ELF Format notes (4) -- Section, elfsection

ELF Format notes (4) -- Section, elfsection

The ELF file can contain many sections. All sections have a corresponding item in the section header table. Each section header is an Elf32_Shdr structure used to describe the information of the corresponding section.

The e_shoff In the ELF Header specifies the byte offset of the section header table in the ELF File. The e_shentsize indicates the size of each item in the section header table. The e_shnum indicates the total number of items.

Elf32_Shdr structure:

 1 typedef struct { 2     Elf32_Word sh_name; 3     Elf32_Word sh_type; 4     Elf32_Word sh_flags; 5     Elf32_Addr sh_addr; 6     Elf32_Off  sh_offset; 7     Elf32_Word sh_size; 8     Elf32_Word sh_link; 9     Elf32_Word sh_info;10     Elf32_Word sh_addralign;11     Elf32_Word sh_entsize;12 } Elf32_Shdr;

Sh_name: the name of the section. This is actually an index that specifies the location where the section name is stored in. shstrtab .. Shstrtab is a string table that stores the names of all sections.

Sh_type: the type of section, which has been learned in the previous note.

Sh_flags: defines some attributes through 1-bit flag.

 

• SHF_WRITE: data contained in this section, which can be written during the process.
• SHF_ALLOC: This section occupies memory during the process.

Some sections used for control do not occupy memory during the process. For example, the dynamic linker may only read some information in the section and drop it when it is used up, there is no need to store it in a process image.

• SHF_EXECINSTR: This section stores executable machine codes.
• SHF_MASKPROC: Reserved.

Sh_addr: if this section needs to be mapped to the process space, this Member specifies the starting address of the ing. If no ing is required, this value is 0.

Sh_offset: The Byte offset of this section relative to the beginning of the file. If the section type is SHT_NOBITS, it indicates that the section does not occupy space in the file. In this case, sh_offset is useless.

Sh_size: the size of the section in bytes. If the section type is SHT_NOBITS, you don't need to worry about sh_size.

Sh_link and sh_info in different sections have different meanings:

 

Basically, the section contains the index of the string table, symbol table, and other sections in the section header table for different section types.

Sh_addralign: Specifies the sh_addr of this section to which it is aligned. sh_addralign should be a positive integer multiple of 2. If it is 0 or 1, this section does not have the byte alignment constraint.

Sh_entsize: the content of some sections is a table, and the size of each table item is fixed, such as a symbol table. For such a table, this Member specifies the size of each of its table items. If the value is 0, this section does not contain XX tables.

The index in section header table is 0 (SHN_UNDEF). The content is: