Systems Programming · Cluster
Binary Formats
Executables, sections, and parsing.
- 01 ELF Program Headers and the Mapping a Loader Performs Before _start How PT_LOAD entries describe the bytes the kernel maps, why file offsets and virtual addresses must be congruent modulo the page size, and where the process stack layout comes from.
- 02 Section Headers, String Tables, and the Bookkeeping a Linker Needs What the section table adds that segments do not carry, how names are resolved through a string table by offset, and why a stripped binary can still run without it.
- 03 Relocation Entries and the Arithmetic a Linker Performs How REL and RELA entries encode the patch a linker must apply, why the addend is sometimes stored in the section and sometimes in the entry, and what R_X86_64_RELATIVE actually computes.
- 04 The PLT and GOT Protocol That Defers Symbol Resolution How a call to an external function becomes a jump through a writable table, what the resolver stub pushes, and what is given up when binding happens eagerly instead.
- 05 Mach-O Load Commands and the Segments a dyld Image Is Built From How the Mach-O header addresses its command list, why __PAGEZERO occupies the low address space, and how chained fixups replaced the older rebase and bind opcode streams.
- 06 PE/COFF Relative Virtual Addresses and the Import Directory How the Windows loader resolves addresses without a link-time base, what an RVA is relative to, and why the import table is a tree of small structures with no fixed total size.
- 07 DWARF Debug Information: Abbreviation Tables and the Line Number State Machine How debug sections compress a typed tree of entries into a byte stream, why attribute forms matter, and how a line table is reconstructed by running a small virtual machine over its opcodes.
- 08 Symbol Versioning and the Two Hash Tables Behind Every Lookup How a symbol name acquires a version suffix at runtime, what SysV and GNU hash tables each optimise for, and why a lookup that succeeds on one distribution can fail on another.
- 09 Position-Independent Executables and the Cost of PC-relative Addressing Why a PIE carries relocation tables that a fixed-address executable does not, how RIP-relative instructions encode the same reference, and what the GOT still has to mediate.
- 10 Parsing Untrusted Binaries Without Trusting Their Length Fields Why every offset in an executable is an attacker-controlled integer, how a bounded cursor converts that into a single failure path, and which structural checks the formats leave to the reader.