Skip to content

File format

Image : link.

ELF File format

strip - Remove symbol table and sections.

Remove a section :

$ gcc main.c -o binary
$ objdump -s --section .comment ./binary

./binary:     file format elf64-x86-64

Contents of section .comment:
 0000 4743433a 2028474e 55292031 312e312e  GCC: (GNU) 11.1.
 0010 3000                                 0.
$ strip -R .comment binary
$ objdump -s --section .comment ./binary

./binary:     file format elf64-x86-64

objdump: section '.comment' mentioned in a -j option, but not found in any input file

Removing the Section Headers Table

The section headers table is useful for a reverse engineer because it breaks down the binary’s address space into very specific chunks.

The section headers table isn’t actually needed for execution. You can remove it entirely.

There are four variables from the ELF header that are used to find, parse, and display the section headers table:

  1. Start of sections headers
  2. Size of section headers
  3. Number of section headers
  4. Section header string table index

Little Endian or Big Endian?

The sixth byte is called EI_DATA and it indicates the endianness of the binary.

This field isn't necessary to execute a binary. A system is either little-endian or big-endian (unless its ARM which can be bi-endian). As such, a loader probably doesn't need to check this byte because it can only execute one or the other.

Little endian :

$ gcc test.c -o test
$ readelf -a ./test | head
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              DYN (Shared object file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
$ ./test
I'm still working !!!

Let's manually overwrite the EI_DATA field, to fake a big endian binary :

$ printf '\x02' | dd conv=notrunc of=./test bs=1 seek=5
1+0 records in
1+0 records out
1 byte copied, 3.3036e-05 s, 30.3 kB/s

Testing readelf :

$ readelf -a ./test | head
readelf: Warning: The e_shentsize field in the ELF header is larger than the size of an ELF section header
readelf: Error: Reading 125829120 bytes extends past end of file for section headers
readelf: Error: Section headers are not available!
readelf: Error: Too many program headers - 0xd00 - the file is not that big
readelf: Error: ELF Header:
Too many program headers - 0xd00 - the file is not that big
  Magic:   7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, big endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              <unknown>: 300
  Machine:                           <unknown>: 0x3e00
  Version:                           0x1000000

Testing gdb :

$ gdb ./test
GNU gdb (GDB) 11.1
[...]

For help, type "help".
Type "apropos word" to search for commands related to "word"...
"/tmp/./test": not in executable format: file format not recognized
(gdb) Quit

Testing radare2 :

$ r2 ./test
 -- There is no F5 key in radare2 yet
[0x4010000000000000]> aaa
[af: Cannot find function at 0x4010000000000000try0 (aa)
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Finding and parsing C++ vtables (avrr)
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information (aanr)
[x] Use -AA or aaaa to perform additional experimental analysis.
[0x4010000000000000]> pdf @main
Invalid address (main)
|ERROR| Invalid command 'pdf @main' (0x70)

Executing the binary :

$ ./test
I'm still working !!!

readelf, gdb and radare2 seems to be broken, but the binary is still working.

References

Back to top