
Course introduction.
Explore the ELF format, its four file types (relocatable, executable, shared object, dump), and how linking, memory segments, and dynamic loading occur on Linux and Unix systems.
Walk through the initial elf-tutorial program, inspect source files, and build with a simple shell script and make. Run the ncurses-based two-window interface to explore the event loop and rendering.
Explore the ELF structure, starting with ELF header and the program and section header tables, highlighting the 16-byte identity with the magic number and 64-bit little-endian details.
Learn to read and display the Elf header, build left and right tables to show the header and its members, and visualize the program header and section header details.
Learn to render the elf program header table in a two-window viewer by reading the header, calculating sizes, and updating the right window from the left selection.
Explore the elf section header table, detailing section name, type, attributes, virtual address, offset, size, alignment, and links to symbol, string, and program header tables.
Implement and display the elf section header table by extending the left window and detailing each section header’s fields, including offset, size, address, entry size, entry count, and type.
Discover how the ELF string table stores strings with null terminators, read section and member names from the section header string table, and identify dot text, data, and bss sections.
Translate ELF section indices into names by using the string table and section headers, implementing get section name string table and get section header.
Explore how ELF headers define segments and sections, how the program header table and section header table map memory and file data, and how overlaps involve initialized and uninitialized data.
Explore how to display the string table contents in the elf lab by counting strings from the section header and printing each with its index.
Explore the symbol table section, reading symbol entries and their name indices, types, and bindings, including global, local, and weak, plus visibilities and dynamic versus static linking.
Explore the ELF dynamic section and its role in dynamic linking, showing how the linker resolves dependencies, relocates symbols, and returns control to the user program.
Explore dynamic section parsing in an ELF lab by building a dynamic table, printing tag values as hex, and translating tags to strings.
This course explains the format of the ELF (Executable and Linking Format) file, which is the file format for almost all executable files and shared object files in Linux/Unix world.
By taking this course, you will learn to understand
1. ELF file format, like ELF header, program header table, and section header table;
2. The contents (the individual sections) in ELF file, like symbol section, dynamic section, relocation section, string table section, hash section, GNU versioning section, and so on;
3. How ELF file plays in dynamic linking (including variable relocation and function relocation);
4. How ELF file supports multiple versions of symbol;
5. How ELF file supports efficient symbol lookup;
6. Some common tools reading ELF file, like file, readelf, and objdump.
As part of the course, you will also learn to develop your own ELF reader program, enriching your understanding of ELF file format and contents. You can also extend this program for your future ELF file analysis or processing.
When you finish this course, you will have good knowledge and understanding about ELF file, especially if you work on the areas like Linux kernel, compiler/linker technology, performance analysis, and so on. It's also good for who with strong interests in how program is constructed and executes on Linux/Unix.