Analyzing Files With elfdump

Various tools are available to analyze the contents of an ELF file, including the standard Unix utilities dump(1), nm(1), and size(1). Under Oracle Solaris, these tools have been largely superseded by elfdump(1).

The use of eldump to diagnose the contents of an ELF object can be useful to explore the various performance issues described in the following sections.

The ELF format organizes data into sections. Sections are in turn allocated to units known as segments. Segments describe how portions of a file are mapped into memory. See mmapobj(2). These loadable segments can be displayed by using the elfdump(1) command and examining the PT_LOAD entries.

$ elfdump -p -NPT_LOAD libfoo.so.1
Program Header[0]:
    p_vaddr:      0           p_flags:    [ PF_X PF_R ]
    p_paddr:      0           p_type:     [ PT_LOAD ]
    p_filesz:     0x53c       p_memsz:    0x53c
    p_offset:     0           p_align:    0x10000

Program Header[1]:
    p_vaddr:      0x1053c     p_flags:    [ PF_X PF_W PF_R ]
    p_paddr:      0           p_type:     [ PT_LOAD ]
    p_filesz:     0x114       p_memsz:    0x13c
    p_offset:     0x53c       p_align:    0x10000

There are two loadable segments in the shared object libfoo.so.1, commonly referred to as the text and data segments. The text segment is mapped to allow reading and execution of its contents, PF_X and PF_R. The data segment is mapped to also allow its contents to be modified, PF_W. The memory size, p_memsz, of the data segment differs from the file size, p_filesz. This difference accounts for the .bss section, which is part of the data segment, and is dynamically created when the segment is loaded.

Programmers usually think of a file in terms of the symbols that define the functions and data elements within their code. These symbols can be displayed using the –s option to elfdump.

$ elfdump -sN.symtab libfoo.so.1

Symbol Table Section:  .symtab
   index    value     size  type bind oth ver shndx          name
    ....
    [36]  0x10628     0x28  OBJT GLOB  D    0 .data          data
    ....
    [38]  0x10650     0x28  OBJT GLOB  D    0 .bss           bss
    ....
    [40]    0x520      0xc  FUNC GLOB  D    0 .init          _init
    ....
    [44]    0x508     0x14  FUNC GLOB  D    0 .text          foo
    .... 
    [46]    0x52c      0xc  FUNC GLOB  D    0 .fini          _fini

The symbol table information displayed by elfdump includes the section the symbol is associated with. The elfdump –c option can be used to display information about these sections.

$ elfdump -c libfoo.so.1
....
Section Header[6]:  sh_name: .text
    sh_addr:      0x4f8           sh_flags:   [ SHF_ALLOC SHF_EXECINSTR ]
    sh_size:      0x28            sh_type:    [ SHT_PROGBITS ]
    sh_offset:    0x4f8           sh_entsize: 0
    sh_link:      0               sh_info:    0
    sh_addralign: 0x8

Section Header[7]:  sh_name: .init
    sh_addr:      0x520           sh_flags:   [ SHF_ALLOC SHF_EXECINSTR ]
    sh_size:      0xc             sh_type:    [ SHT_PROGBITS ]
    sh_offset:    0x520           sh_entsize: 0
    sh_link:      0               sh_info:    0
    sh_addralign: 0x4

Section Header[8]:  sh_name: .fini
    sh_addr:      0x52c           sh_flags:   [ SHF_ALLOC SHF_EXECINSTR ]
    sh_size:      0xc             sh_type:    [ SHT_PROGBITS ]
    sh_offset:    0x52c           sh_entsize: 0
    sh_link:      0               sh_info:    0
    sh_addralign: 0x4
....
Section Header[12]:  sh_name: .data
   sh_addr:      0x10628         sh_flags:   [ SHF_WRITE SHF_ALLOC ]
   sh_size:      0x28            sh_type:    [ SHT_PROGBITS ]
   sh_offset:    0x628           sh_entsize: 0
   sh_link:      0               sh_info:    0
   sh_addralign: 0x4
....
Section Header[14]:  sh_name: .bss
   sh_addr:      0x10650         sh_flags:   [ SHF_WRITE SHF_ALLOC ]
   sh_size:      0x28            sh_type:    [ SHT_NOBITS ]
   sh_offset:    0x650           sh_entsize: 0
   sh_link:      0               sh_info:    0
   sh_addralign: 0x4
....

The output from elfdump(1) in the previous examples shows the association of the functions _init, foo, and _fini to the sections .init, .text and .fini. These sections, because of their read-only nature, are part of the text segment.

Similarly, the data arrays data, and bss are associated with the sections .data and .bss respectively. These sections, because of their writable nature, are part of the data segment.