Distinguish shared objects from position-independent executables

Question

I am looking for a quick way to check if an ELF binary is generic or position-independent executable. I think this can be done by checking the contained characters / functions. I am looking for a more efficient way not to read the full file. I have to check on different platforms, at least Android, Linux (32 and 64 bit).

Answer 1

I am looking for a quick way to check if an ELF binary is a common or independent position.

Unable to verify: The PIE executable is a shared object.

I think this can be done by checking the contained characters / functions.

Symbols can be deleted, and as soon as they appear, you cannot say.

shared objects and executables that they usually differ in related startup code

This is true: PIE is usually associated with Scrt1.o , but usually there is no shared library. But there is nothing that would prevent the shared library from communicating with Scrt1.o , and in the split binary, even finding that the startup code can be somewhat problematic.

If you really need to distinguish between the shared library and the PIE executable that you created (instead of solving the general case of any shared library and any PIE), then check for PT_INTERP ( PT_INTERP readelf -l a.out | grep INTERP ), probably the most an easy way: the PIE executable will have PT_INTERP , but usually not in shared libraries ( libc.so.6 is a notable exception).

Answer 2

Try elfutils and the included eh- readelf program:

 eh-readelf --file-header $ELFFILE 

will show you the file header and which file it is:

 ... Typ: EXEC (Executable file) ... 

or

 Typ: DYN (Shared object file) 

Combined with a small sed string, you should get the desired results.