手拆ELF（三，节区头表）

太过爱你忘了你带给我的痛 2022-12-16 06:08 119阅读 0赞

## 节区头表 ##

节区头的数据结构为Elf32\_Shdr，大小为40字节，其数据结构如下：

/* Section header. */
    
    typedef struct
    { 
      Elf32_Word	sh_name;		/* Section name (string tbl index) */
      Elf32_Word	sh_type;		/* Section type */
      Elf32_Word	sh_flags;		/* Section flags */
      Elf32_Addr	sh_addr;		/* Section virtual addr at execution */
      Elf32_Off	    sh_offset;		/* Section file offset */
      Elf32_Word	sh_size;		/* Section size in bytes */
      Elf32_Word	sh_link;		/* Link to another section */
      Elf32_Word	sh_info;		/* Additional section information */
      Elf32_Word	sh_addralign;	/* Section alignment */
      Elf32_Word	sh_entsize;		/* Entry size if section holds table */
    } Elf32_Shdr;

**注意：32bit和64bit的节区头没有实质性区别**

### sh\_name ###

该成员的值为一个指向节区头字符表节的索引，通过该索引可以在节区头字符表节中找到节区的名称。

本文实例中，由手拆ELF一得知字符表的的索引为0x001c（文件头的e\_shstrndx成员），即SectionHeaderTable\[0x1c\] = SectionHeaderTable\[28\]，对应为.shstrtab，通过.shstrtab的sh\_offset成员找到节区首地址p(本文实际案例中char \*p = 0x18ab)，通过p\[sh\_name\]即p\[0x1b\]可找到对应的节区名称。

### sh\_type ###

该成员归类节区的内容和语义，标明节区是什么类型，有什么作用。

/* Legal values for sh_type (section type). */
    
    #define SHT_NULL 0 /* Section header table entry unused */
    #define SHT_PROGBITS 1 /* Program data */
    #define SHT_SYMTAB 2 /* Symbol table */
    #define SHT_STRTAB 3 /* String table */
    #define SHT_RELA 4 /* Relocation entries with addends */
    #define SHT_HASH 5 /* Symbol hash table */
    #define SHT_DYNAMIC 6 /* Dynamic linking information */
    #define SHT_NOTE 7 /* Notes */
    #define SHT_NOBITS 8 /* Program space with no data (bss) */
    #define SHT_REL 9 /* Relocation entries, no addends */
    #define SHT_SHLIB 10 /* Reserved */
    #define SHT_DYNSYM 11 /* Dynamic linker symbol table */
    #define SHT_INIT_ARRAY 14 /* Array of constructors */
    #define SHT_FINI_ARRAY 15 /* Array of destructors */
    #define SHT_PREINIT_ARRAY 16 /* Array of pre-constructors */
    #define SHT_GROUP 17 /* Section group */
    #define SHT_SYMTAB_SHNDX 18 /* Extended section indeces */
    #define SHT_NUM 19 /* Number of defined types. */
    #define SHT_LOOS 0x60000000 /* Start OS-specific. */
    #define SHT_GNU_ATTRIBUTES 0x6ffffff5 /* Object attributes. */
    #define SHT_GNU_HASH 0x6ffffff6 /* GNU-style hash table. */
    #define SHT_GNU_LIBLIST 0x6ffffff7 /* Prelink library list */
    #define SHT_CHECKSUM 0x6ffffff8 /* Checksum for DSO content. */
    #define SHT_LOSUNW 0x6ffffffa /* Sun-specific low bound. */
    #define SHT_SUNW_move 0x6ffffffa
    #define SHT_SUNW_COMDAT 0x6ffffffb
    #define SHT_SUNW_syminfo 0x6ffffffc
    #define SHT_GNU_verdef 0x6ffffffd /* Version definition section. */
    #define SHT_GNU_verneed 0x6ffffffe /* Version needs section. */
    #define SHT_GNU_versym 0x6fffffff /* Version symbol table. */
    #define SHT_HISUNW 0x6fffffff /* Sun-specific high bound. */
    #define SHT_HIOS 0x6fffffff /* End OS-specific type */
    #define SHT_LOPROC 0x70000000 /* Start of processor-specific */
    #define SHT_HIPROC 0x7fffffff /* End of processor-specific */
    #define SHT_LOUSER 0x80000000 /* Start of application-specific */
    #define SHT_HIUSER 0x8fffffff /* End of application-specific */

