An analysis on ELF files

During my journey towards the reverse engineering of boot binary, I tried a lot of way to disassemble a boot binary. Generally  hackers use tools like IDA pro. But this tools comes with a cost (IDA pro costs 1000 Dollar for single user license). Freeware version of IDA pro is available (for non-commercial use only), but this comes with limited disassembler functionality (like ARMv7 & ARMv8 not supported).
A lot of open sourced tools like Ghidra (from NSA) is present, but it has very much limited functionality.

So, I finally decided to disassemble a flat binary from my own (may be using GNU). But it is not a straight forward task. When we build a boot binary (let say OPTEE or bootloader or ATF), at first a Executable & Linkable File is created then using objcopy tool a flat binary file is finally produced which goes to the ROM. In the continued series of this post, we will crack from scratch what is the significance of ELF, its various sections, why ELF is not flashed in ROM and instead why flat binary files are used, and finally we will try to disassemble some small boot binary.

So Let's start with a normal HELLO WORLD program (let's say helloworld.c), we will build using gcc.

#include <stdio.h>

int main()
{
    printf("HELLO WORLD\n");
    return 0;
}

Then we build using the command (gcc helloworld.c -o outfile). The output will generate an ELF file. The objective of this post to analyze this ELF file.

So, in this experiment we will be using these tools: readelf, objdump, xxd

An ELF file contain three main type of headers:

1. File Header/ELF header: Contain the top level information like for which machine the ELF is build for, Endianess of binary, class of binary (ELF64/32), start address of Program headers & the section headers. readelf -h outfile command is used to extract the ELF header.
   
2. Program Header: It tells the system about how to create the process. readelf -l outfile command is used to extract the program header. In my outfile there were 9 program header. The first one of type PHDR is used to represent the program header segment itself. Now each program header represent each segment. Some are of type LOAD (loadable segment) that tells the system about all the loadable data like .text, .rodata, .bss, .data etc while creating the process. 
   
    
3. Section Header: When a program is build, the object file contain lot of sections like .texr, .rodata, .bss, data, .symtab, etc. The section header depict each one of these sections. One very interesting section that I explored among them is the strtab section that contain all the section name in concatenated form. I guess the while loading the binary, the linux kernel first check and ensures that some particular section (let say .text) is present in the ELF or not. readelf -S outfile command is to be used to get the section header.
   

For reference the ELF wiki link gives a very good explanation about the ELF files.
Also this NPTEL youtube video explains a lot about ELF headers.
Maybe next we will explore something more on reverse engineering some helloworld program using the readelf, objdump and xxd tools.