Sunday, December 27, 2009

Photography resource

摄影教育 Education
1. 美国纽约摄影学院:[url=http://www.nyip.com/]http://www.nyip.com/[/url]
2. 罗彻斯特技术学校:[url=http://www.rit.edu/~rckpph/]http://www.rit.edu/~rckpph/[/url]
3. 创意摄影:[url=http://www.art.fullerton.edu/CreativePhoto/]http://www.art.fullerton.edu/CreativePhoto/[/url]
4. 宾夕法尼亚摄影空间:[url=http://www.psu.edu/photogyaphy/]http://www.psu.edu/photogyaphy/[/url]
5. 澳大利亚通信学校摄影课程:[url=http://xenios.qldnet.com.au/acs/photo/]http://xenios.qldnet.com.au/acs/photo/[/url]
6. 荷兰摄影学生毕业作品展:[url=http://utopia.knoware.nl/users/philippe/academie.html]http://utopia.knoware.nl/users/philippe/academie.html[/url]
7. 哥伦比亚学院摄影系:[url=http://www.colum.edu/undergraduate/photo/index.html]http://www.colum.edu/undergraduate/photo/index.html[/url]
8. 大学进修:[url=http://www.ryerson.ca/programs/imagearts.html]http://www.ryerson.ca/programs/imagearts.html[/url]
9. 时装摄影学校:[url=http://www.clickup.net/]http://www.clickup.net/[/url]
10. 美国西北学院摄影通讯:[url=http://photo.nwc.cc.wy.us/]http://photo.nwc.cc.wy.us/[/url]
11. 摄影和数码图象工作室:[url=http://www.kst.dit.ie/dit/photo/]http://www.kst.dit.ie/dit/photo/[/url]
12. 圣约斯州大学摄影课程:[url=http://www.sjsu.edu/depts/photography/photo-homepage.html]http://www.sjsu.edu/depts/photography/photo-homepage.html[/url]
13. MFA摄影和相关媒体课程:[url=http://www.mfaphoto.sva.edu/]http://www.mfaphoto.sva.edu/[/url]



摄影历史 History
1. 摄影的历史:[url=http://www.kbnet.co.uk/rleggat/photo/]http://www.kbnet.co.uk/rleggat/photo/[/url]
2. 国会图书馆的“美国记忆”:[url=http://lcweb2.loc.gov/ammem/pnhome.html]http://lcweb2.loc.gov/ammem/pnhome.html[/url]
3. 东京摄影:[url=http://tokyophoto.com/]http://tokyophoto.com/[/url]
4. NOAA摄影和图象收藏:[url=http://www.photolib.noaa.gov/]http://www.photolib.noaa.gov/[/url]
5. 波恩斯档案:[url=http://www.burnsarchive.com/]http://www.burnsarchive.com/[/url]
6. 波士顿空间:[url=http://www.bostonspsce.com/introtoc.html]http://www.bostonspsce.com/introtoc.html[/url]
7. 不可思议的媒体:[url=http://www.magic.be/]http://www.magic.be/[/url]
8. 国际摄影图书馆:[url=http://www.picture.com/]http://www.picture.com/[/url]
9. 海岸视觉画廊:[url=http://members.cruzio.com/~hoax1950/CoastalVisions.html]http://members.cruzio.com/~hoax1950/CoastalVisions.html[/url]
10. 洪水画廊:[url=http://www.public.asu.edu/~marcvan/]http://www.public.asu.edu/~marcvan/[/url]
11. 付费电话的世界:[url=http://www.2600.com/phones/]http://www.2600.com/phones/[/url]
12. 老照相机图片:[url=http://www.flash.net/~bobgil/cam/camera.html]http://www.flash.net/~bobgil/cam/camera.html[/url]
13. 京都艺术人体:[url=http://web.kyoto-inet.or.jp/people/photos/]http://web.kyoto-inet.or.jp/people/photos/[/url]
14. 科学中的艺术:[url=http://www.anl.gov/OPA/sciart/]http://www.anl.gov/OPA/sciart/[/url]
15. 牛津印象:[url=http://web.comlab.ox.ac.uk/oxinfo/photos/index.html]http://web.comlab.ox.ac.uk/oxinfo/photos/index.html[/url]
16. 美国摄影博物馆:[url=http://www.photographymuseum.com/]http://www.photographymuseum.com/[/url]
17. 绿眼睛计划:[url=http://cafeandre.com/]http://cafeandre.com/[/url]’
18. 迈布里和阿奇雷特摄影:[url=http://www.colorphotography.com/]http://www.colorphotography.com/[/url]
19. 毛里求斯图片展:[url=http://www.airmauritius.int.ch/photogra.htm]http://www.airmauritius.int.ch/photogra.htm[/url]
20. 摄影家画廊:[url=http://www.sfn.saskatoon.sk.ca/arts/tpg/index.html]http://www.sfn.saskatoon.sk.ca/arts/tpg/index.html[/url]
21. 摄影国际档案中的女性:[url=http://www.sla.purdue.edu/WAAW/Palmquist/index.htm]http://www.sla.purdue.edu/WAAW/Palmquist/index.htm[/url]
22. 上前线的女性:[url=http://lcweb.loc.gov/exhibits/wcf/wcf0001.html]http://lcweb.loc.gov/exhibits/wcf/wcf0001.html[/url]
23. 日本摄影史:[url=http://photojpn.org/HIST/hist1.html]http://photojpn.org/HIST/hist1.html[/url]
24. 探索通讯:[url=http://www.discovery.com/news/picture.html]http://www.discovery.com/news/picture.html[/url]
25. 数码休闲室:[url=http://www.digitallounge.com/]http://www.digitallounge.com/[/url]
26. 收藏视觉:[url=http://cvisions.nyu.edu/]http://cvisions.nyu.edu/[/url]
27. 时代广场:[url=http://www.timessquarephotos.org/]http://www.timessquarephotos.org/[/url]
28. 抓拍城市:[url=http://snapcity.com/]http://snapcity.com/[/url]
29. 网上都柏林:[url=http://gallery.adnet.ie/]http://gallery.adnet.ie/[/url]
30. 图象画廊:[url=http://www.planetdata.com/images/]http://www.planetdata.com/images/[/url]
31. 通过孩子的眼睛:[url=http://www.eyesofachild.com/]http://www.eyesofachild.com/[/url]
32. 达盖尔社团:[url=http://abell.austinc.edu/dag/home.html]http://abell.austinc.edu/dag/home.html[/url]



