This guide explains what a Core Dump is, why it is essential for Linux crash analysis, how the kernel creates it, common signals that trigger it, typical causes of crashes, and step‑by‑step configuration and GDB techniques to capture and debug Core Dump files effectively.
This article explains how a C/C++ program is compiled into an ELF executable, details the ELF file structure, describes the kernel's validation and segment mapping, covers dynamic linking, and shows how the process starts execution from the _start entry point, providing practical commands and debugging tips.
An open‑source PHP‑written Rust compiler can generate native x86‑64 Linux ELF binaries without LLVM, assemblers, or linkers, offering ownership, borrowing, type checking, generics, traits, closures, and more; the guide covers installation via PHP and WSL, usage commands, supported features, and current limitations.
This article details a step‑by‑step method to embed Frida scripts directly into Android binaries, creating a root‑free, self‑contained Xposed module by compiling a custom Frida‑gadget, editing ELF/PE files, adding magic markers, and automating packaging with Rust and apktool.
This article explains the ELF file format, its various types, internal structure, compilation and linking steps, and how the Linux kernel loads ELF binaries, creates processes with fork and exec, handles dynamic linking, relocation, and builds the process address space, providing developers and system engineers with deep insight into Linux execution.
This article explains why C/C++ function and global variable addresses are fixed at link time, how modern operating systems provide each process with a private virtual address space, the role of ABI and linker scripts in defining segment layout, and how the loader later maps those virtual addresses to physical memory.
This article explains how linkers determine virtual memory addresses during linking, describes the operating system's per‑process virtual address space, outlines ABI and ELF conventions including default base addresses and linker scripts, and shows how the loader later maps those virtual addresses to physical memory.
This article explains the ELF (Executable and Linkable Format) file structure, how to identify ELF binaries, the roles of headers, program and section tables, the compilation‑to‑execution lifecycle, and practical tools for inspecting and manipulating ELF files on Linux.
This article explains what ELF files are, details their header, program header table, sections and section header table, and walks through how Linux uses fork and execve to clone a child process and load an ELF binary into a new address space.
This article explores the mechanisms of dynamic linking on Linux, covering global symbol interposition, lazy binding, position‑independent code, relocation tables, hidden symbols, and initialization order, with detailed code examples and assembly analysis to help developers understand and troubleshoot symbol conflicts and address‑independent execution.
The article explains that an executable file contains machine instructions which the operating system parses (e.g., ELF), loads into RAM by allocating distinct memory regions for code, data, heap, stack and any dynamic libraries, then reads the entry‑point address to set the CPU’s instruction pointer and start execution.
This article explains how an executable file is identified, loaded into memory, and organized into code, data, heap, and stack segments, describing the OS’s role, ELF format details, dynamic library placement, and how the CPU finds the program’s entry point to start execution.
This guide walks through the complete GCC compilation pipeline—preprocessing, compilation, assembly, and linking—demonstrates how to build a simple C program, inspect the resulting ELF file, and use Binutils tools to analyze sections and disassemble the binary.
This article explains how high‑level C/C++ programs are transformed into processor‑executable binary code on Linux, covering preprocessing, compilation, assembly, linking, the GCC toolchain, Binutils utilities, C runtime libraries, and ELF file analysis with practical command examples.
The article explains how AArch64 stack unwinding works using both frame‑pointer based methods and DWARF .eh_frame/.debug_frame CFI data, detailing the calling convention, compiler effects, CIE/FDE structures, and their integration into Android’s simpleperf profiler for accurate back‑traces.
This guide explains how GNU ld linker scripts work, covering their purpose, basic concepts like sections, symbols, VMA/LMA, the syntax of SECTIONS, INPUT, OUTPUT, and other commands, with practical examples and code snippets for embedded and desktop ELF binaries.
This article explains how the HeapTaskDaemon thread drives garbage collection in Android's ART runtime, analyzes its source code and related HeapTask classes, and presents two practical methods—adding custom HeapTasks or pausing existing ones—using ELF symbol lookup, ndk_dlopen, and virtual‑function hooking to temporarily suppress GC for better performance.
