사용 방법
- 설치 명령을 복사하고 자신의 에이전트 환경에 설치하기 전에 소스 패키지를 확인하세요.
- 필요한 도구, 인증 정보, 지원 환경은 원본 문서에서 확인하세요.
- 입력과 원하는 산출물을 설명하고 출처와 결과를 대조하세요.
npx skills add https://github.com/mohitmishra786/low-level-dev-skills --skill elf-inspection시작 전 확인
- 설치에는 모델 구독, API 한도, 파일 접근 권한이 포함되지 않습니다.
- 별점 수와 설치 수는 활동 지표이며 독립적인 품질·보안 검증이 아닙니다.
원본 Skill 문서
원본 저장소의 제목, 예시, 코드, 표, 링크, 이미지를 유지해 표시합니다.
ELF Inspection
Purpose
Guide agents through inspecting Linux ELF binaries: symbol tables, section layout, dynamic linking, debug info, and diagnosing linker errors.
Triggers
- "What libraries does this binary depend on?"
- "Why is this binary so large?"
- "I have an
undefined referenceor symbol not found at runtime" - "How do I check if debug info is in this binary?"
- "How do I find what symbols a library exports?"
- "How do I check if a binary is PIE / has RELRO?"
Workflow
1. Quick overview: file and size
bash
file prog # type, arch, linkage, stripped or not
size prog # section sizes: text, data, bss
size --format=sysv prog # detailed per-section breakdown2. Dynamic dependencies: ldd
bash
ldd ./prog # show all shared lib dependencies
ldd -v ./prog # verbose: include symbol versions
# Check why a library is loaded
ldd ./prog | grep libssl
# For a library (not an executable)
ldd ./libfoo.soIf ldd shows not found, the shared library is missing from LD_LIBRARY_PATH or /etc/ld.so.conf.
Fix:
bash
export LD_LIBRARY_PATH=/path/to/libs:$LD_LIBRARY_PATH
# Or install the library and run ldconfig
sudo ldconfig3. Symbols: nm
bash
nm prog # all symbols (T=text, D=data, U=undefined, etc.)
nm -D ./libfoo.so # dynamic symbols only
nm -C prog # demangle C++ symbols
nm --defined-only prog # only defined symbols
nm -u prog # only undefined (needed) symbols
nm -S prog # include symbol size
# Search for a symbol
nm -D /usr/lib/libssl.so | grep SSL_readSymbol type codes:
T/t— text (code): global / localD/d— data (initialised): global / localB/b— BSS (uninitialised): global / localR/r— read-only data: global / localU— undefined (needs to be provided at link time)W/w— weak symbol
4. Sections: readelf
bash
readelf -h prog # ELF header (arch, type, entry point)
readelf -S prog # all sections
readelf -l prog # program headers (segments)
readelf -d prog # dynamic section (like ldd but raw)
readelf -s prog # symbol table
readelf -r prog # relocations
readelf -n prog # notes (build ID, ABI tag)
readelf --debug-dump=info prog | head -100 # DWARF info
readelf -a prog # all of the above5. Disassembly and source: objdump
bash
# Disassemble all code sections
objdump -d prog
objdump -d -M intel prog # Intel syntax
# Disassemble + intermix source (needs -g at compile time)
objdump -d -S prog
# Disassemble specific symbol
objdump -d prog | awk '/^[0-9a-f]+ <main>:/,/^$/'
# All sections (including data)
objdump -D prog
# Header info
objdump -f prog
objdump -p prog # private headers (including needed libs)6. Binary hardening check
bash
# Check for PIE, RELRO, stack canary, NX
# Use checksec (install separately)
checksec --file=prog
# Manual checks:
readelf -h prog | grep Type # ET_DYN = PIE, ET_EXEC = non-PIE
readelf -d prog | grep GNU_RELRO # RELRO present
readelf -d prog | grep BIND_NOW # full RELRO
readelf -s prog | grep __stack_chk # stack protector
readelf -l prog | grep GNU_STACK # NX bit (RW = no exec, RWE = exec stack)7. Section size analysis (binary bloat)
bash
# Detailed section sizes
size --format=sysv prog | sort -k2 -nr | head -20
# Per-object contribution (with -Wl,--print-map or bloaty)
# Bloaty (install separately): https://github.com/google/bloaty
bloaty prog
# Check stripped vs not
file prog
strip --strip-all -o prog.stripped prog
ls -lh prog prog.stripped8. Build ID
Build IDs uniquely identify a binary/library build, enabling debuginfod lookups.
bash
readelf -n prog | grep 'Build ID'
# or
file prog | grep BuildID9. Common diagnosis flows
"undefined symbol at runtime"
bash
# Which library was expected to provide it?
nm -D libfoo.so | grep mysymbol
# Is the library in the runtime path?
ldd ./prog | grep libfoo
# Check LD_PRELOAD / LD_LIBRARY_PATH"binary is too large"
bash
size --format=sysv prog | sort -k2 -nr | head
nm -S --defined-only prog | sort -k2 -nr | head -20
objdump -d prog | awk '/^[0-9a-f]+ </{fn=$2} /^[0-9a-f]/{count[fn]++} END{for(f in count) print count[f], f}' | sort -nr | head -20For a quick reference, see references/cheatsheet.md.
Related skills
- Use
skills/binaries/linkers-ltofor linker flags and LTO - Use
skills/binaries/binutilsforar,strip,objcopy,addr2line - Use
skills/debuggers/core-dumpsfor build ID and debuginfod usage
