Readelf

From aldeid
Jump to navigation Jump to search

Description

Display information about the contents of ELF format files

Usage

Syntax

readelf <option(s)> elf-file(s)

Options

-a --all
Equivalent to: -h -l -S -s -r -d -V -A -I
-h --file-header
Display the ELF file header
-l --program-headers
Display the program headers
--segments
An alias for --program-headers
-S --section-headers
Display the sections' header
--sections
An alias for --section-headers
-g --section-groups
Display the section groups
-t --section-details
Display the section details
-e --headers
Equivalent to: -h -l -S
-s --syms
Display the symbol table
--symbols
An alias for --syms
--dyn-syms
Display the dynamic symbol table
-n --notes
Display the core notes (if present)
-r --relocs
Display the relocations (if present)
-u --unwind
Display the unwind info (if present)
-d --dynamic
Display the dynamic section (if present)
-V --version-info
Display the version sections (if present)
-A --arch-specific
Display architecture specific information (if any)
-c --archive-index
Display the symbol/file index in an archive
-D --use-dynamic
Use the dynamic section info when displaying symbols
-x --hex-dump=<number|name>
Dump the contents of section <number|name> as bytes
-p --string-dump=<number|name>
Dump the contents of section <number|name> as strings
-R --relocated-dump=<number|name>
Dump the contents of section <number|name> as relocated bytes
-z --decompress
Decompress section before dumping it
-w[lLiaprmfFsoRtUuTgAckK] or
--debug-dump[=rawline,=decodedline,=info,=abbrev,=pubnames,=aranges,=macro,=frames,
=frames-interp,=str,=loc,=Ranges,=pubtypes,
=gdb_index,=trace_info,=trace_abbrev,=trace_aranges,
=addr,=cu_index,=links,=follow-links]
Display the contents of DWARF debug sections
--dwarf-depth=N
Do not display DIEs at depth N or greater
--dwarf-start=N
Display DIEs starting with N, at the same depth or deeper
--ctf=<number|name>
Display CTF info from section <number|name>
--ctf-parent=<number|name>
Use section <number|name> as the CTF parent
--ctf-symbols=<number|name>
Use section <number|name> as the CTF external symtab
--ctf-strings=<number|name>
Use section <number|name> as the CTF external strtab
-I --histogram
Display histogram of bucket list lengths
-W --wide
Allow output width to exceed 80 characters
@<file>
Read options from <file>
-H --help
Display this information
-v --version
Display the version number of readelf

Examples

$ readelf -h vuln 
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x80484d0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          6504 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         9
  Size of section headers:           40 (bytes)
  Number of section headers:         31
  Section header string table index: 28

$ readelf -s vuln 

Symbol table '.dynsym' contains 14 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 00000000     0 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.0 (2)
     2: 00000000     0 FUNC    GLOBAL DEFAULT  UND gets@GLIBC_2.0 (2)
     3: 00000000     0 FUNC    GLOBAL DEFAULT  UND fgets@GLIBC_2.0 (2)
     4: 00000000     0 FUNC    GLOBAL DEFAULT  UND getegid@GLIBC_2.0 (2)
     5: 00000000     0 FUNC    GLOBAL DEFAULT  UND puts@GLIBC_2.0 (2)
     6: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
     7: 00000000     0 FUNC    GLOBAL DEFAULT  UND exit@GLIBC_2.0 (2)
     8: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.0 (2)
     9: 00000000     0 FUNC    GLOBAL DEFAULT  UND setvbuf@GLIBC_2.0 (2)
    10: 00000000     0 FUNC    GLOBAL DEFAULT  UND fopen@GLIBC_2.1 (3)
    11: 00000000     0 FUNC    GLOBAL DEFAULT  UND setresgid@GLIBC_2.0 (2)
    12: 0804a03c     4 OBJECT  GLOBAL DEFAULT   26 stdout@GLIBC_2.0 (2)
    13: 0804874c     4 OBJECT  GLOBAL DEFAULT   16 _IO_stdin_used

