1

How can I find section .init? Section header has field Elf32_Word sh_name. So I suppose I have to go through all sections to find one with name .init But sh_name is not an array of chars. It is an index of entry in String Table. Where is String Table? There is field elfHdr.e_shstrndx in the ELF header. It is index of section there String Table is situated. So to calculate offset of String Table I use formula which is described below. 

offset = ((elfHdr.e_shstrndx)*elfHdr.e_shentsize)+elfHdr.e_shoff,  
where 
elfHdr.e_shstrndx = index where we can find .shstrtab
elfHdr.e_shentsize = Size of each Section Header
elfHdr.e_shoff = Offset at which section header starts.

But the turned-out offset is not correct offset of String Table. I have tried it on various files. May be there is another way to determine whether section is .init or not ?

PeeHaa
  • 71,436
  • 58
  • 190
  • 262
Qwerty
  • 153
  • 1
  • 9

1 Answers1

1

It seems that you almost got it right.

The offset you've calculated is a file offset in bytes of the section header of the String Table section. Again, this is the beginning of this section's header and it will be a structure of type Elf32_Shdr. Now you should read its sh_offset and this will be the offset to the list of strings you are looking for.

kirelagin
  • 13,248
  • 2
  • 42
  • 57