Linux Kernel Architecture

Mauerer runapp05.tex V1 - 09/04/2008 6:13pm Page 1257

Appendix E: The ELF Binary Format

Elf64_Word sh_info; /* Additional section information */

Elf64_Xword sh_addralign; /* Section alignment */

Elf64_Xword sh_entsize; /* Entry size if section holds table */

} Elf64_Shdr;

The ELF standard defines a number of sections with fixed names. These are used to perform standard

tasks needed in most object files. All names begin with a dot to distinguish them from user-defined or

non-standard sections. The most important standard sections are as follows:

❑ .bssholds uninitialized data sections of the program that are padded with null bytes before the

program begins to run.

❑ .datacontains initialized program data — for instance, pre-initialized structures that were filled

with static data at compilation time. These data can be changed during program run time.

❑ .rodataholds read-only data that is used by the program but cannot be modified — strings, for

example.

❑ .dynamicand.dynstrhold the dynamic information discussed at the end of this appendix.

❑ .interpholds the name of the program interpreter in the form of a string.

❑ .shstrtabcontains a string table that defines section names.

❑ .strtabholds a string table that contains primarily the strings required for the symbol table.

❑ .symtabholds the symbol table of the binary file.

❑ .initand.finihold machine instructions that are executed to initialize or terminate the pro-

gram. The contents of these sections are usually generated automatically by the compiler and its

auxiliary tools in order to create a suitable runtime environment.

❑ .textholds the main machine instructions that make up the actual program.

E.2.3 String Tables

The format of string tables was discussed previously in Section E.1.5. Because their format is very

dynamic, the kernel is not able to provide a fixed data structure but must analyze the existing data

‘‘manually.’’

E.2.4 Symbol Tables

Symbol tables hold all the information needed to find program symbols, assign values to them, and

relocate them. As already noted, a special section type holds symbol tables. The tables themselves consist

of entries whose format is defined by the following data structure:

<elf.h>

typedef struct elf32_sym{

Elf32_Word st_name;

Elf32_Addr st_value;

Elf32_Word st_size;

unsigned char st_info;

unsigned char st_other;

Elf32_Half st_shndx;

} Elf32_Sym;