ELF
The Executable and Linkable Format: headers, program headers, sections, symbol tables, relocations, and the code that reads and loads them.
- •7 min read•elfreverse-engineering
Mini-Readelf: Gluing It All Together
The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.
- •6 min read•elfreverse-engineering
Relocations: How PIE Binaries Fix Their Addresses
A PIE binary can't write final addresses because ASLR moves it. The linker leaves placeholders and the loader patches them after mapping. That's a relocation: R_X86_64_RELATIVE, GLOB_DAT and JUMP_SLOT.
- •7 min read•elfreverse-engineering
Symbol Tables: What Function Names Actually Are
Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.
- •12 min read•elfreverse-engineering
Building a Custom ELF Loader from Scratch, in C
You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.
- •8 min read•elfreverse-engineering
Parsing ELF Binaries in C
The first step to actually understanding what runs on your machine: read an ELF file yourself. No libelf, no readelf — just mmap and pointer casts. I walk the header and section table of a real binary, and diff my output against the tools that already exist.
- •5 min read•elfreverse-engineering
Easy Elf (reversing.kr)
Find the password that makes the binary print `Correct!`.
- •4 min read•elfreverse-engineering
Static Analysis of ELF x86 Binary - RootMe Challenge
Systematic reverse engineering approach for unprotected ELF binaries using static analysis techniques and Ghidra decompilation