How can I find section .init
?
Section header has field Elf32_Word sh_name
. So I suppose I have to go through all sections to find one with name .init
But sh_name
is not an array of chars. It is an index of entry in String Table.
Where is String Table? There is field elfHdr.e_shstrndx
in the ELF header. It is index of section there String Table is situated.
So to calculate offset of String Table I use formula which is described below.
offset = ((elfHdr.e_shstrndx)*elfHdr.e_shentsize)+elfHdr.e_shoff,
where
elfHdr.e_shstrndx = index where we can find .shstrtab
elfHdr.e_shentsize = Size of each Section Header
elfHdr.e_shoff = Offset at which section header starts.
But the turned-out offset is not correct offset of String Table. I have tried it on various files.
May be there is another way to determine whether section is .init
or not ?
It seems that you almost got it right.
The offset
you've calculated is a file offset in bytes of the section header of the String Table section. Again, this is the beginning of this section's header and it will be a structure of type Elf32_Shdr
. Now you should read its sh_offset
and this will be the offset to the list of strings you are looking for.