Python Arsenal for Reverse Engineering

http://pythonarsenal.erpscan.com/

Elfutils

https://access.redhat.com/site/documentation/en-US/Red_Hat_Developer_Toolset/1/html/User_Guide/chap-elfutils.html

sudo apt-get install elfutils
eu-readelf --all /lib/x86_64-linux-gnu/libc.so.6

gcc dumpspecs

gcc -dumpspecs
# ...
# *startfile:
# %{!mandroid|tno-android-ld:%{!shared: %{pg|p|profile:gcrt1.o%s;pie:Scrt1.o%s;:crt1.o%s}}    crti.o%s # %{static:crtbeginT.o%s;shared|pie:crtbeginS.o%s;:crtbegin.o%s};:%{shared: crtbegin_so%O%s;:  %{static: crtbegin_static%O%s;: crtbegin_dynamic%O%s}}}
# ...

http://gcc.gnu.org/onlinedocs/gcc-4.7.2/gcc/Spec-Files.html#Spec-Files

ld --verbose
#...
# OUTPUT_ARCH(i386:x86-64)
# ENTRY(_start)
# SEARCH_DIR("/usr/x86_64-linux-gnu/lib64"); SEARCH_DIR("=/usr/local/lib/x86_64-linux-gnu"); SEARCH_DIR("=/usr/local/lib64"); SEARCH_DIR("=/lib/x86_64-linux-gnu"); SEARCH_DIR("=/lib64"); SEARCH_DIR("=/usr/lib/x86_64-linux-gnu"); SEARCH_DIR("=/usr/lib64"); SEARCH_DIR("=/usr/local/lib"); SEARCH_DIR("=/lib"); # SEARCH_DIR("=/usr/lib");
SECTIONS
# ...

https://sourceware.org/binutils/docs/ld/

Kernel. Modules, program exec, syscalls, elf

man 2 syscalls

system_call()

strace -e trace=open date
strace -c date

ltrace -T -S rmdir t
ltrace -c -S rmdir t

ldd `which python`

Elf

# view headers, section...
readelf -a a.out
readelf --sections=vmlinux a.out
readelf --dynamic a.out

# disassembly
objdump -M intel -S a.out

# list symbols from object files
nm a.out

# dependencies resolved from this list
cat /proc/kallsyms | grep printk

cat /boot/System.map-3.13.0 | grep printk

stat a.out
file a.out

Modules

# list modules
lsmod

# Modules dependencies
cat /lib/modules/3.12.7/modules.dep | grep vboxdrv
man depmod

# info
modinfo vboxdrv

# view system device information
systool -v -m vboxdrv

struct module
sys_init_module() -> load_module()
sys_delete_module()
request_module()
hello world module

man 2 init_module
man 2 delete_module

# which module loader
cat /proc/sys/kernel/modprobe
sudo sysctl -a | grep modprobe

man modprobe
man insmod
man rmmod

ll /sbin/udevd

udevadm monitor

cat /proc/sys/kernel/taintined
dmesg | grep taint