ELF Binary Analysis

ELF (Executable and Linkable Format) is the standard binary format for Linux executables. Understanding ELF structure lets you locate code, find strings, identify functions, and analyze binaries using command-line tools like readelf, objdump, and nm.

For most CTF challenges, you don't need to understand every ELF detail. You need to know: where the code is (.text), where the strings are (.rodata), and where the function names are (symbol table).

ELF File Structure

Analysis Workflow

file ./binary
# ELF 64-bit LSB executable, x86-64, dynamically linked, not stripped

checksec --file=./binary
readelf -h ./binary | grep "Entry point"

strings ./binary | grep -iE "(flag|ctf|correct|wrong|pass|key)"
strings -n 8 ./binary

readelf -S ./binary            # list sections
readelf -s ./binary            # list symbols
nm ./binary                    # symbol table
nm --demangle ./binary         # demangle C++ names
ldd ./binary                   # dynamic dependencies

objdump -d -M intel ./binary   # Intel syntax (recommended)
objdump -d -M att ./binary     # AT&T syntax (default)

objdump -s -j .rodata ./binary
readelf -x .rodata ./binary

Basic Recon Commands

file ./binary
checksec --file=./binary
readelf -h ./binary

Stripped vs Not Stripped

file ./binary
# "not stripped" → has symbol table → function names visible

nm ./binary | grep " T "    # list text (code) symbols
# 0000000000401234 T main
# 0000000000401280 T check_password

Typical CTF Patterns

Checklist

• file → architecture and linking info
• checksec → protections
• strings | grep flag → quick win
• readelf -s / nm → symbol table for function names
• ldd → what libraries are loaded
• objdump -d | grep -B5 "call strcmp" → flag comparison
• readelf -x .rodata → constant data section
• If stripped → use Ghidra for decompilation

Last updated on Aug 1, 2025