Формат ELF изнутри: заголовки, сегменты, секции и загрузка исполняемого файла Linux

file -k binary          # краткое описание, не останавливается на первом совпадении
file --mime-type binary

[HEADING=1]быстрая проверка магии без file(1)[/HEADING]
xxd -l 20 binary

file binary
readelf -h binary          # тип, архитектура, точка входа
readelf -l binary          # сегменты, NX/PIE
readelf -d binary          # зависимости, RPATH (вместо ldd)
checksec --file=binary     # защиты
strings -a -n 8 binary | head -100
nm -D binary               # импорты/экспорты

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <elf.h>

/* Вывод полей ELF header */
static void dump_ehdr(const Elf64_Ehdr *eh) {
    printf("ELF header:\n");
    printf("  Class:      %s\n", eh->e_ident[EI_CLASS] == ELFCLASS64 ? "ELF64" : "ELF32");
    printf("  Data:       %s\n", eh->e_ident[EI_DATA] == ELFDATA2LSB ? "little-endian" : "big-endian");
    printf("  Version:    %u\n", eh->e_ident[EI_VERSION]);
    printf("  OS/ABI:     %u\n", eh->e_ident[EI_OSABI]);
    printf("  Type:       %u\n", eh->e_type);
    printf("  Machine:    %u\n", eh->e_machine);
    printf("  Entry:      0x%lx\n", (unsigned long)eh->e_entry);
    printf("  Phoff:      0x%lx\n", (unsigned long)eh->e_phoff);
    printf("  Shoff:      0x%lx\n", (unsigned long)eh->e_shoff);
    printf("  Phnum:      %u\n", eh->e_phnum);
    printf("  Shnum:      %u\n", eh->e_shnum);
    printf("  Shstrndx:   %u\n", eh->e_shstrndx);
}

/* Вывод program headers */
static void dump_phdrs(const Elf64_Ehdr *eh, const uint8_t *base) {
    if (eh->e_phoff == 0 || eh->e_phnum == 0) {
        printf("No program headers.\n");
        return;
    }
    printf("\nProgram headers:\n");
    printf("%-8s %-10s %-10s %-10s %-10s %-10s %-3s %s\n",
           "Type", "Offset", "VirtAddr", "PhysAddr", "FileSiz", "MemSiz", "Flg", "Align");
    for (int i = 0; i < eh->e_phnum; i++) {
        const Elf64_Phdr *ph = (const Elf64_Phdr *)(base + eh->e_phoff + i * eh->e_phentsize);
        printf("%-8u 0x%-8lx 0x%-8lx 0x%-8lx 0x%-8lx 0x%-8lx %-3x 0x%-2lx\n",
               ph->p_type,
               (unsigned long)ph->p_offset,
               (unsigned long)ph->p_vaddr,
               (unsigned long)ph->p_paddr,
               (unsigned long)ph->p_filesz,
               (unsigned long)ph->p_memsz,
               ph->p_flags,
               (unsigned long)ph->p_align);
    }
}

/* Вывод section headers */
static void dump_shdrs(const Elf64_Ehdr *eh, const uint8_t *base) {
    if (eh->e_shoff == 0 || eh->e_shnum == 0) {
        printf("No section headers.\n");
        return;
    }
    /* Находим строковую таблицу имён секций */
    const Elf64_Shdr *shstr = (const Elf64_Shdr *)(base + eh->e_shoff + eh->e_shstrndx * eh->e_shentsize);
    const char *shstrtab = (const char *)(base + shstr->sh_offset);

    printf("\nSection headers:\n");
    printf("%-20s %-10s %-10s %-10s %-10s %-10s %s\n",
           "Name", "Type", "Addr", "Off", "Size", "Flags", "Link");
    for (int i = 0; i < eh->e_shnum; i++) {
        const Elf64_Shdr *sh = (const Elf64_Shdr *)(base + eh->e_shoff + i * eh->e_shentsize);
        const char *name = (sh->sh_name < shstr->sh_size) ? shstrtab + sh->sh_name : "?";
        printf("%-20s %-10u 0x%-8lx 0x%-8lx 0x%-8lx %-10lx %u\n",
               name,
               sh->sh_type,
               (unsigned long)sh->sh_addr,
               (unsigned long)sh->sh_offset,
               (unsigned long)sh->sh_size,
               (unsigned long)sh->sh_flags,
               sh->sh_link);
    }
}

int main(int argc, char **argv) {
    if (argc != 2) {
        fprintf(stderr, "Usage: %s <elf-file>\n", argv[0]);
        return 1;
    }

    int fd = open(argv[1], O_RDONLY);
    if (fd < 0) {
        perror("open");
        return 1;
    }

    struct stat st;
    if (fstat(fd, &st) != 0) {
        perror("fstat");
        close(fd);
        return 1;
    }

    uint8_t *base = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
    if (base == MAP_FAILED) {
        perror("mmap");
        close(fd);
        return 1;
    }

    /* Проверка магии */
    if (st.st_size < EI_NIDENT || memcmp(base, ELFMAG, SELFMAG) != 0) {
        fprintf(stderr, "Not an ELF file.\n");
        munmap(base, st.st_size);
        close(fd);
        return 1;
    }

    /* Определяем класс и используем соответствующие структуры */
    if (base[EI_CLASS] == ELFCLASS64) {
        const Elf64_Ehdr *eh = (const Elf64_Ehdr *)base;
        dump_ehdr(eh);
        dump_phdrs(eh, base);
        dump_shdrs(eh, base);
    } else if (base[EI_CLASS] == ELFCLASS32) {
        /* Для 32-битных можно аналогично использовать Elf32_* структуры */
        const Elf32_Ehdr *eh = (const Elf32_Ehdr *)base;
        printf("ELF32 header:\n");
        printf("  Entry: 0x%x\n", eh->e_entry);
        printf("  Phnum: %u, Shnum: %u\n", eh->e_phnum, eh->e_shnum);
        /* Здесь можно добавить полный вывод, но для краткости пропустим */
    } else {
        fprintf(stderr, "Unknown ELF class.\n");
    }

    munmap(base, st.st_size);
    close(fd);
    return 0;
}

gcc -o elfparse elfparse.c
./elfparse /usr/bin/ls