The common sections in an Elf file.
One is a text section.
Text section contains the machine code to be loaded into memory and executed on CPU.
The type of the text section in the section header is section header.
Type is program bits and it has flags.
Section header.
Flag is exec instruction, so this means the section contains executable instructions.
Then it has a flag as a chief underscore log section header flag log.
So this means the contents of the section has to be loaded into memory when executing the binary.
So you can verify this either using Objdump as well.
And you can verify using the radial f hyphen w s command.
So here it is printing the disassembly of the section header.
Uh, it is printing the contents.
What is present in the section header and not section header is printing this.
Uh, it says disassembly of the text section.
Okay.
It is using this command.
You can I can do I can only check the contents of the text section if I do.
Objdump hyphen d user space dot o.
It will tell me all that uh contents.
Right.
If I say user space it will print me all the contents, different different sections of the different
different sections.
Right.
If I want to look only only for the text section, I can see using Objdump.
So it is also printing contents of the section, and it is also printing the disassembly of the section.
But if I use the this command it is only printing this disassembly.
It is not printing the contents.
But if I use capital D and all this flags it is printing.
Along with that the contents as well.
And we have the data section which is containing the initialized data which is hard coded in hard coded
in the executable to be loaded in the memory.
The global variables.
Right.
The type of this f is C program bits.
So text section and the data section has the same type SSD program bits.
But the flag is different here.
We don't have executable instructions, but we have the uh f underscore.
Right.
Because this section can be writable during runtime.
We have a different flag as a f underscore right.
And has a flag.
This means when the contents of the section are loaded in memory, uh, this section will be loaded
into the memory.
The text section and the data section will be loaded into the memory.
Then we have BSS section.
So BSS is uh some section which is zeroed by the uh we have to zero out.
What, uh what all the variables are in the BSS section.
This has we assigned a value zero.
So it is common to have some allocated memory that starts zeroed out.
And it will be a waste of, uh, memory to include a bunch of empty bytes in the file.
So we are not including, uh, zero location, zero memory location in the Elf file.
We will only inform that we have BSS section.
And please allocate bss section.
And if you see, we have.
SSD.
No bytes.
Okay.
Type is SSD, no bytes.
Uh, it is not program bytes.
It is SSD.
No bytes.
It does not contain any useful information.
It is, uh, type of no bytes, no bits.
This is program bits.
This is no bit.
The flag is again a successful log and stuff.
Right.
So similarly the flag is same as a data section for the BSS section.
So BSS is simply a tip to the loader to pre-allocate some space when starting the program, it will
be all zeros at the execution and won't hold any useful information until the program writes to it.
Then you have R0 data section.
Uh, similar to the data section, uh, it is simply read only and it has all the constant strings here.
And then you have section header string tables.
And it is of type different type 60 str.
So there are various types like program bits no bits and all.
And we know section header string table is used to store the information about the strings which are
used in the uh name of the strings sections.
The name of the sections, the strings of the section sections.
The section names are stored in the section header string table.
These other sections like init, Fini, and uh.
This all init contains the code which will be executed before the main function, if any contains the
code which will be executed after the main program completes.
There is a interpreter which is used to store the string pointer to the program interpreter.
I can verify that using Readelf as well.
So Rudolph print interpreter section.
I say this one and uh to print me, the interpreter is the loader lib64 ld this.
We have seen it when we are compiling the C code, we are using this LD loader.
We are passing this to the LD as well.
Right.
So this information is all LD also will give you this information.
Right.
Uh this is the same.
So interpreter is the where the section where this information of what interpreter to use is present.
And you have played and got which contains the procedure Linkage linkage table and global offset table
which is used to implement lazy binding.
Okay.
These are the various like almost so many sections.
If you see f, f and s.
You have like 2930 sections.
There are 29 sections and each has different type.
First one is null.
This is uh null header.
It has no size at all.
Then you have program bits.
Means it is.
This has to be loaded.
If you have program bits this means it will be allocated in the memory a means allocated.
This has to be loaded in the memory.
So then you have uh.
In each section.
This has also executable instructions and plt and plt.
Got all this are having executable section.
Text section is already having executable section.
Then you have data section which is not having executable but it is Writeable.
It is VSS is Writeable and got and dynamic is Writeable.
So these are the various sections like init array and writeable write alloc.
So m means merge okay.
So various sections in an, uh, l file, and you can print using objdump.
So if I want to print using objdump hyphen s also this one command hyphen s, I can print, uh, all
the sections of this.
So previously we were printing section one, section by one section.
This command was printing only text section.
But if I want to print full, uh, all the sections, I can use objdump hyphen s command, and it will
print me all the sections of the user space interpreter section as, uh, interpreter name the string
name and we'll see some of the sections like uh.
The raw data has the constant strings.
And we have we should we have this not printing I think section at a string table here anyway.
So section at a string table is not being printed.
It is printing the remaining sections because it is getting the name from the section header string
table all.
So various commands we have seen.
One is happiness.
And we have also seen this command which is printing this contents of the section along with the which
section you want.
You can select using hyphen uh j option, but if you want only all sections you can just use uh objdump
hyphen S which will print all the sections.
So this is a comment section as well which contains information about the ubuntu version and the compiler
used.
This is the compiler version.