2013-9-1 Create ELF file from scratch

Creating smallest possible elf file.

Structure of ELF file:
Elf header
Program header
Code Part
Data Part

C structure of ELF header /usr/include/elf.h:

	typedef struct
	{
	  unsigned char	e_ident[EI_NIDENT];	/* Magic number and other info */
	  Elf64_Half	e_type;				/* Object file type */
	  Elf64_Half	e_machine;			/* Architecture */
	  Elf64_Word	e_version;			/* Object file version */
	  Elf64_Addr	e_entry;			/* Entry point virtual address */
	  Elf64_Off		e_phoff;			/* Program header table file offset */
	  Elf64_Off		e_shoff;			/* Section header table file offset */
	  Elf64_Word	e_flags;			/* Processor-specific flags */
	  Elf64_Half	e_ehsize;			/* ELF header size in bytes */
	  Elf64_Half	e_phentsize;		/* Program header table entry size */
	  Elf64_Half	e_phnum;			/* Program header table entry count */
	  Elf64_Half	e_shentsize;		/* Section header table entry size */
	  Elf64_Half	e_shnum;			/* Section header table entry count */
	  Elf64_Half	e_shstrndx;			/* Section header string table index */
	} Elf64_Ehdr;

Structure of Program header file /usr/include/elf.h:

	typedef struct
	{
	  Elf64_Word	p_type;			/* Segment type */
	  Elf64_Word	p_flags;		/* Segment flags */
	  Elf64_Off		p_offset;		/* Segment file offset */
	  Elf64_Addr	p_vaddr;		/* Segment virtual address */
	  Elf64_Addr	p_paddr;		/* Segment physical address */
	  Elf64_Xword	p_filesz;		/* Segment size in file */
	  Elf64_Xword	p_memsz;		/* Segment size in memory */
	  Elf64_Xword	p_align;		/* Segment alignment */
	} Elf64_Phdr;

This structures is all what we need to make our ELF file.
Now we will look inside kernel source and see that
we need only one program header for our program. All big programs
using usually two program headers one for code and one for data.

/linux-3.3.1/fs/binfmt_elf.c:605

	if (loc->elf_ex.e_phnum < 1 ||
		loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
		goto out;

Step by step there should be filled all
fields of the ELF header structure.

	typedef struct
	{
	  unsigned char	e_ident[EI_NIDENT];	/* default values of ELFMAG,ELFCLASS64,ELFDATA2LSB */
	  Elf64_Half	e_type;				/* we making executable then it would be ET_EXEC  */
	  Elf64_Half	e_machine;			/* Architecture is 0x3e(EM_X86_64) 
										 (not from elf header 
										 from /binutils/include/elf/common.h) */
	  Elf64_Word	e_version;			/* Object file version EV_CURRENT */
	  Elf64_Addr	e_entry;			/* Entry point virtual address points to
										 main function it is with label entrypoint */
	  Elf64_Off		e_phoff;			/* Program header table file offset */
										  offset of program header sizeof(Elf64_Ehdr)
	  Elf64_Off		e_shoff;			/* Section header table file offset 
											there is no section header */
	  Elf64_Word	e_flags;			/* No processor-specific flags 
											*/
	  Elf64_Half	e_ehsize;			/* ELF header size in bytes 
											0x40 sizeof(Elf64_Ehdr)
	  Elf64_Half	e_phentsize;		/* Program header table entry size 
											0x38 sizeof(Elf64_Phdr) */
	  Elf64_Half	e_phnum;			/* Program header table entry count 
											0x01 */
	  Elf64_Half	e_shentsize;		/* Section header table entry size 
											I put 0x40 */
	  Elf64_Half	e_shnum;			/* Section header table entry count 
											0x00 */
	  Elf64_Half	e_shstrndx;			/* There is no section header and 
										 string table index is 0x0 then */
	} Elf64_Ehdr;

With program header we will tell kernel how to load our file in memory
and with part of file will be mmaped to needed address. As our data
and code is placed in one address space and kernel ELF source says
that there is enough with 1 program header then we will use only 1.

	typedef struct
	{
	  Elf64_Word	p_type;			/* Segment type PT_LOAD */
	  Elf64_Word	p_flags;		/* Segment flags PF_X,PF_R,PF_W
									as our memory should be readable, writable and
									executable as it contains code and data */
	  Elf64_Off		p_offset;		/* Segment file offset 
										point to offset of entry point label offset
										in file */
	  Elf64_Addr	p_vaddr;		/* Segment virtual address 
										64bits programs is usually at 0x400000+code_file_offset*/
	  Elf64_Addr	p_paddr;		/* Segment physical address 
										same as above*/
	  Elf64_Xword	p_filesz;		/* Segment size in file 
										size of code and data if file */
	  Elf64_Xword	p_memsz;		/* Segment size in memory 
										same as above */
	  Elf64_Xword	p_align;		/* Segment alignment 
										same as all programs have on my CPU*/
	} Elf64_Phdr;

Now everything is ready. Only thing that is left is code some small code
that uses data. And it would be hello world

mov eax, 1
mov edx, 12
mov rsi, qword 0x040009c ;address of string 
mov edi, 1
syscall

xor edi, edi
mov eax, 60
syscall

msg db 'Hello World',0xA

To calculate offsets of code and data labels is used macro:

macro doffset
{	
	bits = 16
	display ' 0x'
	repeat bits/4
		d = '0' + $ shr (bits-%*4) and 0Fh
		if d > '9'
			d = d + 'A'-'9'-1
		end if
		display d
	end repeat
	display 13,10
}

Total size of executable on 64bit system:
ELF header size 0x40
Program header 0x38
Code size 0x24
Data size 0xc
Total: 168 bytes

If 32 bit system is used then need to find defintions of data structures
and retype some bytes. Also architecture variable need to be changed.

Future plans:
Add some shared libs and compile smallest possible program using
SDL graphics lib.

Code:
Code is written and tested on x86_64.