CODEWITHSUNDEEP
pythonarmelfobjdump
mic_e
mic_e

Reputation: 5840

pyelftools: retrieve section flags like objdump does for an elf32-littlearm binary

I need to identify all ELF sections that have the LOAD flag in my python script; using objdump, I receive

$ arm-none-eabi-objdump -h test.elf

test.elf:     file format elf32-littlearm

Sections:
Idx Name          Size      VMA       LMA       File off  Algn
  0 .text         00014480  00000000  00000000  00008000  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .relocate     00000090  20000000  00014480  00020000  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  2 .bss          000016ec  20000090  00014510  00020090  2**4
                  ALLOC
  3 .stack        00002004  2000177c  00014510  0002177c  2**0
                  ALLOC
  4 TOUCH_SAFETY_DATA_LOCATION 00000704  20004000  00014510  00024000  2**3
                  CONTENTS, ALLOC, LOAD, DATA
  5 FMEA_SAFETY_DATA_LOCATION 00000070  20007c00  00014c14  00027c00  2**2
                  CONTENTS, ALLOC, LOAD, DATA
  ... (some 10 or so more sections)

However, with the Python3 elftools module, from the following sources:

from elftools.elf.elffile import ELFFile

for section in ELFFile(open("test.elf", "rb")).iter_sections():
    print("{0:30s} 0b{1:08b}".format(section.name, section.header.sh_flags))

I receive completely different flags:

                               0b00000000
.text                          0b00000110
.relocate                      0b00000011
.bss                           0b00000011
.stack                         0b00000011
TOUCH_SAFETY_DATA_LOCATION     0b00000011
FMEA_SAFETY_DATA_LOCATION      0b00000011
... (some 10 or so more sections)

From the objdump sources (I wasn't able to locate any documentation on the issue), the LOAD flag should have the value 0x02 (0b00000010). It seems like the flags that are reported by pyelftools are entirely independent of those that are reported by objdump (presumably the correct ones). What am I doing wrong?

Upvotes: 0

Views: 1140

Answers (2)

Anthony Giardina
Anthony Giardina

Reputation: 11

The issue here is that objdump is not getting the LOAD identifier from the sh_flags but instead from sh_type.

If you look at section.header.sh_type you will see either SHT_PROGBITS or SHT_NOBITS to indicate if it is a loadable section or not.

Upvotes: 1

Diego Elio Pettenò
Diego Elio Pettenò

Reputation: 3240

Actually they both agree. As Notlikethat already pointed out, the ELF spec points 0x1 (0b00000001) to be SHF_WRITE, so all the sections but .text are marked writable.

Since objdump is not ELF specific (like readelf would be), the flags don't match 1:1, and instead it reports READONLY when 0x01 is missing.

Upvotes: 1

Related Questions