Multiple string tables in ELF object

Question

From ELF Documentation:

SHT_STRTAB The section holds a string table. An object file may have multiple string table sections. See ‘‘String Table’’ below for details.

(Note: I didn't notice any information regarding multiple string table sections in ‘‘String Table’’ paragraph)

Does multiple string table sections mean string table for the section headers and string table for the object file itself?

There is no mention in the documentation regarding how to read a string if there are multiple string table for the object itself (.strtab).

Any clarification about the subject appreciated.

Answer 1

The manpage only has a overview/summary of (some parts of) the ELF file format, you might want to look at the System V ABI spec.

Explanation

Linking view

An ELF file has multiple string tables. Usually you have 3-4 string tables:

• One string table (usually called .shstrtab) is used for section names. All section names (in the section header table) are taken from a single string table. This string table is identified by its index in the section header table: the index of the section name string table is indicated in the ELF header (e_shstrndx).

• Another string table (usually called .strtab) is used for the full symbol table (.symtab). The same string table is used by the .dynamic section.

• Another string table (usually called .dynstr) is used for the minirmal symbol table (.dynsym).

• Another string table is used for

For a given symbol table section, the section used as string table is indicated in the sh_link field of the section header table (see Fig 4-12 of the system V ABI spec).

Execution view

For the execution view (the program header table), the address of the string table used for the symbol table (DT_SYMTAB) is given in the DT_STRTAB entry of the dynamic section.

Example

Linking view

This is a hello world program (shown with readelf -a).

.shtrtab

The ELF header:

ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x4003c0
  Start of program headers:          64 (bytes into file)
  Start of section headers:          4624 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         8
  Size of section headers:           64 (bytes)
  Number of section headers:         30
  Section header string table index: 27

tells us that the section names are in section 27. Conveniently enough this is .shtrtab:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
[...]
  [27] .shstrtab         STRTAB           0000000000000000  000008e0
       0000000000000108  0000000000000000           0     0     1

.dynstr

For .dynsym we have:

  [ 5] .dynsym           DYNSYM           0000000000400280  00000280
       0000000000000048  0000000000000018   A       6     1     8
                                                    ^
                                                    HERE

Its names are taken from section 6 which is .dynstr:

  [ 6] .dynstr           STRTAB           00000000004002c8  000002c8
       0000000000000038  0000000000000000   A       0     0     1

This string table is used by other sections as well:

  [ 8] .gnu.version_r    VERNEED          0000000000400308  00000308
       0000000000000020  0000000000000000   A       6     1     8
  [21] .dynamic          DYNAMIC          0000000000600698  00000698
       00000000000001d0  0000000000000010  WA       6     0     8

.strtab

For .symtab:

  [28] .symtab           SYMTAB           0000000000000000  000009e8
       0000000000000600  0000000000000018          29    45     8
                                                   ^
                                                   HERE

the names are taken from section 29 which happens to be .strtab:

  [29] .strtab           STRTAB           0000000000000000  00000fe8
       0000000000000224  0000000000000000           0     0     1

Execution view

Dynamic section at offset 0x698 contains 24 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000c (INIT)               0x400370
 0x000000000000000d (FINI)               0x400544
 0x0000000000000019 (INIT_ARRAY)         0x600680
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x600688
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x400260
 0x0000000000000005 (STRTAB)             0x4002c8    <= HERE
 0x0000000000000006 (SYMTAB)             0x400280
 0x000000000000000a (STRSZ)              56 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x600870
 0x0000000000000002 (PLTRELSZ)           48 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x400340
 0x0000000000000007 (RELA)               0x400328
 0x0000000000000008 (RELASZ)             24 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000006ffffffe (VERNEED)            0x400308
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x400300
 0x0000000000000000 (NULL)               0x0

The string table for dynamic linking is located at 0x4002c8 in the program memory.

Note: this is .dynstr.