Create ELF file from scratch

Creating smallest possible elf file.

Structure of ELF file:

Elf header
Program header
Code Part
Data Part

C structure of ELF header /usr/include/elf.h:

typedef struct
{
  unsigned char e_ident[EI_NIDENT]; /* Magic number and other info */
  Elf64_Half    e_type;             /* Object file type */
  Elf64_Half    e_machine;          /* Architecture */
  Elf64_Word    e_version;          /* Object file version */
  Elf64_Addr    e_entry;            /* Entry point virtual address */
  Elf64_Off     e_phoff;            /* Program header table file offset */
  Elf64_Off     e_shoff;            /* Section header table file offset */
  Elf64_Word    e_flags;            /* Processor-specific flags */
  Elf64_Half    e_ehsize;           /* ELF header size in bytes */
  Elf64_Half    e_phentsize;        /* Program header table entry size */
  Elf64_Half    e_phnum;            /* Program header table entry count */
  Elf64_Half    e_shentsize;        /* Section header table entry size */
  Elf64_Half    e_shnum;            /* Section header table entry count */
  Elf64_Half    e_shstrndx;         /* Section header string table index */
} Elf64_Ehdr;

Structure of Program header file /usr/include/elf.h:

typedef struct
{
  Elf64_Word    p_type;         /* Segment type */
  Elf64_Word    p_flags;        /* Segment flags */
  Elf64_Off     p_offset;       /* Segment file offset */
  Elf64_Addr    p_vaddr;        /* Segment virtual address */
  Elf64_Addr    p_paddr;        /* Segment physical address */
  Elf64_Xword   p_filesz;       /* Segment size in file */
  Elf64_Xword   p_memsz;        /* Segment size in memory */
  Elf64_Xword   p_align;        /* Segment alignment */
} Elf64_Phdr;

This structures is all what we need to make our ELF file. Now we will look inside kernel source and see that we need only one program header for our program. All big programs using usually two program headers one for code and one for data.

/linux-3.3.1/fs/binfmt_elf.c:605

if (loc->elf_ex.e_phnum < 1 ||
    loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
    goto out;

Step by step there should be filled all fields of the ELF header structure.

typedef struct
{
  unsigned char e_ident[EI_NIDENT]; /* default values of ELFMAG,ELFCLASS64,ELFDATA2LSB */
  Elf64_Half    e_type;             /* we making executable then it would be ET_EXEC  */
  Elf64_Half    e_machine;          /* Architecture is 0x3e(EM_X86_64) 
                                     (not from elf header 
                                     from /binutils/include/elf/common.h) */
  Elf64_Word    e_version;          /* Object file version EV_CURRENT */
  Elf64_Addr    e_entry;            /* Entry point virtual address points to
                                     main function it is with label entrypoint */
  Elf64_Off     e_phoff;            /* Program header table file offset */
                                      offset of program header sizeof(Elf64_Ehdr)
  Elf64_Off     e_shoff;            /* Section header table file offset 
                                        there is no section header */
  Elf64_Word    e_flags;            /* No processor-specific flags 
                                        */
  Elf64_Half    e_ehsize;           /* ELF header size in bytes 
                                        0x40 sizeof(Elf64_Ehdr)
  Elf64_Half    e_phentsize;        /* Program header table entry size 
                                        0x38 sizeof(Elf64_Phdr) */
  Elf64_Half    e_phnum;            /* Program header table entry count 
                                        0x01 */
  Elf64_Half    e_shentsize;        /* Section header table entry size 
                                        I put 0x40 */
  Elf64_Half    e_shnum;            /* Section header table entry count 
                                        0x00 */
  Elf64_Half    e_shstrndx;         /* There is no section header and 
                                     string table index is 0x0 then */
} Elf64_Ehdr;

With program header we will tell kernel how to load our file in memory and with part of file will be mmaped to needed address. As our data and code is placed in one address space and kernel ELF source says that there is enough with 1 program header then we will use only 1.

typedef struct
{
  Elf64_Word    p_type;         /* Segment type PT_LOAD */
  Elf64_Word    p_flags;        /* Segment flags PF_X,PF_R,PF_W
                                as our memory should be readable, writable and
                                executable as it contains code and data */
  Elf64_Off     p_offset;       /* Segment file offset 
                                    point to offset of entry point label offset
                                    in file */
  Elf64_Addr    p_vaddr;        /* Segment virtual address 
                                    64bits programs is usually at 0x400000+code_file_offset*/
  Elf64_Addr    p_paddr;        /* Segment physical address 
                                    same as above*/
  Elf64_Xword   p_filesz;       /* Segment size in file 
                                    size of code and data if file */
  Elf64_Xword   p_memsz;        /* Segment size in memory 
                                    same as above */
  Elf64_Xword   p_align;        /* Segment alignment 
                                    same as all programs have on my CPU*/
} Elf64_Phdr;

Now everything is ready. Only thing that is left is code some small code that uses data. And it would be hello world

mov eax, 1
mov edx, 12
mov rsi, qword 0x040009c ;address of string 
mov edi, 1
syscall

xor edi, edi
mov eax, 60
syscall

msg db 'Hello World',0xA

To calculate offsets of code and data labels is used macro:

macro doffset
{   
    bits = 16
    display ' 0x'
    repeat bits/4
        d = '0' + $ shr (bits-%*4) and 0Fh
        if d > '9'
            d = d + 'A'-'9'-1
        end if
        display d
    end repeat
    display 13,10
}

Total size of executable on 64bit system: ELF header size 0x40
Program header 0x38
Code size 0x24
Data size 0xc
Total: 168 bytes

If 32 bit system is used then need to find definitions of data structures and retype some bytes. Also architecture variable need to be changed.

Future plans:

Add some shared libs and compile smallest possible program using SDL graphics lib.

Code

Code is written and tested on x86_64.

Links

http://refspecs.freestandards.org/elf/elf.pdf

Source

http://archive.main.lv/files/writeup/create_elf_file_from_scratch/small_elf_file.zip