How to find `.strtab` in an ELF file?

Question

When running readelf -S I get:

  [27] .strtab           STRTAB           0000000000000000  00001630
       00000000000001d7  0000000000000000           0     0     1
  [28] .shstrtab         STRTAB           0000000000000000  00001807
       0000000000000103  0000000000000000           0     0     1

How can I get the index of .strtab? At first I tried to detect it using the Type field, but that won't work as you can see (27 and 28 have same type). Plus I can't be sure that it will be the first of type STRTAB to appear.

My struct with some explanations:

/*
 * Section header.
 */
typedef struct {
    Elf64_Word sh_name;    /* Section name (index into the
                       section header string table). */
    Elf64_Word sh_type;    /* Section type. */
    Elf64_Xword sh_flags;    /* Section flags. */
    Elf64_Addr sh_addr;    /* Address in memory image. */
    Elf64_Off sh_offset;    /* Offset in file. */
    Elf64_Xword sh_size;    /* Size in bytes. */
    Elf64_Word sh_link;    /* Index of a related section. */
    Elf64_Word sh_info;    /* Depends on section type. */
    Elf64_Xword sh_addralign;    /* Alignment in bytes. */
    Elf64_Xword sh_entsize;    /* Size of each entry in section. */
} Elf64_Shdr;

Related, if not duplicate: [Distinguish .shstrtab and .strtab in ELF file](https://stackoverflow.com/questions/64967077/distinguish-shstrtab-and-strtab-in-elf-file) — janw, Nov 08 '21 at 19:32

Employed Russian · Accepted Answer · 2021-06-22T01:12:56.920

How can I get the index of .strtab?

You read the Elf64_Shdrs one by one. When you've read the 28th entry, you will have read the .strtab, and you'll know its index.

You'll know that it's the .strtab section by comparing its name with ".strtab" string literal.

(You are probably intending to ask a different question, but if that's the case, you haven't expressed it well.)

Update:

Can't I do anything else rather than comparing strings

Maybe. If your real question is finding the .strtab section, then not really.

(which is somehow hard) can I assume it will be the first STRTAB in the file for example?

There is no guarantee that that will be the case.

Note: if you are worried about the speed of strcmp(), note that you can only do that strcmp() when .sh_type == SHT_STRTAB, and since there are usually at most two such sections in any given file, the concern about the speed of strcmp() is likely misplaced. Your code would look something like:

  if (shdr.sh_type == SHT_STRTAB) {
    const char *sh_name = contents_of_shstrab + shdr.sh_name;
    if (strcmp(sh_name, ".strtab") == 0) {
      /* found .strtab; do whatever you need with it */
    }
  }

Update 2:

your solution is wrong, please see: http://stackoverflow.com/questions/68074508/

You can't claim that my solution is wrong, since I haven't provided a complete solution. It is also not wrong.

Here is complete code (with most error checking omitted):

#include <elf.h>
#include <fcntl.h>
#include <link.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/stat.h>

int main(int argc, char *argv[])
{
  if (argc < 1) return 1;

  int fd = open(argv[1], O_RDONLY);
  if (fd == -1) return 2;

  struct stat st_buf;
  if (fstat(fd, &st_buf) != 0) return 3;

  char *data = mmap(NULL, st_buf.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
  if (data == MAP_FAILED) return 4;

  const ElfW(Ehdr) *ehdr = (const ElfW(Ehdr) *)data;
  const ElfW(Shdr) *shdr = (const ElfW(Shdr) *)(data + ehdr->e_shoff);

  const char *shstrtab = data + shdr[ehdr->e_shstrndx].sh_offset;

  for (int j = 0; j < ehdr->e_shnum; j++) {
    printf("[%2d] %s\n", j, shstrtab + shdr[j].sh_name);
  }

  return 0;
}

$ gcc -g t.c -Wall
$ ./a.out ./a.out
[ 0]
[ 1] .interp
[ 2] .note.gnu.build-id
[ 3] .note.ABI-tag
[ 4] .gnu.hash
[ 5] .dynsym
[ 6] .dynstr
...
[32] .symtab
[33] .strtab
[34] .shstrtab

Can't I do anything else rather than comparing strings (which is somehow hard) can I assume it will be the first STRTAB in the file for example? — , Jun 21 '21 at 19:34
"If your real question is finding the .strtab section, then not really." yes that's what I want, what you mean? — , Jun 22 '21 at 08:33
I am sorry I don't understand what you are asking. I showed how to enumerate all sections and print their names. If you _literally_ need to find a section named `.strtab`, then the solution is to go over sections until you find one that is named `.strtab` (using `strcmp`). There is no way to avoid `strcmp` (or equivalent). — Employed Russian, Jun 22 '21 at 15:25

score 0 · Answer 2 · answered Mar 23 '23 at 14:45

Just for reference, string parsing is not necessary I think:

How can I get the index of .strtab?

The sh_link-member of the Elf64_Shdr-struct points to the index of the section header containing the string table (.strtab) if one is present.

  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
                                     ...
  [34] .symtab           SYMTAB           0000000000000000  00003790
       0000000000000438  0000000000000018          35    20     8
  [35] .strtab           STRTAB           0000000000000000  00003bc8
       0000000000000283  0000000000000000           0     0     1
  [36] .shstrtab         STRTAB           0000000000000000  00003e4b
       000000000000016a  0000000000000000           0     0     1

In the example above, notice how the .symtab section header contains the value of 35 for sh_link which is precisely the section header index of .strtab.

This is also what readelf uses to figure out the offset of the .strtab.

How to find `.strtab` in an ELF file?

2 Answers2