Program Header

The program header table consists of several entries that are handled in the same way as the entries of an array (the number of entries is specified by e_phnum in the ELF header). A separate structure is defined as a data type for the entries. On 32-bit systems, it has the following contents:

typedef Elf32_ Elf32_ Elf32_ Elf32_ Elf32_ Elf32_ Elf32_ Elf32_ } Elf32_

struct

Word

Addr

Addr

Word

Word

Word

Word

elf32_phdr{ p_type; p_offset; p_vaddr; p_paddr; p_filesz; p_memsz; p_flags; p_align;

The meaning of the elements is as follows:

p_type indicates what kind of segment the current entry describes. The following constants are defined for this purpose:

□ pt_null indicates an unused segment.

□ pt_load is used for loadable segments that are mapped from the binary file into memory before the program can be executed.

□ pt_dynamic indicates that the segment contains information for the dynamic linker (discussed in Section E.2.6).

□ pt_interp indicates that the current segment specifies the program interpreter used for dynamic linking. Usually, this is ld-linux.so as previously mentioned.

□ pt_note specifies a segment that may contain additional proprietary compiler information.

Two further variants (pt_loproc and pt_highproc) are defined for processor-specific purposes but are not used by the kernel.

p_offset gives the offset (in bytes from the beginning of the binary file) at which the data of the segment described resides.

p_vaddr gives the position in virtual address space to which the data of the segment is mapped (for segments of the pt_load type). Systems that support physical but not virtual addressing use the information stored in p_paddr instead.

p_filesz specifies the size (in bytes) of the segment in the binary file.

p_memsz specifies the size (in bytes) of the segment in virtual address space. Size differences as compared with the physical segments are compensated by truncating data or padding with null bytes.

p_flags holds flags to define access permissions to the segment. pf_r gives read permission, pf_w gives write permission, and pf_x gives execute permission.

p_align specifies how the segment is to be aligned in memory and in the binary file (the p_vaddr and p_offset addresses must be modulo p_align). A p_align value of 0x1000 = 4096 means, for example, that the segment must be aligned on 4 KiB pages.

As you can see in the following code, a similar data structure is defined for 64-bit architectures. The only difference as compared to the 32-bit variant is that other data types are used. Nevertheless, the meaning of the entries is the same:

typedef struct elf64_phdr Elf64_Word p_type; Elf64_Word p_flags; Elf64_Off p_offset; Elf64_Addr p_vaddr; Elf64_Addr p_paddr; Elf64_Xword p_filesz; Elf64_Xword p_memsz; Elf64_Xword p_align; } Elf64_Phdr;

Segment file offset */ Segment virtual address */ Segment physical address */ Segment size in file */ Segment size in memory */ Segment alignment, file & memory */

Continue reading here: Section Header

Was this article helpful?

0 0