Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1249

Appendix E: The ELF Binary Format

libraries or by means of dynamic linking at load time (usingld-linux.so). Thenmtool generates a list of

all symbols defined and used by a program, as shown here:

wolfgang@meitner>nm test.o

00000000 T add

U exit

0000001a T main

U printf

The left column shows the symbol value — the object file position at which the symbol definition is

located. The example includes two different symbol types — functions defined in the text segment (as

indicated by the abbreviationT) and undefined references indicated by aU. Logically, the undefined

references do not have a symbol value.

Many more symbols appear in executable files. However, because most are generated automatically by

the compiler and are used for internal purposes of the runtime system, the following example shows only

the elements that also appeared in the object file:

wolfgang@meitner>nm test

08048388 T add

U exit@@GLIBC_2.0

080483a2 T main

U printf@@GLIBC_2.0

exitandprintfremain undefined, but in the meantime, information has been added indicating the

earliest version of the GNU standard library from which the functions must betaken (in the example, no

version earlier than 2.0 may be used, which means that the program does not function with Libc5 and

Libc4^7 ). Theaddandmainsymbols defined by the program have been moved to fixed positions in virtual

address space (their code was mapped to these positions when the file was loaded).

How is the symbol table mechanism implemented in ELF? The following three sections are used to accept

the relevant data:

❑ .symtabestablishes the link between the name of a symbol and its value. However, the symbol

name is not coded directly as a string but indirectly as a number that is used as an index into a

string array.

❑ .strtabholds the string array.

❑ .hashholds a hash table that helps find symbols quickly.

Expressed in simple terms, each entry in the.symtabsection consists of two elements — the position of

the name in the string table and the associated value. (As you will see next, the real situation is a little

more complicated, because more information needs to be considered for each entry.)

E.1.5 String Tables

Figure E-2 shows how string tables are implemented to manage strings for ELF files.

(^7) The version numbering seems rather strange but is correct. Libc4and Libc5 were special C standard libraries for Linux — Glibc 2.0
was the first cross-system variant of the library that replaced the old versions.