1.在顶楼我向各位高手大虾求救的问题已经解决,同时我也说明了如何解决是什么原因,在这里再次谢过。后面是在讨论顶楼问题的引伸:500k代码是什么?不是elf和pe谁更优?也不是做事应以何种态度的问题?sinanjj请不要再试途来证明这些问题谁是谁非。对于这些问题如果有兴趣可以另外再讨论。同时愿你早日康复 2。对于pe和elf在前面我已经承认我并不了解,对于500k是什么这个问题的观点只是基于经验的推测,我确实拿不出直接的证据去证实500K里都是些什么东西?我想sinanjj斑竹(这个刚刚注意到)同样拿不出直接的证据去证实500k就是你说的elf信息,23楼的代码我并不清楚你想要说明什么问题。但是这些数据都实实在在的在那里只要分析一下就可以知道真相,所以今天特别拿出一的时间去看了一下有关elf的文档(很遗憾这并不能为我的米缸里增加点米),并readelf工具分析了一下动态链接和静态链接的文件.以直接证明500k不是elf信息,是代码和数据。 代码t.c如下: #include <stdio.h> int main() { int i,j; for(j=0,i = 0; i < 100; i++) j+=i; return 0; } gcc -static -o ts t.c gcc -o ts t.c //动态链接td的Section Headers信息 readelf -S td There are 36 section headers, starting at offset 0xc74:
Section Headers: [Nr] Name Type Addr Off Size ES ** Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .interp PROGBITS 08048114 000114 000013 00 A 0 0 1 [ 2] .note.ABI-tag NOTE 08048128 000128 000020 00 A 0 0 4 [ 3] .hash HASH 08048148 000148 000024 04 A 5 0 4 [ 4] .gnu.hash GNU_HASH 0804816c 00016c 000020 04 A 5 0 4 [ 5] .dynsym DYNSYM 0804818c 00018c 000040 10 A 6 1 4 [ 6] .dynstr STRTAB 080481cc 0001cc 000045 00 A 0 0 1 [ 7] .gnu.version VERSYM 08048212 000212 000008 02 A 5 0 2 [ 8] .gnu.version_r VERNEED 0804821c 00021c 000020 00 A 6 1 4 [ 9] .rel.dyn REL 0804823c 00023c 000008 08 A 5 0 4 [10] .rel.plt REL 08048244 000244 000010 08 A 5 12 4 [11] .init PROGBITS 08048254 000254 000030 00 AX 0 0 4 [12] .plt PROGBITS 08048284 000284 000030 04 AX 0 0 4 [13] .text PROGBITS 080482c0 0002c0 00016c 00 AX 0 0 16 [14] .fini PROGBITS 0804842c 00042c 00001c 00 AX 0 0 4 [15] .rodata PROGBITS 08048448 000448 000008 00 A 0 0 4 [16] .eh_frame PROGBITS 08048450 000450 000004 00 A 0 0 4 [17] .ctors PROGBITS 08049454 000454 000008 00 WA 0 0 4 [18] .dtors PROGBITS 0804945c 00045c 000008 00 WA 0 0 4 [19] .jcr PROGBITS 08049464 000464 000004 00 WA 0 0 4 [20] .dynamic DYNAMIC 08049468 000468 0000d0 08 WA 6 0 4 [21] .got PROGBITS 08049538 000538 000004 04 WA 0 0 4 [22] .got.plt PROGBITS 0804953c 00053c 000014 04 WA 0 0 4 [23] .data PROGBITS 08049550 000550 00000c 00 WA 0 0 4 [24] .bss NOBITS 0804955c 00055c 000004 00 WA 0 0 4 [25] .comment PROGBITS 00000000 00055c 000126 00 0 0 1 [26] .debug_aranges PROGBITS 00000000 000688 000050 00 0 0 8 [27] .debug_pubnames PROGBITS 00000000 0006d8 000025 00 0 0 1 [28] .debug_info PROGBITS 00000000 0006fd 0001a7 00 0 0 1 [29] .debug_abbrev PROGBITS 00000000 0008a4 00006f 00 0 0 1 [30] .debug_line PROGBITS 00000000 000913 000129 00 0 0 1 [31] .debug_str PROGBITS 00000000 000a3c 0000bb 01 MS 0 0 1 [32] .debug_ranges PROGBITS 00000000 000af8 000040 00 0 0 8 [33] .shstrtab STRTAB 00000000 000b38 000139 00 0 0 1 [34] .symtab SYMTAB 00000000 001214 000490 10 35 55 4 [35] .strtab STRTAB 00000000 0016a4 0001f2 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)
//静态链接ts的Section Headers信息 readelf -S ts There are 33 section headers, starting at offset 0x78ffc:
Section Headers: [Nr] Name Type Addr Off Size ES ** Lk Inf Al [ 0] NULL 00000000 000000 000000 00 0 0 0 [ 1] .note.ABI-tag NOTE 080480d4 0000d4 000020 00 A 0 0 4 [ 2] .init PROGBITS 080480f4 0000f4 000030 00 AX 0 0 4 [ 3] .text PROGBITS 08048130 000130 0588dc 00 AX 0 0 16 [ 4] __libc_freeres_fn PROGBITS 080a0a10 058a10 000ac2 00 AX 0 0 16 [ 5] .fini PROGBITS 080a14d4 0594d4 00001c 00 AX 0 0 4 [ 6] .rodata PROGBITS 080a1500 059500 017568 00 A 0 0 32 [ 7] __libc_subfreeres PROGBITS 080b8a68 070a68 00002c 00 A 0 0 4 [ 8] __libc_atexit PROGBITS 080b8a94 070a94 000004 00 A 0 0 4 [ 9] .eh_frame PROGBITS 