This is one of the most common sources of confusion in ELF. Sections and segments are related but fundamentally different concepts. Mixing them up leads to incorrect tool usage and misunderstanding of how ELF works.
Think of it this way: a library has books organized by topic (sections), but the library's shipping department groups books into boxes for delivery (segments). One box might contain books from multiple topics.
Key differences:
| Aspect | Section | Segment |
|---|---|---|
| Defined by | Section header table | Program header table |
| Used by | Tools (linker, debugger) | Runtime loader (kernel) |
| Granularity | Fine-grained (many sections) | Coarse-grained (few segments) |
| Overlap | Sections don't overlap | Segments can contain multiple sections |
| Permissions | No permissions | R/W/X permissions per segment |
| Purpose | Define what the data is | Define how to load it |
A single PT_LOAD segment typically contains multiple sections: .init, .plt, .text, and .rodata might all be in the same read-only, executable segment.
Segments (program headers): LOAD [0x000000-0x0005e8] R → Contains: .interp, .note, .gnu.hash, .dynsym, .dynstr, .gnu.version LOAD [0x001000-0x002a52] R E → Contains: .init, .plt, .text LOAD [0x003000-0x003ba0] R → Contains: .rodata, .eh_frame LOAD [0x003dc0-0x004020] RW → Contains: .data, .bss, .got Sections: .text → In LOAD segment 2 (R E) .data → In LOAD segment 4 (RW) .bss → In LOAD segment 4 (RW, zero-filled) .rodata → In LOAD segment 3 (R)
Notice how 4 segments contain 12+ sections. The loader doesn't know about individual sections — it only sees segments.
Can a section exist without being in any segment?
Sections like .symtab, .strtab, and .debug_* are not loaded into memory — they have no corresponding segment.
You want to strip debug symbols from a binary. Which tool modifies section headers without touching segments?
Congratulations! You've completed the ELF course fundamentals. You now understand bytes, binary representation, file layout, the ELF header, program headers, sections, and the relationship between them.
Next steps: explore symbols, relocations, and dynamic linking — the advanced topics that make ELF a complete binary format.