linuxelfstring-table

Searching .init section in ELF file


How can I find section .init? Section header has field Elf32_Word sh_name. So I suppose I have to go through all sections to find one with name .init But sh_name is not an array of chars. It is an index of entry in String Table. Where is String Table? There is field elfHdr.e_shstrndx in the ELF header. It is index of section there String Table is situated. So to calculate offset of String Table I use formula which is described below.

offset = ((elfHdr.e_shstrndx)*elfHdr.e_shentsize)+elfHdr.e_shoff,  
where 
elfHdr.e_shstrndx = index where we can find .shstrtab
elfHdr.e_shentsize = Size of each Section Header
elfHdr.e_shoff = Offset at which section header starts.

But the turned-out offset is not correct offset of String Table. I have tried it on various files. May be there is another way to determine whether section is .init or not ?


Solution

  • It seems that you almost got it right.

    The offset you've calculated is a file offset in bytes of the section header of the String Table section. Again, this is the beginning of this section's header and it will be a structure of type Elf32_Shdr. Now you should read its sh_offset and this will be the offset to the list of strings you are looking for.