8 ELF Section Headers

Sections can be stored anywhere in an ELF file. They can also be of any size, of any type, have any name (or no name) and their contents are free. The ELF file therefore contains a table, called the section header table, whose entries describe each section. This table is sized and linked from the ELF header via the e_shoff field. As we have seen, the section header table is available in the shdr field of Elf32_File and Elf64_File.

The Poke types denoting entries in the section header table are Elf32_Shdr and Elf64_Shdr for ELF32 and ELF64 respectively.

8.1 Overview

type Elf32_Shdr =
  struct
  {
    offset<Elf_Word,B> sh_name;
    Elf_Word sh_type;
    Elf_Word sh_flags;
    Elf32_Addr sh_addr;
    Elf32_Off sh_offset;
    offset<Elf_Word,B> sh_size;
    Elf_Word sh_link;
    Elf_Word sh_info;
    Elf_Word sh_addralign;
    offset<Elf_Word,B> sh_entsize;
  };

type Elf64_Shdr =
  struct
  {
    offset<Elf_Word,B> sh_name;
    Elf_Word sh_type;
    Elf64_Xword sh_flags;
    Elf64_Addr sh_addr;
    Elf64_Off sh_offset;
    offset<Elf64_Xword,B> sh_size;
    Elf_Word sh_link;
    Elf_Word sh_info;
    Elf64_Xword sh_addralign;
    offset<Elf64_Xword,B> sh_entsize;
  };

8.2 Fields

sh_name

Is the offset to the name of this section in the file’s section string table. Two or more sections can share the same name.

sh_type

Is a code identifying the type of the section. This is one of the ELF_SHT_* values.

The type of a section determines what kind of contents (if any) a section has: relocations, a symbol table, a string table, executable compiled code, etc. These are the types defined in the base spec:

ELF_SHT_NULL

This marks “unused” entry in the section header table. The first entry in the table seems to always be an unused entry. Unused entries have empty names.

ELF_SHT_PROGBITS

Section is what the spec calls “program specific (private) data.” In practice, this basically means executable code. The prototypical progbits section is .text.

ELF_SHT_SYMTAB

Section contains a symbol table. Each symbol table is an array of ELF64_Sym (Elf32_Sym in ELF32) values spanning for sh_size bytes. See ELF Symbols.

ELF_SHT_STRTAB

Section contains a string table. Each string table is an array of NULL terminated strings spanning for sh_size bytes.

ELF_SHT_RELA

ELF_SHT_REL

Section contains ELF relocations, with or without explicit addend. Each section contains an array of Elf64_Rela or Elf64_Rel (Elf32_Rela or Elf32_Rel in ELF32) values spanning for sh_size bytes. See ELF Relocations.

ELF_SHT_HASH

Section contains a symbol hash table.

ELF_SHT_DYNAMIC

Section contains dynamic linking information in the form of a sequence of dynamic tags. This is an array of Elf64_Dyn (Elf32_Dyn in ELF32) values spanning for sh_size bytes. See ELF Dynamic Info.

ELF_SHT_NOTE

Section contains notes. These are flexible annotations that are usually used in order to reflect certain “auxiliary” attributes of the ELF file. For example, the name and full version of the compiler that generated it. The format in which the notes are encoded is well defined, and supported by the elf pickles. See ELF Notes.

ELF_SHT_SHLIB

This value for sh_type is reserved by the ELF specification and has undefined semantics.

ELF_SHT_DYNSYM

ELF_SHT_NOBITS

The section contents occupy no bits in the file.

ELF_SHT_INIT_ARRAY

ELF_SHT_FINI_ARRAY

ELF_SHT_PREINIT_ARRAY

Section contains an array of pointers to initialization/finalization/pre-initialization functions, which are parameter-less procedures that do not return any value. This is an array of offset<uint<64>,B> (offset<uint<32>,B> in ELF32) values spanning for sh_size bytes.

ELF_SHT_GROUP

Section contains the definition of an ELF section group. See ELF File.

ELF_SHT_SYMTAB_SHNDX

Section contains indices for SHN_XINDEX entries.

The ELF supplements for architectures/machines and operating systems introduce their own additional section types. See ELF Machines.

This field is checked against the section-types configuration parameter, and pretty-printed accordingly.

sh_flags

Is a bitmap where each enabled bit flags some particular property of the section. This is one of the ELF_SHF_* values. These are the flags defined in the base spec:

ELF_SHF_WRITE

The section contains data that should be writable during process execution.

ELF_SHF_ALLOC

The section contents are actually loaded into memory during process execution.

ELF_SHF_EXECINSTR

The section contains executable machine instructions.

ELF_SHF_MERGE

The section contents can be merged to eliminate duplication. The ELF spec provides an algorithm (to be implemented by link editors) that explains how to merge sections flagged with this flag. The algorithm covers two cases: merge-able sections containing elements of fixed size, and string tables.

ELF_SHF_STRINGS

The section contains a string table.

ELF_SHF_INFO_LINK

The sh_info field of this section header contains a section header table index.

ELF_SHF_LINK_ORDER

This section is to be ordered in a particular way by link editors. The order to use is specified by a link to other section header table via sh_info. See the ELF spec for details.

ELF_SHF_OS_NONCONFORMING

This section requires special OS support to be linked.

ELF_SHF_OS_TLS

This section holds thread-local storage.

ELF_SHF_COMPRESSED

This section contents are compressed. Sections flagged as compressed cannot have the flag ELF_SHF_ALLOC set. Also, sections of type ELF_SHT_NOBITS cannot be compressed.

The ELF supplements for architectures/machines and operating systems introduce their own additional section types. See ELF Machines.

This field is checked against the section-flags configuration parameter, and pretty-printed accordingly.