我如何知道ELF文件是用于Cortex-A还是Cortex-M？

Question

我在做二进制分析时有个问题。对于已经为ARM体系结构识别的给定的ELF文件(hello.elf)，如何快速地知道这个ELF是用于Cortex-A还是Cortex-M?，更具体地说，我正在尝试识别整个裸金属图像(或像FreeRTOS这样的RTOS图像)。

从file hello.elf的结果来看

% file hello.elf
hello.elf: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, with debug_info, not stripped

我们只能看到这个ELF是为ARM准备的。从readelf -h ./hello.elf的结果来看

% readelf -h ./hello.elf
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           ARM
  Version:                           0x1
  Entry point address:               0xcb5
  Start of program headers:          52 (bytes into file)
  Start of section headers:          150896 (bytes into file)
  Flags:                             0x5000200, Version5 EABI, soft-float ABI
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         5
  Size of section headers:           40 (bytes)
  Number of section headers:         19
  Section header string table index: 17

它也只是显示这个文件是用于ARM架构的。那么，还有其他方法可以快速识别ELF文件的目标体系结构吗？

Answer 1

如果您的二进制文件遵循Arm ELF规范，则有一个属性部分，其中包含有关cpu体系结构和(如果适用)体系结构概要文件的信息。这一信息可以由可读的提取。请注意，信息是编译器和链接器视图，有时可能是错误的。

下面的第一个示例来自为Cortex-A8构建的二进制文件，第二个示例是为Cortex-M33构建的二进制文件。两者都是使用IAR工具链构建的。

> readelf -A cortex-a8.out                                                       
Attribute Section: aeabi
File Attributes
  Tag_conformance: "2.10"
  Tag_CPU_arch: v7
  Tag_CPU_arch_profile: Application
  Tag_ARM_ISA_use: Yes
  Tag_THUMB_ISA_use: Thumb-2
  Tag_PCS_config: Bare platform
  Tag_ABI_align_needed: 8-byte
  Tag_ABI_align_preserved: 8-byte, except leaf SP
  Tag_ABI_enum_size: small
  Tag_ABI_VFP_args: compatible
  Tag_CPU_unaligned_access: v6
  Tag_DIV_use: Not allowed

 > readelf -A cortex-m33.out
Attribute Section: aeabi
File Attributes
  Tag_conformance: "2.10"
  Tag_CPU_arch: v8-M.mainline
  Tag_CPU_arch_profile: Microcontroller
  Tag_THUMB_ISA_use: Yes
  Tag_FP_arch: FPv5/FP-D16 for ARMv8
  Tag_PCS_config: Bare platform
  Tag_ABI_align_needed: 8-byte
  Tag_ABI_align_preserved: 8-byte, except leaf SP
  Tag_ABI_enum_size: forced to int
  Tag_ABI_HardFP_use: SP only
  Tag_ABI_VFP_args: compatible
  Tag_CPU_unaligned_access: v6
  Tag_DIV_use: Not allowed