Can ELF file contain more than one symbol table?

Can ELF file contain more than one symbol table?

[Dennis Yurichev]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi.

Excuse me if I chose wrong place for my question.
Can ELF file contain more than one symbol table?
Is it standardized somehow?

- -- 
My PGP public key: http://yurichev.com/dennis.yurichev.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkxBkikACgkQ1YPmFmJG++NiCACfRIjJ7Q4WqhtrsZzPAzJVDnOI
+hYAnROX/0WHR2kkHqRlzJL/Nh8BwLtS
=9lme
-----END PGP SIGNATURE-----

Re: Can ELF file contain more than one symbol table?

[John Reiser]

> Can ELF file contain more than one symbol table?
> Is it standardized somehow?

Most executable main programs contain three symbol tables:
a DT_SYMTAB table and a .gnu.version table that are used
by the runtime dynamic loader/linker, and a .symtab SHT_SYMTAB
table that is used by the static loader/binder and by debuggers.

There ELF file format specification itself places no restriction
on the number of any kind of symbol tables, although most
producers and most consumers pay attention to at most one
(usually the last or the first) of a particular kind.

$ readelf --all hello  |  grep -i sym
  [ 5] .dynsym           DYNSYM           0000000000400280  00000280
  [ 7] .gnu.version      VERSYM           000000000040031e  0000031e
  [28] .symtab           SYMTAB           0000000000000000  00001218
 0x0000000000000006 (SYMTAB)             0x400280
 0x000000006ffffff0 (VERSYM)             0x40031e
Symbol table '.dynsym' contains 4 entries:
Symbol table '.symtab' contains 64 entries:
Version symbols section '.gnu.version' contains 4 entries:

-- 

Re: Can ELF file contain more than one symbol table?

[Dennis Yurichev]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 17-Jul-10 17:54, John Reiser wrote:
>> Can ELF file contain more than one symbol table?
>> Is it standardized somehow?
> 
> Most executable main programs contain three symbol tables:
> a DT_SYMTAB table and a .gnu.version table that are used
> by the runtime dynamic loader/linker, and a .symtab SHT_SYMTAB
> table that is used by the static loader/binder and by debuggers.
> 
> There ELF file format specification itself places no restriction
> on the number of any kind of symbol tables, although most
> producers and most consumers pay attention to at most one
> (usually the last or the first) of a particular kind.

Okay, but it is there any compiler/linker which is able to produce
multiple SYMTAB sections?

- -- 
My PGP public key: http://yurichev.com/dennis.yurichev.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkxB0MAACgkQ1YPmFmJG++P+PgCglanR/KqqqJc/TR4xD1xphv2H
EUAAoL0CzhvF9CLDVmJi8tLx1ZohMnOW
=huMF
-----END PGP SIGNATURE-----

Re: Can ELF file contain more than one symbol table?

[John Reiser]

> Okay, but it is there any compiler/linker which is able to produce
> multiple SYMTAB sections?

I have several in my back pocket.  At this moment nobody else has any copies :-)

Because most consuming programs pay attention to only one Elf32_Shdr
section with SHT_SYMTAB==.sh_type [and usually with .sh_name ==> ".symtab"]
then the only point of an ET_REL file with more than one such section
would be to occupy space or to "pass through" a private conversation.
Similarly for DT_SYMTAB in the Dynamic section.

Please tell the purpose for multiple SYMTAB sections.

-- 

Re: Can ELF file contain more than one symbol table?

[Dennis Yurichev]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 17-Jul-10 19:29, John Reiser wrote:
>> Okay, but it is there any compiler/linker which is able to produce
>> multiple SYMTAB sections?
> 
> I have several in my back pocket.  At this moment nobody else has any copies :-)
> 
> Because most consuming programs pay attention to only one Elf32_Shdr
> section with SHT_SYMTAB==.sh_type [and usually with .sh_name ==> ".symtab"]
> then the only point of an ET_REL file with more than one such section
> would be to occupy space or to "pass through" a private conversation.
> Similarly for DT_SYMTAB in the Dynamic section.
> 
> Please tell the purpose for multiple SYMTAB sections.

I'm writing utility for ELF files processing.
And if I planing to handle only one SYMTAB, things are simpler.
But just want to be sure.
I found here http://www.sco.com/developers/gabi/latest/ch4.sheader.html
... that in case of SHT_REL section, sh_link contain "The section header
index of the associated symbol table."
That disappointing me. Is it rudiment?

- -- 
My PGP public key: http://yurichev.com/dennis.yurichev.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkxB3HAACgkQ1YPmFmJG++M++ACcCWWAs4lcv7iyy0i5HYXyya08
zHsAn3qk7mTH668+sFt7uqGBlc4g89eg
=EkjW
-----END PGP SIGNATURE-----

Re: Can ELF file contain more than one symbol table?

[John Reiser]

> I'm writing utility for ELF files processing.
> And if I planing to handle only one SYMTAB, things are simpler.
> But just want to be sure.
> I found here http://www.sco.com/developers/gabi/latest/ch4.sheader.html
> ... that in case of SHT_REL section, sh_link contain "The section header
> index of the associated symbol table."
> That disappointing me. Is it rudiment?

$ cat sections.c
int x, y;

int f() { return x; }

int g() { return y; }

$ gcc -c -ffunction-sections sections.s
$ readelf --all sections.o
Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 4] .text.f           PROGBITS         0000000000000000  00000040
       000000000000000c  0000000000000000  AX       0     0     1
  [ 5] .rela.text.f      RELA             0000000000000000  00000670
       0000000000000018  0000000000000018          13     4     8
  [ 6] .text.g           PROGBITS         0000000000000000  0000004c
       000000000000000c  0000000000000000  AX       0     0     1
  [ 7] .rela.text.g      RELA             0000000000000000  00000688
       0000000000000018  0000000000000018          13     6     8
  [13] .symtab           SYMTAB           0000000000000000  00000508
       0000000000000150  0000000000000018          14    10     8
  [14] .strtab           STRTAB           0000000000000000  00000658
       0000000000000014  0000000000000000           0     0     1
$

This shows that "gcc -ffunction-sections" splits the .text and .rel[a]
for each function into a separate Elf64_Shdr (sections 4, 6; sections 5, 7.)
In this case the .sh_link to the SYMTAB section is the same (section 13),
and all in-the-wild compilers/assemblers use only one SYMTAB section.
However, it would be a legal ELF file if there were multiple SYMTAB
sections, say one for each REL[A] section; it would just be inefficient
(in space for the ElfXX_Shdr, and possibly for duplicate ElfXX_Sym
if more than one function referenced the same symbol) and cumbersome.
Similarly, there is no requirement that the ElfXX_Sym entries in
any symbol table are unique; there could be a different entry for each
reference, ignoring any commonality of name.  (Of course, multiple
entries for the same symbol probably have some consistency in .st_value, etc.)
Also, there is no requirement that the STRTAB have exactly one entry
for any given name.  For instance, in .shstrtab the entries for the
section names ".text.f" and ".rela.text.f" often overlap the common tail.

It is simple to process REL[A] regardless of how many SYMTAB there are:
index an array of ElfXX_Shdr by the .sh_link.  If your algorithm
depends on only one SYMTAB, then start by just detecting and reporting
any violation of that assumption.  It would not be the first case
of a utility that accepted only a subset of the entire specified domain.

--