使用readelf分析so文件
版权归作者所有，如有转发，请注明文章出处：https://cyrus-studio.github.io/blog/
readelf
readelf 是一个用于读取和显示 ELF（Executable and Linkable Format）文件信息的工具。虽然 readelf 工具本身是为 Unix-like 操作系统设计的，但你可以在 Windows 上通过 WSL 使用它。
WSL 允许你在 Windows 上运行 Linux 发行版，并且可以在其中使用 readelf 工具。
安装 WSL
打开 PowerShell 以管理员身份运行，并执行以下命令启用 WSL 并安装 Ubuntu 系统
wsl --install -d Ubuntu
然后设置用户账户和密码。
通过 wsl 命令进入 Ubuntu 系统。
在 wsl 中 /mnt/d 对应的就是 windows 下的 D 盘，其他同理。
使用 readelf
调用 readelf -a 一次性查看文件中的所有信息，包括文件头、程序头、节头、符号表、动态节等。
readelf -a libGameVMP.so
ELF Header:
Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
Class: ELF64
Data: 2's complement, little endian
Version: 1 (current)
OS/ABI: UNIX - System V
ABI Version: 0
Type: DYN (Shared object file)
Machine: AArch64
Version: 0x1
Entry point address: 0x2650
Start of program headers: 64 (bytes into file)
Start of section headers: 130160 (bytes into file)
Flags: 0x0
Size of this header: 64 (bytes)
Size of program headers: 56 (bytes)
Number of program headers: 7
Size of section headers: 64 (bytes)
Number of section headers: 7
Section header string table index: 1
Section Headers:
[Nr] Name Type Address Offset
Size EntSize Flags Link Info Align
[ 0] NULL 0000000000000000 00000000
0000000000000000 0000000000000000 0 0 0
[ 1] .shstrtab STRTAB 000000000001fe30 0001fe30
0000000000000035 0000000000000000 0 0 0
[ 2] .dynsym DYNSYM 0000000000000518 00000518
0000000000000048 0000000000000018 A 3 1 4
[ 3] .dynstr STRTAB 0000000000000ec0 00000ec0
0000000000000342 0000000000000000 A 0 0 0
[ 4] .symtab SYMTAB 000000000001fe65 0001fe65
0000000000000048 0000000000000018 A 5 1 4
[ 5] .strtab STRTAB 000000000001fead 0001fead
000000000000002b 0000000000000000 A 0 0 1
[ 6] .dynamic DYNAMIC 000000000006eae8 0001dae8
0000000000000240 0000000000000008 AX 3 0 4
Key to Flags:
W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
L (link order), O (extra OS processing required), G (group), T (TLS),
C (compressed), x (unknown), o (OS specific), E (exclude),
D (mbind), p (processor specific)
There are no section groups in this file.
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x000000000001cba4 0x000000000001cba4 R E 0x10000
LOAD 0x000000000001d9e8 0x000000000006e9e8 0x000000000006e9e8
0x00000000000021de 0x0000000000002418 RW 0x1000
DYNAMIC 0x000000000001dae8 0x000000000006eae8 0x000000000006eae8
0x0000000000000240 0x0000000000000240 RW 0x8
NOTE 0x00000000000001c8 0x00000000000001c8 0x00000000000001c8
0x0000000000000024 0x0000000000000024 R 0x4
GNU_EH_FRAME 0x0000000000015634 0x0000000000056634 0x0000000000056634
0x0000000000001afc 0x0000000000001afc R 0x4
GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x0000000000000000 0x0000000000000000 RW 0x10
GNU_RELRO 0x000000000001d9e8 0x000000000006e9e8 0x000000000006e9e8
0x0000000000000618 0x0000000000000618 R 0x1
Section to Segment mapping:
Segment Sections...
