Why does the tool "readelf" outputs two ELF file section count numbers?

Question

I am currently investigating an issue with our tool which reads and interprets ELF files, that has an problem reading a specific elf file.

The unix tool "readelf" with the option "-h" outputs 2 values for the parameter "Number of section headers". There is an additional one after the initial number.

Example for the file that works:

Number of section headers: 1234

Example for the file that does not work:

Number of section headers: 0 (4524)

What does the number in the brackets mean? I guess it could be the cause for my issue as our application thinks there are no sections in the problematic file.

Please don't show pictures of text. Show the text itself. – Employed Russian Jun 10 '21 at 01:56 — Employed Russian, Jun 10 '21 at 01:56

score 3 · Answer 1 · answered Jun 09 '21 at 16:26

Here is the relevant code in the readelf source.. It looks like if header->e_shnum has the value SHN_UNDEF (zero) then what's printed in parentheses is the value of filedata->section_headers[0].sh_size.

This corresponds to the following passage in the elf(5) man page:

   e_shnum
          This member holds the number of entries in the section
          header table.  Thus the product of e_shentsize and e_shnum
          gives the section header table's size in bytes.  If a file
          has no section header table, e_shnum holds the value of
          zero.

          If the number of entries in the section header table is
          larger than or equal to SHN_LORESERVE (0xff00), e_shnum
          holds the value zero and the real number of entries in the
          section header table is held in the sh_size member of the
          initial entry in section header table.  Otherwise, the
          sh_size member of the initial entry in the section header
          table holds the value zero.

So this would be a valid way to specify that the section header table has 74496 entries (which indeed is larger than 0xff00). It seems you need to fix your tool to handle this case.

Why does the tool "readelf" outputs two ELF file section count numbers?

1 Answers1