// include/uapi/linux/elf.h
#define EI_NIDENT   16
​
typedef struct elf32_hdr{unsigned char e_ident[EI_NIDENT];Elf32_Half    e_type;Elf32_Half    e_machine;Elf32_Word    e_version;Elf32_Addr    e_entry;  /* Entry point */Elf32_Off e_phoff;Elf32_Off e_shoff;Elf32_Word    e_flags;Elf32_Half    e_ehsize;Elf32_Half    e_phentsize;Elf32_Half    e_phnum;Elf32_Half    e_shentsize;Elf32_Half    e_shnum;Elf32_Half    e_shstrndx;
} Elf32_Ehdr;
​
typedef struct elf64_hdr {unsigned char e_ident[EI_NIDENT]; /* ELF "magic number" */Elf64_Half e_type;Elf64_Half e_machine;Elf64_Word e_version;Elf64_Addr e_entry;       /* Entry point virtual address */Elf64_Off e_phoff;        /* Program header table file offset */Elf64_Off e_shoff;        /* Section header table file offset */Elf64_Word e_flags;Elf64_Half e_ehsize;Elf64_Half e_phentsize;Elf64_Half e_phnum;Elf64_Half e_shentsize;Elf64_Half e_shnum;Elf64_Half e_shstrndx;
} Elf64_Ehdr;

// include/uapi/linux/elf.h
/* These constants define the different elf file types */
#define ET_NONE   0     // 未知目标文件格式
#define ET_REL    1     // 可重定位文件
#define ET_EXEC   2     // 可执行文件
#define ET_DYN    3     // 动态共享目标文件
#define ET_CORE   4     // core文件，程序崩溃时内存映像的转储格式
#define ET_LOPROC 0xff00    // 特定处理器文件的扩展下界
#define ET_HIPROC 0xffff    // 特定处理器文件的扩展上界

// include/uapi/linux/elf-em.h
/* These constants define the various ELF target machines */
#define EM_NONE     0
#define EM_M32      1
#define EM_SPARC    2
#define EM_386      3
#define EM_68K      4
#define EM_88K      5
#define EM_486      6   /* Perhaps disused */
#define EM_860      7
#define EM_MIPS     8   /* MIPS R3000 (officially, big-endian only) *//* Next two are historical and binaries andmodules of these types will be rejected byLinux.  */
#define EM_MIPS_RS3_LE  10  /* MIPS R3000 little-endian */
#define EM_MIPS_RS4_BE  10  /* MIPS R4000 big-endian */
​
#define EM_PARISC   15  /* HPPA */
#define EM_SPARC32PLUS  18  /* Sun's "v8plus" */
#define EM_PPC      20  /* PowerPC */
......

// include/uapi/linux/elf.h
typedef struct elf32_phdr{Elf32_Word    p_type;Elf32_Off p_offset;Elf32_Addr    p_vaddr;Elf32_Addr    p_paddr;Elf32_Word    p_filesz;Elf32_Word    p_memsz;Elf32_Word    p_flags;Elf32_Word    p_align;
} Elf32_Phdr;
​
typedef struct elf64_phdr {Elf64_Word p_type;Elf64_Word p_flags;Elf64_Off p_offset;       /* Segment file offset */Elf64_Addr p_vaddr;       /* Segment virtual address */Elf64_Addr p_paddr;       /* Segment physical address */Elf64_Xword p_filesz;     /* Segment size in file */Elf64_Xword p_memsz;      /* Segment size in memory */Elf64_Xword p_align;      /* Segment alignment, file & memory */
} Elf64_Phdr;

// include/uapi/linux/elf.h
/* These constants are for the segment types stored in the image headers */
#define PT_NULL    0 // 忽略
#define PT_LOAD    1 // 可加载程序段
#define PT_DYNAMIC 2 // 动态链接信息
#define PT_INTERP  3 // 动态加载器名称
#define PT_NOTE    4 // 辅助的附加信息
#define PT_SHLIB   5 // 保留
#define PT_PHDR    6 // 程序头表
#define PT_TLS     7               /* Thread local storage segment */
#define PT_LOOS    0x60000000      /* OS-specific */
#define PT_HIOS    0x6fffffff      /* OS-specific */
#define PT_LOPROC  0x70000000
#define PT_HIPROC  0x7fffffff

