-
Notifications
You must be signed in to change notification settings - Fork 0
elfinject 분석
김동건 edited this page Jun 5, 2023
·
3 revisions
$ readelf -a elf_32
...
**Entry point address: 0x8049060**
...
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] .interp PROGBITS 08048194 000194 000013 00 A 0 0 1
[ 2] .note.gnu.bu[...] NOTE 080481a8 0001a8 000024 00 A 0 0 4
**[ 3] .note.ABI-tag NOTE 080481cc 0001cc 000020 00 A 0 0 4**
[ 4] .gnu.hash GNU_HASH 080481ec 0001ec 000020 04 A 5 0 4
[ 5] .dynsym DYNSYM 0804820c 00020c 000050 10 A 6 1 4
[ 6] .dynstr STRTAB 0804825c 00025c 000057 00 A 0 0 1
[ 7] .gnu.version VERSYM 080482b4 0002b4 00000a 02 A 5 0 2
[ 8] .gnu.version_r VERNEED 080482c0 0002c0 000030 00 A 6 1 4
[ 9] .rel.dyn REL 080482f0 0002f0 000008 08 A 5 0 4
[10] .rel.plt REL 080482f8 0002f8 000010 08 AI 5 22 4
[11] .init PROGBITS 08049000 001000 000024 00 AX 0 0 4
[12] .plt PROGBITS 08049030 001030 000030 04 AX 0 0 16
[13] .text PROGBITS 08049060 001060 000156 00 AX 0 0 16
[14] .fini PROGBITS 080491b8 0011b8 000018 00 AX 0 0 4
[15] .rodata PROGBITS 0804a000 002000 000016 00 A 0 0 4
[16] .eh_frame_hdr PROGBITS 0804a018 002018 000034 00 A 0 0 4
[17] .eh_frame PROGBITS 0804a04c 00204c 0000b0 00 A 0 0 4
[18] .init_array INIT_ARRAY 0804bf0c 002f0c 000004 04 WA 0 0 4
[19] .fini_array FINI_ARRAY 0804bf10 002f10 000004 04 WA 0 0 4
[20] .dynamic DYNAMIC 0804bf14 002f14 0000e8 08 WA 6 0 4
[21] .got PROGBITS 0804bffc 002ffc 000004 04 WA 0 0 4
[22] .got.plt PROGBITS 0804c000 003000 000014 04 WA 0 0 4
[23] .data PROGBITS 0804c014 003014 000008 00 WA 0 0 4
[24] .bss NOBITS 0804c01c 00301c 000004 00 WA 0 0 1
[25] .comment PROGBITS 00000000 00301c 00002d 01 MS 0 0 1
[26] .symtab SYMTAB 00000000 00304c 000250 10 27 18 4
[27] .strtab STRTAB 00000000 00329c 0001d3 00 0 0 1
[28] .shstrtab STRTAB 00000000 00346f 000101 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00160 0x00160 R 0x4
INTERP 0x000194 0x08048194 0x08048194 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x00308 0x00308 R 0x1000
LOAD 0x001000 0x08049000 0x08049000 0x001d0 0x001d0 R E 0x1000
LOAD 0x002000 0x0804a000 0x0804a000 0x000fc 0x000fc R 0x1000
LOAD 0x002f0c 0x0804bf0c 0x0804bf0c 0x00110 0x00114 RW 0x1000
DYNAMIC 0x002f14 0x0804bf14 0x0804bf14 0x000e8 0x000e8 RW 0x4
** NOTE 0x0001a8 0x080481a8 0x080481a8 0x00044 0x00044 R 0x4**
GNU_EH_FRAME 0x002018 0x0804a018 0x0804a018 0x00034 0x00034 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x10
GNU_RELRO 0x002f0c 0x0804bf0c 0x0804bf0c 0x000f4 0x000f4 R 0x1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.gnu.build-id **.note.ABI-tag** .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt
03 .init .plt .text .fini
04 .rodata .eh_frame_hdr .eh_frame
05 .init_array .fini_array .dynamic .got .got.plt .data .bss
06 .dynamic
07 .note.gnu.build-id **.note.ABI-tag **
08 .eh_frame_hdr
09
10 .init_array .fini_array .dynamic .got $ readelf -a elf_32
...
