Keyboard Shortcuts

Ctrl+K
Open search
Esc
Close search / dialog
↑
Back to top

Common Sections

18 minintermediateModule 4: SectionsContinues from section-header-table

Why This Matters

When you run readelf -S, you see dozens of sections. Understanding the most common ones lets you navigate any ELF file and know what you're looking at.

A Simple Model

Sections are like labeled boxes in a warehouse:

The Actual Detail

SectionTypeFlagsContains
.textSHT_PROGBITSSHF_ALLOC + SHF_EXECINSTRMachine code
.rodataSHT_PROGBITSSHF_ALLOCRead-only constants
.dataSHT_PROGBITSSHF_ALLOC + SHF_WRITEInitialized global variables
.bssSHT_NOBITSSHF_ALLOC + SHF_WRITEUninitialized globals (zeroed)
.symtabSHT_SYMTABnoneAll symbols (for debugging)
.strtabSHT_STRTABnoneSymbol names
.dynsymSHT_DYNSYMSHF_ALLOCDynamic symbols (for linking)
.dynstrSHT_STRTABSHF_ALLOCDynamic symbol names
.rela.textSHT_RELASHF_ALLOCCode relocations
.initSHT_PROGBITSSHF_ALLOC + SHF_EXECINSTRInitialization code
.finiSHT_PROGBITSSHF_ALLOC + SHF_EXECINSTRCleanup code

Note: .bss has type SHT_NOBITS — it takes no space in the file but is zero-filled in memory.

A Real Example

$ readelf -S /bin/ls | grep -E '\.(text|data|bss|rodata|symtab|strtab)'
  [11] .text             PROGBITS   0000000000001000  00001000  001a52
  [17] .rodata           PROGBITS   0000000000003000  00003000  000ba0
  [24] .data             PROGBITS   0000000000004dc0  00003dc0  000020
  [25] .bss              NOBITS     0000000000004de0  00003de0  000040
  [26] .symtab           SYMTAB     0000000000000000  00003e28  000c90

Check Your Understanding

Why does .bss have type SHT_NOBITS?

Apply It

If .rodata and .text are in the same PT_LOAD segment, what permissions does the kernel set for .rodata?

Connect

You now know the common sections. But remember — sections and segments are different things. The next concept clarifies this distinction.

Match Code to Output

Match each section type to its correct description:

.text
.data
.bss
.rodata
← Swipe to navigate →