Ciro Santilli @cirosantilli 40

 Articles (13k) Discussions (29) Comments (66) Follows  Received likes Files

New Updated  Top  Announced  A-Z  Liked  Followed

ELF Hello World Tutorial / .rel.text Updated 2025-07-16

Besides sh_type == SHT_RELA, there also exists SHT_REL, which would have section name .text.rel (not present in this object file).

Those represent the same struct, but without the addend, e.g.:

typedef struct {
    Elf64_Addr  r_offset;
    Elf64_Xword r_info;
} Elf64_Rela;

The ELF standard says that in many cases the both can be used, and it is just a matter of convenience.

 Read the full article

ELF Hello World Tutorial / Section header table Updated 2025-07-16

 View more

Array of Elf64_Shdr structs.

Each entry contains metadata about a given section.

e_shoff of the ELF header gives the starting position, 0x40 here.

e_shentsize and e_shnum from the ELF header say that we have 7 entries, each 0x40 bytes long.

So the table takes bytes from 0x40 to 0x40 + 7 + 0x40 - 1 = 0x1FF.

Some section names are reserved for certain section types: www.sco.com/developers/gabi/2003-12-17/ch4.sheader.html#special_sections e.g. .text requires a SHT_PROGBITS type and SHF_ALLOC + SHF_EXECINSTR

Running:

readelf -S hello_world.o

outputs:

There are 7 section headers, starting at offset 0x40:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .data             PROGBITS         0000000000000000  00000200
       000000000000000d  0000000000000000  WA       0     0     4
  [ 2] .text             PROGBITS         0000000000000000  00000210
       0000000000000027  0000000000000000  AX       0     0     16
  [ 3] .shstrtab         STRTAB           0000000000000000  00000240
       0000000000000032  0000000000000000           0     0     1
  [ 4] .symtab           SYMTAB           0000000000000000  00000280
       00000000000000a8  0000000000000018           5     6     4
  [ 5] .strtab           STRTAB           0000000000000000  00000330
       0000000000000034  0000000000000000           0     0     1
  [ 6] .rela.text        RELA             0000000000000000  00000370
       0000000000000018  0000000000000018           4     2     4
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), l (large)
  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

The struct represented by each entry is:

typedef struct {
    Elf64_Word  sh_name;
    Elf64_Word  sh_type;
    Elf64_Xword sh_flags;
    Elf64_Addr  sh_addr;
    Elf64_Off   sh_offset;
    Elf64_Xword sh_size;
    Elf64_Word  sh_link;
    Elf64_Word  sh_info;
    Elf64_Xword sh_addralign;
    Elf64_Xword sh_entsize;
} Elf64_Shdr;

 Read the full article

ELF Hello World Tutorial / Section vs segment Updated 2025-07-16

 View more

We will get into more detail later, but it is good to have it in mind now:

section: exists before linking, in object files.
One ore more sections will be put inside a single segment by the linker.
Major information sections contain for the linker: is this section:
- raw data to be loaded into memory, e.g. .data, .text, etc.
- or metadata about other sections, that will be used by the linker, but disappear at runtime e.g. .symtab, .srttab, .rela.text
segment: exists after linking, in the executable file.
Contains information about how each segment should be loaded into memory by the OS, notably location and permissions.

See also:

 Read the full article

ELF Hello World Tutorial / SHN_ABS Updated 2025-07-16

 View more

hello_world_len points to the special st_shndx == SHN_ABS == 0xF1FF.

0xF1FF is chosen so as to not conflict with other sections.

st_value == 0xD == 13 which is the value we have stored there on the assembly: the length of the string Hello World!.

This means that relocation will not affect this value: it is a constant.

This is small optimization that our assembler does for us and which has ELF support.

If we had used the address of hello_world_len anywhere, the assembler would not have been able to mark it as SHN_ABS, and the linker would have extra relocation work on it later.

 Read the full article

ELF Hello World Tutorial / .shstrtab Updated 2025-07-16

 View more

Section type: sh_type == SHT_STRTAB.

Common name: "section header string table".

The section name .shstrtab is reserved. The standard says:

This section holds section names.

This section gets pointed to by the e_shstrnd field of the ELF header itself.

String indexes of this section are are pointed to by the sh_name field of section headers, which denote strings.

