Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>After some tests I figured things out, answering for anyone looking for this information :</p> <blockquote> <p>Can someone confirm I am going the right way structuring my Elf file this way ?</p> </blockquote> <p>Yes.</p> <p>As GDB is accepting the file, this seems to be the right way of doing. Results shown by <em>readelf -a</em> show the correct structure, good so far.</p> <blockquote> <p>I am not sure about where should lay the data (note &amp; program sections) into my file : is there a mandatory order, or is this my program headers offset that define where the data is ?</p> </blockquote> <p>Offsets given to <code>Phdr.p_offset</code> should point where the data lays in the Elf file. They start at the very beginning of the file.</p> <p>For example :</p> <p>The p_offset for the <code>PT_NOTE</code> program header should be set at <code>sizeof(ElfW(Ehdr)) + ehdr.e_phnum*sizeof(ElfW(Phdr))</code>. <code>ehdr.e_phnum</code> being the number of program header present in the Elf file.</p> <p>For the <code>PT_LOAD</code> program header, this is a bit longer, cause we will also have to add length of all the note sections. For a "standard" core dump with a note segment containg <code>NT_PRSTATUS</code>, <code>NT_PRPSINFO</code> and <code>NT_AUXV</code> sections, offset for the PT_LOAD data (<code>Phdr.p_offset</code>) will be :</p> <pre><code>sizeof(ElfW(Ehdr)) + ehdr.e_phnum*sizeof(ElfW(Phdr)) + sizeof(ElfW(Nhdr)) + sizeof(name_of_section) + sizeof(struct prstatus) + sizeof(ElfW(Nhdr)) + sizeof(name_of_section) + sizeof(struct prpsinfo) + sizeof(ElfW(Nhdr)) + sizeof(name_of_section) + sizeof(struct auxv_t) </code></pre>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload