What are the meanings of the columns of the symbol table displayed by readelf?

Could someone explain the columns shown of the symbol table using readelf?


Solution 1:

Consider the following:

Symbol table .symtab contains 1203 entries:

 Num:    Value  Size Type    Bind   Vis      Ndx Name
 310: a0008120     0 NOTYPE  GLOBAL DEFAULT  ABS _gp  
 734: a0000010    32 OBJECT  GLOBAL DEFAULT   77 v 
 818: 9d000018   496 FUNC    GLOBAL DEFAULT   71 main 
 849: a0000124     4 OBJECT  GLOBAL DEFAULT   78 phrase 
 955: a0000000     9 OBJECT  GLOBAL DEFAULT   77 peppers  
1020: a000023c   192 OBJECT  GLOBAL DEFAULT   80 bins
  • Num: = The symbol number
  • Value = The address of the Symbol
  • Size = The size of the symbol
  • Type = symbol type: Func = Function, Object, File (source file name), Section = memory section, Notype = untyped absolute symbol or undefined
  • Bind = GLOBAL binding means the symbol is visible outside the file. LOCAL binding is visible only in the file. WEAK is like global, the symbol can be overridden.
  • Vis = Symbols can be default, protected, hidden or internal.
  • Ndx = The section number the symbol is in. ABS means absolute: not adjusted to any section address's relocation
  • Name = symbol name

Solution 2:

You can either:

man readelf

or look at these tutorials:

  • The ELF Object File Format by Dissection
  • Understanding ELF using readelf and objdump.

Solution 3:

I think Ndx field shows the section number where that symbol is defined.

Do a readelf -a <file>, and find out which section the address corresponds to for a given symbol.

I bet the section number of that section will appear in Ndx field.