I'm wondering how a .shstrtab is identified compared to a .strtab when parsing an ELF file? From reading elf(5) - Linux manual page both are of section header type SHT_STRTAB, so how would I know if the one I encounter is one or the other?
Their descriptions are:
.shstrtab
This section holds section names. This section is of type
SHT_STRTAB. No attribute types are used.
.strtab
This section holds strings, most commonly the strings that
represent the names associated with symbol table entries. If
the file has a loadable segment that includes the symbol
string table, the section's attributes will include the
SHF_ALLOC bit. Otherwise, the bit will be off. This section
is of type SHT_STRTAB.
When doing readelf file.o, I see the following:
...
[18] .strtab STRTAB 0000000000000000 00000548
0000000000000033 0000000000000000 0 0 1
[19] .shstrtab STRTAB 0000000000000000 000007a8
00000000000000a8 0000000000000000 0 0 1
so they appear the same to me except the offset.
From the same docs: e_shstrndx: This member [in ElfN_Ehdr] holds the section header table index of the entry associated with the section name string table. If the file has no section name string table, this member holds the value SHN_UNDEF.