** Entry point address: 0x8009f8**
...
Section Headers:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
** [ 1] .injected PROGBITS 008009f8 0039f8 000042 00 AX 0 0 16**
[ 2] .note.gnu.bu[...] NOTE 080481a8 0001a8 000024 00 A 0 0 4
[ 3] .interp PROGBITS 08048194 000194 000013 00 A 0 0 1
[ 4] .gnu.hash GNU_HASH 080481ec 0001ec 000020 04 A 5 0 4
[ 5] .dynsym DYNSYM 0804820c 00020c 000050 10 A 6 1 4
[ 6] .dynstr STRTAB 0804825c 00025c 000057 00 A 0 0 1
[ 7] .gnu.version VERSYM 080482b4 0002b4 00000a 02 A 5 0 2
[ 8] .gnu.version_r VERNEED 080482c0 0002c0 000030 00 A 6 1 4
[ 9] .rel.dyn REL 080482f0 0002f0 000008 08 A 5 0 4
[10] .rel.plt REL 080482f8 0002f8 000010 08 AI 5 22 4
[11] .init PROGBITS 08049000 001000 000024 00 AX 0 0 4
[12] .plt PROGBITS 08049030 001030 000030 04 AX 0 0 16
[13] .text PROGBITS 08049060 001060 000156 00 AX 0 0 16
[14] .fini PROGBITS 080491b8 0011b8 000018 00 AX 0 0 4
[15] .rodata PROGBITS 0804a000 002000 000016 00 A 0 0 4
[16] .eh_frame_hdr PROGBITS 0804a018 002018 000034 00 A 0 0 4
[17] .eh_frame PROGBITS 0804a04c 00204c 0000b0 00 A 0 0 4
[18] .init_array INIT_ARRAY 0804bf0c 002f0c 000004 04 WA 0 0 4
[19] .fini_array FINI_ARRAY 0804bf10 002f10 000004 04 WA 0 0 4
[20] .dynamic DYNAMIC 0804bf14 002f14 0000e8 08 WA 6 0 4
[21] .got PROGBITS 0804bffc 002ffc 000004 04 WA 0 0 4
[22] .got.plt PROGBITS 0804c000 003000 000014 04 WA 0 0 4
[23] .data PROGBITS 0804c014 003014 000008 00 WA 0 0 4
[24] .bss NOBITS 0804c01c 00301c 000004 00 WA 0 0 1
[25] .comment PROGBITS 00000000 00301c 00002d 01 MS 0 0 1
[26] .symtab SYMTAB 00000000 00304c 000250 10 27 18 4
[27] .strtab STRTAB 00000000 00329c 0001d3 00 0 0 1
[28] .shstrtab STRTAB 00000000 00346f 000101 00 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00160 0x00160 R 0x4
INTERP 0x000194 0x08048194 0x08048194 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x00308 0x00308 R 0x1000
LOAD 0x001000 0x08049000 0x08049000 0x001d0 0x001d0 R E 0x1000
LOAD 0x002000 0x0804a000 0x0804a000 0x000fc 0x000fc R 0x1000
LOAD 0x002f0c 0x0804bf0c 0x0804bf0c 0x00110 0x00114 RW 0x1000
DYNAMIC 0x002f14 0x0804bf14 0x0804bf14 0x000e8 0x000e8 RW 0x4
** LOAD 0x0039f8 0x008009f8 0x008009f8 0x00042 0x00042 R E 0x1000**
GNU_EH_FRAME 0x002018 0x0804a018 0x0804a018 0x00034 0x00034 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x10
GNU_RELRO 0x002f0c 0x0804bf0c 0x0804bf0c 0x000f4 0x000f4 R 0x1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .note.gnu.build-id .interp .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt
03 .init .plt .text .fini
04 .rodata .eh_frame_hdr .eh_frame
05 .init_array .fini_array .dynamic .got .got.plt .data .bss
06 .dynamic
** 07 .injected **
08 .eh_frame_hdr
09
10 .init_array .fini_array .dynamic .got
$ readelf -a elf_64
**Entry point address: 0x401050**
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000400318 00000318
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.gnu.pr[...] NOTE 0000000000400338 00000338
0000000000000030 0000000000000000 A 0 0 8
[ 3] .note.gnu.bu[...] NOTE 0000000000400368 00000368
