前言：搞 pwn 搞自闭了。。。
#include
int main() {
printf("hello world\n");
return 0;
}
生成可执行文件：
gcc hello.c -o hello
objdump
- 整体信息
$ objdump -f factorial
hello： 文件格式 elf64-x86-64
体系结构：i386:x86-64， 标志 0x00000150：
HAS_SYMS, DYNAMIC, D_PAGED
起始地址 0x0000000000000530
- 所有段
$ objdump -p hello
hello： 文件格式 elf64-x86-64
程序头：
PHDR off 0x0000000000000040 vaddr 0x0000000000000040 paddr 0x0000000000000040 align 2**3
filesz 0x00000000000001f8 memsz 0x00000000000001f8 flags r--
INTERP off 0x0000000000000238 vaddr 0x0000000000000238 paddr 0x0000000000000238 align 2**0
filesz 0x000000000000001c memsz 0x000000000000001c flags r--
LOAD off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**21
filesz 0x0000000000000838 memsz 0x0000000000000838 flags r-x
LOAD off 0x0000000000000db8 vaddr 0x0000000000200db8 paddr 0x0000000000200db8 align 2**21
filesz 0x0000000000000258 memsz 0x0000000000000260 flags rw-
DYNAMIC off 0x0000000000000dc8 vaddr 0x0000000000200dc8 paddr 0x0000000000200dc8 align 2**3
filesz 0x00000000000001f0 memsz 0x00000000000001f0 flags rw-
NOTE off 0x0000000000000254 vaddr 0x0000000000000254 paddr 0x0000000000000254 align 2**2
filesz 0x0000000000000044 memsz 0x0000000000000044 flags r--
EH_FRAME off 0x00000000000006f0 vaddr 0x00000000000006f0 paddr 0x00000000000006f0 align 2**2
filesz 0x000000000000003c memsz 0x000000000000003c flags r--
STACK off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
RELRO off 0x0000000000000db8 vaddr 0x0000000000200db8 paddr 0x0000000000200db8 align 2**0
filesz 0x0000000000000248 memsz 0x0000000000000248 flags r--
动态节：
NEEDED libc.so.6
INIT 0x00000000000004e8
FINI 0x00000000000006d4
INIT_ARRAY 0x0000000000200db8
INIT_ARRAYSZ 0x0000000000000008
FINI_ARRAY 0x0000000000200dc0
FINI_ARRAYSZ 0x0000000000000008
GNU_HASH 0x0000000000000298
STRTAB 0x0000000000000360
SYMTAB 0x00000000000002b8
STRSZ 0x0000000000000082
SYMENT 0x0000000000000018
DEBUG 0x0000000000000000
PLTGOT 0x0000000000200fb8
PLTRELSZ 0x0000000000000018
PLTREL 0x0000000000000007
JMPREL 0x00000000000004d0
RELA 0x0000000000000410
RELASZ 0x00000000000000c0
RELAENT 0x0000000000000018
FLAGS 0x0000000000000008
FLAGS_1 0x0000000008000001
VERNEED 0x00000000000003f0
VERNEEDNUM 0x0000000000000001
VERSYM 0x00000000000003e2
RELACOUNT 0x0000000000000003
版本引用：
required from libc.so.6:
0x09691a75 0x00 02 GLIBC_2.2.5
- 所有节
$ objdump -h hello
hello： 文件格式 elf64-x86-64
节：
Idx Name Size VMA LMA File off Algn
0 .interp 0000001c 0000000000000238 0000000000000238 00000238 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
1 .note.ABI-tag 00000020 0000000000000254 0000000000000254 00000254 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .note.gnu.build-id 00000024 0000000000000274 0000000000000274 00000274 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
3 .gnu.hash 0000001c 0000000000000298 0000000000000298 00000298 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 .dynsym 000000a8 00000000000002b8 00000000000002b8 000002b8 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 .dynstr 00000082 0000000000000360 0000000000000360 00000360 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .gnu.version 0000000e 00000000000003e2 00000000000003e2 000003e2 2**1
CONTENTS, ALLOC, LOAD, READONLY, DATA
7 .gnu.version_r 00000020 00000000000003f0 00000000000003f0 000003f0 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
8 .rela.dyn 000000c0 0000000000000410 0000000000000410 00000410 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
9 .rela.plt 00000018 00000000000004d0 00000000000004d0 000004d0 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
10 .init 00000017 00000000000004e8 00000000000004e8 000004e8 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
