//显示上面提取的信息
#include<stdio.h>
#include<elf.h>
#include<stdlib.h>
#include<string.h>
int main(int argc,char *argv[])
{
FILE *fp;
Elf64_Ehdr *ehdr;
Elf64_Shdr *shdr;
char buffer[1024]={0};
int i=0,j=0;
long length;
fp=fopen(argv[1],"rb");
if(fp==NULL)
{
printf("can not open %s\n",argv[1]);
return -1;
}
ehdr = (Elf64_Ehdr *)malloc(sizeof(Elf64_Ehdr));
shdr = (Elf64_Shdr *)malloc(sizeof(Elf64_Shdr));
fread(ehdr,sizeof(Elf64_Ehdr),1,fp);
if(ehdr->e_ident[EI_MAG0] == ELFMAG0 ||
ehdr->e_ident[EI_MAG1] == ELFMAG1 ||
ehdr->e_ident[EI_MAG2] == ELFMAG2 ||
ehdr->e_ident[EI_MAG3] == ELFMAG3)
{
printf("此文件是ELF文件!\n");
printf("节头表地址是 %p\n",ehdr+ehdr->e_shoff);
//获取节头字符串表地址
fseek(fp,ehdr->e_shoff,0);
fread(shdr,sizeof(Elf64_Shdr),ehdr->e_shnum,fp);
length = shdr[ehdr->e_shstrndx].sh_offset;
printf("节头字符串表的地址 %p\n",length);
//获取字符串表各节名称
fseek(fp,length,0);
fread(buffer,1,sizeof(buffer),fp);
//匹配"infosection"
for(i=0;i<=(int)ehdr->e_shnum;i++)
{
char *name=&buffer[shdr[i].sh_name];
if(!strcmp(name,".infosection"))
{
printf("匹配到的section name is %s\n", name);
char temp[shdr[i].sh_size];
fseek(fp, shdr[i].sh_offset, 0);
fread(temp, 1, shdr[i].sh_size, fp);
printf("匹配到的节的 message is : %s", temp);
}
}
}
else
{
printf("此文件不是ELF文件\n");
}
fclose(fp);
return 0;
}
检查打开的文件是不是ELF格式的文件,提取“特别”的节中的信息
原文地址：http://blog.csdn.net/u013012494/article/details/39225269