<table> 
 <thead> 
  <tr> 
   <th>macro</th> 
   <th>description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>SHT_NULL</td> 
   <td>This value marks the section header as inactive. It does not have an associated section. Other members of the section header have undefined values.</td> 
  </tr> 
  <tr> 
   <td>SHT_PROGBITS</td> 
   <td>This section holds information defined by the program, whose format and meaning are determined solely by the program.</td> 
  </tr> 
  <tr> 
   <td>SHT_SYMTAB</td> 
   <td>This section holds a symbol table. Typically, SHT_SYMTAB provides symbols for link editing, though it may also be used for dynamic linking. As a complete symbol table, it may contain many symbols unnecessary for dynamic linking. An object file can also contain a SHT_DYNSYM section.</td> 
  </tr> 
  <tr> 
   <td>SHT_STRTAB</td> 
   <td>This section holds a string table. An object file may have multiple string table sections.</td> 
  </tr> 
  <tr> 
   <td>SHT_RELA</td> 
   <td>This section holds relocation entries with explicit addends, such as type Elf32_Rela for the 32-bit class of object files. An object may have multiple relocation sections.</td> 
  </tr> 
  <tr> 
   <td>SHT_HASH</td> 
   <td>This section holds a symbol hash table. An object participating in dynamic linking must contain a symbol hash table. An object file may have only one hash table.</td> 
  </tr> 
  <tr> 
   <td>SHT_DYNAMIC</td> 
   <td>This section holds information for dynamic linking. An object file may have only one dynamic section.</td> 
  </tr> 
  <tr> 
   <td>SHT_NOTE</td> 
   <td>This section holds information that marks the file in some way.</td> 
  </tr> 
  <tr> 
   <td>SHT_NOBITS</td> 
   <td>A section of this type occupies no space in the file but otherwise resembles SHT_PROGBITS. Although this section contains no bytes, the sh_offset member contains the conceptual file offset.</td> 
  </tr> 
  <tr> 
   <td>SHT_REL</td> 
   <td>This section holds relocation offsets without explicit addends, such as type Elf32_Rel for the 32-bit class of object files. An object file may have multiple relocation sections.</td> 
  </tr> 
  <tr> 
   <td>SHT_SHLIB</td> 
   <td>This section is reserved but has unspecified semantics.</td> 
  </tr> 
  <tr> 
   <td>SHT_DYNSYM</td> 
   <td>This section holds a minimal set of dynamic linking symbols. An object file can also contain a SHT_SYMTAB section.</td> 
  </tr> 
  <tr> 
   <td>SHT_LOPROC</td> 
   <td>This value up to and including SHT_HIPROC is reserved for processor-specific semantics.</td> 
  </tr> 
  <tr> 
   <td>SHT_HIPROC</td> 
   <td>This value down to and including SHT_LOPROC is reserved for processor-specific semantics.</td> 
  </tr> 
  <tr> 
   <td>SHT_LOUSER</td> 
   <td>This value specifies the lower bound of the range of indices reserved for application programs.</td> 
  </tr> 
  <tr> 
   <td>SHT_HIUSER</td> 
   <td>This value specifies the upper bound of the range of indices reserved for application programs. Section types between SHT_LOUSER and SHT_HIUSER may be used by the application, without conflicting with current or future system-defined section types.</td> 
  </tr> 
 </tbody> 
</table>

### sh\_flags ###

Sections support one-bit flags that describe miscellaneous attributes. If a flag bit is set in sh\_flags, the attribute is “on” for the section. Otherwise, the attribute is “off” or does not apply. Undefined attributes are set to zero.

/* Legal values for sh_flags (section flags). */
    
    #define SHF_WRITE (1 << 0) /* Writable */
    #define SHF_ALLOC (1 << 1) /* Occupies memory during execution */
    #define SHF_EXECINSTR (1 << 2) /* Executable */
    #define SHF_MERGE (1 << 4) /* Might be merged */
    #define SHF_STRINGS (1 << 5) /* Contains nul-terminated strings */
    #define SHF_INFO_LINK (1 << 6) /* `sh_info' contains SHT index */
    #define SHF_LINK_ORDER (1 << 7) /* Preserve order after combining */
    #define SHF_OS_NONCONFORMING (1 << 8) /* Non-standard OS specific handling required */
    #define SHF_GROUP (1 << 9) /* Section is member of a group. */
    #define SHF_TLS (1 << 10) /* Section hold thread-local data. */
    #define SHF_COMPRESSED (1 << 11) /* Section with compressed data. */
    #define SHF_MASKOS 0x0ff00000 /* OS-specific. */
    #define SHF_MASKPROC 0xf0000000 /* Processor-specific */
    #define SHF_ORDERED (1 << 30) /* Special ordering requirement (Solaris). */
    #define SHF_EXCLUDE (1U << 31) /* Section is excluded unless referenced or allocated (Solaris).*/

<table> 
 <thead> 
  <tr> 
   <th>macro</th> 
   <th>description</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>SHF_WRITE</td> 
   <td>This section contains data that should be writable during process execution.</td> 
  </tr> 
  <tr> 
   <td>SHF_ALLOC</td> 
   <td>This section occupies memory during process execution. Some control sections do not reside in the memory image of an object file. This attribute is off for those sections.</td> 
  </tr> 
  <tr> 
   <td>SHF_EXECINSTR</td> 
   <td>This section contains executable machine instructions.</td> 
  </tr> 
  <tr> 
   <td>SHF_MASKPROC</td> 
   <td>All bits included in this mask are reserved for processor-specific semantics.</td> 
  </tr> 
 </tbody> 
</table>

### sh\_addr ###

If this section appears in the memory image of a process, this member holds the address at which the section’s first byte should reside. Otherwise, the member contains zero.

