dot H here.
Of that age and here, as you can see, actually.
And this is our file.
And here we have the E type.
Machine type here.
As you can see, we also have the comments of it.
Let's increase the font size a little bit.
And here so the executable header is represented here as a C struct here.
And called the Elf 64 e HDR here.
And if you look at up as we did here, you will get the same results.
And here.
And you may notice that the struct definition given there contains types such as 64 half and Elf 64
word here.
These are just typedefs for integer types such as u integer 16 dash t and u integer 32 t.
So for simplicity here you can see.
Uh, the.
Comments of all those definitions here.
And now let's start with the.
E ident array.
Right.
So.
This is an array.
The executable header.
The elf file.
Oops.
Sorry.
Let's actually get the pen here.
So I will draw this.
It.
And here.
So we will.
First, let's start with the ident here.
So the executable heater and the files start with the 16 byte array called the E ident.
And the array always starts with the four byte.
For byte magical.
That's the magic value here.
Identifying the file as an elf binary.
And.
Sexually it again here.
And the magic value consists of the hexadecimal number of 0X7.
F here.
Followed by an Ascii character.
Um, codes for letters like E here, L and F.
Having these bites right at the start is convenient because it allows tools such as file like.
We did in previous year.
We can get the information of files with.
File.
Command in Linux here, for example, let's go to new terminal and desktop and we will use the files
again.
To see the desktop here.
And here we have several files here.
So let's try with my APK here.
And as you can see here, it's a C source Ascii text here.
My my app file, my app dot all here and we can see the Elf 64 bit LSB Relocatable.
We discussed about this in previous lecture here, so.
Uh, we will skip this for now.
And here we have the.
So we can quickly discover that they are dealing with an Elf file and following magic value.
There are a number of bytes that give more detailed information about the specifics of the type of Elf
file.
In elf dot h here elf dot header file the indexes for these bytes.
For example indexes for here four through 15 in the identifier array are symbolically referred as a
E class.
Here I will write it out.
So a E class is the.
A class.
Uppercase.
Also.
E a e theta.
Also a.
Version.
Also.
A wasabi here.
These are the underscores.
And also a E.
Abbey version.
Abby version.
And a.
Lastly here a part.
Sorry for my handwriting.
These are actually not handwriting.
This is mouse writing here.
I'm struggling with this, so.
The A Path field actually contains multiple bytes.
Namely indexes seven nine through 15 in a ident here.
All of these bytes are currently designated as padding, so there are reserved for possible future use,
but currently set to zero.
And the A class byte denotes what the specifications refers to as the binary class.
So this is a bit of a misnomer since the world class is so generic and it could mean almost anything.
So you will learn about this in the next lectures.
But firstly.
We will.
Rudolph here.
We can close this now.
We will.
Rudolph.
Our old file here.
Let's see here.
As you can see here, we should have the dot out.
So if we execute, try to run this app, we will.
This is just a regular Hello World application is written in C and what we're going to do is read Elf
here, read Elf H and a dot out and that's it.
We have the several information here which I will explain right now.
And here the a ident here, this is the a ident is shown on the line marked the magic.
This was the.
That agent which we discussed previously here.
When we started this lecture.
Let's try this.
Open this up here again.
And.
We're going to go to cat or mouse.
Fat is okay here.
Mouse pad is mouse pad user.
Include.
And that.
Once while include l.v.h.
Here.
And here.
We will now.
To that.
Right here.
That's actually the struct, but in struct we have this array magic number and other information here.
A ident.
And here.
The thing you can see here in magic.
As I said, it's the ident array and it starts with the familiar four magic bytes.
Seven F, uh, 45 uh, followed by a value of two.
Indicating that elf class six, fourth, then one.
Um, which is Elf data to LSB.
And finally another one which is EV current.
So the remaining bytes are all zeroed out since the a OCB and a EB version bytes are at their default
values.
So the padding bytes are also are all set to zero as well.
So this the information contained in some of these bytes is explicitly repeated on dedicated lines marked
as the class here.
Data versions.
Two's complement Little endian and version one Current.