0000000000000024 0000000000000000 A 0 0 4
** [ 4] .note.ABI-tag NOTE 000000000040038c 0000038c**
**0000000000000020 0000000000000000 A 0 0 4**
[ 5] .gnu.hash GNU_HASH 00000000004003b0 000003b0
000000000000001c 0000000000000000 A 6 0 8
[ 6] .dynsym DYNSYM 00000000004003d0 000003d0
0000000000000060 0000000000000018 A 7 1 8
[ 7] .dynstr STRTAB 0000000000400430 00000430
000000000000004a 0000000000000000 A 0 0 1
[ 8] .gnu.version VERSYM 000000000040047a 0000047a
0000000000000008 0000000000000002 A 6 0 2
[ 9] .gnu.version_r VERNEED 0000000000400488 00000488
0000000000000030 0000000000000000 A 7 1 8
[10] .rela.dyn RELA 00000000004004b8 000004b8
0000000000000030 0000000000000018 A 6 0 8
[11] .rela.plt RELA 00000000004004e8 000004e8
0000000000000018 0000000000000018 AI 6 24 8
[12] .init PROGBITS 0000000000401000 00001000
000000000000001b 0000000000000000 AX 0 0 4
[13] .plt PROGBITS 0000000000401020 00001020
0000000000000020 0000000000000010 AX 0 0 16
[14] .plt.sec PROGBITS 0000000000401040 00001040
0000000000000010 0000000000000010 AX 0 0 16
[15] .text PROGBITS 0000000000401050 00001050
0000000000000109 0000000000000000 AX 0 0 16
[16] .fini PROGBITS 000000000040115c 0000115c
000000000000000d 0000000000000000 AX 0 0 4
[17] .rodata PROGBITS 0000000000402000 00002000
0000000000000012 0000000000000000 A 0 0 4
[18] .eh_frame_hdr PROGBITS 0000000000402014 00002014
0000000000000034 0000000000000000 A 0 0 4
[19] .eh_frame PROGBITS 0000000000402048 00002048
00000000000000a4 0000000000000000 A 0 0 8
[20] .init_array INIT_ARRAY 0000000000403e10 00002e10
0000000000000008 0000000000000008 WA 0 0 8
[21] .fini_array FINI_ARRAY 0000000000403e18 00002e18
0000000000000008 0000000000000008 WA 0 0 8
[22] .dynamic DYNAMIC 0000000000403e20 00002e20
00000000000001d0 0000000000000010 WA 7 0 8
[23] .got PROGBITS 0000000000403ff0 00002ff0
0000000000000010 0000000000000008 WA 0 0 8
[24] .got.plt PROGBITS 0000000000404000 00003000
0000000000000020 0000000000000008 WA 0 0 8
[25] .data PROGBITS 0000000000404020 00003020
0000000000000010 0000000000000000 WA 0 0 8
[26] .bss NOBITS 0000000000404030 00003030
0000000000000008 0000000000000000 WA 0 0 1
[27] .comment PROGBITS 0000000000000000 00003030
000000000000002d 0000000000000001 MS 0 0 1
[28] .symtab SYMTAB 0000000000000000 00003060
0000000000000330 0000000000000018 29 18 8
[29] .strtab STRTAB 0000000000000000 00003390
00000000000001a2 0000000000000000 0 0 1
[30] .shstrtab STRTAB 0000000000000000 00003532
000000000000011f 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), l (large), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000400040 0x0000000000400040
0x00000000000002d8 0x00000000000002d8 R 0x8
INTERP 0x0000000000000318 0x0000000000400318 0x0000000000400318
0x000000000000001c 0x000000000000001c R 0x1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000
0x0000000000000500 0x0000000000000500 R 0x1000
LOAD 0x0000000000001000 0x0000000000401000 0x0000000000401000
0x0000000000000169 0x0000000000000169 R E 0x1000
LOAD 0x0000000000002000 0x0000000000402000 0x0000000000402000