11 .plt 00000020 0000000000000500 0000000000000500 00000500 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
12 .plt.got 00000008 0000000000000520 0000000000000520 00000520 2**3
CONTENTS, ALLOC, LOAD, READONLY, CODE
13 .text 000001a2 0000000000000530 0000000000000530 00000530 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
14 .fini 00000009 00000000000006d4 00000000000006d4 000006d4 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
15 .rodata 00000010 00000000000006e0 00000000000006e0 000006e0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
16 .eh_frame_hdr 0000003c 00000000000006f0 00000000000006f0 000006f0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
17 .eh_frame 00000108 0000000000000730 0000000000000730 00000730 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
18 .init_array 00000008 0000000000200db8 0000000000200db8 00000db8 2**3
CONTENTS, ALLOC, LOAD, DATA
19 .fini_array 00000008 0000000000200dc0 0000000000200dc0 00000dc0 2**3
CONTENTS, ALLOC, LOAD, DATA
20 .dynamic 000001f0 0000000000200dc8 0000000000200dc8 00000dc8 2**3
CONTENTS, ALLOC, LOAD, DATA
21 .got 00000048 0000000000200fb8 0000000000200fb8 00000fb8 2**3
CONTENTS, ALLOC, LOAD, DATA
22 .data 00000010 0000000000201000 0000000000201000 00001000 2**3
CONTENTS, ALLOC, LOAD, DATA
23 .bss 00000008 0000000000201010 0000000000201010 00001010 2**0
ALLOC
24 .comment 00000029 0000000000000000 0000000000000000 00001010 2**0
CONTENTS, READONLY
- 所有段 + 所有节 + 所有符号
$ objdump +x hello
hello： 文件格式 elf64-x86-64
hello
体系结构：i386:x86-64， 标志 0x00000150：
HAS_SYMS, DYNAMIC, D_PAGED
起始地址 0x0000000000000530
程序头：
PHDR off 0x0000000000000040 vaddr 0x0000000000000040 paddr 0x0000000000000040 align 2**3
filesz 0x00000000000001f8 memsz 0x00000000000001f8 flags r--
INTERP off 0x0000000000000238 vaddr 0x0000000000000238 paddr 0x0000000000000238 align 2**0
filesz 0x000000000000001c memsz 0x000000000000001c flags r--
LOAD off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**21
filesz 0x0000000000000838 memsz 0x0000000000000838 flags r-x
LOAD off 0x0000000000000db8 vaddr 0x0000000000200db8 paddr 0x0000000000200db8 align 2**21
filesz 0x0000000000000258 memsz 0x0000000000000260 flags rw-
DYNAMIC off 0x0000000000000dc8 vaddr 0x0000000000200dc8 paddr 0x0000000000200dc8 align 2**3
filesz 0x00000000000001f0 memsz 0x00000000000001f0 flags rw-
NOTE off 0x0000000000000254 vaddr 0x0000000000000254 paddr 0x0000000000000254 align 2**2
filesz 0x0000000000000044 memsz 0x0000000000000044 flags r--
EH_FRAME off 0x00000000000006f0 vaddr 0x00000000000006f0 paddr 0x00000000000006f0 align 2**2
filesz 0x000000000000003c memsz 0x000000000000003c flags r--
STACK off 0x0000000000000000 vaddr 0x0000000000000000 paddr 0x0000000000000000 align 2**4
filesz 0x0000000000000000 memsz 0x0000000000000000 flags rw-
RELRO off 0x0000000000000db8 vaddr 0x0000000000200db8 paddr 0x0000000000200db8 align 2**0
filesz 0x0000000000000248 memsz 0x0000000000000248 flags r--
动态节：
NEEDED libc.so.6
INIT 0x00000000000004e8
FINI 0x00000000000006d4
INIT_ARRAY 0x0000000000200db8
INIT_ARRAYSZ 0x0000000000000008
FINI_ARRAY 0x0000000000200dc0
FINI_ARRAYSZ 0x0000000000000008
GNU_HASH 0x0000000000000298
STRTAB 0x0000000000000360
SYMTAB 0x00000000000002b8
STRSZ 0x0000000000000082
SYMENT 0x0000000000000018
DEBUG 0x0000000000000000
PLTGOT 0x0000000000200fb8
PLTRELSZ 0x0000000000000018
PLTREL 0x0000000000000007
JMPREL 0x00000000000004d0
RELA 0x0000000000000410
RELASZ 0x00000000000000c0
RELAENT 0x0000000000000018
FLAGS 0x0000000000000008
FLAGS_1 0x0000000008000001
VERNEED 0x00000000000003f0
VERNEEDNUM 0x0000000000000001
VERSYM 0x00000000000003e2
RELACOUNT 0x0000000000000003
版本引用：
required from libc.so.6:
0x09691a75 0x00 02 GLIBC_2.2.5
节：
Idx Name Size VMA LMA File off Algn
