| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061 |
- ## ELF Header
- 7f 45 4c 46 ## e_ident[EI_MAG0-3] ELF's magic number
- 02 ## e_ident[EI_CLASS] Indicating 64 bit
- 01 ## e_ident[EI_DATA] Indicating little endianness
- 01 ## e_ident[EI_VERSION] Indicating original elf
- 00 ## e_ident[EI_OSABI] Set at 0 because none cares
- 00 ## e_ident[EI_ABIVERSION] See above
- 00 00 00 00 00 00 00
- 02 00 ## e_type Indicating Executable
- 3e 00 ## e_machine Indicating AMD64
- 01 00 00 00 ## e_version Indicating original elf
- b0 00 40 00 00 00 00 00 ## e_entry Address of the entry point
- 40 00 00 00 00 00 00 00 ## e_phoff Address of program header table
- 00 00 00 00 00 00 00 00 ## e_shoff Address of section header table
- 00 00 00 00 ## e_flags
- 40 00 ## e_ehsize Indicating our 64 Byte header
- 38 00 ## e_phentsize size of a program header table
- 02 00 ## e_phnum number of entries in program table
- 40 00 ## e_shentsize size of a section header table
- 00 00 ## e_shnum number of entries in section table
- 00 00 ## e_shstrndx index of the section names
- ## Program Header table
- 01 00 00 00 ## p_type
- 05 00 00 00 ## Flags
- 00 00 00 00 00 00 00 00 ## p_offset
- 00 00 40 00 00 00 00 00 ## p_vaddr
- 00 00 40 00 00 00 00 00 ## Undefined
- 11 01 00 00 00 00 00 00 ## p_filesz
- 11 01 00 00 00 00 00 00 ## p_memsz
- 00 00 20 00 00 00 00 00 ## Required alignment
- ## BSS section header
- 01 00 00 00 ## p_type
- 06 00 00 00 ## Flags
- 14 01 00 00 00 00 00 00 ## p_offset
- 14 01 60 00 00 00 00 00 ## p_vaddr
- 14 01 60 00 00 00 00 00 ## Undefined
- 00 00 00 00 00 00 00 00 ## p_filesz
- 00 00 40 00 00 00 00 00 ## p_memsz (4MB)
- 00 00 20 00 00 00 00 00 ## Required alignment
- ## Text section
- b0 2a # mov al,0x2a
- 88 04 25 14 01 60 00 # mov [0x600114],al
- 88 04 25 15 01 60 00 # mov [0x600115],al
- 88 04 25 16 01 60 00 # mov [0x600116],al
- 88 04 25 17 01 60 00 # mov [0x600117],al
- 88 04 25 18 01 60 00 # mov [0x600118],al
- 88 04 25 19 01 60 00 # mov [0x600119],al
- 88 04 25 1a 01 60 00 # mov [0x60011a],al
- 48 c7 c0 01 00 00 00 # mov rax,0x1
- 48 c7 c7 00 00 00 00 # mov rdi,0x0
- 48 c7 c6 14 01 60 00 # mov rsi,0x600114
- 48 c7 c2 03 00 00 00 # mov rdx,0x3
- 0f 05 # syscall
- 48 c7 c0 3c 00 00 00 # mov rax,0x3c
- 48 c7 c7 00 00 00 00 # mov rdi,0x0
- 0f 05 # syscall
|
