Learning Linux Binary Analysis

readecfs

The readecfs utility will be used throughout the rest of this chapter while demonstrating the different ECFS features. Here is a synopsis of the tool from readecfs -h:

Usage: readecfs [-RAPSslphega] <ecfscore> -a print all (equiv to -Sslphega) -s print symbol table info -l print shared library names -p print ELF program headers -S print ELF section headers -h print ELF header -g print PLTGOT info -A print Auxiliary vector -P print personality info -e print ecfs specific (auiliary vector, process state, sockets, pipes, fd's, etc.) -[View raw data from a section] -R <ecfscore> <section> -[Copy an ELF section into a file (Similar to objcopy)] -O <ecfscore> .section <outfile> -[Extract and decompress /proc/$pid from .procfs.tgz section into ...