用于读取ELF格式文件的详细信息的命令：readelf命令

1.功能简介

readelf 用于读取 ELF（Executable and Linkable Format）格式文件的详细信息，包括目标文件、可执行文件、共享目标文件与核心转储文件。

1.1 ELF 文件分类

（1）可重定位文件（Relocatable File），这类文件包含了代码和数据，用于链接生成可以执行文件或共享目标文件，目标文件和静态链接库均属于可重定位文件，例如*.o或lib*.a文件；

（2）可执行文件（Executable File），用于生成进程映像，载入内存执行。Linux 环境下的 ELF 可执行文件一般没有扩展名，例如用户命令 ls；

（3）共享目标文件（Shared Object File），这种文件包含了代码和数据，用于和可重定位文件或其他共享目标文件一起生成可执行文件。例如 Linux 的动态共享对象（Dynamic Shared Object），C 语言运行时库 glibc-2.5.so；

（4）核心转储文件（Core Dump File），当进程意外终止时，系统可以将该进程的地址空间的内容及终止时的一些其他信息转储到核心转储文件。例如 Linux 下的 core dump。

1.2 ELF 文件组成

ELF 文件头描述了 ELF 文件的总体信息，包括系统相关、类型相关、加载相关和链接相关的信息。
（1）系统相关，比如ELF 文件标识的魔数，以及硬件和平台等相关信息，增加了 ELF 文件的移植性，使交叉编译成为可能；
（2）类型相关，比如 ELF 文件类型，分别有目标文件、可执行文件、动态链接库与核心转储文件；
（3）加载相关，比如程序头，描述了 ELF 文件被加载时的段信息；
（4）链接相关，比如节头，描述了 ELF 文件的节信息。

2.命令格式

readelf

3.选项说明

运行 readelf 的时候，除了 -v 和 -H 之外，其它的选项必须有一个被指定。

-a,--all：显示全部信息，等价于-h -l -S -s -r -d -V -A -I
-h,--file-header：显示文件头信息
-l,--program-headers,--segments：显示程序头（如果有的话）
-S,--section-headers,--sections：显示节头信息（如果有的话）
-g,--section-groups：显示节组信息（如果有的话）
-t,--section-details：显示节的详细信息（-S的）
-s,--syms,--symbols：显示符号表节中的项（如果有的话）
--dyn-syms：显示动态符号表节中的项（如果有的话）
-e,--headers：显示全部头信息，等价于-h -l -S
-n,--notes：显示note段（内核注释）的信息
-r,--relocs：显示可重定位段的信息。
-u,--unwind：显示unwind段信息。当前只支持IA64 ELF的unwind段信息。
-d,--dynamic：显示动态段的信息
-V,--version-info：显示版本段的信息
-A ,--arch-specific：显示CPU构架信息
-D,--use-dynamic：使用动态符号表显示符号，而不是符号表
-x ,--hex-dump=：以16进制方式显示指定节内容。number指定节表中节的索引，或字符串指定文件中的节名
-R ,--relocated-dump=：以16进制方式显示指定节内容。number指定节表中节的索引，或字符串指定文件中的节名。节的内容被展示前将被重定位。
-p ,--string-dump=：以可打印的字符串显示指定节内容。number指定节表中节的索引，或字符串指定文件中的节名。
-c,--archive-index：展示档案头中的文件符号索引信息，执行与 ar 的 t 命令相同的功能，但不使用 BFD 库
-w[liaprmfFsoR],--debug-dump[=line,=info,=abbrev,=pubnames,=aranges,=macro,=frames,=frames-interp,=str,=loc,=Ranges]：显示调试段中指定的内容
--dwarf-depth=n：将“.debug_info”节的转储限制为n个子级。这只对--debug dump=info有用。默认为打印所有DIE（debugging information entry）；n的特殊值0也将具有此效果
--dwarf-start=n：只打印以编号为n的模具开始的DIE，仅适用于使用--debug dump=info选项时。该选项可以与--dwarf-depth=n连用。
-I,--histogram：显示符号的时候，显示 bucket list 长度的柱状图
-v,--version：显示 readelf 的版本信息
-H,--help：显示 readelf 所支持的命令行选项
-W,--wide：宽行输出
@file：可以将选项集中到一个文件中，然后使用这个@file 选项载入