080b8a98 070a98 0047a8 00 A 0 0 4 [10] .gcc_except_table PROGBITS 080bd240 075240 000102 00 A 0 0 1 [11] .tdata PROGBITS 080be344 075344 000010 00 WAT 0 0 4 [12] .tbss NOBITS 080be354 075354 000018 00 WAT 0 0 4 [13] .ctors PROGBITS 080be354 075354 000008 00 WA 0 0 4 [14] .dtors PROGBITS 080be35c 07535c 00000c 00 WA 0 0 4 [15] .jcr PROGBITS 080be368 075368 000004 00 WA 0 0 4 [16] .data.rel.ro PROGBITS 080be36c 07536c 00002c 00 WA 0 0 4 [17] .got PROGBITS 080be398 075398 000008 04 WA 0 0 4 [18] .got.plt PROGBITS 080be3a0 0753a0 00000c 04 WA 0 0 4 [19] .data PROGBITS 080be3c0 0753c0 000720 00 WA 0 0 32 [20] .bss NOBITS 080beae0 075ae0 001ad8 00 WA 0 0 32 [21] __libc_freeres_pt NOBITS 080c05b8 075ae0 000014 00 WA 0 0 4 [22] .comment PROGBITS 00000000 075ae0 002f16 00 0 0 1 [23] .debug_aranges PROGBITS 00000000 0789f8 000050 00 0 0 8 [24] .debug_pubnames PROGBITS 00000000 078a48 000025 00 0 0 1 [25] .debug_info PROGBITS 00000000 078a6d 0001a7 00 0 0 1 [26] .debug_abbrev PROGBITS 00000000 078c14 00006f 00 0 0 1 [27] .debug_line PROGBITS 00000000 078c83 000129 00 0 0 1 [28] .debug_str PROGBITS 00000000 078dac 0000bb 01 MS 0 0 1 [29] .debug_ranges PROGBITS 00000000 078e68 000040 00 0 0 8 [30] .shstrtab STRTAB 00000000 078ea8 000152 00 0 0 1 [31] .symtab SYMTAB 00000000 079524 007b90 10 32 905 4 [32] .strtab STRTAB 00000000 0810b4 006e33 00 0 0 1 Key to Flags: W (write), A (alloc), X (execute), M (merge), S (strings) I (info), L (link order), G (group), x (unknown) O (extra OS processing required) o (OS specific), p (processor specific)
从中可以看出.text .rodata .data .bbs的差别,静态的代码段.text占了350K左右 .rodata占了93K左右,所以500K不是elf信息,主要是代码和数据。那么我们的用户代码只有这么几行,所以只能是glibc库,(注兰色部分二个表是什么意思我不了解,但也有比较大的差别)
//动态链接td的program headers信息 readelf -l td
Elf file type is EXEC (Executable file) Entry point 0x80482c0 There are 7 program headers, starting at offset 52
Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz ** Align PHDR 0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4 INTERP 0x000114 0x08048114 0x08048114 0x00013 0x00013 R 0x1 [Requesting program interpreter: /lib/ld-linux.so.2] LOAD 0x000000 0x08048000 0x08048000 0x00454 0x00454 R E 0x1000 LOAD 0x000454 0x08049454 0x08049454 0x00108 0x0010c RW 0x1000 DYNAMIC 0x000468 0x08049468 0x08049468 0x000d0 0x000d0 RW 0x4 NOTE 0x000128 0x08048128 0x08048128 0x00020 0x00020 R 0x4 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4
Section to Segment mapping: Segment Sections... 00 01 .interp 02 .interp .note.ABI-tag .hash .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame 03 .ctors .dtors .jcr .dynamic .got .got.plt .data .bss 04 .dynamic 05 .note.ABI-tag 06
//静态链接ts的program headers信息 readelf -l ts Elf file type is EXEC (Executable file) Entry point 0x8048130 There are 5 program headers, starting at offset 52 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz ** Align LOAD 0x000000 0x08048000 0x08048000 0x75342 0x75342 R E 0x1000 LOAD 0x075344 0x080be344 0x080be344 0x0079c 0x02288 RW 0x1000 NOTE 0x0000d4 0x080480d4 0x080480d4 0x00020 0x00020 R 0x4 TLS 0x075344 0x080be344 0x080be344 0x00010 0x00028 R 0x4 GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x4 Section to Segment mapping: Segment Sections... 00 .note.ABI-tag .init .text __libc_freeres_fn .fini .rodata __libc_subfreeres __libc_atexit .eh_frame .gcc_except_table 01 .tdata .ctors .dtors .jcr .data.rel.ro .got .got.plt .data .bss __libc_freeres_ptrs 02 .note.ABI-tag 03 .tdata .tbss 04 再看看程序头的红色部分的差别,问题就一目了然了 |