0x02 - The Section Header

This is the second part of the ELF Internals: Deep Dive series.
In this article, we’ll explore the Section Header Table, its fields, and how tools like readelf and objdump help in examining them.

Table of Content

• Introduction
• sh_name
• sh_type
• sh_flags
• The sh_addr, sh_offset, and sh_size Fields
• sh_link
• sh_info
• sh_addralign
• sh_entsize
• Viewing the section header table
• Conclusion

Introduction

There are multiple sections in the binary that contains code and data and for each section there are some information associated with it which is stored in section header table.

Sections of the binary helps the static linker (Links the object file and static library and produces a single complete ELF binary) to work.

type def for section header in /usr/include/elf.h :

sh_name

• It contains index value for the string table where the name of the section is stored.
• size - 4 Bytes

sh_type

• It denotes the type of the section
• Size - 4 Bytes
• Value - SHT_PROGBITS (Section conatins instructions or contants), SHT_SYMTAB (Symbol table), SHT_DYNSYM (Dynamic Symbol table used by dynamic linker), SHT_STRTAB (string table), SHT_REL (Relocation), SHT_RELA (Relocation), SHT_DYNAMIC (Information for dynamic linking)

sh_flags

• Some additional information can be added to header using this field.
• Size - 8 Bytes
• Value - SHF_WRITE (Data contained in the section can be written during runtime), SHF_ALLOC (Place the sectio data in memory when running the program), and SHF_EXECINSTR (Section contains the instructions)

The sh_addr, sh_offset, and sh_size Fields

• Sections which will be loaded in the memory has address , offset and size which is used by the linker for some processing.
• Size - 8 Bytes.

sh_link field

• This denotes the realtionship between the sections for example - SHT_REL / SHT_RELA are associated with symbol table for relocation.
• Size - 4 Bytes
• Value - Index of the associated section is stored as the value.

sh_info field

• Size - 4 Byte
• Additional Information can be added which depends on the type of the section.

sh_addralign

• For memory access optimization some section are ment to be placed at some specifed memory boundries for example at the address which is the mutliple of 8 byte.
• Size - 8 Byte

sh_entsize

• If the section contains a table then this field tells the size of the each entry present in the table.
• Size - 8 bytes

Viewing the section header table

We can view section header table of any binary using -

readelf --sections --wide <binary>

If you want to inspect any section listed in the section header table use -

objdump --section .plt -M intel -d <binary>

Conclusion

The section header table may not be directly used by the loader at runtime, but it plays a critical role in linking, relocation, and analysis tools. Understanding its fields gives you deeper insight into how binaries are structured and how tools like objdump, readelf, and debuggers interpret ELF files.

In the next article, we’ll move from sections to the program header table, which is directly used by the loader when running a program.