2.6 Using fromelf to find where a symbol is placed in an executable ELF image

You can find where a symbol is placed in an executable ELF image.

To find where a symbol is placed in an ELF image file, use the --text -s -v options to view the symbol table and detailed information on each segment and section header, for example:

The symbol table identifies the section where the symbol is placed.

Procedure

  1. Create the file s.c containing the following source code:
    long long altstack[10] __attribute__ ((section ("STACK"), zero_init));
    int main()
    {
        return sizeof(altstack);
    }
  2. Compile the source:

    armcc -c s.c -o s.o

  3. Link the object s.o and keep the STACK symbol:
    armlink --keep=s.o(STACK) s.o --output=s.axf
  4. Run the fromelf command to display the symbol table and detailed information on each segment and section header:
    fromelf --text -s -v s.o
  5. Locate the STACK and altstack symbols in the fromelf output, for example:
              ...
              ** Section #9
              Name        : .symtab
              Type        : SHT_SYMTAB (0x00000002)
              Flags       : None (0x00000000)
              Addr        : 0x00000000
              File Offset : 2792 (0xae8)
              Size        : 2896 bytes (0xb50)
              Link        : Section 10 (.strtab)
              Info        : Last local symbol no = 115
              Alignment   : 4
              Entry Size  : 16
              
              Symbol table .symtab (180 symbols, 115 local)
              
                #  Symbol Name                Value      Bind  Sec  Type  Vis  Size
              =========================================================================
              ...
               16  STACK                      0x00008228   Lc    2  Sect  De   0x50
              ...
              179  altstack                   0x00008228   Gb    2  Data  Hi   0x50
              ...

    The Sec column shows the section where the stack is placed. In this example, section 2.

  6. Locate the section identified for the symbol in the fromelf output, for example:
              ...
              ====================================
              ** Section #2
              Name        : ER_ZI
              Type        : SHT_NOBITS (0x00000008)
              Flags       : SHF_ALLOC + SHF_WRITE (0x00000003)
              Addr        : 0x000081c8
              File Offset : 508 (0x1fc)
              Size        : 176 bytes (0xb0)
              Link        : SHN_UNDEF
              Info        : 0
              Alignment   : 8
              Entry Size  : 0
              ====================================
              ...

    This shows that the symbol is placed in an ZI execution region.

Non-ConfidentialPDF file icon PDF versionARM DUI0477M
Copyright © 2010-2016 ARM Limited or its affiliates. All rights reserved.