This section does not have SHF_ALLOC marked, so it will not appear on the executing program.

readelf -x .shstrtab hello_world.o

outputs:

Hex dump of section '.shstrtab':
  0x00000000 002e6461 7461002e 74657874 002e7368 ..data..text..sh
  0x00000010 73747274 6162002e 73796d74 6162002e strtab..symtab..
  0x00000020 73747274 6162002e 72656c61 2e746578 strtab..rela.tex
  0x00000030 7400                                t.

The data in this section has a fixed format: www.sco.com/developers/gabi/2003-12-17/ch4.strtab.html

If we look at the names of other sections, we see that they all contain numbers, e.g. the .text section is number 7.

Then each string ends when the first NUL character is found, e.g. character 12 is \0 just after .text\0.

 Read the full article

Eligius pool Updated 2025-07-16

 View more

en.bitcoin.it/wiki/Eligius

Created by Luke Dashjr.

The pool is named after Saint Eligius, patron of miners^[ref]

Eligius also means to "choose" or "chosen" in Latin: en.wiktionary.org/wiki/Eligius, same root as "to elect" in modern English presumably.

Figure 1.
Saint Eligius by Petrus Christus
. Source. Eligius pool is named after Saint Eligius, patron of goldsmiths and miners^[ref]

 Read the full article

ELF Hello World Tutorial / Standards Updated 2025-07-16

 View more

ELF is specified by the LSB:

The LSB basically links to other standards with minor extensions, in particular:

Generic (both by SCO):
- System V ABI 4.1 (1997) www.sco.com/developers/devspecs/gabi41.pdf, no 64 bit, although a magic number is reserved for it. Same for core files. This is the first document you should look at when searching for information.
- System V ABI Update DRAFT 17 (2003) www.sco.com/developers/gabi/2003-12-17/contents.html, adds 64 bit. Only updates chapters 4 and 5 of the previous document: the others remain valid and are still referenced.
Architecture specific (by the processor vendor):
- IA-32: refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-IA32/LSB-Core-IA32/elf-ia32.html, points mostly to www.sco.com/developers/devspecs/abi386-4.pdf
- AMD64: refspecs.linuxfoundation.org/LSB_4.1.0/LSB-Core-AMD64/LSB-Core-AMD64/elf-amd64.html, points mostly to www.x86-64.org/documentation/abi.pdf

A handy summary can be found at:

man elf

 Read the full article

ELF Hello World Tutorial / .strtab Updated 2025-07-16

 View more

Holds strings for the symbol table.

This section has sh_type == SHT_STRTAB.

It is pointed to by sh_link == 5 of the .symtab section.

readelf -x .strtab hello_world.o

outputs:

Hex dump of section '.strtab':
  0x00000000 0068656c 6c6f5f77 6f726c64 2e61736d .hello_world.asm
  0x00000010 0068656c 6c6f5f77 6f726c64 0068656c .hello_world.hel
  0x00000020 6c6f5f77 6f726c64 5f6c656e 005f7374 lo_world_len._st
  0x00000030 61727400                            art.

This implies that it is an ELF level limitation that global variables cannot contain NUL characters.

 Read the full article

ELF Hello World Tutorial / STT_NOTYPE Updated 2025-07-16

 View more

Then come the most important symbols:

Num:    Value          Size Type    Bind   Vis      Ndx Name
  4: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT    1 hello_world
  5: 000000000000000d     0 NOTYPE  LOCAL  DEFAULT  ABS hello_world_len
  6: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT    2 _start

hello_world string is in the .data section (index 1). It's value is 0: it points to the first byte of that section.

_start is marked with GLOBAL visibility since we wrote:

global _start

in NASM. This is necessary since it must be seen as the entry point. Unlike in C, by default NASM labels are local.

 Read the full article

ELF Hello World Tutorial / STT_SECTION Updated 2025-07-16

 View more

There are two such entries, one pointing to .data and the other to .text (section indexes 1 and 2).

Num:    Value          Size Type    Bind   Vis      Ndx Name
  2: 0000000000000000     0 SECTION LOCAL  DEFAULT    1
  3: 0000000000000000     0 SECTION LOCAL  DEFAULT    2

TODO what is their purpose?

 Read the full article

ELF Hello World Tutorial / .symtab Updated 2025-07-16

 View more

Section type: sh_type == SHT_SYMTAB.

Common name: "symbol table".

