3

Can someone explain the meaning of these columns?
I use readelf to read a ELF file and can't find any rellevant info (like for objdump for example) about Section Headers columns.

For example what are 'ES', 'Lk' and 'Info' ?
What are all available flags in 'Flg' ?
'Al' means alignment ?

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .data             PROGBITS        3ffe8000 000120 0004fa 00  WA  0   0 16
  [ 2] .rodata           PROGBITS        3ffe8500 000620 000ea4 00   A  0   0 16
  [ 3] .bss              NOBITS          3ffe93a8 0014c8 0089d0 00  WA  0   0 16
...
...

Thanks in advance,

yo3hcv
  • 1,531
  • 2
  • 17
  • 27

1 Answers1

2

Here is a link to the System V Application Binary Interface where is a section header defined:

typedef struct {
    Elf64_Word  sh_name;
    Elf64_Word  sh_type;
    Elf64_Xword sh_flags;
    Elf64_Addr  sh_addr;
    Elf64_Off   sh_offset;
    Elf64_Xword sh_size;
    Elf64_Word  sh_link;
    Elf64_Word  sh_info;
    Elf64_Xword sh_addralign;
    Elf64_Xword sh_entsize;
} Elf64_Shdr;

es is actually sh_entsize, it specifies the size of an entry that the header contains (example: size of the symbol forSHT_SYMTAB and SHT_DYNSYN sections)

lk is sh_link, info is sh_info and their meaning depends on the section type (example: sh_link contains section header index with associated string table for SHT_SYMTAB and SHT_DYNSYN sections, sh_info is usually also just header table index)

These are flags defined by the standard:

SHF_WRITE             0x1
SHF_ALLOC             0x2
SHF_EXECINSTR         0x4
SHF_MERGE             0x10
SHF_STRINGS           0x20
SHF_INFO_LINK         0x40
SHF_LINK_ORDER        0x80
SHF_OS_NONCONFORMING  0x100
SHF_GROUP             0x200
SHF_TLS               0x400
SHF_COMPRESSED        0x800

and as you wrote al is sh_align.

If you want precise description of the structure check the link.