Hi all,
Is there perhaps anyone here that can answer this question?
ELF executables have program segment headers, containing a field
p_offset that should refer to the offset in the file where the section
of data starts. However, regardless what executable I look at, they all
seem to contain a header that contains a p_offset = 0. This would mean
the absolute start of the file, exactly where the ELF header itself is
located. For example, when I do:
$ readelf -a /bin/bash |less
I get:
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x000e0 0x000e0 R E 0x4
INTERP 0x000114 0x08048114 0x08048114 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x837bc 0x837bc R E 0x1000
LOAD 0x084000 0x080cc000 0x080cc000 0x05350 0x09a94 RW 0x1000
DYNAMIC 0x088fa4 0x080d0fa4 0x080d0fa4 0x000d8 0x000d8 RW 0x4
NOTE 0x000128 0x08048128 0x08048128 0x00020 0x00020 R 0x4
GNU_EH_FRAME 0x083790 0x080cb790 0x080cb790 0x0002c 0x0002c R 0x4
The 3rd header contains an p_offset=0. Why? I don't get it.
Bert