0 .interp 0000001c 0000000000000238 0000000000000238 00000238 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
1 .note.ABI-tag 00000020 0000000000000254 0000000000000254 00000254 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .note.gnu.build-id 00000024 0000000000000274 0000000000000274 00000274 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
3 .gnu.hash 0000001c 0000000000000298 0000000000000298 00000298 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 .dynsym 000000a8 00000000000002b8 00000000000002b8 000002b8 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 .dynstr 00000082 0000000000000360 0000000000000360 00000360 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .gnu.version 0000000e 00000000000003e2 00000000000003e2 000003e2 2**1
CONTENTS, ALLOC, LOAD, READONLY, DATA
7 .gnu.version_r 00000020 00000000000003f0 00000000000003f0 000003f0 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
8 .rela.dyn 000000c0 0000000000000410 0000000000000410 00000410 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
9 .rela.plt 00000018 00000000000004d0 00000000000004d0 000004d0 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
10 .init 00000017 00000000000004e8 00000000000004e8 000004e8 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
11 .plt 00000020 0000000000000500 0000000000000500 00000500 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
12 .plt.got 00000008 0000000000000520 0000000000000520 00000520 2**3
CONTENTS, ALLOC, LOAD, READONLY, CODE
13 .text 000001a2 0000000000000530 0000000000000530 00000530 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
14 .fini 00000009 00000000000006d4 00000000000006d4 000006d4 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
15 .rodata 00000010 00000000000006e0 00000000000006e0 000006e0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
16 .eh_frame_hdr 0000003c 00000000000006f0 00000000000006f0 000006f0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
17 .eh_frame 00000108 0000000000000730 0000000000000730 00000730 2**3
CONTENTS, ALLOC, LOAD, READONLY, DATA
18 .init_array 00000008 0000000000200db8 0000000000200db8 00000db8 2**3
CONTENTS, ALLOC, LOAD, DATA
19 .fini_array 00000008 0000000000200dc0 0000000000200dc0 00000dc0 2**3
CONTENTS, ALLOC, LOAD, DATA
20 .dynamic 000001f0 0000000000200dc8 0000000000200dc8 00000dc8 2**3
CONTENTS, ALLOC, LOAD, DATA
21 .got 00000048 0000000000200fb8 0000000000200fb8 00000fb8 2**3
CONTENTS, ALLOC, LOAD, DATA
22 .data 00000010 0000000000201000 0000000000201000 00001000 2**3
CONTENTS, ALLOC, LOAD, DATA
23 .bss 00000008 0000000000201010 0000000000201010 00001010 2**0
ALLOC
24 .comment 00000029 0000000000000000 0000000000000000 00001010 2**0
CONTENTS, READONLY
SYMBOL TABLE:
0000000000000238 l d .interp 0000000000000000 .interp
0000000000000254 l d .note.ABI-tag 0000000000000000 .note.ABI-tag
0000000000000274 l d .note.gnu.build-id 0000000000000000 .note.gnu.build-id
0000000000000298 l d .gnu.hash 0000000000000000 .gnu.hash
00000000000002b8 l d .dynsym 0000000000000000 .dynsym
0000000000000360 l d .dynstr 0000000000000000 .dynstr
00000000000003e2 l d .gnu.version 0000000000000000 .gnu.version
00000000000003f0 l d .gnu.version_r 0000000000000000 .gnu.version_r
0000000000000410 l d .rela.dyn 0000000000000000 .rela.dyn
00000000000004d0 l d .rela.plt 0000000000000000 .rela.plt
00000000000004e8 l d .init 0000000000000000 .init
0000000000000500 l d .plt 0000000000000000 .plt
0000000000000520 l d .plt.got 0000000000000000 .plt.got
0000000000000530 l d .text 0000000000000000 .text
00000000000006d4 l d .fini 0000000000000000 .fini
00000000000006e0 l d .rodata 0000000000000000 .rodata
00000000000006f0 l d .eh_frame_hdr 0000000000000000 .eh_frame_hdr
