readelf command is used to analyze binaries based on Linux. This is most common tool used by security professionals to dig into binary files. Further, run the command by using the GCC compiler. You can check the format using Linux utility file.
These characters are described below. Next is the section with which the symbol is associated or ABS if the section is absolute (ie not connected with any section), or UND if the section is referenced in the file being dumped, but not defined there.
Symbols are a symbolic reference to some type of data or code such as a global variable or function. For instance, the printf() function is going to have a symbol entry that points to it in the dynamic symbol table . dynsym .
Ndx = The section number the symbol is in. ABS means absolute: not adjusted to any section address's relocation.
Consider the following:
Symbol table .symtab
contains 1203 entries:
Num: Value Size Type Bind Vis Ndx Name
310: a0008120 0 NOTYPE GLOBAL DEFAULT ABS _gp
734: a0000010 32 OBJECT GLOBAL DEFAULT 77 v
818: 9d000018 496 FUNC GLOBAL DEFAULT 71 main
849: a0000124 4 OBJECT GLOBAL DEFAULT 78 phrase
955: a0000000 9 OBJECT GLOBAL DEFAULT 77 peppers
1020: a000023c 192 OBJECT GLOBAL DEFAULT 80 bins
Num:
= The symbol number Value
= The address of the Symbol Size
= The size of the symbol Type
= symbol type: Func
= Function, Object
, File
(source file name), Section
= memory section, Notype
= untyped absolute symbol or undefinedBind
= GLOBAL
binding means the symbol is visible outside the file. LOCAL
binding is visible only in the file. WEAK
is like global, the symbol can be overridden. Vis
= Symbols can be default, protected, hidden or internal. Ndx
= The section number the symbol is in. ABS means absolute: not adjusted to any section address's relocationName
= symbol nameYou can either:
man readelf
or look at these tutorials:
I think Ndx field shows the section number where that symbol is defined.
Do a readelf -a <file>
, and find out which section the address corresponds to for a given symbol.
I bet the section number of that section will appear in Ndx field.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With