Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Where is Import Table in ELF file?

I found ".dynsym" in String Table, got index. Then I found section with sh_name = index && sh_type = SHT_DYNSYM. So I got sh_offset = 464 and sh_size = 64. But you can see in the attached picture, that on the offset 464 there are only zeros.

I suppose that Import Table starts on offset 528. Question is: how calculate it %)

enter image description here

like image 465
Qwerty Avatar asked Jun 11 '13 14:06

Qwerty


1 Answers

But you can see in the attached picture, that on the offset 464 there are only zeros.

Wrong: 01, 20, 29, 12 etc. are not "only zeros" last time I checked.

I suppose that Import Table starts on offset 528

No, it does not. For some reason you are expecting to find a Microsoft PE-style import table in an ELF file. It's not there.

An equivalent of an import table in ELF is contained in two tables. One contains Elf{32,64}_Sym fixed-size records:

typedef struct
{
  Elf32_Word    st_name;                /* Symbol name (string tbl index) */
  Elf32_Addr    st_value;               /* Symbol value */
  Elf32_Word    st_size;                /* Symbol size */
  unsigned char st_info;                /* Symbol type and binding */
  unsigned char st_other;               /* Symbol visibility */
  Elf32_Section st_shndx;               /* Section index */
} Elf32_Sym;

and is contained in the .dynsym section.

The other table is contained in .dynstr section (which, in your file starts at offset 528), and has just the (variable-size) strings separated by NUL character.

The .st_name in the first table refers to offset in .dynstr.

like image 54
Employed Russian Avatar answered Sep 20 '22 09:09

Employed Russian