I spent the past two weeks in reading Practical Binary Analysis. Since I am not a professional reverse engineer, I glossed over the “Part III: Advanced Binary Analysis”, so I only read half the book. Even though, I still get a big gain:
(1) Know better of ELF file. On
*nix Operating system,
ELF file is everywhere: executable file, object file, shared library and coredump. “Chapter 2: The ELF format” gives me a clear explanation of the composition of
ELF. E.g., I know why some functions have “
@plt” suffix when using
gdb to debug it.
(2) Master many tricks about GNU Binutils.
GNU Binutils is a toolbox which provides versatile command line programs to analyze
ELF files. Literally it relies heavily on BFD library. I also get some sense about how to use
BFD library to tweak
(3) “Appendix A: A crash course on X86 assembly” is a good tutorial for refreshing
X86 architecture and assembly language.
(4) Others: E.g., I understand how to use
LD_PRELOAD environmental variable and dynamic linking functions to manipulate shared library.
All in all, if you are working on
*nix (although this book is based on
Linux, I think most knowledge are also applicable to other
*nix), you should try to read this book. I promise it is not a waste of time and you can always learn something, believe me!
In the past
2 days, I was tortured by
boost. The default
Ubuntu 16.04 is
1.58, but I met following compile errors:
/usr/include/boost/multi_index/detail/bucket_array.hpp: In static member function ‘static std::size_t boost::multi_index::detail::bucket_array_base<_>::size_index(std::size_t)’:
/usr/include/boost/multi_index/detail/bucket_array.hpp:84:62: error: invalid use of non-lvalue array
const std::size_t *bound=std::lower_bound(sizes,sizes+sizes_length,n);
/usr/include/boost/multi_index/detail/bucket_array.hpp:85:25: error: invalid use of non-lvalue array
/usr/include/boost/multi_index/detail/bucket_array.hpp:86:22: error: invalid use of non-lvalue array
1.55; and downloaded and built it:
$ ./bootstrap.sh --prefix=/usr/local
$ sudo ./b2 -a -q install
This time I found the default
gcc-5 could not compile successfully. So I followed this post to install
gcc-6, and modified
/home/nan/boost_1_55_0/tools/build/v2/user-config.jam file to use
gcc-6 to compile
# Configure specific gcc version, giving alternative name to use.
using gcc : 6 : g++-6 ;
Then my project can be compiled successfully. Check
gcc search header file path and library path:
$ echo | gcc-6 -E -Wp,-v -
ignoring nonexistent directory "/usr/local/include/x86_64-linux-gnu"
ignoring nonexistent directory "/usr/lib/gcc/x86_64-linux-gnu/6/../../../../x86_64-linux-gnu/include"
#include "..." search starts here:
#include <...> search starts here:
$ ldconfig -v 2>/dev/null | grep -v ^$'\t'
/usr/lib/nvidia-384/tls: (hwcap: 0x8000000000000000)
/usr/lib32/nvidia-384/tls: (hwcap: 0x8000000000000000)
You will find the fresh installed
boost 1.55 (in
/usr/local directory) always be found before default
boost 1.58 (header files are in
/usr/include/boostand libraries in
I try to develop
Rust program using newest
CLion, but find I can only pass arguments through command editor:
-- arg1 arg2 ....