The symbol table of readelf (
.symtab) shows you the offset of each symbol from the base of the section the symbol is in.
As you showed us, when you listing the table you get something like that:
$ readelf --symbols <filename>
Symbol table '.symtab' contains 471 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 00000000 0 NOTYPE LOCAL DEFAULT UND
1: 00000000 0 SECTION LOCAL DEFAULT 2
2: 00000000 0 SECTION LOCAL DEFAULT 4
3: 00000000 0 SECTION LOCAL DEFAULT 6
4: 00000000 0 SECTION LOCAL DEFAULT 8
5: 00000000 0 SECTION LOCAL DEFAULT 10
6: 00000000 0 SECTION LOCAL DEFAULT 12
... ... Truncated for readability ... ...
462: 0000d2c8 616 FUNC GLOBAL DEFAULT 2 bcmVlan_setDefaultAction
One column is interested us especially, which is the
readelf identifies each section by an integer index. This is what Ndx stands for. The output of the
.symtab shows us that our function
bcmVlan_setDefaultAction belongs to Ndx number 2.
To see which section has index number "2" you should execute:
$ readelf --sections <filename>
When you'll execute it you'd probably see something like this:
There are ?? section headers, starting at offset 0x????:
[Nr] Name Type Addr Off Size ES Flg Lk Inf Al
[ 0] NULL 00000000 000000 000000 00 0 0 0
[ 1] <section name> <type> 00000000 0000?? 0000?? ?? A 0 0 4
[ 2] .text <type> 00000000 000050 00???? 00 AX 0 0 16
You function will probably be in the
.text section which its base address (
Off column) is
0x000050, i.e 0x50 bytes from the beginning of the file.
Then, it should all make sense since it is what you get when subtracting the address you got from
readelf from the one you got from
0x0d318 - 0x0d2c8 = 0x50.
readelf -l <filename> | grep LOADto the output of
f~LOAD0from radare2. You can also check radare's base address using
e bin.baddr. To rebase, use
r2 -B <0xaddr> <filename>.