热门标签 | HotTags
当前位置:  开发笔记 > 编程语言 > 正文

AndroidSO文件结构及readelf命令

0x00AndroidSO文件结构so文件结构详细的分析,请看Android逆向之旅---SO(ELF)文件格式详解,这里就不重复造车轮子了。我们待分析的so已经上传到cs

   0x00 Android SO 文件结构

    so文件结构详细的分析,请看Android逆向之旅---SO(ELF)文件格式详解,这里就不重复造车轮子了。

    我们待分析的so已经上传到csdn,下载地址:http://download.csdn.net/detail/jltxgcy/9602803。


   0x01 readelf命令

   1.1 so文件整体图

   


    1.2 readelf文件位置

    Android下readelf位于android-ndk-r12/toolchains/arm-linux-androideabi-4.9/prebuilt/darwin-x86_64/bin中,文件名称为arm-linux-androideabi-readelf


    1.3 read ELF Header    

    arm-linux-androideabi-readelf -h ~/Public/libPLTUtils.so

ELF Header:  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
Class: ELF32
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: DYN (Shared object file)
Machine: ARM
Version: 0x1
Entry point address: 0x0
Start of program headers: 52 (bytes into file)
Start of section headers: 12664 (bytes into file)
Flags: 0x5000200, Version5 EABI, soft-float ABI
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 9
Size of section headers: 40 (bytes)
Number of section headers: 26
Section header string table index: 25

    

    1.4 read Program Header

    arm-linux-androideabi-readelf -l ~/Public/libPLTUtils.so 

Elf file type is DYN (Shared object file)Entry point 0x0There are 9 program headers, starting at offset 52Program Headers:  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align  PHDR           0x000034 0x00000034 0x00000034 0x00120 0x00120 R   0x4  INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1      [Requesting program interpreter: /system/bin/linker]  LOAD           0x000000 0x00000000 0x00000000 0x0246a 0x0246a R E 0x1000  LOAD           0x002e80 0x00003e80 0x00003e80 0x00188 0x00188 RW  0x1000  DYNAMIC        0x002e8c 0x00003e8c 0x00003e8c 0x00128 0x00128 RW  0x4  NOTE           0x000168 0x00000168 0x00000168 0x00024 0x00024 R   0x4  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0  EXIDX          0x002304 0x00002304 0x00002304 0x00100 0x00100 R   0x4  GNU_RELRO      0x002e80 0x00003e80 0x00003e80 0x00180 0x00180 RW  0x4 Section to Segment mapping:  Segment Sections...   00        01     .interp    02     .interp .note.gnu.build-id .dynsym .dynstr .hash .gnu.version .gnu.version_d .gnu.version_r .rel.dyn .rel.plt .plt .text .ARM.extab .ARM.exidx .rodata    03     .fini_array .init_array .dynamic .got .data    04     .dynamic    05     .note.gnu.build-id    06        07     .ARM.exidx    08     .fini_array .init_array .dynamic .got