4.常用示例

4.1准备工作

（1）首先生成可执行文件形式的 ELF 文件。

使用g++，分别不使用和使用-g选项，编译生成可执行文件main.out和main.debug.out。

g++main.cpp-omain.out
g++-gmain.cpp-omain.debug.out

ll
-rw-r--r--1rootroot74Mar2111:48main.cpp
-rwxr-xr-x1rootroot9119Mar2111:49main.out
-rwxr-xr-x1rootroot19695Mar2111:49main.debug.out

可见，因为加入了调试信息，main.debug.out 的大小明显比 main.out 大很多。

（2）生成库文件。

//
//@file：print.cpp
//

#include

voidprint()
{
std::cout<<"readelf"<

使用g++和ar，分别生成静态链接库libprint.a和动态链接库libprint.so。

#生成静态库libmy.a
g++-cprint.cpp-oprint.o
arclibprint.aprint.o

#生成动态库libprint.so
g++-shared-fPIC-olibprint.soprint.cpp

编译之后，查看生成的文件。

ll
-rw-r--r--1rootroot2810Mar2113:50libprint.a
-rwxr-xr-x1rootroot8613Mar2113:56libprint.so
-rw-r--r--1rootroot104Mar2113:40print.cpp
-rw-r--r--1rootroot2664Mar2113:40print.o

基于以上可执行文件和库，下面给出一些常用的示例。

4.2 常用示例

（1）读取可执行文件形式的 ELF 文件头信息。

readelf-hmain.out
ELFHeader:
Magic:7f454c46020101000000000000000000
Class:ELF64
Data:2'scomplement,littleendian
Version:1(current)
OS/ABI:UNIX-SystemV
ABIVersion:0
Type:EXEC(Executablefile)
Machine:AdvancedMicroDevicesX86-64
Version:0x1
Entrypointaddress:0x400780
Startofprogramheaders:64(bytesintofile)
Startofsectionheaders:4496(bytesintofile)
Flags:0x0
Sizeofthisheader:64(bytes)
Sizeofprogramheaders:56(bytes)
Numberofprogramheaders:9
Sizeofsectionheaders:64(bytes)
Numberofsectionheaders:30
Sectionheaderstringtableindex:27

从Type:EXEC (Executable file)可以看出其类型为 EXEC（可执行文件）。并且可以看出文件的体系结构为 x86-64。另外，含调试信息的"main.debug.out"和不含调试信息的"main"除了一些大小信息之外，其内容是一样的。

（2）读取目标文件形式的 ELF 文件头信息。

readelf-hprint.o
ELFHeader:
Magic:7f454c46020101000000000000000000
Class:ELF64
Data:2'scomplement,littleendian
Version:1(current)
OS/ABI:UNIX-SystemV
ABIVersion:0
Type:REL(Relocatablefile)
Machine:AdvancedMicroDevicesX86-64
Version:0x1
Entrypointaddress:0x0
Startofprogramheaders:0(bytesintofile)
Startofsectionheaders:488(bytesintofile)
Flags:0x0
Sizeofthisheader:64(bytes)
Sizeofprogramheaders:0(bytes)
Numberofprogramheaders:0
Sizeofsectionheaders:64(bytes)
Numberofsectionheaders:15
Sectionheaderstringtableindex:12

可见目标文件的elf文件，其类型为REL(可重定位文件)。且相对于可执行文件，目标文件没有程序头（段头）信息。

（3）读取静态库文件形式的 ELF 文件头信息。

readelf-hlibprint.a

File:libprint.a(print.o)
ELFHeader:
Magic:7f454c46020101000000000000000000
Class:ELF64
Data:2'scomplement,littleendian
Version:1(current)
OS/ABI:UNIX-SystemV
ABIVersion:0
Type:REL(Relocatablefile)
Machine:AdvancedMicroDevicesX86-64
Version:0x1
Entrypointaddress:0x0
Startofprogramheaders:0(bytesintofile)
Startofsectionheaders:488(bytesintofile)
Flags:0x0
Sizeofthisheader:64(bytes)
Sizeofprogramheaders:0(bytes)
Numberofprogramheaders:0
Sizeofsectionheaders:64(bytes)
Numberofsectionheaders:15
Sectionheaderstringtableindex:12

