Mastering GCC: From Preprocessing to ELF Analysis in Linux

Computer programming languages are divided into machine, assembly, and high-level languages. High-level languages must be translated to machine code via compilation or interpretation; examples of compiled languages include C, C++, Java, while interpreted languages include Python, Ruby, MATLAB, JavaScript.

The article explains how a C/C++ program is transformed into executable binary code through four steps: preprocessing, compilation, assembly, and linking.

GCC toolchain overview

GCC (GNU Compiler Collection) is a common compilation tool on Linux, consisting of GCC, Binutils, and the C runtime library.

GCC

GCC (GNU C Compiler) performs the compilation of C/C++ source code into machine code.

Binutils

Binutils provides a set of binary utilities such as addr2line, ar, objcopy, objdump, as, ld, ldd, readelf, and size.

addr2line: converts program addresses to source file and line numbers.

as: assembler.

ld: linker.

ar: creates static libraries; static libraries use .a (Linux) or .lib (Windows), while shared libraries use .so (Linux) or .dll (Windows).

ldd: shows shared library dependencies of an executable.

objcopy: converts object files between formats.

objdump: disassembles binaries.

readelf: displays ELF file information.

size: reports section sizes of an executable.

C runtime library

The C standard defines syntax and a standard library. The runtime library (CRT) provides implementations of these functions; C++ has its own runtime library.

Preparation

Using a Linux environment, a simple Hello World program is prepared as the example source.

#include <stdio.h>

// Simple program that prints a message.
int main(void) {
    printf("Hello World! 
");
    return 0;
}

Compilation process

1. Preprocessing

Preprocessing expands macros, handles #include directives, removes comments, adds line numbers, and preserves #pragma directives. Command:

$ gcc -E hello.c -o hello.i   // Stop after preprocessing

The generated hello.i can be viewed as plain text.

2. Compilation

Compilation performs lexical, syntax, and semantic analysis and generates assembly code. Command:

$ gcc -S hello.i -o hello.s   // Stop after compilation, produce assembly

3. Assembly

Assembly translates assembly code into object files (.o). Commands:

$ gcc -c hello.s -o hello.o
# or directly
$ as -c hello.s -o hello.o

The resulting hello.o is an ELF relocatable object.

4. Linking

Linking combines object files and libraries into an executable. Static linking copies library code into the executable; dynamic linking records library references to be loaded at runtime. Command examples:

$ gcc hello.c -o hello          // Dynamic linking
$ gcc -static hello.c -o hello // Static linking

Dynamic linking results in a smaller executable that depends on shared libraries (e.g., libc.so), while static linking produces a larger binary with no external dependencies.

ELF file analysis

1. ELF sections

Typical ELF sections include .text (code), .rodata (read‑only data), .data (initialized data), .bss (uninitialized data), and .debug (debug symbols).

2. Disassembly

Use objdump -D to disassemble an ELF file, or objdump -S to interleave source code with assembly.

$ objdump -D hello
$ objdump -S hello