    1.5 read Section Header

There are 26 section headers, starting at offset 0x3178:Section Headers:  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al  [ 0]                   NULL            00000000 000000 000000 00      0   0  0  [ 1] .interp           PROGBITS        00000154 000154 000013 00   A  0   0  1  [ 2] .note.gnu.build-i NOTE            00000168 000168 000024 00   A  0   0  4  [ 3] .dynsym           DYNSYM          0000018c 00018c 000390 10   A  4   1  4  [ 4] .dynstr           STRTAB          0000051c 00051c 0004d7 00   A  0   0  1  [ 5] .hash             HASH            000009f4 0009f4 000180 04   A  3   0  4  [ 6] .gnu.version      VERSYM          00000b74 000b74 000072 02   A  3   0  2  [ 7] .gnu.version_d    VERDEF          00000be8 000be8 00001c 00   A  4   1  4  [ 8] .gnu.version_r    VERNEED         00000c04 000c04 000020 00   A  4   1  4  [ 9] .rel.dyn          REL             00000c24 000c24 000050 08   A  3   0  4  [10] .rel.plt          REL             00000c74 000c74 000040 08  AI  3  11  4  [11] .plt              PROGBITS        00000cb4 000cb4 000074 00  AX  0   0  4  [12] .text             PROGBITS        00000d28 000d28 0015a0 00  AX  0   0  4  [13] .ARM.extab        PROGBITS        000022c8 0022c8 00003c 00   A  0   0  4  [14] .ARM.exidx        ARM_EXIDX       00002304 002304 000100 08  AL 12   0  4  [15] .rodata           PROGBITS        00002404 002404 000066 01 AMS  0   0  1  [16] .fini_array       FINI_ARRAY      00003e80 002e80 000008 00  WA  0   0  4  [17] .init_array       INIT_ARRAY      00003e88 002e88 000004 00  WA  0   0  1  [18] .dynamic          DYNAMIC         00003e8c 002e8c 000128 08  WA  4   0  4  [19] .got              PROGBITS        00003fb4 002fb4 00004c 00  WA  0   0  4  [20] .data             PROGBITS        00004000 003000 000008 00  WA  0   0  4  [21] .bss              NOBITS          00004008 003008 000000 00  WA  0   0  1  [22] .comment          PROGBITS        00000000 003008 000028 01  MS  0   0  1  [23] .note.gnu.gold-ve NOTE            00000000 003030 00001c 00      0   0  4  [24] .ARM.attributes   ARM_ATTRIBUTES  00000000 00304c 00002b 00      0   0  1  [25] .shstrtab         STRTAB          00000000 003077 0000fe 00      0   0  1Key to Flags:  W (write), A (alloc), X (execute), M (merge), S (strings)  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)  O (extra OS processing required) o (OS specific), p (processor specific)
    这里我们看到从.fini_array段开始虚拟地址都比文件偏移增加了0x1000, 与此对应的是Program Header的第三个段,Load段,也是以.fini_array为开始,并且虚拟地址也比文件偏移增加了0x1000。
 

    1.6 Section Actual Data

    这里面是放1.4提到的25个段的实际数据。

  

    1.7 read Dynamic Setion Actual Data

    arm-linux-androideabi-readelf -d ~/Public/libPLTUtils.so

Dynamic section at offset 0x2e8c contains 32 entries:  Tag        Type                         Name/Value 0x00000003 (PLTGOT)                     0x3fd4 0x00000002 (PLTRELSZ)                   64 (bytes) 0x00000017 (JMPREL)                     0xc74 0x00000014 (PLTREL)                     REL 0x00000011 (REL)                        0xc24 0x00000012 (RELSZ)                      80 (bytes) 0x00000013 (RELENT)                     8 (bytes) 0x6ffffffa (RELCOUNT)                   7 0x00000006 (SYMTAB)                     0x18c 0x0000000b (SYMENT)                     16 (bytes) 0x00000005 (STRTAB)                     0x51c 0x0000000a (STRSZ)                      1239 (bytes) 0x00000004 (HASH)                       0x9f4 0x00000001 (NEEDED)                     Shared library: [liblog.so] 0x00000001 (NEEDED)                     Shared library: [libdl.so] 0x00000001 (NEEDED)                     Shared library: [libstdc++.so] 0x00000001 (NEEDED)                     Shared library: [libm.so] 0x00000001 (NEEDED)                     Shared library: [libc.so] 0x0000000e (SONAME)                     Library soname: [libPLTUtils.so] 0x0000001a (FINI_ARRAY)                 0x3e80 0x0000001c (FINI_ARRAYSZ)               8 (bytes) 0x00000019 (INIT_ARRAY)                 0x3e88 0x0000001b (INIT_ARRAYSZ)               4 (bytes) 0x00000010 (SYMBOLIC)                   0x0 0x0000001e (FLAGS)                      SYMBOLIC BIND_NOW 0x6ffffffb (FLAGS_1)                    Flags: NOW 0x6ffffff0 (VERSYM)                     0xb74 0x6ffffffc (VERDEF)                     0xbe8 0x6ffffffd (VERDEFNUM)                  1 0x6ffffffe (VERNEED)                    0xc04 0x6fffffff (VERNEEDNUM)                 1 0x00000000 (NULL)                       0x0
    关于Dynamic Section字段的含义,详细请参考 http://download.csdn.net/detail/jiangwei0910410003/9204051。