可见静态库文件的elf文件，其类型为REL（可重定位文件），且没有程序头（段头）信息。

（4）读取动态库文件形式的 ELF 文件头信息。

readelf-hlibprint.so
ELFHeader:
Magic:7f454c46020101000000000000000000
Class:ELF64
Data:2'scomplement,littleendian
Version:1(current)
OS/ABI:UNIX-SystemV
ABIVersion:0
Type:DYN(Sharedobjectfile)
Machine:AdvancedMicroDevicesX86-64
Version:0x1
Entrypointaddress:0x870
Startofprogramheaders:64(bytesintofile)
Startofsectionheaders:4464(bytesintofile)
Flags:0x0
Sizeofthisheader:64(bytes)
Sizeofprogramheaders:56(bytes)
Numberofprogramheaders:7
Sizeofsectionheaders:64(bytes)
Numberofsectionheaders:28
Sectionheaderstringtableindex:25

这里，可见动态库其类型为DYN（共享目标文件），和可执行文件类似，同样拥有程序头（段头）信息。

（5）查看可执行的 ELF 文件程序头信息。

readelf-lmain.out

ElffiletypeisEXEC(Executablefile)
Entrypoint0x400780
Thereare9programheaders,startingatoffset64

ProgramHeaders:
TypeOffsetVirtAddrPhysAddr
FileSizMemSizFlagsAlign
PHDR0x00000000000000400x00000000004000400x0000000000400040
0x00000000000001f80x00000000000001f8RE8
INTERP0x00000000000002380x00000000004002380x0000000000400238
0x000000000000001c0x000000000000001cR1
[Requestingprograminterpreter:/lib64/ld-linux-x86-64.so.2]
LOAD0x00000000000000000x00000000004000000x0000000000400000
0x0000000000000b040x0000000000000b04RE200000
LOAD0x0000000000000dd80x0000000000600dd80x0000000000600dd8
0x00000000000002840x00000000000003a0RW200000
DYNAMIC0x0000000000000df80x0000000000600df80x0000000000600df8
0x00000000000002000x0000000000000200RW8
NOTE0x00000000000002540x00000000004002540x0000000000400254
0x00000000000000440x0000000000000044R4
GNU_EH_FRAME0x000000000000098c0x000000000040098c0x000000000040098c
0x00000000000000440x0000000000000044R4
GNU_STACK0x00000000000000000x00000000000000000x0000000000000000
0x00000000000000000x0000000000000000RW10
GNU_RELRO0x0000000000000dd80x0000000000600dd80x0000000000600dd8
0x00000000000002280x0000000000000228R1

SectiontoSegmentmapping:
SegmentSections...
00
01.interp
02.interp.note.ABI-tag.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.text.fini.rodata.eh_frame_hdr.eh_frame
03.init_array.fini_array.jcr.dynamic.got.got.plt.data.bss
04.dynamic
05.note.ABI-tag.note.gnu.build-id
06.eh_frame_hdr
07
08.init_array.fini_array.jcr.dynamic.got

注意：含调试信息的可执行文件"main.debug.out"和不含调试信息的"main.out"其内容是一样的。

（6）查看动态库 ELF 文件程序头信息。

readelf-llibprint.so

ElffiletypeisDYN(Sharedobjectfile)
Entrypoint0x870
Thereare7programheaders,startingatoffset64

ProgramHeaders:
TypeOffsetVirtAddrPhysAddr
FileSizMemSizFlagsAlign
LOAD0x00000000000000000x00000000000000000x0000000000000000
0x0000000000000acc0x0000000000000accRE200000
LOAD0x0000000000000da80x0000000000200da80x0000000000200da8
0x00000000000002a00x00000000000002a8RW200000
DYNAMIC0x0000000000000dd00x0000000000200dd00x0000000000200dd0
0x00000000000001f00x00000000000001f0RW8
NOTE0x00000000000001c80x00000000000001c80x00000000000001c8
0x00000000000000240x0000000000000024R4
GNU_EH_FRAME0x00000000000009f80x00000000000009f80x00000000000009f8
0x000000000000002c0x000000000000002cR4
GNU_STACK0x00000000000000000x00000000000000000x0000000000000000
0x00000000000000000x0000000000000000RW10
GNU_RELRO0x0000000000000da80x0000000000200da80x0000000000200da8
0x00000000000002580x0000000000000258R1

SectiontoSegmentmapping:
SegmentSections...
00.note.gnu.build-id.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.text.fini.rodata.eh_frame_hdr.eh_frame
01.init_array.fini_array.jcr.data.rel.ro.dynamic.got.got.plt.bss
02.dynamic
03.note.gnu.build-id
04.eh_frame_hdr
05
06.init_array.fini_array.jcr.data.rel.ro.dynamic.got

（7）查看一个可执行的 ELF 文件的节头信息。

readelf-Smain.out
Thereare30sectionheaders,startingatoffset0x1190:

SectionHeaders:
[Nr]NameTypeAddressOffset
SizeEntSizeFlagsLinkInfoAlign
[0]NULL000000000000000000000000
00000000000000000000000000000000000
[1].interpPROGBITS000000000040023800000238
000000000000001c0000000000000000A001
[2].note.ABI-tagNOTE000000000040025400000254
00000000000000200000000000000000A004
[3].note.gnu.build-iNOTE000000000040027400000274
00000000000000240000000000000000A004
[4].gnu.hashGNU_HASH000000000040029800000298
00000000000000300000000000000000A508
[5].dynsymDYNSYM00000000004002c8000002c8
00000000000001380000000000000018A618
[6].dynstrSTRTAB000000000040040000000400
00000000000001800000000000000000A001
[7].gnu.versionVERSYM000000000040058000000580
000000000000001a0000000000000002A502
[8].gnu.version_rVERNEED00000000004005a0000005a0
00000000000000400000000000000000A628
[9].rela.dynRELA00000000004005e0000005e0
00000000000000300000000000000018A508
[10].rela.pltRELA000000000040061000000610
00000000000000c00000000000000018A5128
[11].initPROGBITS00000000004006d0000006d0
000000000000001a0000000000000000AX004
[12].pltPROGBITS00000000004006f0000006f0
00000000000000900000000000000010AX0016
[13].textPROGBITS000000000040078000000780
00000000000001e40000000000000000AX0016
[14].finiPROGBITS000000000040096400000964
00000000000000090000000000000000AX004
[15].rodataPROGBITS000000000040097000000970
000000000000001c0000000000000000A008
[16].eh_frame_hdrPROGBITS000000000040098c0000098c
00000000000000440000000000000000A004
[17].eh_framePROGBITS00000000004009d0000009d0
00000000000001340000000000000000A008
[18].init_arrayINIT_ARRAY0000000000600dd800000dd8
00000000000000100000000000000000WA008
[19].fini_arrayFINI_ARRAY0000000000600de800000de8
00000000000000080000000000000000WA008
[20].jcrPROGBITS0000000000600df000000df0
00000000000000080000000000000000WA008
[21].dynamicDYNAMIC0000000000600df800000df8
00000000000002000000000000000010WA608
[22].gotPROGBITS0000000000600ff800000ff8
00000000000000080000000000000008WA008
[23].got.pltPROGBITS000000000060100000001000
00000000000000580000000000000008WA008
[24].dataPROGBITS000000000060105800001058
00000000000000040000000000000000WA004
[25].bssNOBITS00000000006010600000105c
00000000000001180000000000000000WA0032
[26].commentPROGBITS00000000000000000000105c
000000000000002c0000000000000001MS001
[27].shstrtabSTRTAB000000000000000000001088
00000000000001080000000000000000001
[28].symtabSYMTAB000000000000000000001910
00000000000006f0000000000000001829488
[29].strtabSTRTAB000000000000000000002000
000000000000039f0000000000000000001
KeytoFlags:
W(write),A(alloc),X(execute),M(merge),S(strings),l(large)
I(info),L(linkorder),G(group),T(TLS),E(exclude),x(unknown)
O(extraOSprocessingrequired)o(OSspecific),p(processorspecific)

