| |||
| Home > ELF overview and background > ELF file structure > ELF sections | |||
An ELF file normally has a number of standard sections. A section is block of similar data. An ELF file normally comprises sections containing program code, program data, dynamic information, relocations, a symbol table, and a string table. Each section in the file has a section header table entry describing the section and its properties.
The following sub-sections provide an overview of the most commonly found ELF sections.
An ELF file normally includes multiple program sections. There is normally a program section for read only code, read/write (RW) data and zero-initialized (ZI) data. It is also common to have a section for read only data.
These sections normally have standard names:
.text for
executable code
.data for RW data
.bss for ZI data.
The string table is a section containing a list of null terminated strings. These are referenced from elsewhere in the ELF file, for example, the symbol table, using an offset into the string table.
For dynamically linked images there are normally two string tables:
.dynstrtab for
strings relating to dynamically linked symbols
.strtab for statically linked
symbols.
The symbol table describes the symbol definitions and references in the ELF file. It holds the address, binding, visibility, section, symbol type (code/data), size and name (via an offset into the string table) of each symbol.
In a dynamic image there might be two symbol tables:
.symtab contains
the static symbol table
.dynsym contains the dynamic
symbol table.
It is common to remove the static symbol table from images to save space and hide IP.
The dynamic section, normally named .dynamic,
is used to provide specific information to the dynamic linker. This
is achieved through entries called tags. There are a number of different types
of tags. Each tag is used to provide a specific piece of information
to the dynamic linker. Each tag has a value or associated piece
of data.
For example DT_NEEDED tags are used to
inform the dynamic linker which modules (dependencies) the current
image requires. There are also tags to inform the dynamic linker
of the location of certain items in the ELF file.
The tags in the dynamic section tell the dynamic linker where to find all of the other data, such as the dynamic symbol table, needed by the dynamic linker.
It is important for a dynamic linker to use the tags in the dynamic section to find the dynamic content, rather than use the section header table.
Relocation sections are used to store the relocations in the ELF file.
For object files these sections are normally named .rel<name> or .rela<name>,
where <name> is the section that the relocations
apply to.
.relname is
used for rel types relocations
.relaname is used for rela type
relocations.
For a dynamically linked ELF file, the section is normally
named .dyn.