    1.8 read Dynsym Section Actual Data

    arm-linux-androideabi-readelf -s ~/Public/libPLTUtils.so

Symbol table '.dynsym' contains 57 entries:   Num:    Value  Size Type    Bind   Vis      Ndx Name     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND      1: 00000000     0 FUNC    GLOBAL DEFAULT  UND __cxa_finalize@LIBC (2)     2: 00000000     0 FUNC    GLOBAL DEFAULT  UND __cxa_atexit@LIBC (2)     3: 00000d65    52 FUNC    GLOBAL DEFAULT   12 Java_com_example_ndkplt_P     4: 00000000     0 FUNC    GLOBAL DEFAULT  UND puts@LIBC (2)     5: 00004004     4 OBJECT  GLOBAL DEFAULT   20 global_fun     6: 00001904     8 FUNC    WEAK   DEFAULT   12 __aeabi_unwind_cpp_pr1     7: 000018fc     8 FUNC    GLOBAL DEFAULT   12 __aeabi_unwind_cpp_pr0     8: 0000190c     8 FUNC    WEAK   DEFAULT   12 __aeabi_unwind_cpp_pr2     9: 00000000     0 FUNC    WEAK   DEFAULT  UND __gnu_Unwind_Find_exidx    10: 00001ca4     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Restore_VFP_    11: 00001c94     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Restore_VFP    12: 00001cb4     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Restore_VFP_    13: 00001cc4     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Restore_WMMX    14: 00001d4c     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Restore_WMMX    15: 00000000     0 FUNC    GLOBAL DEFAULT  UND abort@LIBC (2)    16: 00001c80    20 FUNC    GLOBAL DEFAULT   12 restore_core_regs    17: 00000000     0 FUNC    GLOBAL DEFAULT  UND memcpy@LIBC (2)    18: 000011c0     8 FUNC    GLOBAL DEFAULT   12 _Unwind_GetCFA    19: 000011c8   164 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_RaiseExcepti    20: 0000126c    28 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_ForcedUnwind    21: 00001288   116 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Resume    22: 000012fc    32 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Resume_or_Re    23: 0000131c     4 FUNC    GLOBAL DEFAULT   12 _Unwind_Complete    24: 00001320    24 FUNC    GLOBAL DEFAULT   12 _Unwind_DeleteException    25: 00001338    92 FUNC    GLOBAL DEFAULT   12 _Unwind_VRS_Get    26: 000013bc    92 FUNC    GLOBAL DEFAULT   12 _Unwind_VRS_Set    27: 00001444   200 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Backtrace    28: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __cxa_begin_cleanup    29: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __cxa_type_match    30: 00001eb4   904 FUNC    GLOBAL DEFAULT   12 __gnu_unwind_execute    31: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __cxa_call_unexpected    32: 00001914   876 FUNC    GLOBAL DEFAULT   12 _Unwind_VRS_Pop    33: 00001cac     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Save_VFP_D    34: 00001c9c     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Save_VFP    35: 00001cbc     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Save_VFP_D_1    36: 00001d08     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Save_WMMXD    37: 00001d60     0 FUNC    GLOBAL DEFAULT   12 __gnu_Unwind_Save_WMMXC    38: 00001c80    20 FUNC    GLOBAL DEFAULT   12 __restore_core_regs    39: 00001d74    36 FUNC    GLOBAL DEFAULT   12 ___Unwind_RaiseException    40: 00001d74    36 FUNC    GLOBAL DEFAULT   12 _Unwind_RaiseException    41: 00001d98    36 FUNC    GLOBAL DEFAULT   12 ___Unwind_Resume    42: 00001d98    36 FUNC    GLOBAL DEFAULT   12 _Unwind_Resume    43: 00001dbc    36 FUNC    GLOBAL DEFAULT   12 ___Unwind_Resume_or_Rethr    44: 00001dbc    36 FUNC    GLOBAL DEFAULT   12 _Unwind_Resume_or_Rethrow    45: 00001de0    36 FUNC    GLOBAL DEFAULT   12 ___Unwind_ForcedUnwind    46: 00001de0    36 FUNC    GLOBAL DEFAULT   12 _Unwind_ForcedUnwind    47: 00001e04    36 FUNC    GLOBAL DEFAULT   12 ___Unwind_Backtrace    48: 00001e04    36 FUNC    GLOBAL DEFAULT   12 _Unwind_Backtrace    49: 0000223c    64 FUNC    GLOBAL DEFAULT   12 __gnu_unwind_frame    50: 0000227c    16 FUNC    GLOBAL DEFAULT   12 _Unwind_GetRegionStart    51: 0000228c    28 FUNC    GLOBAL DEFAULT   12 _Unwind_GetLanguageSpecif    52: 000022a8     8 FUNC    GLOBAL DEFAULT   12 _Unwind_GetDataRelBase    53: 000022b0     8 FUNC    GLOBAL DEFAULT   12 _Unwind_GetTextRelBase    54: 00004008     0 NOTYPE  GLOBAL DEFAULT  ABS _edata    55: 00004008     0 NOTYPE  GLOBAL DEFAULT  ABS __bss_start    56: 00004008     0 NOTYPE  GLOBAL DEFAULT  ABS _end
     关于DynSym Section字段的含义,详细请参考 http://download.csdn.net/detail/jiangwei0910410003/9204051


