Parse the ELF Symbol Table

Topic Overview

ELF Symbol Tables

Symbols are the names that linkers use to connect references between object files. The symbol table maps names to addresses, sizes, and types. Without symbols, you see raw addresses; with them, you see function and variable names.

Symbol Entry Structure

Each Elf64_Sym entry contains:

• st_name: String table offset for the symbol name
• st_info: Type and binding packed together
• st_value: Address or offset of the symbol
• st_size: Size in bytes
• st_shndx: Section index where defined

Symbol types (from st_info & 0x0F):

• STT_FUNC (2): Function (for example main)
• STT_OBJECT (1): Data object (for example a global variable)
• STT_NOTYPE (0): Unspecified

Bindings: STB_LOCAL is visible only in its object file, STB_GLOBAL is visible to all files being linked.

For This Exercise

You will parse symbol entries from .symtab, resolve names via .strtab, and print each symbol's type and binding. This is the same data nm and objdump -t display, and it is essential for understanding what a binary exports and imports.

Dynamic vs Static Symbols

The .dynsym table lists symbols needed for runtime linking: imported functions like printf and exported entry points. The full .symtab includes local symbols stripped from release builds. Undefined global functions show st_value = 0 until the dynamic linker resolves them at load time. Parsing both tables tells you what a binary calls and what it exposes to other modules.

Your Task

Decode an ELF64 symbol table. Each Elf64_Sym is 24 bytes, all fields little-endian:

• Name: the NUL-terminated string at st_name in the string table, or ? if st_name is past its end.
• Binding: 0 LOCAL, 1 GLOBAL, 2 WEAK, other OTHER.
• Type: 0 NOTYPE, 1 OBJECT, 2 FUNC, 3 SECTION, 4 FILE, other OTHER.
• Ndx: 0 is UND (an undefined, imported symbol), 0xFFF1 is ABS (an absolute value), anything else sec.

Input

1. The string-table length L (1 to 65535), then L bytes in hex. Offset 0 is the NUL byte.
2. The symbol count N (0 to 1024).
3. N symbols of 24 bytes each, in hex.

Output

cCopy
Loading…

then one row per symbol with the C format "%-16s 0x%08llX %-8llu %-8s %-7s %s\n", for example

cCopy
Loading…

and finally Summary: 3 functions, 2 objects, 4 globals, 2 undefined, counting FUNC types, OBJECT types, GLOBAL bindings and UND symbols.