摄影杂志 Magazine

1. 变焦国际杂志:[url=http://www.zoom-net.com/]http://www.zoom-net.com/[/url]
2. 亚洲摄影:[url=http://www.asiaphoto.com/]http://www.asiaphoto.com/[/url]
3. 视觉摄影杂志:[url=http://www.sightphoto.com/index.html]http://www.sightphoto.com/index.html[/url]
4. 日本国际摄影杂志:[url=http://www.apn.co.jp/photo/index-e.html]http://www.apn.co.jp/photo/index-e.html[/url]
5. 资源杂志:[url=http://www.sourcemagazine.demon.co.uk/]http://www.sourcemagazine.demon.co.uk/[/url]
6. 黑白世界:[url=http://www.photos.com/bwworld/]http://www.photos.com/bwworld/[/url]
7. 令人惊讶的眼睛:[url=http://www.eyecaramba.com/index.html]http://www.eyecaramba.com/index.html[/url]
8. 在线摄影:[url=http://www.onlinephotography.com/]http://www.onlinephotography.com/[/url]

数码摄影 Digital
1柯达数码图象奉献:[url=http://www.kodak.com/digitallmages/samples/imagelntro.shtml]http://www.kodak.com/digitallmages/samples/imagelntro.shtml[/url]
1. 数码画廊:[url=http://www.willmaster.com/gallery/]http://www.willmaster.com/gallery/[/url]
2. 数码摄影和图象:[url=http://www.digitalphoto.com.nf/]http://www.digitalphoto.com.nf/[/url]
3. 数码短课程:[url=http://www.shortcourses.com/]http://www.shortcourses.com/[/url]
4. 数码焦点:[url=http://www.digfocus.com/]http://www.digfocus.com/[/url]
5. CNET照相机:[url=http://www.cnet.com/Content/Gadgets/Special/DigcamTC/index.html]http://www.cnet.com/Content/Gadgets/Special/DigcamTC/index.html[/url]
6. 数码照相机资源专栏:[url=http://www.dcresource.com/]http://www.dcresource.com/[/url]
7. 数码摄影大观:[url=http://www.inconference.com/digicam/index.html]http://www.inconference.com/digicam/index.html[/url]
8. 数码摄影展览:[url=http://www.bradley.edu/exhibit95/]http://www.bradley.edu/exhibit95/[/url]
9. 数码照相机指南:[url=http://www.plugin.com/digitalcameraguide/index.html]http://www.plugin.com/digitalcameraguide/index.html[/url]
10. 数码之眼:[url=http://www.image-acquire.com/]http://www.image-acquire.com/[/url]
11. 图象资源:[url=http://www.imaging-resource.com/]http://www.imaging-resource.com/[/url]
12. 有效购买者指南—数码照相机:[url=http://www.digitalcameras.activebuyesguide.com/]http://www.digitalcameras.activebuyesguide.com/

[/url]



新闻摄影 Photojournalism
1. 普利策奖:[url=http://www.pulitzer.org/]http://www.pulitzer.org/[/url]
2. 白宫新闻摄影家协会:[url=http://www.whnpa.org/]http://www.whnpa.org/[/url]
3. 电子新闻杂志:[url=http://www.journale.com/]http://www.journale.com/[/url]
4. 大洛杉矶新闻摄影家协会:[url=http://www.ppagla.org/]http://www.ppagla.org/[/url]
5. 国际摄影:[url=http://www.interfoto.ru/]http://www.interfoto.ru/[/url]
6. 东加拿大新闻摄影家协会:[url=http://www.execulink.com/~ecnpa/]http://www.execulink.com/~ecnpa/[/url]
7. 国际战争照相机协会:[url=http://www.combatcamera.org/]http://www.combatcamera.org/[/url]
8. 国家新闻摄影家协会:[url=http://metalab.unc.edu/nppa/]http://metalab.unc.edu/nppa/[/url]
9. 联系图片社:[url=http://www.contactpress.com/]http://www.contactpress.com/[/url]
10. 黑星图片社:[url=http://www.biackstar.com/]http://www.biackstar.com/[/url]
11. 美国新闻摄影:[url=http://www.photojournal.com/]http://www.photojournal.com/[/url]
12. 自由摄影:[url=http://www.mbnet.mb.ca/f-pro/]http://www.mbnet.mb.ca/f-pro/[/url]
13. 明尼苏达州新闻摄影家协会:[url=http://www.mnpa.org/]http://www.mnpa.org/[/url]
14. 学生出版物摄影团体:[url=http://www.collegemedia.com/spps/]http://www.collegemedia.com/spps/[/url]
15. 世界新闻摄影;[url=http://www.worldpressphoto.nl/]http://www.worldpressphoto.nl/[/url]
16. 取景器后面—新闻摄影记者一年的生活:[url=http://www.digitalstoryteller.com/YITL]http://www.digitalstoryteller.com/YITL[/url]
17. 摄影8:[url=http://www.foto8.com/]http://www.foto8.com/

[/url]



自然摄影 Nature
1. 阿拉斯加室外和自然摄影家社团:[url=http://www.asonp.org/]http://www.asonp.org/[/url]
2. 佛罗里达州热带设计:[url=http://www.tropicaldesigns.com/]http://www.tropicaldesigns.com/[/url]

3. 野外摄影:[url=http://wildphotography.com/]http://wildphotography.com/[/url]
4. BBC野生动物:[url=http://www.bbcwild.com/]http://www.bbcwild.com/[/url]
5. 英国旅游指南图片:[url=http://website.lineone.net/~beautifulengland/]http://website.lineone.net/~beautifulengland/[/url]
6. 地球的艺术:[url=http://artofearth.anthill.com/]http://artofearth.anthill.com/[/url]
7. 大西部图象:[url=http://www.gorp.com/gwi/]http://www.gorp.com/gwi/[/url]
8. 光圈艺术:[url=http://www.apertureart.com/]http://www.apertureart.com/[/url]
9. 加利福尼亚自然和科学摄影:[url=http://www.fredparker.com/]http://www.fredparker.com/[/url]
10. 纪实影象:[url=http://www.candidimages.com/]http://www.candidimages.com/[/url]
11. 画意摄影:[url=http://www.tucson-sunset.com/]http://www.tucson-sunset.com/[/url]
12. 夜晚视觉:[url=http://www.nightviz.com/]http://www.nightviz.com/[/url]
13. 家乡的视觉:[url=http://www.backcountryimaging.com/]http://www.backcountryimaging.com/[/url]
14. 迈克尔。马罗:[url=http://www.mauromedia.com/]http://www.mauromedia.com/[/url]
15. 接近野生动物:[url=http://www.up-close.com/]http://www.up-close.com/[/url]
16. 立体景观:[url=http://www.3dviewmax.com/]http://www.3dviewmax.com/[/url]
17. 绿色代理机构:[url=http://www.greenagency.net/]http://www.greenagency.net/[/url]
18. 金色土地影象:[url=http://www.goldenstateimages.com/]http://www.goldenstateimages.com/[/url]
19. 山脉数码图象:[url=http://www.quietplaces.com/]http://www.quietplaces.com/[/url]
20. 明尼苏达州野生动植物连接:[url=http://www.uslin.net/~rosebudm/lee.htm]http://www.uslin.net/~rosebudm/lee.htm[/url]
21. 冒险性和图片:[url=http://www.sportingpics.com/]http://www.sportingpics.com/[/url]
22. 美国风光画廊:[url=http://www.landscapephoto.com/]http://www.landscapephoto.com/[/url]
23. 冒险图象画廊:[url=http://adventurepix.com/]http://adventurepix.com/[/url]
24. 摄影自然主义者:[url=http://www.photonaturalist.com/]http://www.photonaturalist.com/[/url]
25. 山脉图象:[url=http://www.mountain-images.co.uk/]http://www.mountain-images.co.uk/[/url]
26. 野生感觉摄影:[url=http://www.wildperceptions.com/]http://www.wildperceptions.com/[/url]
27. 野生动植物摄影:[url=http://www.wildlife-photography.co.uk/]http://www.wildlife-photography.co.uk/[/url]
28. 室外图象:[url=http://www.outdoorimages.com/]http://www.outdoorimages.com/[/url]
29. 乡村光源出版:[url=http://chrisharris.com/]http://chrisharris.com/[/url]
30. 踪迹的尽头:[url=http://www.launchnet.com/dtehshuh/index.html]http://www.launchnet.com/dtehshuh/index.html[/url]
31. 自然摄影商店:[url=http://www.tesser.com/naturephoto/]http://www.tesser.com/naturephoto/

[/url]



婚礼和肖像摄影 Wedding & Portrait
1. 婚礼和肖像摄影家国际组织:[url=http://www.wppi-online.com/]http://www.wppi-online.com/[/url]
2. 传奇婚礼摄影:[url=http://www.wedfoto.com/]http://www.wedfoto.com/[/url]
3. 创造等待:[url=http://www.creationwaits.com/]http://www.creationwaits.com/[/url]
4. 创造性艺术摄影:[url=http://www.creativefoto.com/]http://www.creativefoto.com/[/url]
5. 更好的影象:[url=http://www.betterimage.com/]http://www.betterimage.com/[/url]
6. 光谱产品:[url=http://www.markgoldberg.com/]http://www.markgoldberg.com/[/url]
7. 婚礼摄影:[url=http://www.photographer.com/]http://www.photographer.com/[/url]
8. 美国摄影师:[url=http://www.ameriphoto.com/]http://www.ameriphoto.com/[/url]
9. 佩特鲁斯卡斯摄影:[url=http://www.petruska-photography.com/index2000.html]http://www.petruska-photography.com/index2000.html[/url]
10. 纪实视野:[url=http://home.ici.net/~ndel/candidvu.htm]http://home.ici.net/~ndel/candidvu.htm[/url]
11. GK摄影:[url=http://www.gkphotography.com/home.stm]http://www.gkphotography.com/home.stm[/url]
12. 优秀婚礼摄影:[url=http://www.weddingphoto-ma.com/]http://www.weddingphoto-ma.com/[/url]
13. 摄影的注视:[url=http://eyesonphotography.com/]http://eyesonphotography.com/[/url]
14. 图象概念:[url=http://www.imageryconcepts.com/]http://www.imageryconcepts.com/[/url]
15. 永恒的印象摄影:[url=http://www.lastingphotos.com/]http://www.lastingphotos.com/[/url]

艺术人体摄影 Art Nude
1. 爱好者(艺术人体):[url=http://www.fineartnude.com/]http://www.fineartnude.com/[/url]
2. 创意人体摄影网络:[url=http://www.ethoseros.com/cnpn.html]http://www.ethoseros.com/cnpn.html[/url]
3. 画意黑白摄影:[url=http://www.monoart.com/]http://www.monoart.com/[/url]
4. 艺术**:[url=http://www.artnudes.com/]http://www.artnudes.com/[/url]
5. 完全偶像摄影:[url=http://www.tfphoto.com/guestindex.html]http://www.tfphoto.com/guestindex.html[/url]
6. 摄影世界:[url=http://www.photo-world.de/]http://www.photo-world.de/[/url]
7. 神经网络连接:[url=http://www.nervelink.com/]http://www.nervelink.com/[/url]
8. 人体的心跳:[url=http://web.kyoto-inet.or.jp/people/photos/gordon/nudes/index.html]http://web.kyoto-inet.or.jp/people/photos/gordon/nudes/index.html[/url]
9. 艺术创造:[url=http://www.artcreate.com/photo/body/index.html]http://www.artcreate.com/photo/body/index.html[/url]
10. 失眠症画廊:[url=http://www.insomniagallery.com/]http://www.insomniagallery.com/[/url]
11. 地球上最好的人体:[url=http://www.condotiere.com/best-nudes/]http://www.condotiere.com/best-nudes/[/url]
12. 隐藏图象虚拟画廊:[url=http://www.latenimages.com/]httP://www.latenimages.com/[/url]
13. 狼吞虎咽画廊:[url=http://www.ravengallery.com/]http://www.ravengallery.com/[/url]
14. 全美男性形象:[url=http://www.allamericanguys.com/]http://www.allamericanguys.com/[/url]
15. 男性艺术:[url=http://www.himself.com/]http://www.himself.com/[/url]



其他摄影题材 Others

1. 北加利福尼亚水下摄影社团:
[url=http://www.ncups.org/]http://www.ncups.org/[/url]
2. 单镜头反光照相机的水下摄影:[url=http://www.mir.com/rb/photoraphy/underh20/housing/index.html]http://www.mir.com/rb/photoraphy/underh20/housing/index.html[/url]
3. 洛杉矶水下摄影社团:[url=http://www.laups.org/]http://www.laups.org/[/url]
4. 南佛罗里达水下摄影社团:[url=http://www.quantumleap.net/sfups/sfups.html]http://www.quantumleap.net/sfups/sfups.html[/url]
5. 潜水者网络:[url=http://www.divernet.com/photog/photog.htm]http://www.divernet.com/photog/photog.htm[/url]
6. 圣迪戈水下摄影社团:[url=http://www.personal.isat.com/sdups/]http://www.personal.isat.com/sdups/[/url]
7. 世界范围的水下摄影比赛:[url=http://www.underwaterphoto.com/]http://www.underwaterphoto.com/[/url]
8. 水下拍摄:[url=http://www.unterwasserfoto.com/]http://www.unterwasserfoto.com/[/url]
9. 水下摄影:[url=http://www.underwaterphotography.com/Default.asp]http://www.underwaterphotography.com/Default.asp[/url]
10. 水下摄影初步:[url=http://www.uwsports.ycg.com/maga]http://www.uwsports.ycg.com/maga ... -december/photo.htm[/url]
11. 五彩缤纷的海之旅游:
[url=http://www.rstours.com/]http://www.rstours.com/[/url]
12. 红外线画廊:[url=http://ruly70.medfac.leidenuniv.nl/~cor/ir-gallery.html]http://ruly70.medfac.leidenuniv.nl/~cor/ir-gallery.html[/url]
13. 黑白红外线摄影画廊:[url=http://www.coast-tv.demon.co.uk/]http://www.coast-tv.demon.co.uk/[/url]
14. 光谱选择性:[url=http://www.photo.net/photo/edscott/spectsel.htm]http://www.photo.net/photo/edscott/spectsel.htm[/url]
15. 留兰香红外线摄影指导:[url=http://www.coolmint.co.uk/infrared/]http://www.coolmint.co.uk/infrared/[/url]

16. 红外线摄影常见问题:[url=http://www.mat.uc.pt/!rps/photo/FAQ-LR.html]http://www.mat.uc.pt/!rps/photo/FAQ-LR.html[/url]
17. 摄影艺术画廊:[url=http://www.ac.wwu.edu/~skywise/gallery.html]http://www.ac.wwu.edu/~skywise/gallery.html[/url]
18. 捕足光线:[url=http://www.astropix.com/]http://www.astropix.com/[/url]
19. 低照度摄影:[url=http://home.c2i.net/llp/]http://home.c2i.net/llp/[/url]
20. 空间穿梭摄影:[url=http://www.nasm.edu/ceps/RPIF/SSPR.html]http://www.nasm.edu/ceps/RPIF/SSPR.html[/url]
21. 太空天体摄影:[url=http://www.psiaz.com/Schur/astro/index.html]http://www.psiaz.com/Schur/astro/index.html[/url]
22. 日食摄影:[url=http://www.mreclipse.com/]http://www.mreclipse.com/[/url]
23. 天文学画廊:[url=http://www.j-2.com/space/astronomy.htm]http://www.j-2.com/space/astronomy.htm[/url]
24. 天空和望远镜摄影:[url=http://www.skypub.com/sights/eclipses/lunar/photography.html]http://www.skypub.com/sights/eclipses/lunar/photography.html[/url]
25. 天体摄影:[url=http://oeonline.com/~jsc]http://oeonline.com/~jsc[/url]
26. 月球上的女性:[url=http://www.tufts.edu/as/wright-center/fellows/georgepage.html]http://www.tufts.edu/as/wright-center/fellows/georgepage.html[/url]
27. 天体摄影资源:[url=http://www.photoresource.com/resourceastro.html]http://www.photoresource.com/resourceastro.html[/url]
28. 活着的细胞:[url=http://www.cellsalive.com/]http://www.cellsalive.com/[/url]
29. 毫微世界:[url=http://www.hitachi.co.jp/Div/keisokuki/english/nano/arte.html]http://www.hitachi.co.jp/Div/keisokuki/english/nano/arte.html[/url]
30. 分子的表现:[url=http://micro.magnet.fsu.edu/]http://micro.magnet.fsu.edu/[/url]
31. 丹尼斯.昆克尔的显微镜使用:[url=http://www.pbrc.hawaii.edu/~kunkel/]http://www.pbrc.hawaii.edu/~kunkel/[/url]
32. 微距天使:[url=http://www.pbrc.hawaii.edu/bemf/microangela/]http://www.pbrc.hawaii.edu/bemf/microangela/[/url]
33. 微距世界图象画廊:[url=http://www.uq.edu.au/nanoworld/images-1.html]http://www.uq.edu.au/nanoworld/images-1.html[/url]
34. 拍摄微生物:[url=http://micscape.simplenet.com/mag/art98/sdurr.html]http://micscape.simplenet.com/mag/art98/sdurr.html[/url]
35. 晶莹的土地:[url=http://www.crystal-land.com/]http://www.crystal-land.com/[/url]
36. 岩石、矿物和纹理:[url=http://www.geolab.unc.edu/Petunia/lg-MetAtlas/mainmenu.html]http://www.geolab.unc.edu/Petunia/lg-MetAtlas/mainmenu.html[/url]
37. 细菌世界:[url=http://bugscope.beckman.uiuc.edu/]http://bugscope.beckman.uiuc.edu/[/url]
38. 显微照相术:[url=http://micscape.simplenet.com/mag/art97/ellsphot.html]http://micscape.simplenet.com/mag/art97/ellsphot.html[/url]
39. 雪花晶体摄影家:[url=http://www.snowflakebentley.com/]http://www.snowflakebentley.com/[/url]
40. 针孔摄影——历史、影象、照相机和制造法:[url=http://home.sol.no/~gjon/pinhole.htm]http://home.sol.no/~gjon/pinhole.htm[/url]
41. 针孔画廊:[url=http://www.pinhole.org/]http://www.pinhole.org/[/url]
42. 针孔摄影:[url=http://www.pinhole.com/]http://www.pinhole.com/[/url]
43. 针孔照片:[url=http://www.cool.mb.ca/~gnome/pinhole.html]http://www.cool.mb.ca/~gnome/pinhole.html[/url]
44. 如何制作和使用针孔照相机:[url=http://www.kodak.com/ciHome/education/lessonPlans/pinholeCamera/]http://www.kodak.com/ciHome/education/lessonPlans/pinholeCamera/[/url]
45. 零点2000:[url=http://www.zeroimage.com/]http://www.zeroimage.com/[/url]

46. 倒数第二的针孔摄影:[url=http://neon.airtime.co.uk/pinhole/open.htm]http://neon.airtime.co.uk/pinhole/open.htm[/url]
47. 德巴拉.维恩的白房子:[url=http://www.artshow.com/whitehouse/]http://www.artshow.com/whitehouse/[/url]
48. 迷失的美国夜景摄影:[url=http://www.lostamerica.com/]http://www.lostamerica.com/[/url]
49. 收容摄影画廊:[url=http://pages.sssnet.com/glg/camera.html]http://pages.sssnet.com/glg/camera.html[/url]
50. 夜景照片:[url=http://fotog.net/]http://fotog.net/[/url]
51. 四边角摄影:[url=http://www.fourcornersphoto.com/]http://www.fourcornersphoto.com/[/url]
52. 夜景摄影:[url=http://ww.dbphotography.demon.co.uk/index.html]http://ww.dbphotography.demon.co.uk/index.html[/url]
53. 夜曲:[url=http://www.thenocturnes.com/]http://www.thenocturnes.com/


[/url]

摄影家 Photographers
1. 摄影大师:
[url=http://www.masters-of-photography.com/]http://www.masters-of-photography.com/[/url]
2. 伊莫金.坎宁安:[url=http://thecity.sfsu.edu/pacific.pix/WEBPAGE/imogen2.html]http://thecity.sfsu.edu/pacific.pix/WEBPAGE/imogen2.html[/url]
[url=http://wwwlocal.cea.berkeley.edu/~bboyd/phot/lmogen.html]http://wwwlocal.cea.berkeley.edu/~bboyd/phot/lmogen.html[/url]
3. 艾瑟.布波莱:[url=http://www.estherbubley.com/]http://www.estherbubley.com/[/url]
[url=http://alphaclp.clpgh.org/CLP/exhibit/photog6.html]http://alphaclp.clpgh.org/CLP/exhibit/photog6.html[/url]
4. 罗伯特.梅普尔索普:[url=http://www.ocaiw.com/mapple.htm]http://www.ocaiw.com/mapple.htm[/url]
[url=http://www.irish-photography.com/mapplethorpe/]http://www.irish-photography.com/mapplethorpe/[/url]
5. 路易斯.海因:[url=http://www.historyplace.com/unitedstates.childlabor/index.html]http://www.historyplace.com/unitedstates.childlabor/index.html[/url]
6. 安德烈.克泰斯:[url=http://swallow.mit.edu/vitaly/KERTESZ.html]http://swallow.mit.edu/vitaly/KERTESZ.html[/url]
[url=http://nimbus.ocis.temple.edu/~nphan001/photographers/apage.ht]http://nimbus.ocis.temple.edu/~nphan001/photographers/apage.ht[/url]
7. 多萝西娅.兰格:[url=http://lcweb.loc.gov/exhibits/wcf/wcf0013.html]http://lcweb.loc.gov/exhibits/wcf/wcf0013.html[/url]
8. 威廉姆.亨利.杰克衅:[url=http://www.fit.edu/lnfoTechSys/resources/congsei/whjte.html]http://www.fit.edu/lnfoTechSys/resources/congsei/whjte.html[/url]
[url=http://www.beebop.com/siam/index.htm]http://www.beebop.com/siam/index.htm[/url]
9. 曼.雷:[url=http://www.artn.com/Early/ManRayll.html]http://www.artn.com/Early/ManRayll.html[/url]
[url=http://www.manray-photo.com/index-us.html]http://www.manray-photo.com/index-us.html[/url]
10. 蒂娜.莫多蒂:[url=http://www.modotti.com/]http://www.modotti.com/[/url]
[url=http://www.chron.com/content/int]http://www.chron.com/content/int ... ts/art/modotti.html[/url]
11. 佛里德.斯坦尼:
[url=http://www.fredstein.com/]http://www.fredstein.com/[/url]
12. 安塞尔.亚当斯:[url=http://www.adamsgallery.com/]http://www.adamsgallery.com/[/url]
[url=http://www.book.uci.edu/AdamsHome.html]http://www.book.uci.edu/AdamsHome.html[/url]
13. 福克斯.塔尔博特:[url=http://www.r-cube.co.uk/fox-tallbot/]http://www.r-cube.co.uk/fox-tallbot/[/url]
14. 沃克.伊文斯:[url=http://xrosds.viginia.edu/~UG97/fsa/welcome.html]http://xrosds.viginia.edu/~UG97/fsa/welcome.html[/url]
15. 约翰.哈特菲尔德:[url=http://www.tc.umn.edu/~whit0580/igloo/dada/heartfield.html]http://www.tc.umn.edu/~whit0580/igloo/dada/heartfield.html[/url]
[url=http://www.brasscheck.com/heartfield/]http://www.brasscheck.com/heartfield/[/url]
16. 比尔.布兰特:[url=http://www.billbrandt.com/]http://www.billbrandt.com/[/url]
17. 戴安娜.阿巴斯:[url=http://www.clark.net/pub/cosmic/darbhcpp.html]http://www.clark.net/pub/cosmic/darbhcpp.html[/url]
18. 贝伦妮斯.阿博特:[url=http://www.nypl.org/ressarch/chs]http://www.nypl.org/ressarch/chs ... bbottex/abbott.html[/url]
19. 赫尔穆特.牛顿:
[url=http://art.dada.it/newton/]http://art.dada.it/newton/[/url]
[url=http://art.dada.it/newton/home.htm]http://art.dada.it/newton/home.htm[/url]
20. 理查德.阿威顿:[url=http://www.richardavedon.com/]http://www.richardavedon.com/[/url]
21. 杰里.尤斯曼:[url=http://www.uelsmann.com/]http://www.uelsmann.com[/url]
22. 安妮.莱波维兹:[url=http://kultura.gratex.sk/krajcovicova/leib/annie-a.html]http://kultura.gratex.sk/krajcovicova/leib/annie-a.html[/url]
23. 霍华德.斯恰兹:[url=http://www.howardschatz.com/]http://www.howardschatz.com/[/url]
24. 克里斯。雷尼尔:[url=http://www.chrisrainier.com/textindex.html]http://www.chrisrainier.com/textindex.html[/url]
25. 简-彼得.威金:[url=http://www.sirius.com/~aether/witkin/home.html]http://www.sirius.com/~aether/witkin/home.html[/url]
26. 威廉姆.魏格曼:[url=http://www.segura.com/Wegman.html]http://www.segura.com/Wegman.html[/url]
27.辛迪.雪曼:[url=http://www.moma.org/sherman/index.html]http://www.moma.org/sherman/index.html[/url]
27. 大卫.汉弥尔顿:[url=http://www.hamiton-archives.com/html/]http://www.hamiton-archives.com/html/[/url]
28. 安妮.戈德斯:[url=http://www.annegeddes.com/index.htm]http://www.annegeddes.com/index.htm[/url]
[url=http://www.andrea-schroeder.de/Ageddese.html]http://www.andrea-schroeder.de/Ageddese.html[/url]
29. 佛兰克.霍瓦特:[url=http://www.efassoc.com/hfrank/]http://www.efassoc.com/hfrank/[/url]
30. 波特.斯特恩:[url=http://www.bertsterm.com/home.html]http://www.bertsterm.com/home.html[/url]
31. 拉尔夫.吉布森:[url=http://www.ralphgibson.com/main.html]http://www.ralphgibson.com/main.html[/url]
32. 简.索德克:[url=http://www.acc.umu.se/~argali/saudek/saudek.htm]http://www.acc.umu.se/~argali/saudek/saudek.htm[/url]
33. 南.戈丁:[url=http://www.blastfilms.demon.co.uk/nan.htm]http://www.blastfilms.demon.co.uk/nan.htm[/url]
34. 赫伯.里兹:[url=http://www.ocaivv.com/eittsh.htm]http://www.ocaivv.com/eittsh.htm[/url]
35. 玛丽.艾伦.马克www.maryellenmark.com/home/index.html

Sunday, December 13, 2009

Tuesday, November 10, 2009

Understanding ELF using readelf and objdump (zz)

http://www.linuxforums.org/articles/understanding-elf-using-readelf-and-objdump_125.html

What is ELF? ELF (Executable and Linking Format) is file formatthat defines how an object file is composed and organized. With thisinformation, your kernel and the binary loader know how to loadthe file, where to look for the code, where to look the initializeddata, which shared library that needs to be loaded and so on.

First of all, you should know about different kind of ELF object:

  • Relocatable file: an object file that holds code and data suitable for linking with other object files to create an executable or a shared object file. In other word, you can say that relocatable file is a foundation for creating executables and libraries.

    This is kind of file you get if you compile a source code like this:

    $ gcc -c test.c

    That will produce test.o, which is a relocatable file.

    Kernel module (either suffixed with .o or .ko) is also a form of relocatable file.

  • Executable file: object file that holds a program suitable for execution. Yes, that means, your XMMS mp3 player, your vcd software player, even your text editor are all ELF executable files.

    This is also a familiar file if you compile a program:

    $ gcc -o test test.c

    After you make sure the executable bit of "test" is enabled, you can execute it. The question is, what about shell script? Shell script is NOT ELF executable, but the interpreter IS.

  • Shared object file: This file holds code and data suitable for linking in two contexts:

    1. The link editor may process it with other relocatable and shared shared object file to create another object file.
    2. The dynamic linker combines it with an executable file and other shared objects to create a process image.

    In simple words, these are the files that you usually see with suffix .so (normally located inside /usr/lib on most Linux installation).

Is there any other way to detect the ELF type? Yes there is. In every ELF object, there is a file header that explains what kind file it is. Assuming you have installed binutils package, you can use readelf to read this header. For example (command results are shortened to show related fields only):

$ readelf -h /bin/ls Type:  EXEC (Executable file)  $ readelf -h  /usr/lib/crt1.o Type:  REL (Relocatable file)  $ readelf -h /lib/libc-2.3.2.so Type:  DYN (Shared object file)       

"File" command works too for object file identification, but I won't discuss it further. Let's focus on readelf and objdump, since we will use both of them.

To make us easier to study ELF, you can use the following simple C program:

/* test.c */ #include  int global_data = 4; int global_data_2;  int main(int argc, char **argv) {         int local_data = 3;         printf("Hello Worldn");         printf("global_data = %dn", global_data);         printf("global_data_2 = %dn", global_data_2);         printf("local_data = %dn", local_data);         return (0); } 

And compile it:

$ gcc -o test test.c

A. Examining ELF header.

The produced binary will be our examination target. Let's start with the content of the ELF header:

$ readelf -h test
ELF Header:   Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00   Class:                             ELF32   Data:                              2's complement, little endian   Version:                           1 (current)   OS/ABI:                            UNIX - System V   ABI Version:                       0   Type:                              EXEC (Executable file)   Machine:                           Intel 80386   Version:                           0x1   Entry point address:               0x80482c0   Start of program headers:          52 (bytes into file)   Start of section headers:          2060 (bytes into file)   Flags:                             0x0   Size of this header:               52 (bytes)   Size of program headers:           32 (bytes)   Number of program headers:         7   Size of section headers:           40 (bytes)   Number of section headers:         28   Section header string table index: 25       

What does this header tell us?

  • This executable is created for Intel x86 32 bit architecture ("machine" and "class" fields).

  • When executed, program will start running from virtual address 0x80482c0 (see entry point address). The "0x" prefix here means it is a hexadecimal number. This address doesn't point to our main() procedure, but to a procedure named _start. Never felt you had created such thing? Of course you don't. _start procedure is created by the linker whose purpose is to initialize your program.

  • This program has a total of 28 sections and 7 segments.

What is section? Section is an area in the object file that contains information which is useful for linking: program's code, program's data (variables, array, string), relocation information and other. So, in each area, several information is grouped and it has a distinct meaning: code section only hold code, data section only holds initialized or non-initialized data, etc. Section Header Table (SHT) tells us exactly what sections the ELF object has, but at least by looking on "Number of section headers" field above, you can tell that "test" contains 28 sections.

If section has meaning for the binary, our Linux kernel doesn't see it the same way. The Linux kernel prepares several VMA (virtual memory area) that contains virtually contigous page frames. Inside these VMA, one or more sections are mapped. Each VMA in this case represents an ELF segment. How the kernel knows which section goes to which segment? This is the function of Program Header Table(PHT).

Figure 1. ELF structure in two different point of view.

{mospagebreak title=Examining Section Header Table(SHT)}

B. Examining Section Header Table(SHT).

Let's see what kind of sections that exist inside our program (output is shortened):

$ readelf -S test

There are 28 section headers, starting at offset 0x80c:

Section Headers: [Nr] Name      Type      Addr     Off    Size   ES Flg Lk Inf Al ........ [ 4] .dynsym   DYNSYM    08048174 000174 000060 10   A  5   1  4 ........ [11] .plt      PROGBITS  08048290 000290 000030 04  AX  0   0  4 [12] .text     PROGBITS  080482c0 0002c0 0001d0 00  AX  0   0  4 ........ [20] .got      PROGBITS  080495d8 0005d8 000004 04  WA  0   0  4 [21] .got.plt  PROGBITS  080495dc 0005dc 000014 04  WA  0   0  4 ........ [22] .data     PROGBITS  080495f0 0005f0 000010 00  WA  0   0  4 [23] .bss      NOBITS    08049600 000600 000008 00  WA  0   0  4 ........ [26] .symtab   SYMTAB    00000000 000c6c 000480 10     27  2c  4 ........        

.text section is a place where the compiler put executables code. As the consequence, this section is marked as executable ("X" on Flg field). In this section, you will see the machine codes of our main() procedure:

$ objdump -d -j .text test

-d tells objdump to diassembly the machine code and -j tells objdump to focus on specific section only (in this case, .text section)

08048370 
: ....... 8048397: 83 ec 08 sub $0x8,%esp 804839a: ff 35 fc 95 04 08 pushl 0x80495fc 80483a0: 68 c1 84 04 08 push $0x80484c1 80483a5: e8 06 ff ff ff call 80482b0 80483aa: 83 c4 10 add $0x10,%esp 80483ad: 83 ec 08 sub $0x8,%esp 80483b0: ff 35 04 96 04 08 pushl 0x8049604 80483b6: 68 d3 84 04 08 push $0x80484d3 80483bb: e8 f0 fe ff ff call 80482b0 .......

.data section hold all the initialized variable inside the program which doesn't live inside the stack. "Initialized" here means it is given an initial value like we did on "global_data". How about "local_data"? No, local_data's value isn't in .data since it lives on process's stack.

Here is what objdump found about .data section:

$ objdump -d -j .data test ..... 080495fc :  80495fc:       04 00 00 00           ....  .....

One thing that we can conclude so far is that objdump kindly does address-to-symbol transformation for us. Without looking into symbol table, we know that 0x08049424 is the address of global_data. There, we clearly see that it is initialized with 4. Please note that common executables installed by most Linux distribution has been striped out, thus there is no entry in its symbol table. It makes objdump difficult to interpret the addresses.

And what is .bss? BSS (Block Started by Symbol) is a section where all unitialized variables are mapped. You might think "everything surely has an initial value". True, in Linux case, all unitialized variables are set as zero, that's why .bss section is just bunch of zeroes. For character type variables, that means null character. Knowing this fact, we know that global_data_2 is assigned 0 on runtime:

$ objdump -d -j .bss test-lagi Disassembly of section .bss: ..... 08049604 :  8049604:       00 00 00 00               .... .....

Previously, we mentioned a bit about symbol table. This table is useful to find the correlation between a symbol name (non external function, variable) and an address. Using -s, readelf will decode the symbol table for you:

$ readelf -s ./test
Symbol table '.dynsym' contains 6 entries:    Num:    Value  Size Type    Bind   Vis      Ndx Name .....      2: 00000000    57 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.0 (2) .....  Symbol table '.symtab' contains 72 entries:    Num:    Value  Size Type    Bind   Vis      Ndx Name .....         49: 080495fc     4 OBJECT  GLOBAL DEFAULT   22 global_data .....     55: 08048370   109 FUNC    GLOBAL DEFAULT   12 main .....     59: 00000000    57 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.0 .....     61: 08049604     4 OBJECT  GLOBAL DEFAULT   23 global_data_2 .....       

"Value" denotes the address of the symbol. For example, if an instruction refers to this address (e.g: pushl 0x80495fc), that means it refers to global_data. Printf() is treated differently, since it is a symbol that refers to an external function. Remember that printf is defined in glibc, not inside our program. Later, I will explain how our program calls printf.

C. Examining Program Header Table(PHT).

Like I explained previously, segment is the way operating system "sees" our program. Thus, let's see how will our program be segmented:

$ readelf -l test
..... There are 7 program headers, starting at offset 52  Program Headers:      Type     Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align [00] PHDR     0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4 [01] INTERP   0x000114 0x08048114 0x08048114 0x00013 0x00013 R   0x1 [02] LOAD     0x000000 0x08048000 0x08048000 0x004fc 0x004fc R E 0x1000 [03] LOAD     0x0004fc 0x080494fc 0x080494fc 0x00104 0x0010c RW  0x1000 [04] DYNAMIC  0x000510 0x08049510 0x08049510 0x000c8 0x000c8 RW  0x4 [05] NOTE     0x000128 0x08048128 0x08048128 0x00020 0x00020 R   0x4 [06] STACK    0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x4  Section to Segment mapping:   Segment Sections...    00         01     .interp     02     .interp .note.ABI-tag .hash .dynsym .dynstr .gnu.version  	  .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini  	  .rodata .eh_frame     03     .ctors .dtors .jcr .dynamic .got .got.plt .data .bss     04     .dynamic     05     .note.ABI-tag     06       
Note:I add numbers on the left of each PHT entries to make the reader easier to study the section to segment mapping.

The mapping is quite straightforward. For example, inside segment number 02, there are 15 sections mapped. .text section is mapped in this segment. Its flags are R and E, which means it is Readable and Executable. If you see W in segment's flag, that means it is writable.

By looking on "VirtAddr" column, we can discover the virtual start address of each segment. Back to the segment number #2, the start address is 0x08048000. Later in this section, we will discover that this address isn't the real address of the segment on memory. You can ignore the PhysAddr, because in Linux always operate in protected mode (on Intel/AMD 32 bit and 64 bit) thus virtual address is the thing that matters.

Segment has many types, but let's focus on two types:

  • LOAD: The segment's content is loaded from the executable file. "Offset" denotes the offset of the file where the kernel should start reading the file's content. "FileSiz" tells us how many bytes must be read from the file.

    For example,segment #2 is actually the content of the file starting from offset 0 to 4fc (offset+filesiz). To speed up the execution, the file's content is read on demand, thus it is only read from the disk if it is referenced at runtime.

  • STACK : The segment is stack area. Interesting to see that all the fields except "Flg" and "Align" are given 0. Is it an error? No, it is valid. It is the kernel's job to decide where the stack segment starts from and how big it is. Remember that on Intel compatible processor, stack grows downward (address is decremented each time a value is pushed).

Courious to see the real layout of process segment? We can use /proc/<pid>/maps file to reveal it. <pid> is the PID of the process we want to observe. Before we move on, we have a small problem here. Our test program runs so fast that it ends before we can even dump the related /proc entry. I use gdb to solve this. You can use another trick such as inserting sleep() before it calls return().

