1 views collected around this technical thread.
The article explains that an executable file contains machine instructions which the operating system parses (e.g., ELF), loads into RAM by allocating distinct memory regions for code, data, heap, stack and any dynamic libraries, then reads the entry‑point address to set the CPU’s instruction pointer and start execution.
The article explains how AArch64 stack unwinding works using both frame‑pointer based methods and DWARF .eh_frame/.debug_frame CFI data, detailing the calling convention, compiler effects, CIE/FDE structures, and their integration into Android’s simpleperf profiler for accurate back‑traces.
This article explains how the HeapTaskDaemon thread drives garbage collection in Android's ART runtime, analyzes its source code and related HeapTask classes, and presents two practical methods—adding custom HeapTasks or pausing existing ones—using ELF symbol lookup, ndk_dlopen, and virtual‑function hooking to temporarily suppress GC for better performance.
This article explores how C++ programs start, detailing the role of the _start entry point, the initialization of global objects via .init_array, __libc_csu_init, and constructors, and provides practical techniques—including linking with crt files and using init_priority—to control and debug initialization order and avoid crashes.
This article explains how a Go hello‑world program starts, tracing the ELF entry point, runtime initialization, GMP scheduler setup, creation of the main goroutine, and the flow into the user's main function.
The article shows how to shrink Android NDK .so binaries by over 30% through code de‑duplication, disabling exceptions/RTTI/iostream, using fine‑grained sections with LTO and dead‑code elimination, limiting exported symbols via version scripts, employing JNI dynamic registration, and consolidating C++ runtime dependencies into a shared library.
This article explains step by step how a simple Hello World program is compiled, linked, and executed on Linux, covering the ELF executable format, the role of the file command, the fork‑execve process creation sequence, and the kernel’s binary loader implementation.
ByteDance has open‑sourced bhook, an Android PLT hook framework supporting API 16‑31 and multiple ABIs, featuring a trampoline‑based hook mechanism, automatic ELF monitoring, and a robust native crash‑catching module for safe runtime function interception.
ELF PLT Hook on Android intercepts shared‑library calls by overwriting GOT/PLT entries, providing a stable production‑ready method for tasks such as APM monitoring, APK unpacking and performance profiling, with a clear workflow, dynamic‑linking background, and a practical implementation using the plthook library.
This article provides an in‑depth overview of the ELF file format, describing its headers, section and program tables, symbol structures, and demonstrates how to use this knowledge to locate and hook functions in Android native libraries such as libmedia.so.
This article describes how to statically analyze Linux ELF executables using objdump and shell scripts to collect function definitions, source locations, and call sites, and then construct a detailed function call graph with a C++ data structure.