What problem does it solve? Reverse engineers need to understand the internal structure of Linux ELF executables and shared libraries before deeper analysis, but manually decoding headers, dynamic sections, and relocation tables is error-prone and time-consuming. This Skill provides a structured workflow for parsing ELF files with readelf, objdump, and manual byte-level verification. ## Core Features & Use Cases - Three-table parsing: Read and cross-check the ELF header, program headers, and section headers with readelf, including field-by-field offset maps for 32/64-bit and endianness handling. - Dynamic linking analysis: Inspect GOT/PLT, .dynsym/.dynstr, relocation types (JUMP_SLOT, GLOB_DAT, RELATIVE), and DT_* tags to understand symbol resolution and import behavior. - Security property checks: Determine NX stack, RELRO level (partial vs full via GNU_RELRO + BIND_NOW), and stack canary presence to assess exploitation surface. - Anti-analysis handling: Recover symbols from stripped binaries, detect forged headers that break readelf, unpack gzexe-wrapped files, and find hidden logic in .preinit_array/.init_array. - Use Case: Given a suspicious Linux .so from a firmware image, run the workflow to map its segments, list imported functions, check whether the GOT is writable, and disassemble constructor functions that run before main. ## Quick Start Analyze the ELF structure of the attached sample.so file, including its headers, dynamic symbols, GOT/PLT, init_array callbacks, and security properties like RELRO and NX.
