Inside ELF: Exploring the Core of Executable Files

Name: Inside ELF: Exploring the Core of Executable Files
Rating: 4.1 (64 reviews)

Learn about Executable and Linking Format in Linux

Created byLinux Trainer

Last updated 3/2024

English

What you'll learn

In-depth understanding of the ELF (Executable and Linkable Format) file structure.
Analysis techniques to dissect ELF files and interpret their contents.
Hands-on experience with real-world examples and tutorials to solidify their knowledge of ELF file format.
Write a very minimal ELF file

Course content

7 sections • 63 lectures • 4h 43m total length

Introduction0:49
Executable and Linkable Format3:25
Elf is the executable and linkable format used by Linux for binaries, libraries, and kernel modules, supporting dynamic linking and position independent code across architectures and endianness.
Why Learn Details of ELF2:11
Compilation Process11:09
Changing one character in ELF file4:21

Setting Up ARM Lab2:36
Machine Code3:32
Understand machine code and opcodes, the operation codes CPUs execute with operands in binary and hex. See how assembly and C are converted to machine code by a toolchain.
Executing Machine Instructions9:23
Instruction Set3:00
Explore the instruction set, including arithmetic operations such as addition, subtraction, multiplication, division, and bitwise operations. Compare ARM and x86 instruction sets, opcode patterns, and immediate operands across processors.
Introduction to Assembly3:10
Assembly Program to write to registers5:37
Learn to write an ARM assembly program that adds two numbers using registers in a bare-metal context, with .text directives, labels, and comments.
Generating Binary Files5:40
QEMU Monitor Interface3:53
Assembly Programs for sum of an array9:26
Assembly Program for Length of a string7:16
Symbol Resolution6:05
Section Merging6:48
Section Placement5:26
Relocation merges text and data sections and then places them at a chosen address, patching label references accordingly.
Linker Script2:42
Example of Linker Script3:00
Example of Data in RAM3:57
Specifying Load Addresses3:36
Learn to specify load and runtime addresses in the linker script for elf executables, using the at keyword to set the load address and copy data from flash to ram.
Startup code for copying data into RAM5:35
Handling Exceptions2:28
C startup implementation5:34
Updating startup code for using C Code10:16

Structure of an ELF file2:20
Machine Instructions in ELF File2:21
ELF Header9:21
ELF Identification6:33
Other members in ELF Header3:08
Generating Coredump files2:18
What happens when we change ELF Version1:08
Explore what happens when you change the elf version number using a hex editor. The video demonstrates altering the version byte and observing an 'unknown' version in the executable.
What happens when we change Architecture Version3:08
Changing the elf header's architecture version demonstrates how readelf reports a mixed bitness, switching between x86_64 and i386, and can cause exec format errors when the header and code disagree.
What happens when we change e_entry field2:59
Breakpoint at _start4:07
Who calls _start7:05
C program Without main2:24
Explore gcc options no start files and no stdlib, and see how startup code, underscore start, and library linking affect the absence of main and the C library runtime.
Writing ELF Header from C File4:33
Construct a minimal elf header in C using elf.h, fill e_ident with magic numbers, set 64-bit little-endian amd64, and write a binary with no program or section headers.
ARM ELF2:42

Introduction to Sections and Segments3:20
Explore ELF structure by examining headers, sections, and segments. See how the section header and program header tables guide the linker and loader to merge sections and set up executables.
ELF Sections8:07
Section Header Table10:38
Explore the section header table in elf files, including names, types, flags, offsets, and sizes. Learn how the linker uses this information, and why the loader ignores it after generation.
dumpelf command2:59
Common Sections in an ELF File8:04
Discover the common elf file sections, including the text section with executable code, the data and bss sections, section headers, and the interpreter, using objdump and readelf to inspect.
Debugging Sections2:01
Section Sizes3:22
Strings command2:52
Explore how the strings command extracts printable characters from ELF and executable files, with -S and -D options to inspect sections, data, and symbol names for reverse engineering.
Symbol Sections6:21
Strip Command2:39
Strip Sections4:40
How to add sections in an ELF File2:04

Requirements

Familiarity with the Unix/Linux operating system environment.
Access to a computer with a Unix/Linux-based operating system for hands-on exercises (recommended but not mandatory).

Description

This comprehensive course will take you step-by-step through engaging video tutorials and teach you all the essential concepts and topics you need to understand about Linux Executable Format: ELF in Linux

ELF is the standard binary format for executables, object code, shared libraries, and core dumps on Unix-like operating systems. In this course, we unravel the intricacies of ELF, exploring its structure, sections, headers, and dynamic linking mechanisms.

What will you learn in this course

Learn the inner details of ELF file
Understand different stages of Compilation Process (Pre-processing, compiling, Assembling, Linking)
Understand what is machine code or operation code (opcode)
Write ARM assembly code and run on QEMU
Understand syntax of Assembly code (Label, instruction, comment, assembler directives)
Different sections: .text, .data, .bss
Viewing ARM Registers in QEMU Monitor Interface
Assembler directives (.byte, .asciiz, .ascii, .align, .global, .text, .data)
Viewing symbol table and understand symbol resolution
Understand the role of assembler and linker
Relocation operation performed by Linker (Section Merging and Section Placement)
What is a Linker Script and write a simple linker script file and use it while compiling
Run time addresses and Load time addresses
Creating sections from linker script
Writing a startup code for copying data into RAM, bss and initializing stack
Understanding ELF Header with readelf command
What happens if i change first byte of ELF file
Generate core dump and verify ELF Header
Understand different members of ELF Header
Changing different members of ELF Header
Understand who calls main() using gdb and _start()
Writing a ELF Header from C Code
Sections vs Segments
Linker and Loader view of ELF file
Different readelf commands (readelf -h , readelf -WS, readelf -Wl, readelf -a..)
Understand various fields of section header and program header
dumpelf command to dump ELF structures in C structure format
Write a C Code to print some fields of ELF Section Header
What happens when we compile a user space program with debugging information (-g) inside an ELF file
Use 'size' command to get size of text, data and bss sections
Get deeper understanding of symbol table and what happens when you run 'strip' command
Writing a very minimal ELF executable file with size less than 200KB

There's no risk either !

This course comes with a 30 day money back guaranteed!. If you are not satisfied with the course, you'll get your money back

So what are you waiting for, enroll now and take the next step in becoming an expert in ELF file format

Who this course is for:

Software developers interested in understanding the inner workings of executable files.
Cybersecurity professionals aiming to enhance their skills in analyzing and securing software binaries.
Computer science students seeking to deepen their understanding of low-level programming concepts

Inside ELF: Exploring the Core of Executable Files

What you'll learn

Explore related topics

Course content

Introduction5 lectures • 22min

Bare Metal Arm Programming21 lectures • 1hr 49min

ELF Header14 lectures • 54min

ELF Section12 lectures • 57min

ELF Program Headers5 lectures • 21min

Minimal ELF File5 lectures • 20min

Notes1 lecture0

Requirements

Description

Who this course is for: