Why is the entry point address in my executable 0x8048330? (0x330 being the offset of .text section)

Question

I wrote a small program to add two integers and on using readelf -a executable_name it showed the entry point address in elf header as:

Entry point address: 0x8048330

How does my executable know this address beforehand even before loader loads it in memory? elf_format.pdf says this member gives the virtual address to which the system first transfers control, thus starting the process. Can anyone please explain what is the meaning of this statement and what is the meaning of virtual address here?

Also let me know, from where the executable file gets the value of 0x8048330 as entry point address. Just for cross check I compiled another program and for that also, the entry point address remains the same value 0x8048330 (offset of .text section being 0x330 in both the cases).

Answer 1

The entry address is set by the link editor, at the time when it creates the executable. The loader maps the program file at the address(es) specified by the ELF headers before transferring control to the entry address.

To use a concrete example, consider the following:

% file a.out
a.out: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, \
    for GNU/Linux 2.6.15, not stripped
% readelf -e a.out
... snip ...
Elf file type is EXEC (Executable file)
Entry point 0x8048170
There are 6 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000000 0x08048000 0x08048000 0x7cca6 0x7cca6 R E 0x1000
  LOAD           0x07cf98 0x080c5f98 0x080c5f98 0x00788 0x022fc RW  0x1000
... snip ...

The first program header specifies that the contents of the file at file offset 0 should be mapped to virtual address 0x08048000. The file and memory sizes for this segment are 0x7cca6 bytes. This segment is to be mapped in readable and executable but not writable (it contains the program's code).

The entry point address specified in the ELF header is 0x8048170, which falls inside the region containing program code.

The book "Linkers and Loaders" by John Levine is a good resource to consult on matters related to link editors and loaders.