    1.9 Dynstr Section和Shstrtab Section Actual Data

    Dynstr Section的实际数据是Dynsym Setion Actual Data中的函数名组成的字符表。

    而Shstrtab则是Section Header中的每个setion名字组成的字符表。


    2.0 read Relocation Section

    arm-linux-androideabi-readelf -r ~/Public/libPLTUtils.so

Relocation section '.rel.dyn' at offset 0xc24 contains 10 entries: Offset     Info    Type            Sym.Value  Sym. Name00003e80  00000017 R_ARM_RELATIVE   00003fb4  00000017 R_ARM_RELATIVE   00003fb8  00000017 R_ARM_RELATIVE   00003fbc  00000017 R_ARM_RELATIVE   00003fc0  00000017 R_ARM_RELATIVE   00003fc8  00000017 R_ARM_RELATIVE   00003fcc  00000017 R_ARM_RELATIVE   00004004  00000402 R_ARM_ABS32       00000000   puts00003fc4  00000915 R_ARM_GLOB_DAT    00000000   __gnu_Unwind_Find_exid00003fd0  00001f15 R_ARM_GLOB_DAT    00000000   __cxa_call_unexpectedRelocation section '.rel.plt' at offset 0xc74 contains 8 entries: Offset     Info    Type            Sym.Value  Sym. Name00003fe0  00000216 R_ARM_JUMP_SLOT   00000000   __cxa_atexit00003fe4  00000116 R_ARM_JUMP_SLOT   00000000   __cxa_finalize00003fe8  00000416 R_ARM_JUMP_SLOT   00000000   puts00003fec  00000916 R_ARM_JUMP_SLOT   00000000   __gnu_Unwind_Find_exid00003ff0  00000f16 R_ARM_JUMP_SLOT   00000000   abort00003ff4  00001116 R_ARM_JUMP_SLOT   00000000   memcpy00003ff8  00001c16 R_ARM_JUMP_SLOT   00000000   __cxa_begin_cleanup00003ffc  00001d16 R_ARM_JUMP_SLOT   00000000   __cxa_type_match

    2.1 read Text Section

    ./arm-linux-androideabi-objdump -d ~/Public/libPLTUtils.so



推荐阅读
author-avatar
云上的浮游_154
这个家伙很懒,什么也没留下!
PHP1.CN | 中国最专业的PHP中文社区 | DevBox开发工具箱 | json解析格式化 |PHP资讯 | PHP教程 | 数据库技术 | 服务器技术 | 前端开发技术 | PHP框架 | 开发工具 | 在线工具
Copyright © 1998 - 2020 PHP1.CN. All Rights Reserved | 京公网安备 11010802041100号 | 京ICP备19059560号-4 | PHP1.CN 第一PHP社区 版权所有