0000000000000730 l d .eh_frame 0000000000000000 .eh_frame
0000000000200db8 l d .init_array 0000000000000000 .init_array
0000000000200dc0 l d .fini_array 0000000000000000 .fini_array
0000000000200dc8 l d .dynamic 0000000000000000 .dynamic
0000000000200fb8 l d .got 0000000000000000 .got
0000000000201000 l d .data 0000000000000000 .data
0000000000201010 l d .bss 0000000000000000 .bss
0000000000000000 l d .comment 0000000000000000 .comment
0000000000000000 l df *ABS* 0000000000000000 crtstuff.c
0000000000000560 l F .text 0000000000000000 deregister_tm_clones
00000000000005a0 l F .text 0000000000000000 register_tm_clones
00000000000005f0 l F .text 0000000000000000 __do_global_dtors_aux
0000000000201010 l O .bss 0000000000000001 completed.7697
0000000000200dc0 l O .fini_array 0000000000000000 __do_global_dtors_aux_fini_array_entry
0000000000000630 l F .text 0000000000000000 frame_dummy
0000000000200db8 l O .init_array 0000000000000000 __frame_dummy_init_array_entry
0000000000000000 l df *ABS* 0000000000000000 hello.c
0000000000000000 l df *ABS* 0000000000000000 crtstuff.c
0000000000000834 l O .eh_frame 0000000000000000 __FRAME_END__
0000000000000000 l df *ABS* 0000000000000000
0000000000200dc0 l .init_array 0000000000000000 __init_array_end
0000000000200dc8 l O .dynamic 0000000000000000 _DYNAMIC
0000000000200db8 l .init_array 0000000000000000 __init_array_start
00000000000006f0 l .eh_frame_hdr 0000000000000000 __GNU_EH_FRAME_HDR
0000000000200fb8 l O .got 0000000000000000 _GLOBAL_OFFSET_TABLE_
00000000000006d0 g F .text 0000000000000002 __libc_csu_fini
0000000000000000 w *UND* 0000000000000000 _ITM_deregisterTMCloneTable
0000000000201000 w .data 0000000000000000 data_start
0000000000000000 F *UND* 0000000000000000 puts@@GLIBC_2.2.5
0000000000201010 g .data 0000000000000000 _edata
00000000000006d4 g F .fini 0000000000000000 _fini
0000000000000000 F *UND* 0000000000000000 __libc_start_main@@GLIBC_2.2.5
0000000000201000 g .data 0000000000000000 __data_start
0000000000000000 w *UND* 0000000000000000 __gmon_start__
0000000000201008 g O .data 0000000000000000 .hidden __dso_handle
00000000000006e0 g O .rodata 0000000000000004 _IO_stdin_used
0000000000000660 g F .text 0000000000000065 __libc_csu_init
0000000000201018 g .bss 0000000000000000 _end
0000000000000530 g F .text 000000000000002b _start
0000000000201010 g .bss 0000000000000000 __bss_start
000000000000063a g F .text 0000000000000017 main
0000000000201010 g O .data 0000000000000000 .hidden __TMC_END__
0000000000000000 w *UND* 0000000000000000 _ITM_registerTMCloneTable
0000000000000000 w F *UND* 0000000000000000 __cxa_finalize@@GLIBC_2.2.5
00000000000004e8 g F .init 0000000000000000 _init
- 可执行部分并反汇编
objdump -d hello
hello： 文件格式 elf64-x86-64
Disassembly of section .init:
00000000000004e8 <_init>:
4e8: 48 83 ec 08 sub $0x8,%rsp
4ec: 48 8b 05 f5 0a 20 00 mov 0x200af5(%rip),%rax # 200fe8 <__gmon_start__>
4f3: 48 85 c0 test %rax,%rax
4f6: 74 02 je 4fa <_init+0x12>
4f8: ff d0 callq *%rax
4fa: 48 83 c4 08 add $0x8,%rsp
4fe: c3 retq
- 所有节反汇编
$ objdump -D hello
hello： 文件格式 elf64-x86-64
Disassembly of section .interp:
0000000000000238 <.interp>:
238: 2f (bad)
239: 6c insb (%dx),%es:(%rdi)
23a: 69 62 36 34 2f 6c 64 imul $0x646c2f34,0x36(%rdx),%esp
241: 2d 6c 69 6e 75 sub $0x756e696c,%eax
246: 78 2d js 275 <_init-0x273>
248: 78 38 js 282 <_init-0x266>
24a: 36 2d 36 34 2e 73 ss sub $0x732e3436,%eax
250: 6f outsl %ds:(%rsi),(%dx)
251: 2e 32 00 xor %cs:(%rax),%al
Disassembly of section .note.ABI-tag:
- 显示所有节的 16 进制内容（可看 got 表）
$ objdump -s hello
hello： 文件格式 elf64-x86-64
Contents of section .interp:
0238 2f6c6962 36342f6c 642d6c69 6e75782d /lib64/ld-linux-
0248 7838362d 36342e73 6f2e3200 x86-64.so.2.
