65

Could someone explain the columns shown of the symbol table using readelf?

Ciro Santilli OurBigBook.com
  • 347,512
  • 102
  • 1,199
  • 985
Swaroop S
  • 691
  • 1
  • 5
  • 7

4 Answers4

76

Consider the following:

Symbol table .symtab contains 1203 entries:

 Num:    Value  Size Type    Bind   Vis      Ndx Name
 310: a0008120     0 NOTYPE  GLOBAL DEFAULT  ABS _gp  
 734: a0000010    32 OBJECT  GLOBAL DEFAULT   77 v 
 818: 9d000018   496 FUNC    GLOBAL DEFAULT   71 main 
 849: a0000124     4 OBJECT  GLOBAL DEFAULT   78 phrase 
 955: a0000000     9 OBJECT  GLOBAL DEFAULT   77 peppers  
1020: a000023c   192 OBJECT  GLOBAL DEFAULT   80 bins
  • Num: = The symbol number
  • Value = The address of the Symbol
  • Size = The size of the symbol
  • Type = symbol type: Func = Function, Object, File (source file name), Section = memory section, Notype = untyped absolute symbol or undefined
  • Bind = GLOBAL binding means the symbol is visible outside the file. LOCAL binding is visible only in the file. WEAK is like global, the symbol can be overridden.
  • Vis = Symbols can be default, protected, hidden or internal.
  • Ndx = The section number the symbol is in. ABS means absolute: not adjusted to any section address's relocation
  • Name = symbol name
wallyk
  • 56,922
  • 16
  • 83
  • 148
Caladain
  • 4,801
  • 22
  • 24
  • what does "UNIQUE" means as a value for bind?? – randomgood Jan 21 '15 at 12:29
  • @Caladain What does 'The size of the symbol' mean? Say, if the symbol is a function name, dose 'Size' mean the size of the function(e.g. how many instructions this function has)? – Qi Zhang Jul 08 '16 at 03:19
  • Not how many instructions, but rather how many bytes (generally, may vary by target). For example, in some asm output from gcc, I see the following code at the end of the function `_main`: `.size _main, .-_main`. This directive tells **as** that the size of the function `_main` is the current location minus its start address. – HackerBoss Nov 01 '18 at 19:09
0

I think Ndx field shows the section number where that symbol is defined.

Do a readelf -a <file>, and find out which section the address corresponds to for a given symbol.

I bet the section number of that section will appear in Ndx field.

Stephan
  • 41,764
  • 65
  • 238
  • 329
T.I.
  • 9
  • 1
-2

You can either:

man readelf

or look at these tutorials:

Jay West
  • 1,137
  • 8
  • 5
the_void
  • 5,512
  • 2
  • 28
  • 34
  • 2
    I am also interested in an answer to this question. In particular, what is Ndx (from readelf -s)? Probably it is obvious to someone who understands elf. I looked at both the man page and the documents you listed and could not find the information there. Maybe I just missed it? It would not be the first time. – ejgottl Mar 22 '12 at 00:05
  • Above all: read the standards pointed to by the LSB: http://www.sco.com/developers/gabi/2003-12-17/contents.html being the most interesting. – Ciro Santilli OurBigBook.com May 27 '15 at 05:58
-2

Ok this question is old, but good old Google yields it if you are looking for readelf symboltable and NDX;

Here is what I found out:

The C code compiled with avr-gcc:

int XYZ = 123;
int ABC;

when the generated elf file is analyzed using 

readelf --symbols KoreOS.elf

you get as output:

Num:    Value  Size Type    Bind   Vis      Ndx Name
...
148: 0080200b     2 OBJECT  GLOBAL DEFAULT    2 XYZ
...
258: 00803878     2 OBJECT  GLOBAL DEFAULT    3 ABC
...

I use the NDX column as hint if the variable is initialized or not. But I found no documentation anywhere so I'm just guessing.

greetings, Dominik

Korexio
  • 483
  • 1
  • 7
  • 19
  • in objdump's manpage `or *UND* if the section is referenced in the file being dumped, but not defined there.`. so i assume readelf's UND is also a imported but undefined symbol. still curious about which document define this. – Kevin Chan Jul 21 '22 at 11:11