Domanda

I found ".dynsym" in String Table, got index. Then I found section with sh_name = index && sh_type = SHT_DYNSYM. So I got sh_offset = 464 and sh_size = 64. But you can see in the attached picture, that on the offset 464 there are only zeros.

I suppose that Import Table starts on offset 528. Question is: how calculate it %)

enter image description here

È stato utile?

Soluzione

But you can see in the attached picture, that on the offset 464 there are only zeros.

Wrong: 01, 20, 29, 12 etc. are not "only zeros" last time I checked.

I suppose that Import Table starts on offset 528

No, it does not. For some reason you are expecting to find a Microsoft PE-style import table in an ELF file. It's not there.

An equivalent of an import table in ELF is contained in two tables. One contains Elf{32,64}_Sym fixed-size records:

typedef struct
{
  Elf32_Word    st_name;                /* Symbol name (string tbl index) */
  Elf32_Addr    st_value;               /* Symbol value */
  Elf32_Word    st_size;                /* Symbol size */
  unsigned char st_info;                /* Symbol type and binding */
  unsigned char st_other;               /* Symbol visibility */
  Elf32_Section st_shndx;               /* Section index */
} Elf32_Sym;

and is contained in the .dynsym section.

The other table is contained in .dynstr section (which, in your file starts at offset 528), and has just the (variable-size) strings separated by NUL character.

The .st_name in the first table refers to offset in .dynstr.

Autorizzato sotto: CC-BY-SA insieme a attribuzione
Non affiliato a StackOverflow
scroll top