In a console (or a terminal emulator such as xterm) do:

$ gdb test (gdb) b main Breakpoint 1 at 0x8048376 (gdb) r Breakpoint 1, 0x08048376 in main ()       

Hold right here, open another console and find out the PID of program "test". If you want the quick way, type:

$ cat /proc/`pgrep test`/maps

You will see an output like below (you might get different output):

[1]  0039d000-003b2000 r-xp 00000000 16:41 1080084  /lib/ld-2.3.3.so [2]  003b2000-003b3000 r--p 00014000 16:41 1080084  /lib/ld-2.3.3.so [3]  003b3000-003b4000 rw-p 00015000 16:41 1080084  /lib/ld-2.3.3.so [4]  003b6000-004cb000 r-xp 00000000 16:41 1080085  /lib/tls/libc-2.3.3.so [5]  004cb000-004cd000 r--p 00115000 16:41 1080085  /lib/tls/libc-2.3.3.so [6]  004cd000-004cf000 rw-p 00117000 16:41 1080085  /lib/tls/libc-2.3.3.so [7]  004cf000-004d1000 rw-p 004cf000 00:00 0 [8]  08048000-08049000 r-xp 00000000 16:06 66970    /tmp/test [9]  08049000-0804a000 rw-p 00000000 16:06 66970    /tmp/test [10] b7fec000-b7fed000 rw-p b7fec000 00:00 0 [11] bffeb000-c0000000 rw-p bffeb000 00:00 0 [12] ffffe000-fffff000 ---p 00000000 00:00 0       
Note: I add number on each line as reference.

Back to gdb, type:

(gdb) q

So, in total, we see 12 segment (also known as Virtual Memory Area--VMA). Focus on the first and the last field. First field denotes VMA address range, while last field shows the backing file. Do you see the similarity between VMA #8 and segment #02 listed in PHT? The difference is, SHT said it is ended on 0x080484fc, but on VMA #8, we see that it ends on 0x08049000. Same thing happens between VMA #9 and segment #03; SHT said it starts at 0x080494fc, while the VMA starts at 0x0804900.

There are several facts we must observe:

  1. Even though the VMA started on different address, the related sections are still mapped on exact virtual address.

  2. The kernel allocate memory on per page basis and the page size is 4KB. Thus, every page address is actually a multiple of 4KB e.g: 0x1000, 0x2000 and so on. So, for the first page of VMA #9, the page's address is 0x0804900. Or technically speaking, the address of the segment is rounded down (aligned) to the nearest page boundary.

Last, which one is the stack? That is VMA #11. Usually, the kernel allocate several pages dynamically and map to the highest virtual address possible in user space to form stack area. Simply speaking, each process address space is divided into two part (this assume Intel compatible 32 bit processor): user space and kernel space. User space is in 0x00000000-0xc0000000 range, while kernel space starts on 0xc0000000 onwards.

So, it is clear that stack is assigned address range near the 0xc0000000 boundary. The end address is static, while the start address is changing according to how many values are stored on stack.{mospagebreak title=How a function is referenced?}

D. How a function is referenced?

If a program calls a function that resides within its own executable, all it has to do is simple: just call the procedure. But what happens if it calls something like printf() that is defined inside glibc shared library?

Here, I won't discuss deeply about how the dynamic linker really works, but I focus on how the calling mechanism is implemented inside the executable itself. With this assumption in mind, let's continue.

When a program wants to call a function, it actually does following flow:

  1. It made a jump to relevant entry in PLT (Procedure Linkage Table).

  2. In PLT, there is another jump to an address mentioned in related entry in GOT (Global Offset Table).

  3. If this is the first the function is called, follow step #4. If this isn't, follow step #5.

  4. The related GOT entry contains an address that points back to next instruction in PLT. Program will jump to this address and then calls the dynamic linker to resolve the function's address. If the function is found, its address is put in related GOT entry and then the function itself is executed.

    So, another time the function is called, GOT already holds its address and PLT can jump directly to the address. This procedure is called lazy binding; all external symbols are not resolved until the time it is really needed (in this case, when a function is called). Jump to step #6.

  5. Jump to the address mentioned in GOT. It is the address of the function thus PLT is no longer used.

  6. Execution of the function is finished. Jump back to the next instruction in the main program.

As always, looking inside the executable is the best way to explain it. If you do:

$ objdump -d -j .text test  

You will see the following code fragment:

..... 08048370 
: ..... 804838f: e8 1c ff ff ff call 80482b0

What we have on 0x80482b0 is:

 080482b0 :  80482b0:       ff 25 ec 95 04 08       jmp    *0x80495ec  80482b6:       68 08 00 00 00          push   $0x8  80482bb:       e9 d0 ff ff ff          jmp    8048290 <_init+0x18>	 

As you see, the jump on 0x80482b0 is indirect jump ('*' in front of the address). So, to see where it will jump, we must peek into 0x80482b0. The guesses are, either this address is in .got section or in .got.plt. Looking back in SHT, it is clear that we must check .got.plt. I use readelf to do hexadecimal dump because it does number reordering for us:

$ readelf -x 21 test Hex dump of section '.got.plt':   0x080495dc 080482a6 00000000 00000000 08049510 ................   0x080495ec                            080482b6 ....       
(Note: first column is virtual address. The data in this address is described at the 5th column, not the second one! So, from right to left, the address is in ascending order.)

Bingo! We have "080482b6" here. In other word, we go back to PLT and there we eventually jump another address. This is where the work of the dynamic linker is started, so we will skip it. Assuming the dynamic linker has finished its magic work, the related GOT entry now holds the address of printf().

E. Alternative tool to inspect ELF structure.

Besides counting on readelf and objdump, there is another tool called Biew. This is actually a file viewer but it is capable to parse the ELF structure.. You can grab the source from http://biew.sourceforge.net/ and compile it by yourself. Usually biew is included in hacking oriented Linux Live CD such as Phlak. Refer to the website and the packaged documents on how to compile and install Biew.

I personally like Biew because it offers curses based GUI display. Navigation between sections, checking ELF header, listing symbols and other tasks are now just a matter of pressing certain keyboard shortcut and you're done.

For example, you can list the symbols and directly jump to the symbol's address. Here, we try to jump to main(). First execute biew:

$ biew test

Press Ctrl+A followed by F7 to view symbol table. To avoid wasting time traversing the table, press again F7 to open "Find string" menu. Type "main" and press Enter. Once the highlighted entry is what you're looking for, simply press Enter and Biew will jump to the address of main(). Don't forget to switch to the disassembler mode (press F2 to select it) so you can see the high level interpretation of the opcodes.

Figure 2. Biew lists all symbols

Since we usually refer to virtual address, not file offset, it is better to switch to virtual address view. Press Ctrl+C followed by F6 and select "Local". Now, what you see in the leftmost column is the virtual address.

Conclusion

This article is just an overview on how to study ELF structure. Using readelf and objdump, you are ready to take your first journey. If needed, tool like Biew can help you to explore the binary internal faster. Use any arsenal you have, be creative and practice it regularly, then soon you can master the technique. Happy exploring.

Further reading

Thursday, November 05, 2009

Here is Science Center near Jurong East central. Many kids enjoy their lives with patrents there.
Posted by Picasa