Section.
Header table.
The section header table, uh, series of entries containing information about sections.
Each section has a name.
Okay.
The name of this standard names of sections usually start with a dot.
By convention, it has a type.
It has flags.
It's informs linker how it is intended to be used and decoded.
It has a size.
What is the size of the section where it is stored?
It has offset in the Elf file.
All this information is present in the section header.
For every section there is a section header and group of section headers is nothing but your section
header table, and this section header table is used during link time.
After link time.
After the executable is generated, the section header table is not of use for the loader.
It is only used for the linker and for the debugger.
Okay, where is the section header table present and this information is present in the Elf header.
In the Elf header you have E underscore section header offset.
It provides the offset at which the Elf section is present in the Elf file.
So if you go back to this location you have this header.
You can print the elf header and you have a file entry known as.
Uh, start of the section headers.
So this provides you, uh, where is the offset where section headers is present in the Elf file.
So in the Elf header you have start of section headers.
This provides you the offset where.
E.L.F.
Uh section headers are present in the Elf file, and how many section headers are present in the Elf
file is also been provided by the Elf header.
So we have E underscore section header offset and E underscore section header number, which is providing
the offset in the size of the Elf file.
And also this one more related to section header size of each section header is also provided by so
64.
So at this offset.
You have 29 section headers, each of size 64 bits.
And the structure for this is again depending on, uh, 32 bit and 64 bit you have 64 underscore section
header elf 32 underscore section header.
And if you see this is the structure it has a name.
It has a type.
And I have copied this from usr include elf dot h.
You have a name you have a type flags address okay.
Name.
It's a word.
So it's not a string right.
It is a word.
So this is used to store an index.
So here you are not storing the string but you are storing an index which is an offset into the section
header string table okay.
We'll see how this they are storing the names in a section header.
But here you don't have a string.
You have a number which is just an offset into the section header string table.
Then you have a set type.
It determines the section contents.
If you have this type set to SSD underscore program bits, this means it has the information.
It holds information defined by the program.
It has a code and all, and it has all those information.
SSD underscore no bits is used by the BSS section.
So using this type the linker can identify whether it is a code section data section.
It has information related to relocation.
It has information for the BSS and all.
Then you have assets underscore address.
This is the offset to the virtual address that will be for the particular section.
Then you have s-h underscore offset.
This is the offset of where the section is present in the file.
This is the offset used for the during the memory loading.
This is the offset where actually the content of the section is present in the file.
And then you have size of the section.
What is the size of this section present on the file and section header table link index link.
So we have uh linking to some other sections.
Sometimes like uh some section depend on some other section where you can specify the link like symbol
table and all.
Okay.
Now, uh, I'll show you a simple example.
Uh, so.
So this is a code.
Okay, first let's see.
Oh.
I'm in this code.
Uh, I have written a code, uh, where I am printing the section header.
So we know section header contains information about the sections.
So I am accepting a file name as an input.
And, uh, I'm checking the file is present or not, and I'm passing this to this function with the
size of the file.
Here I am performing opening the file descriptor, opening the file, and I am performing memory map
operation.
And I am first, you know, the first 64 bytes are the header.
So I am mapping it to the Elf header.
So I have included elf dot h and I know where is the section header present.
I know elf section header is present at this particular offset.
This information is present in the elf header.
So I am taking that and empower or typecasting it to the Elf 64.
And I know how many section headers are present.
Again this information is coming from the section header.
Uh elf header.
Now if I want to get uh, if I want to get the section name, I need to get the information from the
this section known as, uh, section header string table.
From that section, I need to get information about the name of the section.
And I have this information present in the elf.
So elf header has a field section header string index.
So what is the index of the.
Where is this section header string table present in the section header array.
So that information I will get it from the elf header.
And I will map that section header here.
And now I also get the offset of I will get the location where this is present.
String table is present okay.
Uh with the offset from the section header table.
So I got the section header table.
And then I got the offset where this is present on the file.
And I am pointing to a pointer.
Now I am printing the section header name.
So section header name is just an offset.
And then this is the actual offset of uh.
Section, header, string, table and plus then this thing.
Then how much is the value?
Let's see I will print this code.
So this is the code I have make user space.
And I will run user space.
I need to give a file.
I will only give the user space name.
And if you see this it is printing all the different sections.
We have 30 sections we have and all this information is being printed.
First is an empty section and then you have entropy.
Entropy is like entropy.
You will see interpreter.
So.
Here you can see it is printing.
First I, I is a number, uh, serial number and then say then the name is just an offset where it is
present in the section header string table.
At what location of this it is present.
And then we are from the starting location.
We are printing the string.
So we have this many strings.
So one the important point here is we are not having uh, if you see the structure of.
Elevator section.
It is just a integer.
It is not a number, it is a number.
It is not a string.
So this is pointing to the offset into the section.
Header string table section.
Header string table stores all the section names.
Okay.
And if I want to check the section header name I need to check in this particular table.
And for that I need to check what is the offset of this particular section in this table.
And that is how I can check it.
And this is a simple example where we have printed all the section headers and that information we are
already getting.
If I say uh.
Using this as well.
The different instructions.
We have already printed the same thing I am printing using simple code written in my C program.
Then I can also have one more code where I am printing the full section header.
So same code.
I am opening the file in read only mode.
I am getting the file descriptor, I am memory mapping it and then I am printing the section header.
In the previous example I have printed on the section names.
In this example I'm printing the section header some information.
First I am having the elf header, then I am getting the section header table, then the string table
uh section header string table.
And I know how many section headers I have using the elf header this value.
And uh, then I am printing the section header name, the type whether what type it is, program bits,
symbol, table, string, table or dynamic etc. and all those different types of the section.
Header table section header section header type is being printed here.
And then section header flags whether it has permission for write or log exec instruction etc..
That's it.
Two information and printing here.
One is a section header table type and section header flag and the section header name.
So let's compile this one.
And I'll run this and this.
So here I am getting information about the section headed first name type of the section header and
the flags.
The same information is also you are getting using this name.
So it is also printing the type.
It is also printing the flag.
A means allow alloc memory in the uh, allow me to alloc the memory, etc. X means here in this things
you have an executable code and all.
So there are different flags in this, uh, Elf section.