Parses a 64-bit ELF binary's section headers and dynamic symbol table to enumerate every external shared library and imported function it depends on at load time.
Business Impact Summary: Unvetted or tampered binaries can quietly link against unexpected system libraries and functions, creating blind spots in an organization's attack surface. This capability lets security teams verify a binary's declared dependencies before trusting it in a production or forensic environment.
- Operational Risk / Threat Model: Surfaces functions like
systemorexec*imported by a binary, which are common indicators of command injection or privilege escalation logic baked into the executable. - Engineering Mastery: Proves direct manipulation of raw ELF section headers, dynamic symbol tables, and string table offsets via memory-mapped I/O, without relying on
libelforreadelf. - Defensive Utility: Gives incident responders a fast way to profile an unfamiliar binary's runtime dependency footprint without a full disassembler, supporting supply-chain verification and triage.
- Language & Toolchain: C / GCC (
-Wall -Wextra -O2) - Operating System Focus: Linux, 64-bit little-endian ELF (
ELFCLASS64) - Core APIs/Primitives Used:
mmap,fstat,<elf.h>typed structs (Elf64_Ehdr,Elf64_Shdr,Elf64_Dyn,Elf64_Sym)
- Section Header Resolution: Walks the ELF section header table directly, resolving section names through the section header string table (
.shstrtab) rather than assuming fixed indices. - Dynamic Dependency Extraction: Reads
DT_NEEDEDentries from.dynamicto list required shared libraries, resolving each name through.dynstr. - Symbol Table Filtering: Iterates
.dynsymentries, isolating undefined (SHN_UNDEF)STT_FUNCsymbols to surface only externally imported functions, and reports statically linked binaries (which lack these sections) as having no dynamic dependencies rather than treating them as an error.
make
./elf_deps /bin/ls