Linux readelf Command with Practical Examples

Introduction

In this lab, you will learn about the Linux readelf command and its practical applications. The readelf command is a powerful tool used to analyze the contents of ELF (Executable and Linkable Format) files, which are the standard binary format for executables, shared libraries, and object files on Linux and other Unix-like systems. Through this lab, you will explore the basic usage of readelf, understand its purpose and functionality, and learn how to analyze ELF file headers and sections using this command. The knowledge gained from this lab can be useful for tasks such as debugging, reverse engineering, and understanding the structure of binary files.

Linux Commands Cheat Sheet

Skills Graph

Understand the Purpose and Functionality of the readelf Command

In this step, you will learn about the purpose and functionality of the readelf command in Linux. The readelf command is a powerful tool used to analyze the contents of ELF (Executable and Linkable Format) files, which are the standard binary format for executables, shared libraries, and object files on Linux and other Unix-like systems.

The readelf command provides detailed information about the ELF file, including its header, sections, segments, and symbols. This information can be useful for tasks such as debugging, reverse engineering, and understanding the structure of binary files.

Let's start by exploring the basic usage of the readelf command:

readelf -h /bin/ls

Example output:

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x4047e0
  Start of program headers:          64 (bytes into file)
  Start of section headers:          6472 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         9
  Size of section headers:           64 (bytes)
  Number of section headers:         28
  Section header string table index: 27

The output shows the various fields of the ELF file header, providing information about the file's type, architecture, entry point, and other metadata. This information can be useful for understanding the structure and purpose of the binary file.

In the next step, you will explore the basic usage of the readelf command in more detail.

Explore the Basic Usage of the readelf Command

In this step, you will explore the basic usage of the readelf command and learn how to extract various types of information from ELF files.

First, let's examine the basic options available with the readelf command:

readelf --help

This will display a list of all the available options and their descriptions. Some of the most commonly used options include:

• -h: Displays the ELF file header information
• -S: Displays the sections in the ELF file
• -l: Displays the program headers
• -s: Displays the symbol table
• -d: Displays the dynamic section
• -r: Displays the relocation entries

Now, let's try some of these options on a sample ELF file, such as the /bin/ls binary:

readelf -S /bin/ls

Example output:

There are 28 section headers, starting at offset 0x1998:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .interp           PROGBITS         0000000000400238  00000238
       000000000000001c  0000000000000000   A       0     0     1
  [ 2] .note.gnu.build-i NOTE             0000000000400254  00000254
       0000000000000024  0000000000000000   A       0     0     4
  ...

This command displays the section headers of the /bin/ls ELF file, providing information about the various sections, such as their names, types, addresses, and sizes.

You can also use the readelf command to display other information, such as the program headers, dynamic section, and symbol table. Try the following commands:

readelf -l /bin/ls
readelf -d /bin/ls
readelf -s /bin/ls

Explore the output of these commands to understand the different types of information that can be extracted from an ELF file using the readelf command.

Analyze ELF File Headers and Sections Using readelf

In this step, you will learn how to use the readelf command to analyze the headers and sections of ELF files in more detail.

Let's start by examining the ELF file header of the /bin/ls binary:

readelf -h /bin/ls

Example output:

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x4047e0
  Start of program headers:          64 (bytes into file)
  Start of section headers:          6472 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         9
  Size of section headers:           64 (bytes)
  Number of section headers:         28
  Section header string table index: 27

This output provides detailed information about the ELF file header, including the file class, data encoding, type, machine architecture, and various offsets and sizes.

Next, let's explore the sections of the ELF file:

readelf -S /bin/ls

Example output:

There are 28 section headers, starting at offset 0x1998:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .interp           PROGBITS         0000000000400238  00000238
       000000000000001c  0000000000000000   A       0     0     1
  [ 2] .note.gnu.build-i NOTE             0000000000400254  00000254
       0000000000000024  0000000000000000   A       0     0     4
  ...

This command displays the section headers, providing information about the various sections in the ELF file, such as their names, types, addresses, sizes, and other attributes.

You can further explore the sections by using the readelf -e command, which displays the full ELF file information, including the program headers, section headers, and symbol table:

readelf -e /bin/ls

This command will provide a comprehensive view of the ELF file, allowing you to understand its structure and contents in detail.

Summary

In this lab, you learned about the purpose and functionality of the readelf command in Linux. The readelf command is a powerful tool used to analyze the contents of ELF (Executable and Linkable Format) files, which are the standard binary format for executables, shared libraries, and object files on Linux and other Unix-like systems. You explored the basic usage of the readelf command and learned how to analyze ELF file headers and sections using it. This information can be useful for tasks such as debugging, reverse engineering, and understanding the structure of binary files.

Linux Commands Cheat Sheet