Content about low-level

• Sep 9, 2026•7 min read•

  elfreadelf

  Mini-Readelf: Gluing It All Together

  The capstone. Four parts of pieces, headers, sections, symbols, relocations, joined into one tool that reads any ELF. The only new mechanic is the sh_link chain: offset into a table that holds offsets into a table that holds strings.

• Sep 5, 2026•6 min read•

  elfrelocations

  Relocations: How PIE Binaries Fix Their Addresses

  A PIE binary can't write final addresses because ASLR moves it. The linker leaves placeholders and the loader patches them after mapping. That's a relocation: R_X86_64_RELATIVE, GLOB_DAT and JUMP_SLOT.

• Sep 4, 2026•7 min read•

  elfsymbols

  Symbol Tables: What Function Names Actually Are

  Function names in a binary are just entries in a table. Two tables actually: .symtab and .dynsym. Here's what each is for, how the struct works, and how to resolve a name from an address.

• Sep 3, 2026•12 min read•

  elfloader

  Building a Custom ELF Loader from Scratch, in C

  You type ./program and the kernel loads it. Here's how that works: we build a userspace ELF loader in ~300 lines of C that maps PT_LOAD segments, builds a stack by hand, and jumps to the entry point.

• Sep 1, 2026•8 min read•

  elflow-level

  Parsing ELF Binaries in C

  The first step to actually understanding what runs on your machine: read an ELF file yourself. No libelf, no readelf — just mmap and pointer casts. I walk the header and section table of a real binary, and diff my output against the tools that already exist.