18

I'm currently doing my own objdump implementation in C.

For my -s option, I have to show the full contents of the section of an ELF file.

I'm doing it well, but i'm showing more sections than the "real" objdump.

In fact, it does not output the .bss, .shstrtab, .symtab and .strtab sections.

I'm looking around the sh_flags value on the Shdr struct but I can't find any logic...

Why objdump -s does not shows these sections ?

Ciro Santilli Путлер Капут 六四事
  • 302,449
  • 85
  • 1,093
  • 879
  • ELF is quite complex, GNU `objdump` is based on BFD, a library which does the heavy lifting (part of binutils). – vonbrand Mar 04 '14 at 00:46
  • Yeah, I know about the BFD library. On the apple open sources, I can see `(section->flags & SEC_HAS_CONTENTS)` to show or not the section. On my computer, .bss has the same flags than other sections that are showed. –  Mar 04 '14 at 00:54

2 Answers2

15

Why objdump -s does not shows these sections ?

Objdump is based on libbfd, which abstracts away many complexities of ELF, and was written when objects tended to only have three sections.

As such, objdump is quite deficient. In addition to not showing you (some) existing sections, it may also "synthesize" sections that don't exist at all, and do other weird tricks. This is more of a libbfd fault -- its abstraction layer simply doesn't tell objdump about the "missing" sections.

TL;DR: don't use objdump. Use readelf instead.

Employed Russian
  • 182,696
  • 29
  • 267
  • 329
0

Try using sh_size and sh_type, instead of sh_flags.

Quoting from the ELF specification

sh_size This member gives the section’s size in bytes. Unless the section type is SHT_NOBITS, the section occupies sh_size bytes in the file. A section of type SHT_NOBITS may have a non-zero size, but it occupies no space in the file

pank4j
  • 441
  • 4
  • 7
  • It seems that only .bss and .got are of type SHT_NOBITS. So it does not explain why .shstrtab, .symtab and .strtab are not shown... –  Mar 04 '14 at 08:06
  • Here is my conclusion : a section is shown if it has at least one flag (unlike .shstrtab, .symtab and .strtab) or if his type is not NOBITS (unlike .bss). Somebody have another idea ? –  Mar 04 '14 at 08:37
  • So, i found a cons-exemple : .gnu_debuglink has no flag and is shown by objdump -s –  Mar 04 '14 at 09:44