pwn.college - Program Interaction - Binary Files

Summary

Yan introduces the ELF (Executable and Linkable Format), used for executable files on Linux and FreeBSD. The video explains how ELF files describe programs for loading and execution, how their contents are organized, and which tools can inspect or modify them.

ELF Structure and Loading

• An ELF file begins with the magic bytes 7F 45 4C 46, spelling “ELF” after the initial byte. The file utility uses these bytes and other header information to identify a file’s type and architecture.
• ELF headers include details such as the target architecture and the program’s entry point—the address where execution begins after loading.
• Program headers describe segments: portions of the file that are loaded into memory. They specify information such as file offsets, sizes, memory locations, and permissions.
  • Segments can have different permissions, such as read-only, executable, or writable.
  • The video notes that virtual addresses are randomized on modern systems as a security measure.
  • Program headers provide the key information needed to load an ELF file. Other ELF metadata is primarily useful for understanding or working with the file.
• An interpreter entry identifies the loader used for the executable and its dependencies. It points to a path stored elsewhere in the file; it is not itself a segment-loading directive.

Sections and Common Contents

Section headers provide a more semantic view of an ELF file’s contents. They are useful to inspection, debugging, reversing, and editing tools, but are not required to load an ELF file.

Important sections discussed include:

• .text: Compiled executable code.
• .plt and .got: Help resolve and dispatch calls to library functions. The PLT contains call stubs; after a function’s address is resolved, the GOT can cache it for later use.
• .data: Writable global data with initial values stored in the file.
• .rodata: Read-only data, such as constant strings.
• .bss: Uninitialized writable global data. It is allocated as zero-filled memory, so its contents do not take up space in the file.

Symbols and Tools

Symbols provide names for functions, variables, and other structures. They support tasks such as looking up library functions and inspecting program contents. Symbol resolution can involve multiple tables and offsets.

The video demonstrates or mentions these tools:

• readelf: Inspects ELF headers and other metadata.
• Kaitai Struct: Shows parsed fields of a structured file alongside its raw bytes.
• nm: Lists symbols. The video uses nm -D to show dynamic imports and demonstrates finding the address of main.
• GCC: Creates ELF files from C programs.
• PatchELF: Modifies ELF properties, such as the interpreter or libraries to load.
• objcopy: Extracts sections, edits them, and writes them back into a file.
• Vim in binary mode: Makes small direct edits to binary data, though the video notes that editing a section separately can be more convenient.
• strip: Removes symbols and other metadata, which can reduce file size and reveal less information about the binary.

Demonstration and Practical Lessons

Yan uses a simple custom “cat” program that prints haha before outputting a file. The string is stored in .rodata. By extracting and replacing that section with objcopy, the demonstration changes the program’s output to hello; a direct binary edit changes it again to bye.

The main practical lesson is to distinguish between segments, which guide loading and execution, and sections, which make a file’s contents easier for tools and people to understand. The video recommends a blog post series for deeper study of ELF symbols and resolution, while noting that detailed ELF analysis is not necessary for the course at that point.

Speakers and Sources

• Yan — Instructor and only speaker identified in the subtitles.
• Tools and utilities featured or mentioned: file, readelf, Kaitai Struct, GCC, nm, PatchELF, objcopy, Vim, and strip.
• Additional source recommended: An unnamed blog post series about ELF and symbol resolution.