Contents of section .note.ABI-tag:
0254 04000000 10000000 01000000 474e5500 ............GNU.
0264 00000000 03000000 02000000 00000000 ................
- 符号表
objdump -t hello
SYMBOL TABLE:
0000000000000238 l d .interp 0000000000000000 .interp
0000000000000254 l d .note.ABI-tag 0000000000000000 .note.ABI-tag
0000000000000274 l d .note.gnu.build-id 0000000000000000 .note.gnu.build-id
0000000000000298 l d .gnu.hash 0000000000000000 .gnu.hash
00000000000002b8 l d .dynsym 0000000000000000 .dynsym
0000000000000360 l d .dynstr 0000000000000000 .dynstr
00000000000003e2 l d .gnu.version 0000000000000000 .gnu.version
- 动态符号表
$ objdump -T hello
hello： 文件格式 elf64-x86-64
DYNAMIC SYMBOL TABLE:
0000000000000000 w D *UND* 0000000000000000 _ITM_deregisterTMCloneTable
0000000000000000 DF *UND* 0000000000000000 GLIBC_2.2.5 puts
0000000000000000 DF *UND* 0000000000000000 GLIBC_2.2.5 __libc_start_main
0000000000000000 w D *UND* 0000000000000000 __gmon_start__
0000000000000000 w D *UND* 0000000000000000 _ITM_registerTMCloneTable
0000000000000000 w DF *UND* 0000000000000000 GLIBC_2.2.5 __cxa_finalize
- 重定位信息
$ objdump -R hello
hello： 文件格式 elf64-x86-64
DYNAMIC RELOCATION RECORDS
OFFSET TYPE VALUE
0000000000200db8 R_X86_64_RELATIVE *ABS*+0x0000000000000630
0000000000200dc0 R_X86_64_RELATIVE *ABS*+0x00000000000005f0
0000000000201008 R_X86_64_RELATIVE *ABS*+0x0000000000201008
0000000000200fd8 R_X86_64_GLOB_DAT _ITM_deregisterTMCloneTable
0000000000200fe0 R_X86_64_GLOB_DAT __libc_start_main@GLIBC_2.2.5
0000000000200fe8 R_X86_64_GLOB_DAT __gmon_start__
0000000000200ff0 R_X86_64_GLOB_DAT _ITM_registerTMCloneTable
0000000000200ff8 R_X86_64_GLOB_DAT __cxa_finalize@GLIBC_2.2.5
0000000000200fd0 R_X86_64_JUMP_SLOT puts@GLIBC_2.2.5
- 指定节的内容
$ objdump -s -j .got hello
hello： 文件格式 elf64-x86-64
Contents of section .got:
200fb8 c80d2000 00000000 00000000 00000000 .. .............
200fc8 00000000 00000000 16050000 00000000 ................
200fd8 00000000 00000000 00000000 00000000 ................
200fe8 00000000 00000000 00000000 00000000 ................
200ff8 00000000 00000000 ........
readelf
（重复的不要了）
- ELF 头
-h
以后还碰到啥再总结