// include/uapi/linux/elf.h
/* These constants define the permissions on sections in the program    header, p_flags. */
#define PF_R        0x4  // 可读
#define PF_W        0x2  // 可写
#define PF_X        0x1  // 可执行

// include/uapi/linux/elf.h
typedef struct elf32_shdr {Elf32_Word    sh_name;Elf32_Word    sh_type;Elf32_Word    sh_flags;Elf32_Addr    sh_addr;Elf32_Off sh_offset;Elf32_Word    sh_size;Elf32_Word    sh_link;Elf32_Word    sh_info;Elf32_Word    sh_addralign;Elf32_Word    sh_entsize;
} Elf32_Shdr;
​
typedef struct elf64_shdr {Elf64_Word sh_name;       /* Section name, index in string tbl */Elf64_Word sh_type;       /* Type of section */Elf64_Xword sh_flags;     /* Miscellaneous section attributes */Elf64_Addr sh_addr;       /* Section virtual addr at execution */Elf64_Off sh_offset;      /* Section file offset */Elf64_Xword sh_size;      /* Size of section in bytes */Elf64_Word sh_link;       /* Index of another section */Elf64_Word sh_info;       /* Additional section information */Elf64_Xword sh_addralign; /* Section alignment */Elf64_Xword sh_entsize;   /* Entry size if section holds table */
} Elf64_Shdr;

// include/uapi/linux/elf.h
/* sh_type */
#define SHT_NULL    0 // 表示该节是无效节头，没有对应的节
#define SHT_PROGBITS    1
#define SHT_SYMTAB  2
#define SHT_STRTAB  3
#define SHT_RELA    4
#define SHT_HASH    5
#define SHT_DYNAMIC 6
#define SHT_NOTE    7
#define SHT_NOBITS  8
#define SHT_REL     9
#define SHT_SHLIB   10
#define SHT_DYNSYM  11
#define SHT_NUM     12
#define SHT_LOPROC  0x70000000
#define SHT_HIPROC  0x7fffffff
#define SHT_LOUSER  0x80000000
#define SHT_HIUSER  0xffffffff

// include/uapi/linux/elf.h
/* sh_flags */
#define SHF_WRITE   0x1  // 可写
#define SHF_ALLOC   0x2  // 该节包含内存在进程运行时需要占用内存单元
#define SHF_EXECINSTR   0x4 // 该节内容是指令代码
#define SHF_MASKPROC    0xf0000000

$ readelf -H
Usage: readelf <option(s)> elf-file(s)Display information about the contents of ELF format filesOptions are:-a --all               Equivalent to: -h -l -S -s -r -d -V -A -I-h --file-header       Display the ELF file header-l --program-headers   Display the program headers--segments          An alias for --program-headers-S --section-headers   Display the sections' header--sections          An alias for --section-headers-e --headers           Equivalent to: -h -l -S......

$ readelf -h file // 显示ELF文件头
$ readelf -l file // 显示所有的程序头
$ readelf -S file // 显示所有的节头
$ readelf -e file // 显示ELF文件头、程序头、节头全部的头信息，相当于同时运行参数-h、-l、-S

$ man xxd
NAMExxd - make a hexdump or do the reverse.SYNOPSISxxd -h[elp]xxd [options] [infile [outfile]]
......

-a: 自动跳过空白内容，默认关闭；
-u: 使用大写字符的十六进制，默认小写；
-c: 后边加上数字，表示每行显示多少字节的十六进制数，默认16字节，最大256字节；
-g: 设定以多少个字节为一块，默认2字节；
-l: 显示多少字节内容；
-b: 表示以二进制的形式查看文件内容；
-s: 后面接[+-]和address，+表示从address处开始的内容，-表示从距末尾address处开始的内容；