ELF Binary Analysis

A comprehensive guide for analyzing ELF (Executable and Linkable Format) binaries for reverse engineering, security research, and exploitation.

Quick Start

When analyzing an ELF binary, start with this reconnaissance sequence:

# Basic file info
file <binary>

# Program headers (memory layout, protections)
readelf -lW <binary>

# Section headers (detailed structure)
objdump -h <binary>

# Symbols (functions, variables)
readelf -sW <binary>

# Dynamic section (dependencies, relocations)
readelf -d <binary>

# Relocations (GOT/PLT entries)
readelf -r <binary>

Program Headers

Program headers tell the loader how to map the binary into memory. Use

readelf -lW

Key Program Header Types

RW

R

LOAD Segment Analysis

Each LOAD segment specifies:

• Offset: Where in the file to read from
• VirtAddr: Virtual address in memory
• FileSiz: Bytes to copy from file
• MemSiz: Total memory size (may be larger for .bss)
• Flg: Permissions (R=read, W=write, E=execute)

Example interpretation:

LOAD           0x000000 0x0000000000000000 0x0000000000000000 0x003f7c 0x003f7c R E 0x10000

This segment loads 0x3f7c bytes from file offset 0 to virtual address 0x0 with read+execute permissions.

GNU_STACK - Stack Executability

Check if the stack is executable:

readelf -l ./binary | grep GNU_STACK

• RW

  = executable stack (vulnerable to shellcode on stack)

• R

  = non-executable stack (NX/DEP enabled)

Toggle for testing:

execstack -c ./binary  # Clear executable flag
execstack -s ./binary  # Set executable flag

GNU_RELRO - Relocation Read-Only

RELRO marks certain memory regions as read-only after dynamic linking:

• Partial RELRO:

  .plt.got

  remains writable (GOT overwrite possible)
• Full RELRO: All GOT entries are read-only (GOT overwrite blocked)

Check RELRO status:

readelf -l ./binary | grep GNU_RELRO
readelf -d ./binary | grep FLAGS

Look for

BIND_NOW

NOW

Section Headers

Section headers provide detailed information about binary contents. Use

objdump -h

readelf -S

Important Sections

Section Flags

• ALLOC: Section occupies memory at runtime
• LOAD: Section is loaded from file
• READONLY: Read-only at runtime
• CODE: Contains executable code
• DATA: Contains data

Symbols

Symbols are named locations (functions, variables) in the binary. Use

readelf -sW

Symbol Table Structure

Num:    Value          Size Type    Bind   Vis      Ndx Name
  3: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND strlen@GLIBC_2.17

Symbol Binding

• LOCAL: Visible only within the binary
• GLOBAL: Visible to other binaries/libraries
• WEAK: Can be overridden by strong symbols

GNU IFUNC (Indirect Functions)

IFUNC symbols have resolvers that select implementations at load time:

readelf -sW ./binary | rg -i "IFUNC"

Common for CPU dispatch (e.g., optimized string functions).

Symbol Versioning

Modern glibc uses versioned symbols:

strlen@GLIBC_2.17

For manual relocations (ret2dlresolve), you must supply the correct version index.

Dynamic Section

The dynamic section contains information for the dynamic linker. Use

readelf -d

Key Dynamic Entries

Library Search Order

The dynamic linker searches for libraries in this order:

1. LD_LIBRARY_PATH

   (ignored for setuid/secure-execution)

2. DT_RPATH

   (only if

   DT_RUNPATH

   absent)

3. DT_RUNPATH

4. ld.so.cache

5. Default directories (

   /lib64

   ,

   /usr/lib64

   , etc.)

Check RPATH/RUNPATH:

readelf -d ./binary | egrep -i 'r(path|unpath)'

Test library resolution:

LD_DEBUG=libs ./binary 2>&1 | grep -i find

Relocations

Relocations adjust addresses after the binary is loaded. Use

readelf -r

Relocation Types

GOT (Global Offset Table)

The GOT stores addresses of external functions and variables. Key points:

• Lazy binding: First call to a function resolves it via PLT, then updates GOT
• GOT overwrite: If Partial RELRO, you can overwrite GOT entries to redirect calls
• Full RELRO: GOT is read-only, GOT overwrite attacks blocked

PLT (Procedure Linkage Table)

The PLT enables lazy function binding:

1. Call

   func@plt

   → jumps to PLT stub
2. First call: PLT stub resolves address via GOT, updates GOT, calls real function
3. Subsequent calls: Direct call via GOT entry

Modern Linking Behaviors

-z now

-fno-plt

-z pack-relative-relocs

Check for packed relocations:

readelf -d ./binary | egrep -i "DT_RELR|RELRSZ|RELRENT"

Program Initialization

The program doesn't always start at

main

1. Load binary into memory, initialize

   .data

   and zero

   .bss

2. Initialize dependencies and perform dynamic linking
3. Execute

   PREINIT_ARRAY

   functions (if present)
4. Execute

   INIT_ARRAY

   functions
5. Call

   INIT

   function (if present)
6. Call entry point (

   main

   for programs)

Constructor/Destructor Attributes

__attribute__((constructor))  // Runs before main
__attribute__((destructor))   // Runs after main

These functions are added to

INIT_ARRAY

FINI_ARRAY

Exploitation Note

Under Partial RELRO,

INIT_ARRAY

FINI_ARRAY

ld.so

Thread-Local Storage (TLS)

TLS variables have per-thread storage:

__thread int my_var;           // C
__thread_local int my_var;     // C++

• Stored in

  .tdata

  (initialized) and

  .tbss

  (uninitialized)
• Each thread has its own copy

• __TLS_MODULE_BASE

  points to the TLS base address

Auxiliary Vector (auxv)

The kernel passes an auxiliary vector with runtime information:

Access from code:

#include <sys/auxv.h>
printf("AT_RANDOM=%p\n", (void*)getauxval(AT_RANDOM));
printf("AT_SYSINFO_EHDR=%p\n", (void*)getauxval(AT_SYSINFO_EHDR));

From

/proc

cat /proc/$(pidof target)/auxv | xxd

Common Analysis Commands

Full Reconnaissance

# File type and architecture
file ./binary

# Check protections
checksec --file=./binary  # If available

# Program headers
readelf -lW ./binary

# Section headers
objdump -h ./binary
readelf -S ./binary

# Symbols
readelf -sW ./binary
nm ./binary

# Dynamic section
readelf -d ./binary

# Relocations
readelf -r ./binary

# Disassembly
objdump -d ./binary

Protection Detection

# PIE
readelf -h ./binary | grep Type
# DYN = PIE, EXEC = non-PIE

# Stack executable
readelf -l ./binary | grep GNU_STACK

# RELRO
readelf -l ./binary | grep GNU_RELRO
readelf -d ./binary | grep -E "BIND_NOW|NOW"

# Canary (check for __stack_chk_fail)
readelf -sW ./binary | grep stack_chk

# FORTIFY_SOURCE (check for _chk functions)
readelf -sW ./binary | grep _chk

# CET (Control-flow Enforcement Technology)
readelf -n ./binary | grep -i "ibt\|shstk"

Finding Useful Symbols

# System call functions
readelf -sW ./binary | grep -E "sys_|__kernel_"

# Memory functions
readelf -sW ./binary | grep -E "malloc|free|memcpy|strcpy"

# String functions
readelf -sW ./binary | grep -E "str|printf|scanf"

# File I/O
readelf -sW ./binary | grep -E "open|read|write|close"

# Process functions
readelf -sW ./binary | grep -E "fork|exec|exit"

Exploitation Considerations

When GOT/PLT is Available (Partial RELRO)

• GOT overwrite: Redirect function calls to shellcode or ROP chain
• ret2dlresolve: Force dynamic linker to resolve arbitrary symbols
• PLT stubs: Use for ROP gadgets (call + ret sequences)

When GOT/PLT is Not Available (Full RELRO)

• ROP/SROP: Use existing code gadgets
• Format string: Leak addresses, overwrite memory
• Heap exploitation: Use heap corruption techniques
• Other writable pointers: Look for function pointers in data structures

PIE Considerations

• Address randomization: Need to leak an address to calculate offsets
• Common leak sources: Format strings, heap metadata, infoleaks
• vDSO:

  AT_SYSINFO_EHDR

  provides a stable base for gadgets

Static vs Dynamic Binaries

References

• GNU ELF Format
• readelf Manual
• ld.so(8) - Dynamic Loader
• getauxval(3) - Auxiliary Vector
• GCC Function Attributes