1

I was trying to understand the symbol table inside ELF, so I had:

$ cat a.c 

 int i=0; 
 int j; 
 static int l=4; 
 void k(); 
 void d(){ 
   k(); 
 } 

Compile and check its symtab inside the ELF:

$ gcc -g a.c -c -m32 && readelf -s a.o 

Symbol table '.symtab' contains 18 entries:
   Num:    Value  Size Type    Bind   Vis      Ndx Name
     0: 00000000     0 NOTYPE  LOCAL  DEFAULT  UND
     1: 00000000     0 FILE    LOCAL  DEFAULT  ABS a.c    # Confused
     2: 00000000     0 SECTION LOCAL  DEFAULT    1
     3: 00000000     0 SECTION LOCAL  DEFAULT    3
     4: 00000000     0 SECTION LOCAL  DEFAULT    4
     5: 00000000     4 OBJECT  LOCAL  DEFAULT    3 l
     6: 00000000     0 SECTION LOCAL  DEFAULT    5
     7: 00000000     0 SECTION LOCAL  DEFAULT    7
     8: 00000000     0 SECTION LOCAL  DEFAULT    8
     9: 00000000     0 SECTION LOCAL  DEFAULT   10
    10: 00000000     0 SECTION LOCAL  DEFAULT   12
    11: 00000000     0 SECTION LOCAL  DEFAULT   14
    12: 00000000     0 SECTION LOCAL  DEFAULT   15
    13: 00000000     0 SECTION LOCAL  DEFAULT   13
    14: 00000000     4 OBJECT  GLOBAL DEFAULT    4 i
    15: 00000004     4 OBJECT  GLOBAL DEFAULT  COM j
    16: 00000000    13 FUNC    GLOBAL DEFAULT    1 d
    17: 00000000     0 NOTYPE  GLOBAL DEFAULT  UND k  

What really confused me was: It said(from internet), "Value" means the offset of each section and "size" means target size. Why they're all offfset 00000000 and some of them size=0?

Question:

I suppose if size=0 then it shouldn't exist, and meaningless to have information inside ELF.

E.g., for the line "1" that contains source file name "a.c" (I marked "# Confused), it has information of Ndx=ABS and Name=a.c, if this section is 0 size, then how is it stored inside ELF? I suppose there should be at least 3 bytes to save "a.c" file name, so the size should be >=3. right?

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
Troskyvs
  • 7,537
  • 7
  • 47
  • 115

1 Answers1

0

you should notice that the type of the symbol is STT_FILE from what I am familiar with means that the symbols are related to the oject file of that symbols are extracted with. a anyways you are correct, value usually marks the index of the symbol within the section containing it and size representing the size of the symbol

within the symbol you're looking at index is ABS and type is STT_FILE this is information that should be used during static linking of object files and allow linker to know which symbols came from which source, hence this is an abstract symbol that isn't actually stored within object file, hence it has no value and has no size.... hope this helped you

DrPrItay
  • 793
  • 6
  • 20