What are the meanings of the columns of the symbol table displayed by readelf?
Could someone explain the columns shown of the symbol table using readelf
?
Solution 1:
Consider the following:
Symbol table .symtab
contains 1203 entries:
Num: Value Size Type Bind Vis Ndx Name
310: a0008120 0 NOTYPE GLOBAL DEFAULT ABS _gp
734: a0000010 32 OBJECT GLOBAL DEFAULT 77 v
818: 9d000018 496 FUNC GLOBAL DEFAULT 71 main
849: a0000124 4 OBJECT GLOBAL DEFAULT 78 phrase
955: a0000000 9 OBJECT GLOBAL DEFAULT 77 peppers
1020: a000023c 192 OBJECT GLOBAL DEFAULT 80 bins
-
Num:
= The symbol number -
Value
= The address of the Symbol -
Size
= The size of the symbol -
Type
= symbol type:Func
= Function,Object
,File
(source file name),Section
= memory section,Notype
= untyped absolute symbol or undefined -
Bind
=GLOBAL
binding means the symbol is visible outside the file.LOCAL
binding is visible only in the file.WEAK
is like global, the symbol can be overridden. -
Vis
= Symbols can be default, protected, hidden or internal. -
Ndx
= The section number the symbol is in. ABS means absolute: not adjusted to any section address's relocation -
Name
= symbol name
Solution 2:
You can either:
man readelf
or look at these tutorials:
- The ELF Object File Format by Dissection
- Understanding ELF using readelf and objdump.
Solution 3:
I think Ndx field shows the section number where that symbol is defined.
Do a readelf -a <file>
, and find out which section the address corresponds to for a given symbol.
I bet the section number of that section will appear in Ndx field.