ubuntu 理解elf 文件

1. 使用gcc 编译好*.o目标文件和可执行文件*

以以下代码测试：

administrator@ubuntu:~/workspace/MakefileTest/src$gcc MakefileTest.c -c -o MakefileTest.o
administrator@ubuntu:~/workspace/MakefileTest/src$ ls
MakefileTest.c  MakefileTest.o

administrator@ubuntu:~/workspace/MakefileTest/src$ gcc MakefileTest.c -o MakefileTest
administrator@ubuntu:~/workspace/MakefileTest/src$ ls
MakefileTest  MakefileTest.c  MakefileTest.o

MakefileTest.c
/*
 ============================================================================
 Name        : MakefileTest.c
 Author      : Chen Qiang
 Version     :
 Copyright   : Your copyright notice
 Description : Hello World in C, Ansi-style
 ============================================================================
 */

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    puts("!!!Hello World!!!"); /* prints !!!Hello World!!! */
    return EXIT_SUCCESS;
}

2. 可以用file命令，显示编译器生成的两个ELF文件的信息，一个是可执行文件，另一个是可重定向文件。

administrator@ubuntu:~/workspace/MakefileTest/src$file MakefileTest.o
MakefileTest.o: ELF 32-bit LSB relocatable, Intel 80386, version 1 (SYSV), not stripped
administrator@ubuntu:~/workspace/MakefileTest/src$ file MakefileTest
MakefileTest: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xe63ff86032ae5dfd3da5bd613b2563ba405d3a2c, not stripped

3. ELF的详细信息查看工具readelf

administrator@ubuntu:~/workspace/MakefileTest/src$readelf --help
Usage: readelf <option(s)> elf-file(s)
 Display information about the contents of ELF format files
 Options are:
  -a --all               Equivalent to: -h -l -S -s -r -d -V -A -I
  -h --file-header       Display the ELF file header
  -l --program-headers   Display the program headers
     --segments          An alias for --program-headers
  -S --section-headers   Display the sections' header
     --sections          An alias for --section-headers
  -g --section-groups    Display the section groups
  -t --section-details   Display the section details
  -e --headers           Equivalent to: -h -l -S
  -s --syms              Display the symbol table
     --symbols           An alias for --syms
  --dyn-syms             Display the dynamic symbol table
  -n --notes             Display the core notes (if present)
  -r --relocs            Display the relocations (if present)
  -u --unwind            Display the unwind info (if present)
  -d --dynamic           Display the dynamic section (if present)
  -V --version-info      Display the version sections (if present)
  -A --arch-specific     Display architecture specific information (if any).
  -c --archive-index     Display the symbol/file index in an archive
  -D --use-dynamic       Use the dynamic section info when displaying symbols
  -x --hex-dump=<number|name>
                         Dump the contents of section <number|name> as bytes
  -p --string-dump=<number|name>
                         Dump the contents of section <number|name> as strings
  -R --relocated-dump=<number|name>
                         Dump the contents of section <number|name> as relocated bytes
  -w[lLiaprmfFsoRt] or
  --debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,
               =frames-interp,=str,=loc,=Ranges,=pubtypes,
               =gdb_index,=trace_info,=trace_abbrev,=trace_aranges]
                         Display the contents of DWARF2 debug sections
  --dwarf-depth=N        Do not display DIEs at depth N or greater
  --dwarf-start=N        Display DIEs starting with N, at the same depth
                         or deeper
  -I --histogram         Display histogram of bucket list lengths
  -W --wide              Allow output width to exceed 80 characters
  @<file>                Read options from <file>
  -H --help              Display this information
  -v --version           Display the version number of readelf
Report bugs to <http://www.sourceware.org/bugzilla/>

administrator@ubuntu:~/workspace/MakefileTest/src$ readelf -l MakefileTest

Elf file type is EXEC (Executable file)
Entry point 0x8048320
There are 9 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x08048034 0x08048034 0x00120 0x00120 R E 0x4
  INTERP         0x000154 0x08048154 0x08048154 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x08048000 0x08048000 0x005cc 0x005cc R E 0x1000
  LOAD           0x000f14 0x08049f14 0x08049f14 0x00100 0x00108 RW  0x1000
  DYNAMIC        0x000f28 0x08049f28 0x08049f28 0x000c8 0x000c8 RW  0x4
  NOTE           0x000168 0x08048168 0x08048168 0x00044 0x00044 R   0x4
  GNU_EH_FRAME   0x0004d4 0x080484d4 0x080484d4 0x00034 0x00034 R   0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4
  GNU_RELRO      0x000f14 0x08049f14 0x08049f14 0x000ec 0x000ec R   0x1

 Section to Segment mapping:
  Segment Sections...
   00     
   01     .interp
   02     .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
   03     .ctors .dtors .jcr .dynamic .got .got.plt .data .bss
   04     .dynamic
   05     .note.ABI-tag .note.gnu.build-id
   06     .eh_frame_hdr
   07     
   08     .ctors .dtors .jcr .dynamic .got

4. 通过nm工具查看符号表：

符号表是每个ELF文件的一个重要部分，因为它保存了程序实现或使用的所有（全局变量）和函数。 如果程序引用了一个自身代码未定义的符号，则称之为未定义符号（例如printf函数，就是定义在C 标准库中）。此类引用必须在静态链接期间调用其他目标模块或库解决，或在加载时间通过动态链接（使用ld-linux.so）解决。 nm工具可生成程序定义和使用的所有符号列表, --------->终于明白了静态库和动态库的区别了^_^

administrator@ubuntu:~/workspace/MakefileTest/src$nm MakefileTest.o
00000000 T main
         U puts