# ELF Files

## Executable and Linkable Format

**Container for executable files**, object files, shared libraries, and core dumps.

* And other things out of this context like in Android.

Composed of several headers and sections:

* Executable Header.
* Several Program Headers (optional).
* Several Sections, with a header and content.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FuKVGqyB5qWtBqCRm0QyS%2FScreenshot%20from%202024-03-27%2015-16-03.png?alt=media&#x26;token=9802d53f-5e6f-4d66-9eec-9bd285bac4d4" alt=""><figcaption></figcaption></figure>

## Headers

### Executable Header

Mandatory header, with basic information about the file.

* Architecture.
* Entry Point.
* Header locations and number.
* Type.
* Type of data.

Follow the structure `Elf64_Ehdr`

* defined in `/usr/include/elf.h`

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FBbwznByD1TbSWgFoLZU8%2Fimage.png?alt=media&#x26;token=efe746c6-ae8d-4c1f-b50d-edfad6866caf" alt=""><figcaption></figcaption></figure>

### Section Headers

Sections are unstructured placeholders of data (frequently coded) **targeting the Linker**.

* Some sections are well-known and follow a defined structure.
* Some sections can be arbitrary binary blobs.
* Some sections may contain content not useful for execution.
* Section order is irrelevant.
* Symbols and relocation information are stored in sections.

Headers describe the properties of each section.

* Name, type, flags, address when loaded, file offset, size, information…

Files without linking may omit section headers.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FhLHRWe60aKSNNjqmt4p4%2Fimage.png?alt=media&#x26;token=da400222-b71b-4e34-a542-a943a47ce195" alt=""><figcaption></figcaption></figure>

## Sections

### `.init` and `.fini`

Contains executable code required **before/after the** binary **entry point** is executed.

* Initialization tasks to prepare/clean the memory space.

Some uses:

* prepare profiling tasks (`__gmon_start__`)
* Invoke global constructors/destructors (C++).
* Save program arguments.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FjqOS5hflMLuYW3bdAJMJ%2Fimage.png?alt=media&#x26;token=34e0b7ab-4760-4192-81eb-c8774c33d159" alt=""><figcaption></figcaption></figure>

### `.text`

**It contains the main program code.**

* The main target of a Reverse Engineering activity.
* They are **allocated as executable and read-only**.
* It contains the user code, and additional code created by the compiler.
  * Cleanup/initialization functions, stack guards, etc.

In this section resides the program entry point.

* When the binary is loaded, the execution flow is transferred to that address.
* **Related** to the **`main`** function in a C program (but not the main).

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FgOaSs1ui41buwbaA2W3R%2Fimage.png?alt=media&#x26;token=d8660bf5-4603-4c79-b4bb-1d543362d314" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FUAc6CuUwJ5Xm0lG3kMw6%2FScreenshot%20from%202024-03-27%2015-26-58.png?alt=media&#x26;token=d065e0c6-8c8c-4a72-99e3-7141e42ebf16" alt=""><figcaption></figcaption></figure>

### `.bss`, `.data`, `.rodata`

**`.rodata`**: Read-only data.

* **Stores constant values**.
* Mapped to a page marked as read-only.

**`.data`**: Area with information to **initialize variables**.

* As the data can be modified, the section is writable.

**`.bss`**: **Uninitialized variables**.

* Memory is allocated for a variable that may be required, but nothing else is done.
* As there is no data associated, the .bss doesn’t take space on the binary. Only instructs the system to reserve memory.

### `.plt`, `.got`, `.got.plt`

**Procedure Linkage Table** and **Global Offset Table**.

* **.PLT**: Code to relocate symbols.
* **.GOT**: Array with addresses of each symbol requiring relocation.
  * **`.got`** is similar to **`.got.plt`** but it’s writable, while **`.got`** may be marked as Read Only as a security measure (-z relro).
  * Using a table (GOT) allows patching this table, while keeping libraries in the same address, shared to multiple processes.

**Sections required for lazy binding (real-time relocation).**

* The linker needs to resolve the effective address of a code identified by a symbol (e.g., **puts**).
* The code may be on the program, or an external library, mapped to the virtual memory.
* **`.plt`** and **`.got`** ensure the symbol location is found and the code jumps around correctly.
* This is executed as the symbols are required! (LAZY).
* On Linux, the Env Variable LD\_BIND\_NOW forces linking by the linker (on program load).
  * Will increase performance during execution, but will slow down startup.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2F4AM29FCEWwwgQCjS6BDA%2FScreenshot%20from%202024-03-27%2015-32-19.png?alt=media&#x26;token=74b8c01d-90f3-4518-88cb-6333b9224f90" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FS8Y13AYOsoQJ8j9QDasE%2FScreenshot%20from%202024-03-27%2015-32-45.png?alt=media&#x26;token=1630f9af-994d-4e4b-9181-55b732ba57d9" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FzAaPZnHPPSoXYVl0j6Rh%2FScreenshot%20from%202024-03-27%2015-33-12.png?alt=media&#x26;token=410043cc-2a61-4679-97c4-bd3f2115e9de" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FWG1viZGbmruYdfNgbR0O%2FScreenshot%20from%202024-03-27%2015-33-39.png?alt=media&#x26;token=17b758b5-2d93-4917-a0e7-54cb43af512f" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FZV8YJlKHpsFsjuinAs1D%2FScreenshot%20from%202024-03-27%2015-34-00.png?alt=media&#x26;token=ec3596d1-411d-4524-aeee-84280b08f4f6" alt=""><figcaption></figcaption></figure>

### `.rel.*`, `.rela.`_`*`_

Tables containing i**nformation to the dynamic linker about the required relocations**.

* `R_X86_64_GLOB_DAT`: GOT offset should be filled with the symbol address (Lines 8-12).
* `R_X86_64_JUMP_SLO`: Jump Slots to be represented in the **`.got.plt`** and **`.plt`** sections as shown previously (Line 16).

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FHZDDmF8I4pargPwXybdm%2Fimage.png?alt=media&#x26;token=a38a73e5-a1ea-46fb-a425-f6ad77456f1e" alt=""><figcaption></figcaption></figure>

### `.dynamic`

Contains information **instructing the operating system/dynamic linker to load the binary**.

* Address of important tables.
* Flags.
* Required libraries.
* Debug flags.
* INIT/FINI addresses.

<figure><img src="https://1103423335-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvyEajzuIz0PAtDiV6JcU%2Fuploads%2FtA6wYJ41qFDGnwxMyLVU%2Fimage.png?alt=media&#x26;token=08527fa0-7376-4dfc-86fc-47c257815674" alt=""><figcaption></figcaption></figure>