0x00000000000000ec 0x00000000000000ec R 0x1000
LOAD 0x0000000000002e10 0x0000000000403e10 0x0000000000403e10
0x0000000000000220 0x0000000000000228 RW 0x1000
DYNAMIC 0x0000000000002e20 0x0000000000403e20 0x0000000000403e20
0x00000000000001d0 0x00000000000001d0 RW 0x8
NOTE 0x0000000000000338 0x0000000000400338 0x0000000000400338
0x0000000000000030 0x0000000000000030 R 0x8
NOTE 0x0000000000000368 0x0000000000400368 0x0000000000400368
0x0000000000000044 0x0000000000000044 R 0x4
GNU_PROPERTY 0x0000000000000338 0x0000000000400338 0x0000000000400338
0x0000000000000030 0x0000000000000030 R 0x8
GNU_EH_FRAME 0x0000000000002014 0x0000000000402014 0x0000000000402014
0x0000000000000034 0x0000000000000034 R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x10
GNU_RELRO 0x0000000000002e10 0x0000000000403e10 0x0000000000403e10
0x00000000000001f0 0x00000000000001f0 R 0x1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.gnu.property .note.gnu.build-id **.note.ABI-tag** .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt
03 .init .plt .plt.sec .text .fini
04 .rodata .eh_frame_hdr .eh_frame
05 .init_array .fini_array .dynamic .got .got.plt .data .bss
06 .dynamic
07 .note.gnu.property
08 .note.gnu.build-id **.note.ABI-tag **
09 .note.gnu.property
10 .eh_frame_hdr
11
12 .init_array .fini_array .dynamic .got $ readelf -a elf_64
...
** Entry point address: 0x800e18**
...
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .interp PROGBITS 0000000000400318 00000318
000000000000001c 0000000000000000 A 0 0 1
[ 2] .note.gnu.pr[...] NOTE 0000000000400338 00000338
0000000000000030 0000000000000000 A 0 0 8
[ 3] .note.gnu.bu[...] NOTE 0000000000400368 00000368
0000000000000024 0000000000000000 A 0 0 4
[ 4] .init PROGBITS 0000000000401000 00001000
000000000000001b 0000000000000000 AX 0 0 4
[ 5] .gnu.hash GNU_HASH 00000000004003b0 000003b0
000000000000001c 0000000000000000 A 6 0 8
[ 6] .dynsym DYNSYM 00000000004003d0 000003d0
0000000000000060 0000000000000018 A 7 1 8
[ 7] .dynstr STRTAB 0000000000400430 00000430
000000000000004a 0000000000000000 A 0 0 1
[ 8] .gnu.version VERSYM 000000000040047a 0000047a
0000000000000008 0000000000000002 A 6 0 2
[ 9] .gnu.version_r VERNEED 0000000000400488 00000488
0000000000000030 0000000000000000 A 7 1 8
[10] .rela.dyn RELA 00000000004004b8 000004b8
0000000000000030 0000000000000018 A 6 0 8
[11] .rela.plt RELA 00000000004004e8 000004e8
0000000000000018 0000000000000018 AI 6 24 8
[12] .plt PROGBITS 0000000000401020 00001020
0000000000000020 0000000000000010 AX 0 0 16
[13] .plt.sec PROGBITS 0000000000401040 00001040
0000000000000010 0000000000000010 AX 0 0 16
[14] .text PROGBITS 0000000000401050 00001050
0000000000000109 0000000000000000 AX 0 0 16
[15] .fini PROGBITS 000000000040115c 0000115c
000000000000000d 0000000000000000 AX 0 0 4
[16] .rodata PROGBITS 0000000000402000 00002000
0000000000000012 0000000000000000 A 0 0 4
[17] .eh_frame_hdr PROGBITS 0000000000402014 00002014
0000000000000034 0000000000000000 A 0 0 4
[18] .eh_frame PROGBITS 0000000000402048 00002048
00000000000000a4 0000000000000000 A 0 0 8
