Program Header Table

Program Header Table

1.Introduction

• A program header table is an array of program headers that defines the
  memory layout of a program at runtime.
• A program header is a description of a program segment. A program segment is a collection of related sections. A segment contains zero or more sections. An operating system when loading a program, only use segments, not sections.

2.To see the information of a program header table:

albert$ readelf -l hello
Elf file type is EXEC (Executable file)
Entry point 0x80482f0
There are 9 program headers, starting at offset 52
Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
PHDR 0x000034 0x08048034 0x08048034 0x00120 0x00120 R E 0x4
INTERP 0x000154 0x08048154 0x08048154 0x00013 0x00013 R 0x1
[Requesting program interpreter: /lib/ld-linux.so.2]
LOAD 0x000000 0x08048000 0x08048000 0x00594 0x00594 R E 0x1000
LOAD 0x000f08 0x08049f08 0x08049f08 0x00114 0x00120 RW 0x1000
DYNAMIC 0x000f14 0x08049f14 0x08049f14 0x000e8 0x000e8 RW 0x4
NOTE 0x000168 0x08048168 0x08048168 0x00044 0x00044 R 0x4
GNU_EH_FRAME 0x000490 0x08048490 0x08048490 0x00034 0x00034 R 0x4
GNU_STACK 0x000000 0x00000000 0x00000000 0x00000 0x00000 RW 0x10
GNU_RELRO 0x000f08 0x08049f08 0x08049f08 0x000f8 0x000f8 R 0x1
Section to Segment mapping:
Segment Sections…
00
01 .interp
02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rel.dyn .rel.plt .init .plt .text .fini .rodata .eh_frame_hdr .eh_frame
03 .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss
04 .dynamic
05 .note.ABI-tag .note.gnu.build-id
06 .eh_frame_hdr
07
08 .init_array .fini_array .jcr .dynamic .got

In the sample output, LOAD segment appears twice:

• the upper LOAD has Read and Execute permission. This is a text segment. A text segment contains read-only instructions and read-only data.
• the lower LOAD has Read and Write permission. This is a data segment.It means that this segment can be read and written to, but is not allowed to be used as executable code, for security reason.

Then, LOAD contains the following sections:

• 02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym .dynstr
  .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .plt .plt.got .text .fini
  .rodata .eh_frame_hdr .eh_frame
• 03 .init_array .fini_array .jcr .dynamic .got .got.plt .data .bss

  Note:First segment starts at index 0, second at index 1 and so on. LOAD are segments at index 2 and 3.

3.Segments vs sections
  As mentioned earlier, an operating system loads program segments, not sections. However, a question arises: Why doesn’t the operating system use sections instead?
  A segment is the perspective of an operating system, while a section is the perspective of a linker. To understand why, looking into the structure of a segment, we can easily see:

• A segment is a collection of sections. It means that sections are logically grouped together by their attributes. For example, all sections in a LOAD segment are always loaded by the operating system; all sections have the same permission, either a RE (Read + Execute) for executable sections, or RW (Read + Write) for data sections.
• By grouping sections into a segment, it is easier for an operating system to batch load sections just once by loading the start and end of a segment, instead of loading section by section.
• Since a segment is for loading a program and a section is for linking a program, all the sections in a segment is within its start and end virtual memory addresses of a segment.