0

I have a relocatable 64-bit .o file at hand and would like to read each section header. From the wiki I see that the 2-byte value stored in 0x28 should be the start of section header table. The value is 0x0328.

I then go to address 0x0328 and judging from other information each section header is of 0x40 size and I have a total of 14 headers (this information is confirmed with readelf). However then I got lost, and what I interpreted is completely different from what readelf told me:

Section Header 0: I see all 64 bytes are 00, which matches what readelf told me;

Section Header 1: I see the following values from 0x368:

from hex edit

However readelf told me that:

from readelf

What did I miss?

Nicholas Humphrey
  • 1,220
  • 1
  • 16
  • 33
  • Nevermind friends, I figured out that `readelf` actually is nice enough to interpret the information, e.g. it mentions `.text` which is exactly 0x20 bytes offset from the string table. I misunderstood its output. Is it possible to close this question? Thanks! – Nicholas Humphrey Sep 23 '22 at 03:23

0 Answers0