ELF, Compile, and make/makefile

Executable and Linkable Format (ELF)

An ELF file, once the command objdump is called, provides information about the ELF object. It will provide a structure of for binaries, libraries, and core files. These information include file format, memory addresses, disassembly section, instructions called, and bits per instruction in hex format. As an experiment, using Aarch64, I went and used the objdump –source hello | less (which is the object created using Makefile) and jumped to main (typed in /main).

0000000000000764 <main>:
/* Hello World in traditional C using printf() */

#include <stdio.h>

int main() {
 764:   a9bf7bfd        stp     x29, x30, [sp, #-16]!
 768:   910003fd        mov     x29, sp
        printf("Hello World!\n");
 76c:   90000000        adrp    x0, 0 <_init-0x5d0>
 770:   9120a000        add     x0, x0, #0x828
 774:   97ffffb7        bl      650 <printf@plt>
 778:   52800000        mov     w0, #0x0                        // #0
}
 77c:   a8c17bfd        ldp     x29, x30, [sp], #16
 780:   d65f03c0        ret
 784:   d503201f        nop

Breakdown of objdump –source hello

As seen above, this is the opcode for a simple Hello World program in C. On line 7, we see a9bf7bfd. This is a 64-bit instruction set that is encoded as a 32-bit fixed-length instruction. Following the 32-bit instruction set, are the opcodes used such as mov, add, and bl. I also want to point out line 12, at the end of the code we see <printf@plt>. When we ran the objdump command on our hello world program, we were able to get information on our object and the code (dependencies required) to run this program. The @plt (procedure linkage table) represents the external libraries that the ELF file linked to get the printf command from the standard c library.

Conclusion

In conclusion, learning about ELF binaries and how to work with them can help provide valuable information such as the size. There are pros and cons of static and dynamic ELF binaries where static might be bigger, but are more portable.