First the we note that:

sh_link = 5
sh_info = 6

For SHT_SYMTAB sections, those numbers mean that:

strings that give symbol names are in section 5, .strtab
the relocation data is in section 6, .rela.text

A good high level tool to disassemble that section is:

nm hello_world.o

which gives:

0000000000000000 T _start
0000000000000000 d hello_world
000000000000000d a hello_world_len

This is however a high level view that omits some types of symbols and in which the symbol types . A more detailed disassembly can be obtained with:

readelf -s hello_world.o

which gives:

Symbol table '.symtab' contains 7 entries:
   Num:    Value          Size Type    Bind   Vis      Ndx Name
     0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND
     1: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS hello_world.asm
     2: 0000000000000000     0 SECTION LOCAL  DEFAULT    1
     3: 0000000000000000     0 SECTION LOCAL  DEFAULT    2
     4: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT    1 hello_world
     5: 000000000000000d     0 NOTYPE  LOCAL  DEFAULT  ABS hello_world_len
     6: 0000000000000000     0 NOTYPE  GLOBAL DEFAULT    2 _start

The binary format of the table is documented at www.sco.com/developers/gabi/2003-12-17/ch4.symtab.html

The data is:

readelf -x .symtab hello_world.o

which gives:

Hex dump of section '.symtab':
  0x00000000 00000000 00000000 00000000 00000000 ................
  0x00000010 00000000 00000000 01000000 0400f1ff ................
  0x00000020 00000000 00000000 00000000 00000000 ................
  0x00000030 00000000 03000100 00000000 00000000 ................
  0x00000040 00000000 00000000 00000000 03000200 ................
  0x00000050 00000000 00000000 00000000 00000000 ................
  0x00000060 11000000 00000100 00000000 00000000 ................
  0x00000070 00000000 00000000 1d000000 0000f1ff ................
  0x00000080 0d000000 00000000 00000000 00000000 ................
  0x00000090 2d000000 10000200 00000000 00000000 -...............
  0x000000a0 00000000 00000000                   ........

The entries are of type:

typedef struct {
    Elf64_Word  st_name;
    unsigned char   st_info;
    unsigned char   st_other;
    Elf64_Half  st_shndx;
    Elf64_Addr  st_value;
    Elf64_Xword st_size;
} Elf64_Sym;

Like in the section table, the first entry is magical and set to a fixed meaningless values.

 Read the full article

ELF Hello World Tutorial / .text section Updated 2025-07-16

 View more

Now that we've done one section manually, let's graduate and use the readelf -S of the other sections:

  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 2] .text             PROGBITS         0000000000000000  00000210
       0000000000000027  0000000000000000  AX       0     0     16

.text is executable but not writable: if we try to write to it Linux segfaults. Let's see if we really have some code there:

objdump -d hello_world.o

gives:

hello_world.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 <_start>:
   0:       b8 01 00 00 00          mov    $0x1,%eax
   5:       bf 01 00 00 00          mov    $0x1,%edi
   a:       48 be 00 00 00 00 00    movabs $0x0,%rsi
  11:       00 00 00
  14:       ba 0d 00 00 00          mov    $0xd,%edx
  19:       0f 05                   syscall
  1b:       b8 3c 00 00 00          mov    $0x3c,%eax
  20:       bf 00 00 00 00          mov    $0x0,%edi
  25:       0f 05                   syscall

If we grep b8 01 00 00 on the hd, we see that this only occurs at 00000210, which is what the section says. And the Size is 27, which matches as well. So we must be talking about the right section.

This looks like the right code: a write followed by an exit.

The most interesting part is line a which does:

movabs $0x0,%rsi

to pass the address of the string to the system call. Currently, the 0x0 is just a placeholder. After linking happens, it will be modified to contain:

4000ba: 48 be d8 00 60 00 00    movabs $0x6000d8,%rsi

This modification is possible because of the data of the .rela.text section.

 Read the full article

Eli Benderski Updated 2025-07-16

 View more

Homepage: eli.thegreenplace.net/

Amazing systems programming tutorials. Whenever you Google a hard topic, his blog comes up.

Also has many great contributions on Stack Overflow: stackoverflow.com/users/8206/eli-bendersky

As of 2016, Eli worked at Google (reference). TODO before that, I had found his earlier info previously but lost it.

Eli focuses mostly on compiler toolchains.

He also has some mathematics stuff, so cute: eli.thegreenplace.net/2015/change-of-basis-in-linear-algebra/

 Read the full article

Elis Regina Updated 2025-07-16

 View more

Mostly interpreter of songs written by others. But she's just too amazing, many of her interpretations are better than the original.

God, even Ciro Santilli is slightly shocked by her death, which happened before he was born, can you imagine it at the time? She was MPB's golden girl...