This article explores how C++ programs start, detailing the role of the _start entry point, the initialization of global objects via .init_array, __libc_csu_init, and constructors, and provides practical techniques—including linking with crt files and using init_priority—to control and debug initialization order and avoid crashes.
This article explains how a Go hello‑world program starts, tracing the ELF entry point, runtime initialization, GMP scheduler setup, creation of the main goroutine, and the flow into the user's main function.
The article shows how to shrink Android NDK .so binaries by over 30% through code de‑duplication, disabling exceptions/RTTI/iostream, using fine‑grained sections with LTO and dead‑code elimination, limiting exported symbols via version scripts, employing JNI dynamic registration, and consolidating C++ runtime dependencies into a shared library.
This article guides readers through the complete GCC toolchain workflow—preprocessing, compilation, assembly, linking—and explains how to analyze the resulting ELF binary, covering essential commands, Binutils utilities, and runtime library details for C/C++ programs on Linux.
This article explains the ELF (Executable and Linking Format) specification, its variants for Windows PE and Linux, the classification of ELF object files, data representation, ARM‑specific extensions, and the structure of headers, sections, symbols, and related file types such as .axf, .bin and .hex.
This article explains the four common compilation and linking problems C/C++ developers encounter on 64‑bit Linux, covering preprocessing, ELF object formats, static library ordering, dynamic linking mechanics, symbol interposition, and runtime loading pitfalls, and provides concrete solutions for each.
This guide explains how high‑level C/C++ source code is transformed into executable binary code on Linux using the GCC toolchain, covering preprocessing, compilation, assembly, linking, and ELF file inspection with practical command examples.
This article explains the complete transformation of C/C++ source code into processor‑executable binary files using the GCC toolchain, covering preprocessing, compilation, assembly, linking, ELF structure, and practical command‑line examples on a Linux system.
This article explains the fundamental concepts behind C language compilation, covering lexical, syntax, and semantic analysis, GCC options, file types, static and dynamic linking, ELF structure, and the loader process that turns source code into a runnable program.
This article explains step by step how a simple Hello World program is compiled, linked, and executed on Linux, covering the ELF executable format, the role of the file command, the fork‑execve process creation sequence, and the kernel’s binary loader implementation.
This article walks through the complete GCC toolchain workflow—preprocessing, compilation, assembly, and linking—using a simple C "Hello World" program, explains the roles of GCC, Binutils and the C runtime, and shows how to inspect the resulting ELF binary with common Linux utilities.
This guide explains how C/C++ source code is transformed into a runnable binary on Linux by walking through the four stages of preprocessing, compilation, assembly, and linking, detailing GCC and Binutils utilities, command‑line examples, and ELF file inspection techniques.
This article explains how Meituan engineers shrink Android native .so libraries by analyzing ELF sections, simplifying dynamic symbols, removing dead code, using link‑time optimization, garbage‑collecting sections, applying size‑focused compiler flags, disabling exceptions/RTTI, and merging or extracting libraries, achieving 30‑60% APK size reductions and faster load times.
This article explains how high‑level C/C++ programs are transformed into processor‑executable binaries on Linux, covering preprocessing, compilation, assembly, linking, the GCC and Binutils utilities, and how to inspect the resulting ELF file.
This article provides a comprehensive, byte‑level walkthrough of the ELF file format on Linux, explaining headers, sections, program headers, string tables, and how linkers and loaders interpret each part using tools like readelf and od.
ByteDance has open‑sourced bhook, an Android PLT hook framework supporting API 16‑31 and multiple ABIs, featuring a trampoline‑based hook mechanism, automatic ELF monitoring, and a robust native crash‑catching module for safe runtime function interception.
An in‑depth look at the core differences between Linux and Windows kernels, covering kernel fundamentals, user‑ versus kernel‑space, system calls, Linux’s monolithic design with multitasking, SMP and ELF format, and Windows NT’s hybrid architecture with the PE executable format.