[19] .got PROGBITS 0000000000403ff0 00002ff0
0000000000000010 0000000000000008 WA 0 0 8
[20] .init_array INIT_ARRAY 0000000000403e10 00002e10
0000000000000008 0000000000000008 WA 0 0 8
[21] .fini_array FINI_ARRAY 0000000000403e18 00002e18
0000000000000008 0000000000000008 WA 0 0 8
[22] .dynamic DYNAMIC 0000000000403e20 00002e20
00000000000001d0 0000000000000010 WA 7 0 8
[23] .got.plt PROGBITS 0000000000404000 00003000
0000000000000020 0000000000000008 WA 0 0 8
[24] .data PROGBITS 0000000000404020 00003020
0000000000000010 0000000000000000 WA 0 0 8
[25] .comment PROGBITS 0000000000000000 00003030
000000000000002d 0000000000000001 MS 0 0 1
[26] .bss NOBITS 0000000000404030 00003030
0000000000000008 0000000000000000 WA 0 0 1
**[27] .injected PROGBITS 0000000000800e18 00003e18**
**0000000000000045 0000000000000000 AX 0 0 16**
[28] .symtab SYMTAB 0000000000000000 00003060
0000000000000330 0000000000000018 29 18 8
[29] .strtab STRTAB 0000000000000000 00003390
00000000000001a2 0000000000000000 0 0 1
[30] .shstrtab STRTAB 0000000000000000 00003532
000000000000011f 0000000000000000 0 0 1
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), l (large), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
PHDR 0x0000000000000040 0x0000000000400040 0x0000000000400040
0x00000000000002d8 0x00000000000002d8 R 0x8
INTERP 0x0000000000000318 0x0000000000400318 0x0000000000400318
0x000000000000001c 0x000000000000001c R 0x1
[Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
LOAD 0x0000000000000000 0x0000000000400000 0x0000000000400000
0x0000000000000500 0x0000000000000500 R 0x1000
LOAD 0x0000000000001000 0x0000000000401000 0x0000000000401000
0x0000000000000169 0x0000000000000169 R E 0x1000
LOAD 0x0000000000002000 0x0000000000402000 0x0000000000402000
0x00000000000000ec 0x00000000000000ec R 0x1000
LOAD 0x0000000000002e10 0x0000000000403e10 0x0000000000403e10
0x0000000000000220 0x0000000000000228 RW 0x1000
DYNAMIC 0x0000000000002e20 0x0000000000403e20 0x0000000000403e20
0x00000000000001d0 0x00000000000001d0 RW 0x8
**LOAD 0x0000000000003e18 0x0000000000800e18 0x0000000000800e18**
**0x0000000000000045 0x0000000000000045 R E 0x1000**
NOTE 0x0000000000000368 0x0000000000400368 0x0000000000400368
0x0000000000000044 0x0000000000000044 R 0x4
GNU_PROPERTY 0x0000000000000338 0x0000000000400338 0x0000000000400338
0x0000000000000030 0x0000000000000030 R 0x8
GNU_EH_FRAME 0x0000000000002014 0x0000000000402014 0x0000000000402014
0x0000000000000034 0x0000000000000034 R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x10
GNU_RELRO 0x0000000000002e10 0x0000000000403e10 0x0000000000403e10
0x00000000000001f0 0x00000000000001f0 R 0x1
Section to Segment mapping:
Segment Sections...
00
01 .interp
02 .interp .note.gnu.property .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt
03 .init .plt .plt.sec .text .fini
04 .rodata .eh_frame_hdr .eh_frame
05 .got .init_array .fini_array .dynamic .got.plt .data .bss
06 .dynamic
** 07 .injected **
08 .note.gnu.build-id
09 .note.gnu.property
10 .eh_frame_hdr
11
12 .got .init_array .fini_array .dynamic