elf数据结构解析

ELF文件数据结构

32位

#define EI_NIDENT   16

typedef struct {
    unsigned char   e_ident[EI_NIDENT];
    ELF32_Half      e_type;
    ELF32_Half      e_machine;
    ELF32_Word      e_version;
    ELF32_Addr      e_entry;
    ELF32_Off       e_phoff;
    ELF32_Off       e_shoff;
    ELF32_Word      e_flags;
    ELF32_Half      e_ehsize;
    ELF32_Half      e_phentsize;
    ELF32_Half      e_phnum;
    ELF32_Half      e_shentsize;
    ELF32_Half      e_shnum;
    ELF32_Half      e_shstrndx;
} Elf32_Ehdr;

64位

struct Elf64_Ehdr {
  unsigned char e_ident[EI_NIDENT];	//16字节 EI_NIDENT=16
  Elf64_Half e_type;				//2字节
  Elf64_Half e_machine;				//2字节
  Elf64_Word e_version;				//4字节
  Elf64_Addr e_entry;				//8字节
  Elf64_Off e_phoff;				//8字节
  Elf64_Off e_shoff;				//8字节
  Elf64_Word e_flags;				//4字节
  Elf64_Half e_ehsize;				//2字节
  Elf64_Half e_phentsize;			//2字节
  Elf64_Half e_phnum;				//2字节
  Elf64_Half e_shentsize;			//2字节
  Elf64_Half e_shnum;				//2字节
  Elf64_Half e_shstrndx;			//2字节

  bool checkMagic() const {
    return (memcmp(e_ident, ElfMagic, strlen(ElfMagic))) == 0;
  }

  unsigned char getFileClass() const { return e_ident[EI_CLASS]; }
  unsigned char getDataEncoding() const { return e_ident[EI_DATA]; }
};