Ciro Santilli @cirosantilli 35

 Articles  Discussions  Comments  Follows  Received likes

 New  Updated  Top  Announced  A-Z  Liked  Followed

ELF Hello World Tutorial / .strtab  Updated 2025-04-24  +Created 1970-01-01

Holds strings for the symbol table.

This section has sh_type == SHT_STRTAB.

It is pointed to by sh_link == 5 of the .symtab section.

readelf -x .strtab hello_world.o

outputs:

Hex dump of section '.strtab':
  0x00000000 0068656c 6c6f5f77 6f726c64 2e61736d .hello_world.asm
  0x00000010 0068656c 6c6f5f77 6f726c64 0068656c .hello_world.hel
  0x00000020 6c6f5f77 6f726c64 5f6c656e 005f7374 lo_world_len._st
  0x00000030 61727400                            art.

This implies that it is an ELF level limitation that global variables cannot contain NUL characters.

 Read the full article

ELF Hello World Tutorial / .text section  Updated 2025-04-24  +Created 1970-01-01

 View more

Now that we've done one section manually, let's graduate and use the readelf -S of the other sections:

  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 2] .text             PROGBITS         0000000000000000  00000210
       0000000000000027  0000000000000000  AX       0     0     16

.text is executable but not writable: if we try to write to it Linux segfaults. Let's see if we really have some code there:

objdump -d hello_world.o

gives:

hello_world.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 <_start>:
   0:       b8 01 00 00 00          mov    $0x1,%eax
   5:       bf 01 00 00 00          mov    $0x1,%edi
   a:       48 be 00 00 00 00 00    movabs $0x0,%rsi
  11:       00 00 00
  14:       ba 0d 00 00 00          mov    $0xd,%edx
  19:       0f 05                   syscall
  1b:       b8 3c 00 00 00          mov    $0x3c,%eax
  20:       bf 00 00 00 00          mov    $0x0,%edi
  25:       0f 05                   syscall

If we grep b8 01 00 00 on the hd, we see that this only occurs at 00000210, which is what the section says. And the Size is 27, which matches as well. So we must be talking about the right section.

This looks like the right code: a write followed by an exit.

The most interesting part is line a which does:

movabs $0x0,%rsi

to pass the address of the string to the system call. Currently, the 0x0 is just a placeholder. After linking happens, it will be modified to contain:

4000ba: 48 be d8 00 60 00 00    movabs $0x6000d8,%rsi

This modification is possible because of the data of the .rela.text section.

 Read the full article

GitLab  Updated 2025-04-24  +Created 1970-01-01

 View more

GitLab was very important to Ciro because he wanted to base Booktree on it.

 Read the full article

University of Cambridge spinout company  Updated 2025-04-24  +Created 1970-01-01

 Read the full article

University of Oxford exam dates  Updated 2025-04-24  +Created 1970-01-01

 View more

Cool that there is actually a page for a change: www.ox.ac.uk/students/academic/exams/timetables e.g. working in 2024: web.archive.org/web/20240305013807/https://www.ox.ac.uk/students/academic/exams/timetables

And translating from their arcane vocabulary:

Prelims: first year undergrad
Honour school; other years of undergrad, sometimes it includes masters others not which is confusing
MPhil, MSc, MSt: masters

 Read the full article