[deleted]
How is a binary executable organized? Let's explore it (2014)
31–40 of 93 posts
Re: How is a binary executable organized? Let's explore it (2014)
#32The format of executable files fascinated me back in the early 90s, to the point that I spent weeks writing (in Modula 2) a DOS and Windows executable file viewer that I named VEXE, releasing it as shareware in 1991.
It found a niche following among crackers, even deserving a mention in a +ORC tutorial, https://gist.github.com/callowaysutton/48bdf0245e17e72d41a15..., probably because it could detect various encryption and compression methods used to prevent the reverse engineering of those programs.
Re: How is a binary executable organized? Let's explore it (2014)
#33Earlier quoted context omitted.
The entry point can be anywhere in the .text section, and often won't be at the beginning of the section.
yes and then you'll have a bad time, but at the same time per convention _start is where .text begins. You can see where it starts with readelf --file-header and look at Entry point address field. You can change it, yes.
A common hack to reduce ELF size is actually to start the first section (possibly the .text) right on the elf header, as this circumvents the alignment requirements.
Re: How is a binary executable organized? Let's explore it (2014)
#34> Executables aren’t magic. Nothing in a computer is magic. It was all designed by humans, every single one of which was once a clueless noob. No one is born understanding this stuff.
The actual /behavior/ of computers, though, tends to emerge from the confluence of complex processes that humans /can't/ understand...our AGI leverages this emergence to enable problem solving in domains where complexity exceeds human capabilities.
Re: How is a binary executable organized? Let's explore it (2014)
#35Earlier quoted context omitted.
yes and then you'll have a bad time, but at the same time per convention _start is where .text begins. You can see where it starts with readelf --file-header and look at Entry point address field. You can change it, yes.
A common hack to reduce ELF size is actually to start the first section (possibly the .text) right on the elf header, as this circumvents the alignment requirements.
probably not even mandatory.. lots of /usr/bin stuff on my ubuntu machine have __libc_start_main only
Re: How is a binary executable organized? Let's explore it (2014)
#36Amazingly helpful!
Re: How is a binary executable organized? Let's explore it (2014)
#37For folks interested in this topic who have not seen Cosmopolitan and RedBean, αcτµαlly pδrταblε εxεcµταblε (2020) is a great read too: https://justine.lol/ape.html
Re: How is a binary executable organized? Let's explore it (2014)
#38Julia's articles are always excellent. I've always had great results teaching people that compiled code doesn't keep secrets by demoing `strings`.
Can you elaborate?
The other replies are pretty good. You can find all sorts of goodies in string data inside a binary: hostnames, URL fragments, error messages or templates, credentials. Pretty much any string constants that a program might use.
Re: How is a binary executable organized? Let's explore it (2014)
#39Julia's articles are always excellent. I've always had great results teaching people that compiled code doesn't keep secrets by demoing `strings`.
Explain that to the German judges that fined some poor fella for finding passwords in a binary by [doing the equivalent of] running strings on it. They claim he 'circumvented' the software's 'security measures'.
https://www.theregister.com/2024/01/19/germany_fine_security...
Re: How is a binary executable organized? Let's explore it (2014)
#40Earlier quoted context omitted.
The entry point can be anywhere in the .text section, and often won't be at the beginning of the section.
yes and then you'll have a bad time, but at the same time per convention _start is where .text begins. You can see where it starts with readelf --file-header and look at Entry point address field. You can change it, yes.
No, it's not even a convention, _start is most commonly not where .text begins.
Compiling a static hello world binary on my system (aarch64 fedora 39, gcc -static hello.c -o hello), .text starts at 0x410080, e_entry is at 0x4103c0, and the _start symbol is also at 0x4103c0. This is not unusual at all.