Reverse › Module 4 › Lesson 1
ELF Named
ELF headers, segments, and sections name Linux binary layout — triage YOUR toy binaries on $RE_LAB, not unauthorized firmware.
Visual · re_elf_named
ELF literacy. $RE_LAB only. Original Cyberlium.
Opening
ELF tells you bitness, entry point, and where .text lives — read before you disassemble.
Executable and Linkable Format (ELF) wraps Linux binaries: ELF header (magic 7F454C46), program headers for loading, section headers for linking and analysis.text holds code,.data/.bss hold globals,.rodata holds constants. readelf and objdump expose structure on $RE_LAB toys. Cyberlium teaches ELF literacy for static triage. You will NOT extract unauthorized firmware blobs from neighbor devices. Next: PE Named.
1. ELF header and magic
Magic bytes 7F 'E' 'L' 'F' identify ELF. Class byte marks 32 vs 64-bit; e_entry gives start address. Type EXEC vs DYN distinguishes static PIE from shared objects.
Run readelf -h on YOUR Linux toy binary in $RE_LAB; log entry and class in chmod 600 notes.
Command guide
Try these commands — ELF header and magic
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ELF format — https://man7.org/linux/man-pages/man5/elf.5.html (headers, segments, sections) readelf -h/-l — https://man7.org/linux/man-pages/man1/readelf.1.html Ghidra ELF loader — https://ghidra.re/ (GUI import after readelf triage)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install binutils
macOS:
Command — copy this
brew install binutils
Windows: Use WSL binutils Use WSL or install file for Windows
═══ LINUX / macOS ═══
Optional command
sudo apt install binutils # readelf objdump nm
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
file "$LAB_RE/bin/hello"
readelf -h "$LAB_RE/bin/hello"
readelf -l "$LAB_RE/bin/hello" | head -15Primary tools to practice this lesson: readelf, file. Reference sites: ELF format (https://man7.org/linux/man-pages/man5/elf.5.html); readelf -h/-l (https://man7.org/linux/man-pages/man1/readelf.1.html); Ghidra ELF loader (https://ghidra.re/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sections vs segments
Sections (.text,.data,.symtab) aid static analysis; segments (LOAD) describe runtime mapping. Disassembly usually targets.text section addresses.
Stripped binaries omit symtab — function names come from analysis tools, not unauthorized symbol leaks from commercial apps.
3. ELF literacy boundaries
Forbidden: dumping proprietary firmware without rights, repacking commercial Linux binaries for piracy, or sharing extracted ELF from unauthorized products.
Ship: ELF triage lines — magic, class, entry,.text address for YOUR toy binary. Next: PE Named.
4. What you ship: ELF triage sheet for $RE_LAB
readelf -h highlights for YOUR Linux toy. $RE_LAB named. NEVER unauthorized firmware dumps. chmod 600.
5. What you record before the next lesson
Date. ELF triage. $RE_LAB named. File t23-m04-l01-elf-named.txt chmod 600.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Dump neighbor router firmware 'for ELF practice.' Skip entry point logging.
Right
Write ELF triage for $RE_LAB toy binary. Next: PE Named.
Mission: triage YOUR ELF toy binary
1) Log magic, class, entry from readelf -h. 2) Note.text section address. 3) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Entry point is where execution begins — start of RE map.
Knowledge Check
APPLY: ELF literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: ELF magic begins with 7F454C46.
True or False
Knowledge Check
APPLY: Executable code typically resides in:
Multiple choice