Print the symbol table of an ELF file

kitsuneFox picture kitsuneFox · May 22, 2014 · Viewed 12.9k times · Source

I have a program which uses the mmap system call:

map_start = mmap(0, fd_stat.st_size, PROT_READ | PROT_WRITE , MAP_SHARED, fd, 0)

and a header variable:

header = (Elf32_Ehdr *) map_start;

How can I access the symbol table and print its whole content with the header variable?

Answer

Chris Dodd picture Chris Dodd · May 22, 2014

You get the section table by looking at the e_shoff field of the elf header:

sections = (Elf32_Shdr *)((char *)map_start + header->e_shoff);

You can now search throught the section table for the section with type SHT_SYMBTAB, which is the symbol table.

for (i = 0; i < header->e_shnum; i++)
    if (sections[i].sh_type == SHT_SYMTAB) {
        symtab = (Elf32_Sym *)((char *)map_start + sections[i].sh_offset);
        break; }

Of course, you should also do lots of sanity checking in case your file is not an ELF file or has been corrupted in some way.

The linux elf(5) manual page has lots of info about the format.