ELF PLT Hook on Android intercepts shared‑library calls by overwriting GOT/PLT entries, providing a stable production‑ready method for tasks such as APM monitoring, APK unpacking and performance profiling, with a clear workflow, dynamic‑linking background, and a practical implementation using the plthook library.
This guide walks through the complete GCC compilation pipeline—preprocessing, compilation, assembly, and linking—using a simple C "Hello World" program, detailing each step, relevant commands, and how to inspect the resulting ELF binary.
This guide explains how to resolve glibc version errors on CentOS 6 by analyzing ELF symbol tables with objdump and readelf, editing .gnu.version_r entries via a hex editor, and using patchelf to add needed libraries, allowing older systems to run newer binaries safely.
This guide explains why a third‑party program compiled against glibc 2.14/2.17 fails on CentOS 6, how to inspect the ELF symbol versions with objdump and readelf, and how to patch the binary using a hex editor and patchelf so it can run with the system's older glibc.
This article explains how Linux creates a new process with its own virtual address space, maps ELF executable segments to memory regions, describes the roles of code, data, and BSS sections, shows how to inspect mappings via /proc/pid/maps, and clarifies segment‑section relationships and loading details.
This article explains why the same program can execute on Linux yet not run on Windows by breaking down the compilation, assembly, linking stages, the ELF executable format, and how loaders and symbol tables make cross‑platform execution possible.
This article provides an in‑depth overview of the ELF file format, describing its headers, section and program tables, symbol structures, and demonstrates how to use this knowledge to locate and hook functions in Android native libraries such as libmedia.so.
This article explains the detailed ELF file format—including ELF header, section and program header tables, various section types, and a practical Android native hook example—helping developers understand and troubleshoot native binary loading and symbol resolution.
This article explains the design, components, and implementation of UCloud's application hot‑patch framework, covering its motivation, safety checks, multi‑thread support, and how the Creator, Loader, and Core Runtime work together to apply, manage, and roll back patches without restarting services.
This article explains a technique to automatically generate hot patches for any function in a Linux ELF application by comparing original and patched object files, extracting changed sections, resolving symbols, and validating the patch with tools like objdump and gdb.
This article introduces the ELF file format used in Linux and Android, explains its three main types, compares it to Windows PE, and outlines how linkers and loaders interpret ELF headers, sections, and segments for native development and reverse engineering.
The article describes how to remotely debug Android apps by creating a custom JDWP socket channel that bypasses Android 7.0’s library restrictions using a fake dlsym ELF parser, enabling developers to retrieve runtime state from production builds without prior instrumentation or user cooperation.
This article explains Android's linker workflow for loading and linking native .so libraries, detailing the do_dlopen sequence, ELF parsing, memory mapping, soinfo allocation, relocation handling, and constructor calls, and concludes with a brief overview of common SO packing techniques.
This guide walks through the ELF format, the compilation‑assembly‑linking pipeline, and step‑by‑step creation and usage of static (.a) and dynamic (.so) libraries on Linux, including gcc, ar, ldconfig, ldd and runtime loading with dlopen.
This article explains how Linux programs are loaded, the distinction between ELF sections and segments, virtual‑to‑physical address translation, the role of the MMU, brk/sbrk usage, address‑space layout, and practical steps to reproduce and avoid segmentation faults.
The article reveals a novel ELF‑binary manipulation technique that prevents IDA Pro from loading malicious Linux samples, demonstrates reconstruction steps with hex editors, compares other disassemblers, and provides YARA rules and a GitHub script for detection and remediation.
This article describes how to statically analyze Linux ELF executables using objdump and shell scripts to collect function definitions, source locations, and call sites, and then construct a detailed function call graph with a C++ data structure.
On Linux, C source is turned into an ELF executable through compilation with gcc, linking of object files and libraries, and loading by the kernel, a process that depends on CPU architecture, binary formats, symbol tables, dynamic relocation, and startup code before main runs.
