Recall from Chapter 2, The ELF Binary Format, that the dynamic segment can be found in the program header table and is of type PT_DYNAMIC
. There is also a .dynamic
section that also points to the dynamic segment.
The dynamic segment is an array of ElfN_Dyn structs that contains d_tag
and a corresponding value that exists in a union:
typedef struct { ElfN_Sxword d_tag; union { ElfN_Xword d_val; ElfN_Addr d_ptr; } d_un; } ElfN_Dyn;
Using readelf
we can easily view the dynamic segment of a file.
Following is an example of a legitimate dynamic segment:
$ readelf -d ./test
Dynamic section at offset 0xe28 contains 24 entries:
Tag Type Name/Value
0x0000000000000001 (NEEDED) Shared library: [libc.so.6]
0x000000000000000c (INIT) 0x4004c8
0x000000000000000d (FINI) 0x400754...