（8）查看一个包含调试信息的可执行的 ELF 文件的节头信息。

readelf-Smain.debug.out
Thereare35sectionheaders,startingatoffset0x3928:

SectionHeaders:
[Nr]NameTypeAddressOffset
SizeEntSizeFlagsLinkInfoAlign
[0]NULL000000000000000000000000
00000000000000000000000000000000000
[1].interpPROGBITS000000000040023800000238
000000000000001c0000000000000000A001
[2].note.ABI-tagNOTE000000000040025400000254
00000000000000200000000000000000A004
[3].note.gnu.build-iNOTE000000000040027400000274
00000000000000240000000000000000A004
[4].gnu.hashGNU_HASH000000000040029800000298
00000000000000300000000000000000A508
[5].dynsymDYNSYM00000000004002c8000002c8
00000000000001380000000000000018A618
[6].dynstrSTRTAB000000000040040000000400
00000000000001800000000000000000A001
[7].gnu.versionVERSYM000000000040058000000580
000000000000001a0000000000000002A502
[8].gnu.version_rVERNEED00000000004005a0000005a0
00000000000000400000000000000000A628
[9].rela.dynRELA00000000004005e0000005e0
00000000000000300000000000000018A508
[10].rela.pltRELA000000000040061000000610
00000000000000c00000000000000018A5128
[11].initPROGBITS00000000004006d0000006d0
000000000000001a0000000000000000AX004
[12].pltPROGBITS00000000004006f0000006f0
00000000000000900000000000000010AX0016
[13].textPROGBITS000000000040078000000780
00000000000001e40000000000000000AX0016
[14].finiPROGBITS000000000040096400000964
00000000000000090000000000000000AX004
[15].rodataPROGBITS000000000040097000000970
000000000000001c0000000000000000A008
[16].eh_frame_hdrPROGBITS000000000040098c0000098c
00000000000000440000000000000000A004
[17].eh_framePROGBITS00000000004009d0000009d0
00000000000001340000000000000000A008
[18].init_arrayINIT_ARRAY0000000000600dd800000dd8
00000000000000100000000000000000WA008
[19].fini_arrayFINI_ARRAY0000000000600de800000de8
00000000000000080000000000000000WA008
[20].jcrPROGBITS0000000000600df000000df0
00000000000000080000000000000000WA008
[21].dynamicDYNAMIC0000000000600df800000df8
00000000000002000000000000000010WA608
[22].gotPROGBITS0000000000600ff800000ff8
00000000000000080000000000000008WA008
[23].got.pltPROGBITS000000000060100000001000
00000000000000580000000000000008WA008
[24].dataPROGBITS000000000060105800001058
00000000000000040000000000000000WA004
[25].bssNOBITS00000000006010600000105c
00000000000001180000000000000000WA0032
[26].commentPROGBITS00000000000000000000105c
000000000000002c0000000000000001MS001
[27].debug_arangesPROGBITS000000000000000000001088
00000000000000300000000000000000001
[28].debug_infoPROGBITS0000000000000000000010b8
00000000000014f90000000000000000001
[29].debug_abbrevPROGBITS0000000000000000000025b1
000000000000039f0000000000000000001
[30].debug_linePROGBITS000000000000000000002950
00000000000002410000000000000000001
[31].debug_strPROGBITS000000000000000000002b91
0000000000000c4e0000000000000001MS001
[32].shstrtabSTRTAB0000000000000000000037df
00000000000001480000000000000000001
[33].symtabSYMTAB0000000000000000000041e8
0000000000000768000000000000001834538
[34].strtabSTRTAB000000000000000000004950
000000000000039f0000000000000000001
KeytoFlags:
W(write),A(alloc),X(execute),M(merge),S(strings),l(large)
I(info),L(linkorder),G(group),T(TLS),E(exclude),x(unknown)
O(extraOSprocessingrequired)o(OSspecific),p(processorspecific)

可见，相对非调试版本的可执行文件，多了些".debug*"节的信息。

（9）查看一个目标文件的 ELF 文件的节头信息。

readelf-Sprint.o
Thereare15sectionheaders,startingatoffset0x1e8:

SectionHeaders:
[Nr]NameTypeAddressOffset
SizeEntSizeFlagsLinkInfoAlign
[0]NULL000000000000000000000000
00000000000000000000000000000000000
[1].textPROGBITS000000000000000000000040
00000000000000740000000000000000AX004
[2].rela.textRELA000000000000000000000900
000000000000010800000000000000181318
[3].dataPROGBITS0000000000000000000000b4
00000000000000000000000000000000WA004
[4].bssNOBITS0000000000000000000000b4
00000000000000010000000000000000WA004
[5].rodataPROGBITS0000000000000000000000b4
00000000000000080000000000000000A001
[6].init_arrayINIT_ARRAY0000000000000000000000c0
00000000000000080000000000000000WA008
[7].rela.init_arrayRELA000000000000000000000a08
000000000000001800000000000000181368
[8].commentPROGBITS0000000000000000000000c8
000000000000002d0000000000000001MS001
[9].note.GNU-stackPROGBITS0000000000000000000000f5
00000000000000000000000000000000001
[10].eh_framePROGBITS0000000000000000000000f8
00000000000000780000000000000000A008
[11].rela.eh_frameRELA000000000000000000000a20
0000000000000048000000000000001813108
[12].shstrtabSTRTAB000000000000000000000170
00000000000000720000000000000000001
[13].symtabSYMTAB0000000000000000000005a8
0000000000000210000000000000001814138
[14].strtabSTRTAB0000000000000000000007b8
00000000000001450000000000000000001
KeytoFlags:
W(write),A(alloc),X(execute),M(merge),S(strings),l(large)
I(info),L(linkorder),G(group),T(TLS),E(exclude),x(unknown)
O(extraOSprocessingrequired)o(OSspecific),p(processorspecific)

（10）查看一个静态库文件的 ELF 文件的节头信息。

readelf-Slibprint.a

File:libprint.a(print.o)
Thereare15sectionheaders,startingatoffset0x1e8:

SectionHeaders:
[Nr]NameTypeAddressOffset
SizeEntSizeFlagsLinkInfoAlign
[0]NULL000000000000000000000000
00000000000000000000000000000000000
[1].textPROGBITS000000000000000000000040
00000000000000740000000000000000AX004
[2].rela.textRELA000000000000000000000900
000000000000010800000000000000181318
[3].dataPROGBITS0000000000000000000000b4
00000000000000000000000000000000WA004
[4].bssNOBITS0000000000000000000000b4
00000000000000010000000000000000WA004
[5].rodataPROGBITS0000000000000000000000b4
00000000000000080000000000000000A001
[6].init_arrayINIT_ARRAY0000000000000000000000c0
00000000000000080000000000000000WA008
[7].rela.init_arrayRELA000000000000000000000a08
000000000000001800000000000000181368
[8].commentPROGBITS0000000000000000000000c8
000000000000002d0000000000000001MS001
[9].note.GNU-stackPROGBITS0000000000000000000000f5
00000000000000000000000000000000001
[10].eh_framePROGBITS0000000000000000000000f8
00000000000000780000000000000000A008
[11].rela.eh_frameRELA000000000000000000000a20
0000000000000048000000000000001813108
[12].shstrtabSTRTAB000000000000000000000170
00000000000000720000000000000000001
[13].symtabSYMTAB0000000000000000000005a8
0000000000000210000000000000001814138
[14].strtabSTRTAB0000000000000000000007b8
00000000000001450000000000000000001
KeytoFlags:
W(write),A(alloc),X(execute),M(merge),S(strings),l(large)
I(info),L(linkorder),G(group),T(TLS),E(exclude),x(unknown)
O(extraOSprocessingrequired)o(OSspecific),p(processorspecific)

