elf-inspection

ELF 检查

用途

指导 Agent 检查 Linux ELF 二进制文件：符号表、节布局、动态链接、调试信息以及链接器错误诊断。

触发条件

• “这个二进制文件依赖哪些库？”
• “为什么这个二进制文件这么大？”
• “我遇到了 undefined reference，或者运行时找不到符号”
• “如何检查这个二进制文件是否包含调试信息？”
• “如何查找库导出了哪些符号？”
• “如何检查二进制文件是否为 PIE / 是否启用了 RELRO？”

工作流

1. 快速概览：file 和 size

file prog                    # type, arch, linkage, stripped or not
size prog                    # section sizes: text, data, bss
size --format=sysv prog      # detailed per-section breakdown

2. 动态依赖：ldd

ldd ./prog                   # show all shared lib dependencies
ldd -v ./prog                # verbose: include symbol versions

# Check why a library is loaded
ldd ./prog | grep libssl

# For a library (not an executable)
ldd ./libfoo.so

如果 ldd 显示 not found，则共享库缺失于 LD_LIBRARY_PATH 或 /etc/ld.so.conf 中。

修复方法：

export LD_LIBRARY_PATH=/path/to/libs:$LD_LIBRARY_PATH
# Or install the library and run ldconfig
sudo ldconfig

3. 符号：nm

nm prog                       # all symbols (T=text, D=data, U=undefined, etc.)
nm -D ./libfoo.so             # dynamic symbols only
nm -C prog                    # demangle C++ symbols
nm --defined-only prog        # only defined symbols
nm -u prog                    # only undefined (needed) symbols
nm -S prog                    # include symbol size

# Search for a symbol
nm -D /usr/lib/libssl.so | grep SSL_read

符号类型代码：

• T / t — 文本段（代码）：全局 / 本地
• D / d — 数据段（已初始化）：全局 / 本地
• B / b — BSS（未初始化）：全局 / 本地
• R / r — 只读数据：全局 / 本地
• U — 未定义（需要在链接时提供）
• W / w — 弱符号

4. 节：readelf

readelf -h prog               # ELF header (arch, type, entry point)
readelf -S prog               # all sections
readelf -l prog               # program headers (segments)
readelf -d prog               # dynamic section (like ldd but raw)
readelf -s prog               # symbol table
readelf -r prog               # relocations
readelf -n prog               # notes (build ID, ABI tag)
readelf --debug-dump=info prog | head -100  # DWARF info
readelf -a prog               # all of the above

5. 反汇编和源代码：objdump

# Disassemble all code sections
objdump -d prog
objdump -d -M intel prog      # Intel syntax

# Disassemble + intermix source (needs -g at compile time)
objdump -d -S prog

# Disassemble specific symbol
objdump -d prog | awk '/^[0-9a-f]+ <main>:/,/^$/'

# All sections (including data)
objdump -D prog

# Header info
objdump -f prog
objdump -p prog               # private headers (including needed libs)

6. 二进制文件安全加固检查

# Check for PIE, RELRO, stack canary, NX
# Use checksec (install separately)
checksec --file=prog

# Manual checks:
readelf -h prog | grep Type           # ET_DYN = PIE, ET_EXEC = non-PIE
readelf -d prog | grep GNU_RELRO      # RELRO present
readelf -d prog | grep BIND_NOW       # full RELRO
readelf -s prog | grep __stack_chk    # stack protector
readelf -l prog | grep GNU_STACK      # NX bit (RW = no exec, RWE = exec stack)

7. 节大小分析（二进制文件臃肿）

# Detailed section sizes
size --format=sysv prog | sort -k2 -nr | head -20

# Per-object contribution (with -Wl,--print-map or bloaty)
# Bloaty (install separately): https://github.com/google/bloaty
bloaty prog

# Check stripped vs not
file prog
strip --strip-all -o prog.stripped prog
ls -lh prog prog.stripped

8. 构建 ID

构建 ID 可唯一标识一次二进制文件 / 库构建，从而支持通过 debuginfod 查找。

readelf -n prog | grep 'Build ID'
# or
file prog | grep BuildID

9. 常见诊断流程

“运行时出现未定义符号”

# Which library was expected to provide it?
nm -D libfoo.so | grep mysymbol
# Is the library in the runtime path?
ldd ./prog | grep libfoo
# Check LD_PRELOAD / LD_LIBRARY_PATH

“二进制文件太大”

size --format=sysv prog | sort -k2 -nr | head
nm -S --defined-only prog | sort -k2 -nr | head -20
objdump -d prog | awk '/^[0-9a-f]+ </{fn=$2} /^[0-9a-f]/{count[fn]++} END{for(f in count) print count[f], f}' | sort -nr | head -20

如需快速参考，请参阅 references/cheatsheet.md。

相关技能

• 使用 skills/binaries/linkers-lto 了解链接器标志和 LTO
• 使用 skills/binaries/binutils 了解 ar、strip、objcopy、addr2line
• 使用 skills/debuggers/core-dumps 了解构建 ID 和 debuginfod 的用法