Symbol table '.symtab' contains 81 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND 
     1: 08048154     0 SECTION LOCAL  DEFAULT    1 
     2: 08048168     0 SECTION LOCAL  DEFAULT    2 
     3: 08048188     0 SECTION LOCAL  DEFAULT    3 
     4: 080481ac     0 SECTION LOCAL  DEFAULT    4 
     5: 080481d0     0 SECTION LOCAL  DEFAULT    5 
     6: 080482b0     0 SECTION LOCAL  DEFAULT    6 
     7: 0804833e     0 SECTION LOCAL  DEFAULT    7 
     8: 0804835c     0 SECTION LOCAL  DEFAULT    8 
     9: 0804838c     0 SECTION LOCAL  DEFAULT    9 
    10: 0804839c     0 SECTION LOCAL  DEFAULT   10 
    11: 080483ec     0 SECTION LOCAL  DEFAULT   11 
    12: 08048410     0 SECTION LOCAL  DEFAULT   12 
    13: 080484c0     0 SECTION LOCAL  DEFAULT   13 
    14: 080484d0     0 SECTION LOCAL  DEFAULT   14 
    15: 08048734     0 SECTION LOCAL  DEFAULT   15 
    16: 08048748     0 SECTION LOCAL  DEFAULT   16 
    17: 0804882c     0 SECTION LOCAL  DEFAULT   17 
    18: 08048868     0 SECTION LOCAL  DEFAULT   18 
    19: 08049f08     0 SECTION LOCAL  DEFAULT   19 
    20: 08049f0c     0 SECTION LOCAL  DEFAULT   20 
    21: 08049f10     0 SECTION LOCAL  DEFAULT   21 
    22: 08049f14     0 SECTION LOCAL  DEFAULT   22 
    23: 08049ffc     0 SECTION LOCAL  DEFAULT   23 
    24: 0804a000     0 SECTION LOCAL  DEFAULT   24 
    25: 0804a034     0 SECTION LOCAL  DEFAULT   25 
    26: 0804a03c     0 SECTION LOCAL  DEFAULT   26 
    27: 00000000     0 SECTION LOCAL  DEFAULT   27 
    28: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    29: 08049f10     0 OBJECT  LOCAL  DEFAULT   21 __JCR_LIST__
    30: 08048510     0 FUNC    LOCAL  DEFAULT   14 deregister_tm_clones
    31: 08048540     0 FUNC    LOCAL  DEFAULT   14 register_tm_clones
    32: 08048580     0 FUNC    LOCAL  DEFAULT   14 __do_global_dtors_aux
    33: 0804a040     1 OBJECT  LOCAL  DEFAULT   26 completed.7209
    34: 08049f0c     0 OBJECT  LOCAL  DEFAULT   20 __do_global_dtors_aux_fin
    35: 080485a0     0 FUNC    LOCAL  DEFAULT   14 frame_dummy
    36: 08049f08     0 OBJECT  LOCAL  DEFAULT   19 __frame_dummy_init_array_
    37: 00000000     0 FILE    LOCAL  DEFAULT  ABS vuln.c
    38: 00000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    39: 08048970     0 OBJECT  LOCAL  DEFAULT   18 __FRAME_END__
    40: 08049f10     0 OBJECT  LOCAL  DEFAULT   21 __JCR_END__
    41: 00000000     0 FILE    LOCAL  DEFAULT  ABS 
    42: 08049f0c     0 NOTYPE  LOCAL  DEFAULT   19 __init_array_end
    43: 08049f14     0 OBJECT  LOCAL  DEFAULT   22 _DYNAMIC
    44: 08049f08     0 NOTYPE  LOCAL  DEFAULT   19 __init_array_start
    45: 0804882c     0 NOTYPE  LOCAL  DEFAULT   17 __GNU_EH_FRAME_HDR
    46: 0804a000     0 OBJECT  LOCAL  DEFAULT   24 _GLOBAL_OFFSET_TABLE_
    47: 08048730     2 FUNC    GLOBAL DEFAULT   14 __libc_csu_fini
    48: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
    49: 08048500     4 FUNC    GLOBAL HIDDEN    14 __x86.get_pc_thunk.bx
    50: 0804a034     0 NOTYPE  WEAK   DEFAULT   25 data_start
    51: 00000000     0 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.0
    52: 00000000     0 FUNC    GLOBAL DEFAULT  UND gets@@GLIBC_2.0
    53: 0804862f    46 FUNC    GLOBAL DEFAULT   14 vuln
    54: 00000000     0 FUNC    GLOBAL DEFAULT  UND fgets@@GLIBC_2.0
    55: 0804a03c     0 NOTYPE  GLOBAL DEFAULT   25 _edata
    56: 08048734     0 FUNC    GLOBAL DEFAULT   15 _fini
    57: 00000000     0 FUNC    GLOBAL DEFAULT  UND getegid@@GLIBC_2.0
    58: 080486c0     0 NOTYPE  GLOBAL DEFAULT   14 get_return_address
    59: 0804a034     0 NOTYPE  GLOBAL DEFAULT   25 __data_start
    60: 00000000     0 FUNC    GLOBAL DEFAULT  UND puts@@GLIBC_2.0
    61: 00000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    62: 00000000     0 FUNC    GLOBAL DEFAULT  UND exit@@GLIBC_2.0
    63: 0804a038     0 OBJECT  GLOBAL HIDDEN    25 __dso_handle
    64: 0804874c     4 OBJECT  GLOBAL DEFAULT   16 _IO_stdin_used
    65: 00000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
    66: 080486d0    93 FUNC    GLOBAL DEFAULT   14 __libc_csu_init
    67: 080485cb   100 FUNC    GLOBAL DEFAULT   14 win
    68: 00000000     0 FUNC    GLOBAL DEFAULT  UND setvbuf@@GLIBC_2.0
    69: 00000000     0 FUNC    GLOBAL DEFAULT  UND fopen@@GLIBC_2.1
    70: 0804a044     0 NOTYPE  GLOBAL DEFAULT   26 _end
    71: 080484d0     0 FUNC    GLOBAL DEFAULT   14 _start
    72: 08048748     4 OBJECT  GLOBAL DEFAULT   16 _fp_hw
    73: 0804a03c     4 OBJECT  GLOBAL DEFAULT   26 stdout@@GLIBC_2.0
    74: 0804a03c     0 NOTYPE  GLOBAL DEFAULT   26 __bss_start
    75: 0804865d    99 FUNC    GLOBAL DEFAULT   14 main
    76: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _Jv_RegisterClasses
    77: 0804a03c     0 OBJECT  GLOBAL HIDDEN    25 __TMC_END__
    78: 00000000     0 FUNC    GLOBAL DEFAULT  UND setresgid@@GLIBC_2.0
    79: 00000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
    80: 080483ec     0 FUNC    GLOBAL DEFAULT   11 _init
Retrieved from "https://www.aldeid.com/w/index.php?title=Readelf&oldid=34762"