（11）查看一个动态库文件的 ELF 文件的节头信息。

readelf-Slibprint.so
Thereare28sectionheaders,startingatoffset0x1170:

SectionHeaders:
[Nr]NameTypeAddressOffset
SizeEntSizeFlagsLinkInfoAlign
[0]NULL000000000000000000000000
00000000000000000000000000000000000
[1].note.gnu.build-iNOTE00000000000001c8000001c8
00000000000000240000000000000000A004
[2].gnu.hashGNU_HASH00000000000001f0000001f0
000000000000003c0000000000000000A308
[3].dynsymDYNSYM000000000000023000000230
00000000000001e00000000000000018A428
[4].dynstrSTRTAB000000000000041000000410
00000000000001ab0000000000000000A001
[5].gnu.versionVERSYM00000000000005bc000005bc
00000000000000280000000000000002A302
[6].gnu.version_rVERNEED00000000000005e8000005e8
00000000000000400000000000000000A428
[7].rela.dynRELA000000000000062800000628
00000000000001200000000000000018A308
[8].rela.pltRELA000000000000074800000748
00000000000000900000000000000018A3108
[9].initPROGBITS00000000000007d8000007d8
000000000000001a0000000000000000AX004
[10].pltPROGBITS000000000000080000000800
00000000000000700000000000000010AX0016
[11].textPROGBITS000000000000087000000870
00000000000001740000000000000000AX0016
[12].finiPROGBITS00000000000009e4000009e4
00000000000000090000000000000000AX004
[13].rodataPROGBITS00000000000009ed000009ed
00000000000000080000000000000000A001
[14].eh_frame_hdrPROGBITS00000000000009f8000009f8
000000000000002c0000000000000000A004
[15].eh_framePROGBITS0000000000000a2800000a28
00000000000000a40000000000000000A008
[16].init_arrayINIT_ARRAY0000000000200da800000da8
00000000000000100000000000000000WA008
[17].fini_arrayFINI_ARRAY0000000000200db800000db8
00000000000000080000000000000000WA008
[18].jcrPROGBITS0000000000200dc000000dc0
00000000000000080000000000000000WA008
[19].data.rel.roPROGBITS0000000000200dc800000dc8
00000000000000080000000000000000WA008
[20].dynamicDYNAMIC0000000000200dd000000dd0
00000000000001f00000000000000010WA408
[21].gotPROGBITS0000000000200fc000000fc0
00000000000000400000000000000008WA008
[22].got.pltPROGBITS000000000020100000001000
00000000000000480000000000000008WA008
[23].bssNOBITS000000000020104800001048
00000000000000080000000000000000WA004
[24].commentPROGBITS000000000000000000001048
000000000000002c0000000000000001MS001
[25].shstrtabSTRTAB000000000000000000001074
00000000000000f90000000000000000001
[26].symtabSYMTAB000000000000000000001870
0000000000000600000000000000001827468
[27].strtabSTRTAB000000000000000000001e70
00000000000003350000000000000000001
KeytoFlags:
W(write),A(alloc),X(execute),M(merge),S(strings),l(large)
I(info),L(linkorder),G(group),T(TLS),E(exclude),x(unknown)
O(extraOSprocessingrequired)o(OSspecific),p(processorspecific)

---

参考文献

[1] readelf manual
[2] Linux命令大全.readelf命令
[3] 俞甲子,石凡,等.程序员的自我修养——链接、装载与库[M].北京:电子工业出版社,2009-04.C3.1目标文件的格式.P56-57

责任编辑：xj

原文标题：每天一个 Linux 命令（107）：readelf 命令

文章出处：【微信公众号：Linux爱好者】欢迎添加关注！文章转载请注明出处。