List All Sections of an ELF File

Topic Overview

ELF Section Headers

After the ELF header comes the section header table, which describes all sections in the file. Sections are the building blocks for linking: .text holds code, .data holds initialized globals, .bss reserves space for zero-initialized data.

Section Header Structure

Each Elf64_Shdr entry contains:

• sh_name: Offset into .shstrtab for the section name
• sh_type: Section type (PROGBITS, SYMTAB, STRTAB, NOBITS, etc.)
• sh_flags: Writable, allocatable, executable
• sh_offset: File offset to section data
• sh_size: Size in bytes

Common flags you will encounter:

• SHF_WRITE (0x1): Writable at runtime
• SHF_ALLOC (0x2): Loaded into memory
• SHF_EXECINSTR (0x4): Contains executable instructions

For example, .text typically has SHF_ALLOC | SHF_EXECINSTR, while .data has SHF_WRITE | SHF_ALLOC.

For This Exercise

You will walk the section header table and list every section with its name, type, flags, offset, and size. This is exactly what readelf -S prints, and reverse engineers scan section flags first when triaging an unfamiliar binary.

Walking the Section Table

The section count lives in e_shnum, and each entry is e_shentsize bytes wide. You iterate from e_shoff to e_shoff + e_shnum * e_shentsize, resolving each name through .shstrtab. Linkers merge sections with compatible flags during linking, and loaders map only sections with SHF_ALLOC set into the process address space at runtime.

Your Task

List the sections of an ELF64 file the way readelf -S does. Take e_shnum and e_shstrndx from the file header. Then resolve each section's name: sh_name is an offset into the section-name string table (.shstrtab), and the name runs to the next NUL.

• Name: the string at sh_name, or ? when sh_name is past the end of the string table or e_shstrndx is not a valid index (>= e_shnum). Offset 0 is the empty name of the NULL section.
• Type: 0 NULL, 1 PROGBITS, 2 SYMTAB, 3 STRTAB, 8 NOBITS, anything else OTHER.
• Flags: in this order, W for 0x1, A for 0x2, X for 0x4, I for 0x40, or empty.
• Totals: the sum of all sizes, and the sum of the sizes of sections with the A (SHF_ALLOC) flag.

Input

1. 64, then the 64 header bytes in hex. The magic must be 7F 45 4C 46.
2. The string-table length L, then L bytes in hex.
3. e_shnum lines sh_name sh_type sh_flags sh_addr sh_offset sh_size, every value in hex (with or without 0x).

Output

cCopy
Loading…

then one row per section with the C format "%3u %-17s %-9s %-6s 0x%08llX 0x%08llX %llu\n" (index, name, type, flags, address, offset, size in decimal), for example

cCopy
Loading…

and finally total section bytes: N and alloc bytes (SHF_ALLOC): N. The first two header values are decimal.