### sh\_offset ###

This member’s value holds the byte offset from the beginning of the file to the first byte in the section. One section type, SHT\_NOBITS, occupies no space in the file, and its sh\_offset member locates the conceptual placement in the file.

### sh\_size ###

This member holds the section’s size in bytes. Unless the section type is SHT\_NOBITS, the section occupies sh\_size bytes in the file. A section of type SHT\_NOBITS may have a nonzero size, but it occupies no space in the file.

### sh\_link ###

This member holds a section header table index link, whose interpretation depends on the section type.

### sh\_info ###

This member holds extra information, whose interpretation depends on the section type.

### sh\_addralign ###

Some sections have address alignment constraints. If a section holds a doubleword, the system must ensure doubleword alignment for the entire section. That is, the value of sh\_addr must be congruent to zero, modulo the value of sh\_addralign. Only zero and positive integral powers of two are allowed. Values of zero or one mean the section has no alignment constraints.

### sh\_entsize ###

Some sections hold a table of fixed-sized entries, such as a symbol table. For such a section, this member gives the size in bytes for each entry. This member contains zero if the section does not hold a table of fixed-size entries.

## 实例 ##

**手拆ELF（一）** 知道节区表的偏移地址为0x000019a8，节区头大小为40字节，有29个节区头，节区头表大小为`29*40=1160=0x488`字节。

young@ubuntu:~/c/elf$ readelf -S elf32
    There are 29 section headers, starting at offset 0x19a8:
    
    Section Headers:
      [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
      [ 0]                   NULL            00000000 000000 000000 00      0   0  0
      [ 1] .interp           PROGBITS        00000154 000154 000013 00   A  0   0  1
      [ 2] .note.ABI-tag     NOTE            00000168 000168 000020 00   A  0   0  4
      [ 3] .note.gnu.build-i NOTE            00000188 000188 000024 00   A  0   0  4
      [ 4] .gnu.hash         GNU_HASH        000001ac 0001ac 000020 04   A  5   0  4
      [ 5] .dynsym           DYNSYM          000001cc 0001cc 000130 10   A  6   1  4
      [ 6] .dynstr           STRTAB          000002fc 0002fc 000136 00   A  0   0  1
      [ 7] .gnu.version      VERSYM          00000432 000432 000026 02   A  5   0  2
      [ 8] .gnu.version_r    VERNEED         00000458 000458 0000a0 00   A  6   3  4
      [ 9] .rel.dyn          REL             000004f8 0004f8 000040 08   A  5   0  4
      [10] .rel.plt          REL             00000538 000538 000068 08  AI  5  22  4
      [11] .init             PROGBITS        000005a0 0005a0 000023 00  AX  0   0  4
      [12] .plt              PROGBITS        000005d0 0005d0 0000e0 04  AX  0   0 16
      [13] .plt.got          PROGBITS        000006b0 0006b0 000010 08  AX  0   0  8
      [14] .text             PROGBITS        000006c0 0006c0 000434 00  AX  0   0 16
      [15] .fini             PROGBITS        00000af4 000af4 000014 00  AX  0   0  4
      [16] .rodata           PROGBITS        00000b08 000b08 000089 00   A  0   0  4
      [17] .eh_frame_hdr     PROGBITS        00000b94 000b94 00005c 00   A  0   0  4
      [18] .eh_frame         PROGBITS        00000bf0 000bf0 000180 00   A  0   0  4
      [19] .init_array       INIT_ARRAY      00001e9c 000e9c 000004 04  WA  0   0  4
      [20] .fini_array       FINI_ARRAY      00001ea0 000ea0 000004 04  WA  0   0  4
      [21] .dynamic          DYNAMIC         00001ea4 000ea4 000108 08  WA  6   0  4
      [22] .got              PROGBITS        00001fac 000fac 000054 04  WA  0   0  4
      [23] .data             PROGBITS        00002000 001000 000008 00  WA  0   0  4
      [24] .bss              NOBITS          00002008 001008 000004 00  WA  0   0  1
      [25] .comment          PROGBITS        00000000 001008 000029 01  MS  0   0  1
      [26] .symtab           SYMTAB          00000000 001034 000520 10     27  43  4
      [27] .strtab           STRTAB          00000000 001554 000357 00      0   0  1
      [28] .shstrtab         STRTAB          00000000 0018ab 0000fc 00      0   0  1
    Key to Flags:
      W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
      L (link order), O (extra OS processing required), G (group), T (TLS),
      C (compressed), x (unknown), o (OS specific), E (exclude),
      p (processor specific)

<table> 
 <thead> 
  <tr> 
   <th>节区名称</th> 
   <th>描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>.interp</td> 
   <td></td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <thead> 
  <tr> 
   <th>节区类型</th> 
   <th>描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>NULL</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>DYNSYM</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>GUN_HASH</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>PROGBITS</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>INIT_ARRAY</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>FINIT_ARRAY</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>NOBITS</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>NOTE</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>REL</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>SYMTAB</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>VERNEED</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>VERSYM</td> 
   <td></td> 
  </tr> 
 </tbody> 
</table>