00 .dynsym .dynstr
01 .dynamic
02 .dynamic
03
04
05
06 .dynamic
Dynamic section at offset 0x1dae8 contains 32 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [liblog.so]
0x0000000000000001 (NEEDED) Shared library: [libandroid.so]
0x0000000000000001 (NEEDED) Shared library: [libz.so]
0x0000000000000001 (NEEDED) Shared library: [libc.so]
0x0000000000000001 (NEEDED) Shared library: [libm.so]
0x0000000000000001 (NEEDED) Shared library: [libstdc++.so]
0x0000000000000001 (NEEDED) Shared library: [libdl.so]
0x000000000000000e (SONAME) Library soname: [libGameVMP.so]
0x000000000000000c (INIT) 0x1bd68
0x0000000000000019 (INIT_ARRAY) 0x6e9e8
0x000000000000001b (INIT_ARRAYSZ) 216 (bytes)
0x000000000000001a (FINI_ARRAY) 0x6eac0
0x000000000000001c (FINI_ARRAYSZ) 16 (bytes)
0x0000000000000004 (HASH) 0x1f0
0x0000000000000005 (STRTAB) 0xec0
0x0000000000000006 (SYMTAB) 0x518
0x000000000000000a (STRSZ) 834 (bytes)
0x000000000000000b (SYMENT) 24 (bytes)
0x0000000000000003 (PLTGOT) 0x6ed28
0x0000000000000002 (PLTRELSZ) 1488 (bytes)
0x0000000000000014 (PLTREL) RELA
0x0000000000000017 (JMPREL) 0x1c78
0x0000000000000007 (RELA) 0x1330
0x0000000000000008 (RELASZ) 2376 (bytes)
0x0000000000000009 (RELAENT) 24 (bytes)
0x0000000000000018 (BIND_NOW)
0x000000006ffffffb (FLAGS_1) Flags: NOW
0x000000006ffffffe (VERNEED) 0x12d0
0x000000006fffffff (VERNEEDNUM) 3
0x000000006ffffff0 (VERSYM) 0x1202
0x000000006ffffff9 (RELACOUNT) 76
0x0000000000000000 (NULL) 0x0
There are no static relocations in this file.
To see the dynamic relocations add --use-dynamic to the command line.
The decoding of unwind sections for machine type AArch64 is not currently supported.
Symbol table '.dynsym' contains 3 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000002650 0 SECTION LOCAL DEFAULT bad section index[ 10]
readelf: Warning: local symbol 1 found at index >= .dynsym's sh_info value of 1
2: 000000000006ead0 0 SECTION LOCAL DEFAULT bad section index[ 16]
readelf: Warning: local symbol 2 found at index >= .dynsym's sh_info value of 1
Symbol table '.symtab' contains 3 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __stack_chk_fail
2: 0000000000000000 0 FUNC GLOBAL DEFAULT UND __intel_security[...]
Histogram for bucket list length (total of 97 buckets):
Length Number % of total Coverage
0 38 ( 39.2%)
1 29 ( 29.9%) 29.0%
2 20 ( 20.6%) 69.0%
3 9 ( 9.3%) 96.0%
4 1 ( 1.0%) 100.0%
No version information found in this file.
Displaying notes found at file offset 0x000001c8 with length 0x00000024:
Owner Data size Description
GNU 0x00000014 NT_GNU_BUILD_ID (unique build ID bitstring)
Build ID: 7e55cc28965ecb053c55055043d9f1ed3260a498
自动化脚本
新一个 soinfo.sh，编写一个简单的Shell脚本，调用 readelf -a 命令并将输出保存到同名的 .txt 文件中。
#!/bin/bash
# 检查是否提供了SO文件
if [ -z "$1" ]; then
echo "Usage: $0 <path_to_so_file>"
exit 1
fi
# 提取输入文件的文件名
so_file="$1"
# 检查文件是否存在
if [ ! -f "$so_file" ]; then
echo "Error: File '$so_file' not found!"
exit 1
fi
# 获取文件名（不含扩展名）
base_name=$(basename "$so_file" .so)
# 创建输出文件名（.txt文件）
output_file="${base_name}.txt"
# 调用 readelf -a 并将结果导出到输出文件
readelf -a "$so_file" > "$output_file"
# 提示用户操作成功
echo "Information exported to $output_file"
创建 scripts 目录，并把 soinfo.sh 放到该目录下。 执行 nano ~/.bashrc 命令，把 scripts 目录添加到环境变量
export PATH=$PATH:/mnt/e/scripts
修改保存后，执行 source ~/.bashrc 使其生效。
之后就可以调用 soinfo.sh <so_path> 将 SO 文件的信息导出到同名的 .txt 文件
soinfo.sh libGameVMP.so
readelf: Warning: local symbol 1 found at index >= .dynsym's sh_info value of 1
readelf: Warning: local symbol 2 found at index >= .dynsym's sh_info value of 1
Information exported to libGameVMP.txt